# Litmus Edge Manager 3.0.x - Admin Console: Platform Rules

## Get Platform Rule Catalog

**GET** `{{LEM_adminURL}}/admin/v1/platform-rule/catalog`

> **New in 2.35.**

# Get Platform Rule Catalog

Platform rules are built-in alert rules that LEM evaluates for every project, so common failures raise incidents without a per-project trigger. This returns every platform rule with its effective configuration. LEM 3.0 ships 8: connector status, DeviceHub device online, gateway offline, Marketplace app state, license expiring, and gateway disk, memory and CPU.
## Endpoint

```http
GET {{LEM_adminURL}}/admin/v1/platform-rule/catalog
```
## Authentication

API key in a request header (case sensitive). The value is the LEM admin API token.

| URL prefix | Auth header |
|---|---|
| `{{LEM_URL}}/api/v1/...` (main fleet API) | `X-AuthToken: <token>` |
| `{{LEM_adminURL}}/admin/v1/...` (admin console, port 8446) | `X-AuthToken: <token>` |
| `{{LEM_URL}}/mpcs/...` (Marketplace Catalog) | `Authorization: <token>` (3.0.x also accepts `X-AuthToken`) |
## Response

An array of `PlatformRuleView`.

A `PlatformRuleView`:

| Field | Description |
|---|---|
| `ruleKey` | Stable identifier, e.g. `platform.gateway.offline`. |
| `name`, `description`, `summary` | Display text. `summary` is the incident subject template; `$name` and `$alertDelay` are filled in when an incident opens. |
| `category` | `CONNECTOR`, `DEVICE`, `GATEWAY`, `APP` or `LICENSE` on 3.0. |
| `templateCode` | The alert template the rule is built on. |
| `sourceType` | `METRICS` (evaluated from device metrics) or `EVENTS` (evaluated from events). |
| `enabled`, `severity`, `targetValue`, `alertDelay` | The effective configuration: the built-in default, or the override written by `Update Platform Rule`. `alertDelay` is in seconds. |
| `projects` | `ALL`, or the project link list (see `Get Platform Rule Projects`). |
| `attributes` | Extra rule attributes; empty for every built-in rule on 3.0. |

## Errors

| HTTP status         | When it happens                                                                |
|---------------------|--------------------------------------------------------------------------------|
| `400 Bad Request`   | Missing or malformed query/body parameter.                                     |
| `401 Unauthorized`  | Missing or invalid credentials.                                                |
| `403 Forbidden`     | Token lacks permission for this operation.                                     |
| `404 Not Found`     | Target entity does not exist.                                                  |
| `5xx`               | Service is unreachable, restarting, or internally errored. Inspect device logs under `System > Support`. |

> **TLS note**: edge devices use a self-signed certificate by default. Either install the device CA in your client trust store or disable certificate verification when calling this endpoint directly.


