GET /api/rules/{id}

curl -H "Authorization: Bearer chad_ak_xxxxx..." \
  https://chad.example.com/api/external/rules/abc-123

{
  "id": "abc-123",
  "title": "Failed Login Attempt",
  "yaml_content": "title: Failed Login Attempt\nstatus: test\nlogsource:\n  product: windows\n  service: security\ndetection:\n  selection:\n    EventID: 4625\n  condition: selection\nlevel: medium\ntags:\n  - attack.credential_access\n  - attack.t1110",
  "status": "deployed",
  "severity": "medium",
  "tags": ["attack.credential_access", "attack.t1110"],
  "source": "custom",
  "threshold_enabled": false,
  "threshold_count": null,
  "threshold_window_minutes": null,
  "threshold_group_by": null,
  "snooze_until": null,
  "snooze_indefinite": false,
  "webhook_enabled": true,
  "jira_enabled": true,
  "created_at": "2024-01-10T10:00:00Z",
  "updated_at": "2024-01-15T14:32:17Z",
  "created_by": "admin@example.com",
  "updated_by": "analyst@example.com",
  "version": 3,
  "alert_count": 42
}

GET /api/rules/{id}?include_versions=true

{
  "versions": [
    {
      "version": 3,
      "yaml_content": "...",
      "changed_by": "analyst@example.com",
      "created_at": "2024-01-15T14:32:17Z"
    },
    {
      "version": 2,
      "yaml_content": "...",
      "changed_by": "admin@example.com",
      "created_at": "2024-01-12T09:00:00Z"
    }
  ]
}

{
  "detail": "Rule not found"
}

{
  "detail": "Could not validate credentials"
}

import requests

response = requests.get(
    f"{BASE_URL}/api/external/rules/abc-123",
    headers={"Authorization": f"Bearer {API_KEY}"}
)

if response.status_code == 200:
    rule = response.json()
    print(f"Rule: {rule['title']}")
    print(f"Status: {rule['status']}")
    print(f"Alerts: {rule['alert_count']}")
else:
    print(f"Error: {response.json()['detail']}")

const response = await fetch(
  'https://chad.example.com/api/external/rules/abc-123',
  {
    headers: {
      'Authorization': 'Bearer chad_ak_xxxxx...'
    }
  }
);

if (response.ok) {
  const rule = await response.json();
  console.log(`Rule: ${rule.title}`);
} else {
  const error = await response.json();
  console.error(`Error: ${error.detail}`);
}