API Reference

Create a custom scoring rule

post
https://api.embermind.ch/api/v1/client/scoring-rules/create

Create a custom scoring rule in a configuration. Filter fields are validated against the field catalog, the signature is computed, and the rules cache is invalidated.

Recent Requests
Log in to see full request history
TimeStatusUser Agent
Retrieving recent requests…
LoadingLoading…
Body Params
uuid
required

Owning scoring configuration

string
required
length ≥ 1

Human-readable rule title

integer
required
≥ 0

Points added to the transaction score when the rule triggers (must be >= 0)

string
enum

Lifecycle state. DRAFT - inert, no counters, not evaluated. SHADOW - counters accumulate and the rule is evaluated, but it adds nothing to any score (warm-up). ACTIVE - counters accumulate and the rule scores. ARCHIVED - inert. A WINDOWED rule should spend at least one full windowSec in SHADOW before promotion, otherwise it decides against a counter that has only just begun filling. When omitted, falls back to the legacy isActive flag.

Allowed:
boolean

DEPRECATED, use status. Legacy activity flag, kept in responses as (status === ACTIVE). On create/update it is only consulted when status is omitted: true maps to ACTIVE, false to ARCHIVED.

string
enum
required

INSTANT - per-event predicate; WINDOWED - aggregate over a time window grouped by a dimension

Allowed:
string | null
enum

Aggregation function for WINDOWED rules (null for INSTANT)

Allowed:
string | null

Catalog field aggregated by SUM/DISTINCT (required for those aggregation functions)

string | null

Catalog field the window is grouped by (required for WINDOWED)

integer | null
> 0

Time window length in seconds (required for WINDOWED)

string | null
enum

Comparison operator applied to the aggregate value (required for WINDOWED)

Allowed:
number | null

Threshold the aggregate is compared against (required for WINDOWED)

filterJson
object
required
filterDenomJson
object | null
uuid | null

Transaction the investigation that produced this rule started from

uuid | null

Fraud record that motivated the rule, when the investigation began from one

string | null
enum

Graph entity type the analyst was looking at when the pattern was proven

Allowed:
string | null

Raw origin entity value. Hashed server-side with cryptoHashUint64 and stored ONLY as originEntityValueHash - the raw value is never persisted on the rule.

string | null

Analyst note explaining why the rule was created

Headers
string
string
Responses

Updated 3 months ago

Did this page help you?
Language
Credentials
LoadingLoading…
Response
Click Try It! to start a request and see the response here! Or choose an example:
application/json

Updated 3 months ago

Did this page help you?