### Response

**Status**: 200 OK

```json
[
  {
    "ruleKey": "platform.connector.status",
    "name": "Connector Status",
    "description": "Identify unplanned disconnections",
    "summary": "CC connector $name is offline more than $alertDelay seconds",
    "category": "CONNECTOR",
    "templateCode": "CONNECTOR_ONLINE_STATUS",
    "sourceType": "METRICS",
    "enabled": true,
    "severity": 3,
    "targetValue": null,
    "alertDelay": 60,
    "projects": "ALL",
    "attributes": []
  },
  {
    "ruleKey": "platform.devicehub.device.offline",
    "name": "DeviceHub Device Online",
    "description": "Identify unplanned disconnections of DH devices",
    "summary": "DH device $name is offline more than $alertDelay seconds",
    "category": "DEVICE",
    "templateCode": "DH_DEVICE_ONLINE_STATUS",
    "sourceType": "METRICS",
    "enabled": true,
    "severity": 2,
    "targetValue": null,
    "alertDelay": 60,
    "projects": "ALL",
    "attributes": []
  },
  {
    "ruleKey": "platform.gateway.offline",
    "name": "Edge Device Online Status",
    "description": "Detect unexpected disconnects of an edge device",
    "summary": "Edge Device is offline more than $alertDelay seconds",
    "category": "GATEWAY",
    "templateCode": "EDGE_DEVICE_ONLINE_STATUS",
    "sourceType": "METRICS",
    "enabled": true,
    "severity": 3,
    "targetValue": null,
    "alertDelay": 60,
    "projects": "ALL",
    "attributes": []
  },
  {
    "ruleKey": "platform.marketplace.app.state",
    "name": "Marketplace App Lifecycle",
    "description": "Detect marketplace app lifecycle changes. Requires event forwarding to be enabled on edge devices",
    "summary": "Marketplace application state changed",
    "category": "APP",
    "templateCode": null,
    "sourceType": "EVENTS",
    "enabled": true,
    "severity": 2,
    "targetValue": null,
    "alertDelay": null,
    "projects": "ALL",
    "attributes": []
  },
  {
    "ruleKey": "platform.gateway.license.expiring",
    "name": "Edge Device License Expiration",
    "description": "Detect when the license for an edge device has expired",
    "summary": "The license for an edge device is going to be expired in $targetValue days",
    "category": "LICENSE",
    "templateCode": "EDGE_DEVICE_LICENSE_EXPIRATION",
    "sourceType": "METRICS",
    "enabled": true,
    "severity": 3,
    "targetValue": "14",
    "alertDelay": 300,
    "projects": "ALL",
    "attributes": [
      {
        "name": "Target Value",
        "code": "value",
        "description": "Days to expire",
        "datatype": "number",
        "uom": "days",
        "type": "VALUE",
        "values": [],
        "defaultValue": 14
      }
    ]
  },
  {
    "ruleKey": "platform.gateway.disk.low",
    "name": "Edge Device Free Disk Space",
    "description": "Monitor the available disk space on an edge device",
    "summary": "Free disk space less than $targetValue % more than $alertDelay seconds",
    "category": "GATEWAY",
    "templateCode": "EDGE_DEVICE_FREE_DISK_SPACE",
    "sourceType": "METRICS",
    "enabled": true,
    "severity": 3,
    "targetValue": "10",
    "alertDelay": 120,
    "projects": "ALL",
    "attributes": [
      {
        "name": "Target Value",
        "code": "value",
        "description": "Edge device free disk space (%) to trigger an alert",
        "datatype": "number",
        "uom": "%",
        "type": "VALUE",
        "values": [],
        "defaultValue": null
      }
    ]
  },
  {
    "ruleKey": "platform.gateway.memory.low",
    "name": "Edge Device Memory Available",
    "description": "Monitor the available memory on an edge device",
    "summary": "Free RAM less than $targetValue% more than $alertDelay seconds",
    "category": "GATEWAY",
    "templateCode": "EDGE_DEVICE_MEMORY_AVAILABLE",
    "sourceType": "METRICS",
    "enabled": true,
    "severity": 3,
    "targetValue": "10",
    "alertDelay": 120,
    "projects": "ALL",
    "attributes": [
      {
        "name": "Target Value",
        "code": "value",
        "description": "Edge device memory available (%) to trigger an alert",
        "datatype": "number",
        "uom": "%",
        "type": "VALUE",
        "values": [],
        "defaultValue": null
      }
    ]
  },
  {
    "ruleKey": "platform.gateway.cpu.busy",
    "name": "Edge Device CPU Idle",
    "description": "Monitor the CPU usage on an edge device",
    "summary": "CPU idle less than $targetValue % more than $alertDelay seconds",
    "category": "GATEWAY",
    "templateCode": "EDGE_DEVICE_CPU_IDLE",
    "sourceType": "METRICS",
    "enabled": true,
    "severity": 2,
    "targetValue": "5",
    "alertDelay": 300,
    "projects": "ALL",
    "attributes": [
      {
        "name": "Target Value",
        "code": "value",
        "description": "Edge device CPU idle (%) to trigger an alert",
        "datatype": "number",
        "uom": "%",
        "type": "VALUE",
        "values": [],
        "defaultValue": 5
      }
    ]
  }
]
```

