Skip to main content
POST
/
api
/
detection-rules
/
proposals
/
{id}
/
test-query
cURL
curl -X POST "https://app.cotool.ai/api/detection-rules/proposals/:id/test-query" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json"
{
  "success": true,
  "rows": 123,
  "executionTimeMs": 123,
  "results": [
    {}
  ],
  "bytesScanned": 123,
  "error": "<string>",
  "datadogRulePreview": {
    "validation": {
      "valid": true,
      "error": "<string>"
    },
    "historicalPreview": {
      "fidelity": "full",
      "lookbackHours": 2,
      "estimatedSignals": 1,
      "windowsEvaluated": 1,
      "windowsTriggered": 1,
      "severityBreakdown": {},
      "topGroups": [
        {
          "group": {},
          "estimatedSignals": 1
        }
      ],
      "notes": [
        "<string>"
      ]
    }
  },
  "bestEstimate": {
    "count": 1,
    "timeRangeHours": 2,
    "basis": "estimated_detection_noisiness",
    "quality": "authoritative",
    "source": "<string>"
  }
}

Documentation Index

Fetch the complete documentation index at: https://docs.cotool.ai/llms.txt

Use this file to discover all available pages before exploring further.

Authorizations

​
Authorization
string
header
required

API Key authentication for programmatic access. Include your API key in the Authorization header as: Bearer your_api_key_here

Path Parameters

​
id
string<uuid>
required

Response

200 - application/json

Successful response

​
success
boolean
required
​
rows
number
required

Total matching rows in the test time window (may exceed returned sample size)

​
executionTimeMs
number
required
​
results
object[]
required
​
bytesScanned
number
​
error
string
​
datadogRulePreview
object
​
bestEstimate
object

Single best platform-specific estimate used to display hits/hr