Rulesets
Update ruleset
Updates description and/or rules on a DRAFT ruleset. Only DRAFT rulesets are editable. context and schema are identity fields fixed at creation — submitting a changed value rejects with 422 naming the field; resubmitting the current value unchanged is a no-op. Rebinding a context is a new ruleset, not an update.
PATCH
/
api
/
admin
/
rulesets
/
{id}
Update ruleset
curl --request PATCH \
--url https://{instance}.{env}.on-hellgate.cloud/api/admin/rulesets/{id} \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"description": "Block USD transactions over limit",
"rules": [
{
"id": "r1",
"name": "Block USD",
"async": true,
"backend": "vdm",
"condition": {},
"description": "Escalate to the risk backend",
"enabled": true,
"fields": [
"$.credential_fingerprint",
"$.device.ip"
],
"live": true,
"members": [
{
"backend": "vdm",
"live": true,
"weight": 60
}
],
"populate_on": [
"fraud_report",
"chargeback"
],
"ttl_seconds": 86400
}
]
}
'import requests
url = "https://{instance}.{env}.on-hellgate.cloud/api/admin/rulesets/{id}"
payload = {
"description": "Block USD transactions over limit",
"rules": [
{
"id": "r1",
"name": "Block USD",
"async": True,
"backend": "vdm",
"condition": {},
"description": "Escalate to the risk backend",
"enabled": True,
"fields": ["$.credential_fingerprint", "$.device.ip"],
"live": True,
"members": [
{
"backend": "vdm",
"live": True,
"weight": 60
}
],
"populate_on": ["fraud_report", "chargeback"],
"ttl_seconds": 86400
}
]
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.patch(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'PATCH',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({
description: 'Block USD transactions over limit',
rules: [
{
id: 'r1',
name: 'Block USD',
async: true,
backend: 'vdm',
condition: {},
description: 'Escalate to the risk backend',
enabled: true,
fields: ['$.credential_fingerprint', '$.device.ip'],
live: true,
members: [{backend: 'vdm', live: true, weight: 60}],
populate_on: ['fraud_report', 'chargeback'],
ttl_seconds: 86400
}
]
})
};
fetch('https://{instance}.{env}.on-hellgate.cloud/api/admin/rulesets/{id}', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://{instance}.{env}.on-hellgate.cloud/api/admin/rulesets/{id}",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "PATCH",
CURLOPT_POSTFIELDS => json_encode([
'description' => 'Block USD transactions over limit',
'rules' => [
[
'id' => 'r1',
'name' => 'Block USD',
'async' => true,
'backend' => 'vdm',
'condition' => [
],
'description' => 'Escalate to the risk backend',
'enabled' => true,
'fields' => [
'$.credential_fingerprint',
'$.device.ip'
],
'live' => true,
'members' => [
[
'backend' => 'vdm',
'live' => true,
'weight' => 60
]
],
'populate_on' => [
'fraud_report',
'chargeback'
],
'ttl_seconds' => 86400
]
]
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://{instance}.{env}.on-hellgate.cloud/api/admin/rulesets/{id}"
payload := strings.NewReader("{\n \"description\": \"Block USD transactions over limit\",\n \"rules\": [\n {\n \"id\": \"r1\",\n \"name\": \"Block USD\",\n \"async\": true,\n \"backend\": \"vdm\",\n \"condition\": {},\n \"description\": \"Escalate to the risk backend\",\n \"enabled\": true,\n \"fields\": [\n \"$.credential_fingerprint\",\n \"$.device.ip\"\n ],\n \"live\": true,\n \"members\": [\n {\n \"backend\": \"vdm\",\n \"live\": true,\n \"weight\": 60\n }\n ],\n \"populate_on\": [\n \"fraud_report\",\n \"chargeback\"\n ],\n \"ttl_seconds\": 86400\n }\n ]\n}")
req, _ := http.NewRequest("PATCH", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.patch("https://{instance}.{env}.on-hellgate.cloud/api/admin/rulesets/{id}")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"description\": \"Block USD transactions over limit\",\n \"rules\": [\n {\n \"id\": \"r1\",\n \"name\": \"Block USD\",\n \"async\": true,\n \"backend\": \"vdm\",\n \"condition\": {},\n \"description\": \"Escalate to the risk backend\",\n \"enabled\": true,\n \"fields\": [\n \"$.credential_fingerprint\",\n \"$.device.ip\"\n ],\n \"live\": true,\n \"members\": [\n {\n \"backend\": \"vdm\",\n \"live\": true,\n \"weight\": 60\n }\n ],\n \"populate_on\": [\n \"fraud_report\",\n \"chargeback\"\n ],\n \"ttl_seconds\": 86400\n }\n ]\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://{instance}.{env}.on-hellgate.cloud/api/admin/rulesets/{id}")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Patch.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"description\": \"Block USD transactions over limit\",\n \"rules\": [\n {\n \"id\": \"r1\",\n \"name\": \"Block USD\",\n \"async\": true,\n \"backend\": \"vdm\",\n \"condition\": {},\n \"description\": \"Escalate to the risk backend\",\n \"enabled\": true,\n \"fields\": [\n \"$.credential_fingerprint\",\n \"$.device.ip\"\n ],\n \"live\": true,\n \"members\": [\n {\n \"backend\": \"vdm\",\n \"live\": true,\n \"weight\": 60\n }\n ],\n \"populate_on\": [\n \"fraud_report\",\n \"chargeback\"\n ],\n \"ttl_seconds\": 86400\n }\n ]\n}"
