Rule Authoring Skill

​

Overview

​

What It Helps With

• Creating custom rules from scratch or from pre-built templates
• Configuring conditions with property checks, boolean logic, and aggregation thresholds
• Setting up actions (alert creation, transaction halting)
• Managing rule lifecycle (draft, activate, disable, delete, versioning)
• Testing rules with on-demand evaluation
• Understanding how rules generate alerts in production

​

Quick Start

• “Create a rule that alerts on withdrawals over $50K in 24 hours”
• “Copy a rule template and customize the thresholds”
• “What aggregation operators are available for conditions?”
• “Test my rule against a sample transaction”
• “How do I update an active rule without downtime?”

​

What the Skill Knows

​

Rule Lifecycle

Create → Draft → Activate → Active → Disable → Disabled → Delete (soft)

• Only active rules evaluate incoming transactions automatically
• Updating an active rule creates a new version atomically
• Active rules must be disabled before deletion
• activate, disable, and delete accept optional reason for audit trail

​

Conditions

• Entity targets: transaction, client, wallet, bankAccount
• Boolean logic: all (AND) and any (OR) groups with arbitrary nesting
• Operators: equal, notEqual, greaterThan, lessThan, greaterThanInclusive, lessThanInclusive, contains, doesNotContain, in, notIn, between
• Entity relationships: all, sender, receiver for client-scoped conditions

​

Aggregation Thresholds

• Operators: sum, count, avg, min, max, median, stddev, percentile, countDistinct, first, last
• Time windows: in_the_last, all_time, after, before, between
• Periods: minutes, hours, days, weeks, months, years
• Filters: Narrow which transactions are aggregated (e.g., only withdrawals)

​

Actions

​

Templates

const { ruleId } = await client.ruleTemplates.copyRuleTemplate("template-id");
const updated = await client.rules.updateRule(ruleId, { /* customizations */ });
await client.rules.activateRule(ruleId);

​

Evaluation

• Automatic: Active rules evaluate every ingested transaction and trigger actions (alert creation)
• On-demand: POST /v1/evaluation/evaluate tests rules without creating alerts
• History: Query evaluation results by transaction or by rule

​

Key Distinction: Evaluate API vs Production Alerts

​

Common Mistakes It Prevents

​

Source