Skip to content

Rules & Alerts

Get Rules List

Gets list of rules within an account. This API can be used to get all rules or filter by name.

Query Parameters

  • ?assessmentType= : Set to RULE to get rules.
  • ?name= : Name of the rule. By default, it performs a contains match. To match the exact rule name, set the value with double quotes.
  • ?offset= : Index to start for the next paginated request. Default value is 0.
  • ?limit= : Number of items to include in each page result. There could be fewer items remaining than the specified value.

cURL request

$ curl -H "Authorization: Bearer <token>" \
"https://app3.falkonry.ai/api/1.2/accounts/xxxxxxxxxxxxxxx/assessments?assessmentType=RULE&offset=0&limit=10&name=Temperature"

Python

import requests

ACCOUNT_ID = "xxxxxxxxxxxxxxx"
OFFSET = 0
LIMIT = 10
RULE_NAME = "Temperature"
URL = f'https://app3.falkonry.ai/api/1.2/accounts/{ACCOUNT_ID}/assessments?assessmentType=RULE&offset={OFFSET}&limit={LIMIT}&name={RULE_NAME}'
TOKEN = '<token>' 
HEADERS = {'Authorization': f'Bearer {TOKEN}'} 

response = requests.get(URL, headers=HEADERS)
print(response.json())

Example Response 

[
  {
    "id": "yyyyyyyyyyyyyy",
    "name": "Temperature higher than 50",
    "description": "Check the coolant flow for Machine 1",
    "type": "entities.Assessment",
    "tenant": "xxxxxxxxxxxxxxx",
    "createTime": 1712252348761,
    "updateTime": 1712252836836,
    "createdBy": "596357142173134848",
    "updatedBy": "596357142173134848",
    "assessmentType": "RULE",
    "layoutinfo": [],
    "links": []
  },
  {
    ...
  }
]

Get a Rule

Get a rule by ID within an account where the Rule ID is same as the corresponding Assessment ID.

cURL request

$ curl -H "Authorization: Bearer <token>" \ 
"https://app3.falkonry.ai/api/1.2/accounts/xxxxxxxxxxxxxxx/assessments/yyyyyyyyyyyyy"

Python

import requests

ACCOUNT_ID = "xxxxxxxxxxxxxxx"
RULE_ID = "yyyyyyyyyyyyyy"
URL = f'https://app3.falkonry.ai/api/1.2/accounts/{ACCOUNT_ID}/assessments/{RULE_ID}'
TOKEN = '<token>'
HEADERS = {'Authorization': f'Bearer {TOKEN}'} 

response = requests.get(URL, headers=HEADERS)
print(response.json())

Example Response 

{
  "id": "yyyyyyyyyyyyyy",
  "name": "Temperature higher than 50",
  "description": "Check the coolant flow for Machine 1",
  "type": "entities.Assessment",
  "tenant": "xxxxxxxxxxxxxxx",
  "createTime": 1712252348761,
  "updateTime": 1712252836836,
  "createdBy": "596357142173134848",
  "updatedBy": "596357142173134848",
  "assessmentType": "RULE",
  "layoutinfo": [],
  "links": []
}

Get Rule Configuration

Gets rule configuration within an account by rule ID

Query Parameters

  • ?type= : Set to RULE to query rule models.
  • ?isCommonModel= : Set to true to get latest configuration used by the rule.
  • ?offset= : Index to start for the next paginated request. Default value is 0.
  • ?limit= : Number of items to include in each page result. There could be fewer items remaining than the specified value.

cURL request

$ curl -H "Authorization: Bearer <token>" \
"https://app3.falkonry.ai/api/1.2/accounts/xxxxxxxxxxxxxxx/assessments/yyyyyyyyyyyyyy/models?type=RULE&isCommonModel=true&offset=0&limit=10"