response = http.request(request)
puts response.read_body{
"id": "6c1f4e8b-9a2d-4c7e-b5f3-8d1a6e9c4b2f",
"activated_at": "2026-05-15T08:00:00Z",
"context": "checkout",
"created_at": "2026-05-14T16:20:00Z",
"created_by": "ops@example.com",
"description": "Block USD transactions over limit",
"rules": [
{
"enabled": true,
"type": "condition",
"id": "r1",
"action": "BLOCK",
"async": true,
"backend": "vdm",
"condition": {},
"description": "Escalate to the risk backend",
"fields": [
"$.device.ip"
],
"live": true,
"members": [
"vdm"
],
"merge": "strictest",
"name": "Block USD",
"on_error": "allow",
"populate_on": [
"fraud_report",
"chargeback"
],
"strategy": "fallback",
"ttl_seconds": 86400
}
],
"schema": {
"name": "transaction",
"version": 1
},
"status": "DRAFT",
"version": 1
}{
"classifier": "UNAUTHORIZED",
"code": 401,
"message": "No valid means of authentication was provided"
}{
"classifier": "FORBIDDEN",
"code": 403,
"message": "Not allowed to access this resource or feature"
}{
"classifier": "NOT_FOUND",
"code": 404,
"message": "The requested resource does not exist"
}{
"classifier": "VALIDATION_ERROR",
"code": 422,
"validation_errors": [
{
"message": "must be a positive integer",
"path": "limit"
}
]
}Authorizations
HS256-signed JWT bearer token, obtained via the OAuth2 client-credentials grant (see Authentication).
Path Parameters
Ruleset ID
Body
application/json
Update attributes
Only DRAFT rulesets are editable. Omit a field to leave it unchanged. The identity fields context and schema are not updatable — a request carrying a changed value rejects with 422 naming the field, while carrying the current value unchanged is a no-op, so read-modify-write clients may echo the full object back.
Response
Updated ruleset
Example:
"6c1f4e8b-9a2d-4c7e-b5f3-8d1a6e9c4b2f"
Example:
"2026-05-15T08:00:00Z"
Example:
"checkout"
Example:
"2026-05-14T16:20:00Z"
Example:
"ops@example.com"
Example:
"Block USD transactions over limit"
Rule definitions evaluated in array order
Show child attributes
Show child attributes
A ruleset's declared (schema, version) pair. name references a registry entry; version is required for custom schemas and absent for built-ins, whose version is implicit and advances only via Specter releases. Set at ruleset creation and immutable for the life of that ruleset version — rebinding a context means publishing a new ruleset version with the new binding and activating it. Rulesets that predate the registry surface the launch-backfilled transaction binding.
Show child attributes
Show child attributes
Available options:
DRAFT, ACTIVE, INACTIVE Example:
1
⌘I
Update ruleset
curl --request PATCH \
--url https://{instance}.{env}.on-hellgate.cloud/api/admin/rulesets/{id} \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"description": "Block USD transactions over limit",
"rules": [
{
"id": "r1",
"name": "Block USD",
"async": true,
"backend": "vdm",
"condition": {},
"description": "Escalate to the risk backend",
"enabled": true,
"fields": [
"$.credential_fingerprint",
"$.device.ip"
],
"live": true,
"members": [
{
"backend": "vdm",
"live": true,
"weight": 60
}
],
"populate_on": [
"fraud_report",
"chargeback"
],
"ttl_seconds": 86400
}
]
}
'import requests
url = "https://{instance}.{env}.on-hellgate.cloud/api/admin/rulesets/{id}"
payload = {
"description": "Block USD transactions over limit",
"rules": [
{
"id": "r1",
"name": "Block USD",
"async": True,
"backend": "vdm",
"condition": {},
"description": "Escalate to the risk backend",
"enabled": True,
"fields": ["$.credential_fingerprint", "$.device.ip"],
"live": True,
"members": [
{
"backend": "vdm",
"live": True,
"weight": 60
}
],
"populate_on": ["fraud_report", "chargeback"],
"ttl_seconds": 86400
}
]
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.patch(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'PATCH',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({
description: 'Block USD transactions over limit',
rules: [
{
id: 'r1',
