Detection rule catalog
The corpus-wide detection rule catalog.
GET/api/v1/detection-rules
The full catalog of catalogued detection content across every CVE — Nuclei templates and other rules — with a hash and byte size per rule. Rule bodies are omitted by default; pass body=true to inline them.
Parameters
| Name | In | Type | Description |
|---|---|---|---|
source | query | string | Filter by rule source (e.g. nuclei). |
body | query | boolean | Inline the rule body on each entry. Default: false. |
limit | query | integer | Page size, 1–100. Default: 25. |
cursor | query | string | Opaque cursor from the previous page. |
Example request
curl "https://radicalnotion.ai/api/v1/detection-rules?limit=2" \
-H "Authorization: Bearer $RN_TOKEN"Example response(default shape — body omitted (null))
{
"data": [
{
"id": "0000e125-d913-4091-8126-da6285c3d704",
"source": "nuclei",
"source_ref_id": "CVE-2020-36333",
"evidence_type": "detection_template",
"byte_size": 1876,
"body_hash": "42d4220e1ce9d46c127eb3cf73a83e63c98d90a478c7b15b6b3b8315a175228b",
"first_seen": "2026-07-26T15:28:54Z",
"last_seen": "2026-07-26T15:28:54Z",
"body": null
},
{
"id": "000971da-12d9-458e-ade0-7f9d83784fbb",
"source": "nuclei",
"source_ref_id": "CVE-2008-4668",
"evidence_type": "detection_template",
"byte_size": 1833,
"body_hash": "81cc9c9813f042ed460491d81f250997ac565e5ce438eb83933c40df2a0bcc81",
"first_seen": "2026-07-26T15:28:54Z",
"last_seen": "2026-07-26T15:28:54Z",
"body": null
}
],
"pagination": {
"limit": 2,
"next_cursor": "eyJ2IjpudWxsLCJpZCI6IjAwMDk3MWRhLTEyZDktNDU4ZS1hZGUwLTdmOWQ4Mzc4NGZiYiJ9"
}
}Response schema
| Field | Type | Description |
|---|---|---|
data[].id | string | Detection-rule UUID. |
data[].source / source_ref_id | string | Rule source and its reference id (often the CVE). |
data[].evidence_type | string | Kind of detection content (detection_template, ...). |
data[].byte_size / body_hash | integer / string | Size and hash of the rule body. |
data[].first_seen / last_seen | string | Observation window (ISO 8601). |
data[].body | string | null | The rule body; null unless body=true. |
pagination.next_cursor | string | null | Pass as ?cursor= for the next page. |
Responses
| Status | Meaning |
|---|---|
200 | Success. |
400 | A path or query parameter failed validation. |
401 | Missing or invalid access token. |
429 | Rate limit exceeded. |
No rule matches the filters — empty data, null cursor.
{
"data": [],
"pagination": { "limit": 25, "next_cursor": null }
}