API workflows for rules

Manage Application Security rule definitions through the public API.

Manage Application Security rule definitions through the public API. Use it to audit inventory, create, validate, clone, update, and delete custom IaC and Secrets rules, manage labels, and synchronize definitions across tenants.

The API manages rule definitions and metadata. It does not execute scans, create issues, or enforce policies.

Required license: Cortex Cloud Posture Management or Cortex Cloud Runtime Security with Application Security add-on.

For complete API details, see Rules. It includes required headers, permissions, query parameters, request and response schemas, and endpoint-specific guidance.

Supported endpoints

Endpoint	Description
GET /public_api/appsec/v1/rules	List AppSec rules with filtering, sorting, and pagination
POST /public_api/appsec/v1/rules	Create a custom IaC or Secrets rule, including a rule cloned from an existing rule
GET /public_api/appsec/v1/rules/{ruleId}	Get one AppSec rule by its identifier
PATCH /public_api/appsec/v1/rules/{ruleId}	Update a custom rule, or update labels on an out-of-the-box rule
DELETE /public_api/appsec/v1/rules/{ruleId}	Delete an AppSec rule
GET /public_api/appsec/v1/rules/rule-labels	List available AppSec rule labels
POST /public_api/appsec/v1/rules/validate	Validate a custom rule definition before creating or updating it