name: 'Block USD',
async: true,
backend: 'vdm',
condition: {},
description: 'Escalate to the risk backend',
enabled: true,
fields: ['$.credential_fingerprint', '$.device.ip'],
live: true,
members: [{backend: 'vdm', live: true, weight: 60}],
populate_on: ['fraud_report', 'chargeback'],
ttl_seconds: 86400
}
]
})
};
fetch('https://{instance}.{env}.on-hellgate.cloud/api/admin/rulesets/{id}', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://{instance}.{env}.on-hellgate.cloud/api/admin/rulesets/{id}",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "PATCH",
CURLOPT_POSTFIELDS => json_encode([
'description' => 'Block USD transactions over limit',
'rules' => [
[
'id' => 'r1',
'name' => 'Block USD',
'async' => true,
'backend' => 'vdm',
'condition' => [
],
'description' => 'Escalate to the risk backend',
'enabled' => true,
'fields' => [
'$.credential_fingerprint',
'$.device.ip'
],
'live' => true,
'members' => [
[
'backend' => 'vdm',
'live' => true,
'weight' => 60
]
],
'populate_on' => [
'fraud_report',
'chargeback'
],
'ttl_seconds' => 86400
]
]
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://{instance}.{env}.on-hellgate.cloud/api/admin/rulesets/{id}"
payload := strings.NewReader("{\n \"description\": \"Block USD transactions over limit\",\n \"rules\": [\n {\n \"id\": \"r1\",\n \"name\": \"Block USD\",\n \"async\": true,\n \"backend\": \"vdm\",\n \"condition\": {},\n \"description\": \"Escalate to the risk backend\",\n \"enabled\": true,\n \"fields\": [\n \"$.credential_fingerprint\",\n \"$.device.ip\"\n ],\n \"live\": true,\n \"members\": [\n {\n \"backend\": \"vdm\",\n \"live\": true,\n \"weight\": 60\n }\n ],\n \"populate_on\": [\n \"fraud_report\",\n \"chargeback\"\n ],\n \"ttl_seconds\": 86400\n }\n ]\n}")
req, _ := http.NewRequest("PATCH", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.patch("https://{instance}.{env}.on-hellgate.cloud/api/admin/rulesets/{id}")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"description\": \"Block USD transactions over limit\",\n \"rules\": [\n {\n \"id\": \"r1\",\n \"name\": \"Block USD\",\n \"async\": true,\n \"backend\": \"vdm\",\n \"condition\": {},\n \"description\": \"Escalate to the risk backend\",\n \"enabled\": true,\n \"fields\": [\n \"$.credential_fingerprint\",\n \"$.device.ip\"\n ],\n \"live\": true,\n \"members\": [\n {\n \"backend\": \"vdm\",\n \"live\": true,\n \"weight\": 60\n }\n ],\n \"populate_on\": [\n \"fraud_report\",\n \"chargeback\"\n ],\n \"ttl_seconds\": 86400\n }\n ]\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://{instance}.{env}.on-hellgate.cloud/api/admin/rulesets/{id}")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Patch.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"description\": \"Block USD transactions over limit\",\n \"rules\": [\n {\n \"id\": \"r1\",\n \"name\": \"Block USD\",\n \"async\": true,\n \"backend\": \"vdm\",\n \"condition\": {},\n \"description\": \"Escalate to the risk backend\",\n \"enabled\": true,\n \"fields\": [\n \"$.credential_fingerprint\",\n \"$.device.ip\"\n ],\n \"live\": true,\n \"members\": [\n {\n \"backend\": \"vdm\",\n \"live\": true,\n \"weight\": 60\n }\n ],\n \"populate_on\": [\n \"fraud_report\",\n \"chargeback\"\n ],\n \"ttl_seconds\": 86400\n }\n ]\n}"
response = http.request(request)
puts response.read_body{
"id": "6c1f4e8b-9a2d-4c7e-b5f3-8d1a6e9c4b2f",
"activated_at": "2026-05-15T08:00:00Z",
"context": "checkout",
"created_at": "2026-05-14T16:20:00Z",
"created_by": "ops@example.com",
"description": "Block USD transactions over limit",
"rules": [
{
"enabled": true,
"type": "condition",
"id": "r1",
"action": "BLOCK",
"async": true,
"backend": "vdm",
"condition": {},
"description": "Escalate to the risk backend",
"fields": [
"$.device.ip"
],
"live": true,
"members": [
"vdm"
],
"merge": "strictest",
"name": "Block USD",
"on_error": "allow",
"populate_on": [
"fraud_report",
"chargeback"
],
"strategy": "fallback",
"ttl_seconds": 86400
}
],
"schema": {
"name": "transaction",
"version": 1
},
"status": "DRAFT",
"version": 1
}{
"classifier": "UNAUTHORIZED",
"code": 401,
"message": "No valid means of authentication was provided"
}{
"classifier": "FORBIDDEN",
"code": 403,
"message": "Not allowed to access this resource or feature"
}{
"classifier": "NOT_FOUND",
"code": 404,
"message": "The requested resource does not exist"
}{
"classifier": "VALIDATION_ERROR",
"code": 422,
"validation_errors": [
{
"message": "must be a positive integer",
"path": "limit"
}
]
}