Python

import requests 

ACCOUNT_ID = "xxxxxxxxxxxxxxx"
RULE_ID = "yyyyyyyyyyyyyy"
OFFSET = 0
LIMIT = 10
URL = f'https://app3.falkonry.ai/api/1.2/accounts/{ACCOUNT_ID}/assessments/{RULE_ID}/models?type=RULE&isCommonModel=true&offset={OFFSET}&limit={LIMIT}'
TOKEN = '<token>' 
HEADERS = {'Authorization': f'Bearer {TOKEN}'} 

response = requests.get(URL, headers=HEADERS)
print(response.json())

Example Response 

[
  {
    "id": "1232098067063341056",
    "type": "entities.model20",
    "tenant": "xxxxxxxxxxxxxxx",
    "datastream": "00000000002",
    "assessment": "yyyyyyyyyyyyyy",
    "modelType": "RULE",
    "name": "M[0]",
    "description": "This is a common model",
    "index": 1,
    "details": {
      "statistic": "max",
      "expression": {
        "condition": ">",
        "value": 100
      },
      "valueType": "Numeric",
      "alertFrequency": "PT1H",
      "evaluationWindow": "PT5M",
      "coverage": 0,
      "density": 20
    },
    "isCommonModel": true,
    "sourceModel": "1232098065394008064"
  },
  {
    ...
  }
]

Get Alerts

Get alerts generated by all the rules within an account. Alert is an output signal of a rule. To query alert signals across all the rules, use All Rules/alerts signal. You can get the signal ID from the Signal Manager.

request header Accept : application/json

Query Parameters

  • ?start= : Start time of the data request range in nanoseconds. This is a required parameter.
  • ?end= : End time of the data request range in nanoseconds. This is a required parameter only if reverse is set as true else it will be assumed as the latest available data point time of the signal.
  • ?reverse= : Set it to true to start data scan in descending order from the end time. The default value is false.

cURL request

$ curl -H "Authorization: Bearer <token>" -H "Accept: application/json" \
"https://app3.falkonry.ai/api/1.2/data/accounts/xxxxxxxxxxxxxxx/connectedsources/xxxxxxxxxxxxxxx.000000002.alerts/raw_data?start=2025-07-15T22:20:47.259658Z&end=2025-07-16T22:20:47.259658Z"

Python

import requests 

ACCOUNT_ID = "xxxxxxxxxxxxxxx"
SIGNAL_ID = "yyyyyyyyyyyyyy"
START_TIME = "2025-07-15T22:20:47.259658Z"
END_TIME = "2025-07-16T22:20:47.259658Z"
URL = f'https://app3.falkonry.ai/api/1.2/data/accounts/{ACCOUNT_ID}/connectedsources/{ACCOUNT_ID}.000000002.alerts/raw_data?start={START_TIME}&end={END_TIME}'
TOKEN = '<token>' 
HEADERS = {'Authorization': f'Bearer {TOKEN}', 'Accept': 'application/json'} 

response = requests.get(URL, headers=HEADERS) 
print(response.json())

Example Response 

[
  {
    "time": "2024-04-05T15:30:10Z",
    "value": "true",
    "signal": "1225499916417216512"
  },
  {
    "time": "2024-04-05T15:46:40Z",
    "value": "true",
    "signal": "1225502167161499648"
  }
]

Note

The time field in the response is when the alert was generated. The value field true means the rule condition was satisfied. And the signal field is the rule ID. Currently, the API will return first 1000 alerts based on the time range and reverse order.

Get Alerts by a Rule

Get alerts generated by a rule within an account.

request header Accept : application/json

Query Parameters

  • ?start= : Start time of the data request range in nanoseconds. This is a required parameter.
  • ?end=: End time of the data request range in nanoseconds. This is a required parameter only if reverse is set as true else it will be assumed as the latest available data point time of the signal.
  • ?reverse= : Set it to true to start data scan in descending order from the end time. The default value is false.

cURL request

$ curl -H "Authorization: Bearer <token>" -H "Accept: application/json" \
"https://app3.falkonry.ai/api/1.2/data/accounts/xxxxxxxxxxxxxxx/connectedsources/yyyyyyyyyyyyy/raw_data?start=1640168850582000000&end=1640168940981000000"

