Test detection
POST/api/security/detections/:rule_id/test
Evaluate the rule IN MEMORY - over a labelled synthetic fixture, or over this tenant's recent real events. The ONLY thing persisted is a security_detection_runs row with mode 'test': no finding, no security_events row, no audit entry, no notification.
Request
Responses
- 200
- 401
- 403
- 422
Successful Response
The token is missing, invalid or expired. Refresh it, or sign in again.
Your role does not allow this. The detail names the missing permission or role.
Validation Error