{"command":{"effect":"write","timeoutSeconds":30,"inputSchema":{"type":"object","description":"Create a new detection rule.","properties":{"path":{"type":"object","properties":{"account_id":{"type":"string","examples":["023e105f4ecef8ad9ca31a8372d0c353"],"description":"Cloudflare account ID."}},"required":["account_id"],"additionalProperties":false},"body":{"$ref":"#/definitions/cloudforce-one_CreateRule"}},"required":["path"],"additionalProperties":false,"definitions":{"cloudforce-one_CreateRule":{"type":"object","properties":{"actions":{"type":"array","items":{"$ref":"#/definitions/cloudforce-one_RuleAction"}},"commit_message":{"description":"Human-readable justification for this change. Required for internal-account submissions; optional for customer accounts and automated sync.","type":"string","maxLength":1000,"examples":["Add worker rule to catch bpb-panel variants."]},"content":{"minLength":1,"type":"string","examples":["rule example { condition: true }"]},"description":{"description":"Human-readable description of the rule. Auto-extracted from YARA meta if present.","type":"string","maxLength":1000,"examples":["Detects malicious proxy workers"]},"enabled":{"description":"Whether this rule is active for dice consumers.","type":"boolean","default":true,"examples":[true]},"is_public":{"description":"Whether this rule is visible to other internal accounts.","type":"boolean","default":false,"examples":[false]},"meta":{"description":"Adds YARA meta entries to the rule's meta block and stores them in rule_meta alongside content metadata. Use valid YARA identifiers for keys; exclude 'name', 'enabled', and 'description'. You may repeat keys.","type":"array","items":{"$ref":"#/definitions/cloudforce-one_MetaInputEntry"},"maxItems":50},"name":{"type":"string","maxLength":255,"minLength":1,"examples":["block-malicious-workers"]},"namespaces":{"description":"Optional WfP deployment tags (customer rules only). Internal rules leave empty.","type":"array","items":{"maxLength":255,"minLength":1,"type":"string"},"default":[],"examples":[[]]},"path":{"type":"string","minLength":1,"examples":["yara/workers"]}},"required":["name","path","content"]},"cloudforce-one_RuleAction":{"type":"object","properties":{"action_config":{"description":"Action-specific configuration parameters.","type":"object","additionalProperties":{"anyOf":[{"type":"string"},{"type":"number"},{"type":"boolean"},{"items":{"type":"string"},"type":"array"},{"additionalProperties":{"type":"string"},"type":"object"}]}},"action_type":{"type":"string","enum":["alert_gchat","webhook","logging","email","pipeline","remediation","throttle","delete"],"examples":["alert_gchat"]},"enabled":{"type":"boolean","default":true}},"required":["action_type","action_config"]},"cloudforce-one_MetaInputEntry":{"description":"A YARA meta entry. The server resolves its value type. The 'detection' key accepts MALICIOUS, SUSPICIOUS, SPAM, or SPOOF.","type":"object","properties":{"key":{"type":"string","maxLength":128,"minLength":1,"pattern":"^[a-zA-Z_][a-zA-Z0-9_]*$"},"value":{"anyOf":[{"maxLength":10000,"type":"string"},{"type":"number"},{"type":"boolean"}]}},"required":["key","value"]}}},"name":"Create a rule","id":"cloudflare.cloudforce-one-create-rule","example":{"path":{"account_id":"023e105f4ecef8ad9ca31a8372d0c353"}},"maxRequests":1,"summary":false}}