Python

import requests

ACCOUNT_ID = "xxxxxxxxxxxxxxx"
SIGNAL_ID = "yyyyyyyyyyyyyy"
START_TIME = "2025-07-15T22:20:47.259658Z"
END_TIME = "2025-07-16T22:20:47.259658Z"
URL = f'https://app3.falkonry.ai/api/1.2/data/accounts/{ACCOUNT_ID}/connectedsources/{SIGNAL_ID}/raw_data?start={START_TIME}&end={END_TIME}'
TOKEN = '<token>' 
HEADERS = {'Authorization': f'Bearer {TOKEN}', 'Accept': 'application/json'} 

response = requests.get(URL, headers=HEADERS)
print(response.json())
Example Response 
[
  {
    "time": "2024-07-15T23:46:40Z",
    "value": "true"
  },
  {
    "time": "2024-07-16T17:57:40Z",
    "value": "true"
  }
]

Note

The time field in the response is when the alert was generated. And value field true means the rule condition was satisfied. Currently, the API will return first 1000 alerts based on the time range and reverse order.

Get Rule Explanation

Get explanation data for an alert.

Note

Explanation is an output signal of a rule. There are two types of explanation signals for a rule. One that contains explanation data for all the signals that are part of the rule and is named as All Rules/<rule_name>/Explanation. Another is a unique explanation signal for each signal that is part of the rule and is named as <rule_name>/Explanation-<signal_name>. You can get the explanation signal ID from the Signal Manager.

requestheader Accept
application/json

Query Parameters

  • ?start=: Start time of the data request range in nanoseconds. This is a required parameter.
  • ?end= : End time of the data request range in nanoseconds. This is a required parameter only if reverse is set as true else it will be assumed as the latest available data point time of the signal.
  • ?reverse= : Set it to true to start data scan in descending order from the end time. The default value is false.

cURL request

$ curl -H "Authorization: Bearer <token>" -H "Accept: application/json" \
"https://app3.falkonry.ai/api/1.2/data/accounts/xxxxxxxxxxxxxxx/assessments/eeeeeeeeeeeeeeee/explain?time=2025-07-16T19:05:00Z"

Python

import requests 

ACCOUNT_ID = "xxxxxxxxxxxxxxx"
RULE_ID = "yyyyyyyyyyyyyy"
ALERT_TIME = "2025-07-15T22:20:47.259658Z"
URL = f'https://app3.falkonry.ai/api/1.2/data/accounts/{ACCOUNT_ID}/assessments/{RULE_ID}/explain?time={ALERT_TIME}'
TOKEN = '<token>' 
HEADERS = {'Authorization': f'Bearer {TOKEN}', 'Accept': 'application/json'} 

response = requests.get(URL, headers=HEADERS) 
print(response.json())

Example Response 

[
  {
    "time": "2024-04-05T15:30:10Z",
    "value": "true",
    "signal": "1225499916417216513"
  },
  {
    "time": "2024-04-05T15:46:40Z",
    "value": "false",
    "signal": "1225502167161499649"
  }
]

Note

The time field in the response is when the alert was generated. The signal field is the explanation signal ID of the signal used in the rule. And the value field true means the rule condition satisfied for the signal. Currently, the API will return first 1000 records based on the time range and reverse order.

Get Rule Model

Get live model that is in-use for a rule.

request header Accept : application/json

Query Parameters

  • ?isCommonModel= : Filter to get live model only. Set it as true to get live model and false to get model history. The default value is false.
  • ?assessment= : Filter to get models for a specific rule. Set it as rule ID.
  • ?offset= : Index to start for the next paginated request. Default value is 0.
  • ?limit=: Number of items to include in each page result. There could be fewer items remaining than the specified value.

cURL request

$ curl -H "Authorization: Bearer <token>" -H "Accept: application/json" \
"https://app3.falkonry.ai/api/1.2/data/accounts/xxxxxxxxxxxxxxx/models?isCommonModel=true&assessment=yyyyyyyyyyyyyyyy&offset=0&limit=50"

