Skip to main content
POST
/
api
/
detection-rules
/
proposals
/
{id}
/
test-query
cURL
curl -X POST "https://app.cotool.ai/api/detection-rules/proposals/:id/test-query" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json"
{
  "success": true,
  "rows": 123,
  "executionTimeMs": 123,
  "results": [
    {}
  ],
  "bytesScanned": 123,
  "error": "<string>",
  "datadogRulePreview": {
    "validation": {
      "valid": true,
      "error": "<string>"
    },
    "historicalPreview": {
      "lookbackHours": 2,
      "estimatedSignals": 1,
      "windowsEvaluated": 1,
      "windowsTriggered": 1,
      "severityBreakdown": {},
      "topGroups": [
        {
          "group": {},
          "estimatedSignals": 1
        }
      ],
      "notes": [
        "<string>"
      ]
    }
  },
  "bestEstimate": {
    "count": 1,
    "timeRangeHours": 2,
    "source": "<string>"
  }
}

Authorizations

Authorization
string
header
required

API Key authentication for programmatic access. Include your API key in the Authorization header as: Bearer your_api_key_here

Path Parameters

id
string<uuid>
required

Response

Successful response

success
boolean
required
rows
number
required

Total matching rows in the test time window (may exceed returned sample size)

executionTimeMs
number
required
results
object[]
required
bytesScanned
number
error
string
datadogRulePreview
object
bestEstimate
object

Single best platform-specific estimate used to display hits/hr