> ## Documentation Index > Fetch the complete documentation index at: https://docs.sreagent.app/llms.txt > Use this file to discover all available pages before exploring further. # Create an outbound rule > Escalate the alerts a rule matches to one target, once per firing per alert. A rule with no match_source, match_severity or match_labels matches every alert in the organization. The target must be one of this organization's own. Setting escalate_after_minutes makes it a timed rule instead, which pages for the alerts it matches once their firing has lasted that long; read that field's description before setting it. ## OpenAPI ````yaml /api-reference/openapi.json post /outbound_rules openapi: 3.1.0 info: description: >- A resource-shaped endpoint onto the same tool surface the MCP server (/api/mcp) reaches. Every gate, refusal and audit row a caller sees here is the exact one the MCP endpoint answers for the same tool. Authenticated with an API key holding the api:admin scope, or the read-only api:config_read scope for GET alone. title: SRE Agent configuration API version: 1.0.0 servers: - url: https://sreagent.app/api/v1/config security: - apiKey: [] tags: - name: ai_providers - name: ai_settings - name: alert_mutes - name: alert_routes - name: aws_external_id - name: certificate_monitors - name: change_notifications - name: compliance_periods - name: connectors - name: data_sources - name: deploy_policies - name: export - name: github_settings - name: image_targets - name: notification_settings - name: organization_settings - name: outbound_configs - name: outbound_rules - name: overseer_settings - name: prompt_templates - name: repo_settings - name: service_bindings - name: slack - name: slis - name: slos - name: status_page_components - name: status_page_incidents - name: status_page_settings - name: synthetic_checks - name: team_members - name: teams - name: ticket_import_rules - name: ticket_integrations paths: /outbound_rules: post: tags: - outbound_rules summary: Create an outbound rule description: >- Escalate the alerts a rule matches to one target, once per firing per alert. A rule with no match_source, match_severity or match_labels matches every alert in the organization. The target must be one of this organization's own. Setting escalate_after_minutes makes it a timed rule instead, which pages for the alerts it matches once their firing has lasted that long; read that field's description before setting it. operationId: create_outbound_rule parameters: [] requestBody: content: application/json: schema: properties: cooldown_minutes: description: >- An immediate rule waits this long, at least 1, after a delivered page before it pages about a DIFFERENT alert; a page the target refused spends nothing, so every matching alert still gets its own attempt and its own row. A timed rule does not space its pages by this at all: one scheduled evaluation pages for every alert it matches whose firing has lasted long enough, and the number is read only as the seed of the retry wait below. Either kind of rule waits this long before re-attempting a page that could not be delivered, doubling the wait with each further failure up to one day; the immediate path makes that attempt on the next delivery of the alert that arrives after the wait, and the timed path on its next pass. Neither repeats a page that was delivered for the same firing. null leaves the default of 30 minutes. type: - integer - 'null' enabled: description: >- Whether this rule may fire at all. A disabled rule keeps everything it matches on and is skipped. type: boolean escalate_after_minutes: description: >- Makes this a timed rule, at least 1, and it changes when the rule pages rather than what it pages for. A timed rule is run by a scheduled evaluation, which pages once per firing for the alerts it matches, and only once the firing has lasted this many minutes; an alert that cleared and fired again is firing since the moment it came back, however long it was open before that. match_source, match_severity and match_labels are read the same way as on an immediate rule. A page the target refuses is attempted again at growing intervals, starting at cooldown_minutes after the failure and doubling with each further failure up to one day, and one that was delivered is never repeated for that alert and rule in that firing. null leaves the rule immediate, and an immediate rule pages for the alerts it matches as they arrive: once per firing per alert, so a redelivery of an alert that is still active does not page again and an alert that cleared and fired again does. type: - integer - 'null' match_labels: description: >- Only alerts whose labels carry every one of these pairs, compared as strings, so every value here must be a string. An empty object and null both match every alert. type: - object - 'null' match_severity: description: >- Only alerts of this severity, matched exactly, one of: critical, high, warning, medium, low, info. null matches every severity. type: - string - 'null' match_source: description: >- Only alerts from this source, matched exactly, one of: grafana, pagerduty, opsgenie, prometheus, alertmanager, datadog, newrelic, cloudwatch, cloudtrail, custom, slo_breach, slo_tracking, certificate_monitor, cost_monitor, synthetic_check, slack, overseer, security. null matches every source. type: - string - 'null' name: description: >- What this rule is called here. It is a label for the people reading the table, not anything the target sees. type: string outbound_config_id: description: >- The target this rule escalates to, by its uuid as list_outbound_configs answers it. It must belong to this organization. type: string step_order: description: >- Where this rule sits in an escalation chain. Step 0 pages first; a rule with a higher step order is skipped for a firing somebody already acknowledged, and waits for a step 0 page that nobody acknowledged before it pages. Leave it at 0 for a rule that is not part of a chain. type: - integer - 'null' required: - name - outbound_config_id type: object required: true responses: '201': description: Created. '409': description: A row already matches this resource's natural key. '422': description: The tool refused the request's shape or content. default: description: The request failed. content: application/json: schema: $ref: '#/components/schemas/Error' components: schemas: Error: type: object description: The body of every failed request. properties: error: type: string description: >- A short machine-readable code such as forbidden, conflict or read_only_key. message: type: string description: A sentence that says what to change. required: - error - message additionalProperties: true securitySchemes: apiKey: description: >- An sre_ak_* API key holding the api:admin scope (or api:config_read, which every write refuses with read_only_key). scheme: bearer type: http ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.