Python

import requests 

ACCOUNT_ID = "xxxxxxxxxxxxxxx"
RULE_ID = "yyyyyyyyyyyyyy"
LIMIT = 10
OFFSET = 0
URL = f'https://app3.falkonry.ai/api/1.2/data/accounts/{ACCOUNT_ID}/models?isCommonModel=true&assessment={RULE_ID}&offset={OFFSET}&limit={LIMIT}'
TOKEN = '<token>' 
HEADERS = {'Authorization': f'Bearer {TOKEN}', 'Accept': 'application/json'} 

response = requests.get(URL, headers=HEADERS) 
print(response.json())
Example Response 
[
  {
    "id": "mmmmmmmmmmmmmmmmm",
    "type": "entities.model20",
    "tenant": "xxxxxxxxxxxxxxx",
    "datastream": "000000002",
    "assessment": "yyyyyyyyyyyyyyyy",
    "modelType": "RULE",
    "name": "M[0]",
    "description": "This is a common model",
    "index": 1,
    "details": {
      "statistic": "count",
      "expression": {
        "condition": ">=",
        "value": "1"
      },
      "valueType": "Numeric",
      "evaluationWindow": "PT1H",
      "coverage": 100,
      "density": 0
    },
    "isCommonModel": true,
    "sourceModel": "1356709283685056512"
  }
]

Note

M[0] model corresponds to model that is live for a rule. The model details are the rule configurations that are in use.

Run Historical Rule Evaluation

Apply current Rule configuration over a historical time period to see the Rule output. To run the historical evaluation, get the common model ID using the Get Rule Model API.

request header Content-Type : application/json

Request Payload

{
  "name": "Historial rule eval",
  "flowType": "RULEEVAL",
  "assessment": "{{rule_id}}",
  "spec": {
    "model": "{{common_model_id}}",
    "timeRange": {
      "startTime": "YYYY-MM-DDTHH:mm:ssZ",
      "endTime": "YYYY-MM-DDTHH:mm:ssZ"
    }
  }
}

cURL request

$ curl --location --request POST 'https://app3.falkonry.ai/api/1.2/accounts/xxxxxxxxxxxxxxx/flows' \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' 
--data-raw '{
      "name": "Historial rule eval", "flowType": "RULEEVAL",
      "assessment": "yyyyyyyyyyyyyyyy", "spec": { "model":
      "mmmmmmmmmmmmmmmmm", "timeRange": { "startTime":
      "2024-08-11T00:00:00Z", "endTime": "2024-08-12T06:00:00Z" }
    }}'

Python

import requests 
import json

URL = 'https://app3.falkonry.ai/api/1.2/accounts/xxxxxxxxxxxxxxx/flows'
TOKEN = '<token>' 
HEADERS = {'Authorization': f'Bearer {TOKEN}', 'Content-Type': 'application/json'} 
PAYLOAD = {
      "name": "Historial rule eval", 
      "flowType": "RULEEVAL",
      "assessment": "yyyyyyyyyyyyyyyy", 
      "spec": { "model": "mmmmmmmmmmmmmmmmm", 
              "timeRange": { 
                  "startTime": "2024-08-11T00:00:00Z", 
                  "endTime": "2024-08-12T06:00:00Z"
                }
            }
        }

response = requests.post(URL, headers=HEADERS, data=json.dumps(PAYLOAD)) 
print(response.json())

Example Response 

[
  {
    "id": "1318753160517943296",
    "type": "entities.flow",
    "tenant": "xxxxxxxxxxxxxxx",
    "flowType": "RULEEVAL",
    "status": "CREATED",
    "name": "Historial rule eval",
    "assessment": "yyyyyyyyyyyyyyyy",
    "spec": {
      "model": "mmmmmmmmmmmmmmmmm",
      "timeRange": {
        "startTime": "2024-08-11T00:00:00.000Z",
        "endTime": "2024-08-12T06:00:00.000Z"
      }
    },
    "flowState": {},
    "createTime": 1734485654716,
    "updateTime": 1734486012249,
    "createdBy": "597843765695430656",
    "updatedBy": "pod",
    "archived": false,
    "transitions": [],
    "links": []
  }
]

Note

Track the RULEEVAL activity within the Activity view UI and wait for this activity to complete to see the output on the rule dashboard.