---

## Get Platform Rule Stats

**GET** `{{LEM_adminURL}}/admin/v1/platform-rule/stats`

> **New in 2.35.**

# Get Platform Rule Stats

Returns the summary counts shown above the platform-rule list.
## Endpoint

```http
GET {{LEM_adminURL}}/admin/v1/platform-rule/stats
```
## Authentication

API key in a request header (case sensitive). The value is the LEM admin API token.

| URL prefix | Auth header |
|---|---|
| `{{LEM_URL}}/api/v1/...` (main fleet API) | `X-AuthToken: <token>` |
| `{{LEM_adminURL}}/admin/v1/...` (admin console, port 8446) | `X-AuthToken: <token>` |
| `{{LEM_URL}}/mpcs/...` (Marketplace Catalog) | `Authorization: <token>` (3.0.x also accepts `X-AuthToken`) |
## Response

```json
{ "totalRules": 8, "activeRules": 8, "openIncidents": 5, "autoResolvedToday": 0 }
```

## Errors

| HTTP status         | When it happens                                                                |
|---------------------|--------------------------------------------------------------------------------|
| `400 Bad Request`   | Missing or malformed query/body parameter.                                     |
| `401 Unauthorized`  | Missing or invalid credentials.                                                |
| `403 Forbidden`     | Token lacks permission for this operation.                                     |
| `404 Not Found`     | Target entity does not exist.                                                  |
| `5xx`               | Service is unreachable, restarting, or internally errored. Inspect device logs under `System > Support`. |

> **TLS note**: edge devices use a self-signed certificate by default. Either install the device CA in your client trust store or disable certificate verification when calling this endpoint directly.


### Response

**Status**: 200 OK

```json
{
  "totalRules": 8,
  "activeRules": 8,
  "openIncidents": 5,
  "autoResolvedToday": 0
}
```

---

## Get Platform Rule

**GET** `{{LEM_adminURL}}/admin/v1/platform-rule/{{platform_rule_key}}`

> **New in 2.35.**

# Get Platform Rule

Returns the effective configuration of one platform rule.
## Endpoint

```http
GET {{LEM_adminURL}}/admin/v1/platform-rule/{{platform_rule_key}}
```
## Authentication

API key in a request header (case sensitive). The value is the LEM admin API token.

| URL prefix | Auth header |
|---|---|
| `{{LEM_URL}}/api/v1/...` (main fleet API) | `X-AuthToken: <token>` |
| `{{LEM_adminURL}}/admin/v1/...` (admin console, port 8446) | `X-AuthToken: <token>` |
| `{{LEM_URL}}/mpcs/...` (Marketplace Catalog) | `Authorization: <token>` (3.0.x also accepts `X-AuthToken`) |
## Parameters

| Parameter | In | Notes |
|---|---|---|
| `ruleKey` | path | **Required.** Rule key from `Get Platform Rule Catalog`, e.g. `platform.devicehub.device.offline`. |

## Response

A `PlatformRuleView`:

| Field | Description |
|---|---|
| `ruleKey` | Stable identifier, e.g. `platform.gateway.offline`. |
| `name`, `description`, `summary` | Display text. `summary` is the incident subject template; `$name` and `$alertDelay` are filled in when an incident opens. |
| `category` | `CONNECTOR`, `DEVICE`, `GATEWAY`, `APP` or `LICENSE` on 3.0. |
| `templateCode` | The alert template the rule is built on. |
| `sourceType` | `METRICS` (evaluated from device metrics) or `EVENTS` (evaluated from events). |
| `enabled`, `severity`, `targetValue`, `alertDelay` | The effective configuration: the built-in default, or the override written by `Update Platform Rule`. `alertDelay` is in seconds. |
| `projects` | `ALL`, or the project link list (see `Get Platform Rule Projects`). |
| `attributes` | Extra rule attributes; empty for every built-in rule on 3.0. |

## Errors

| HTTP status         | When it happens                                                                |
|---------------------|--------------------------------------------------------------------------------|
| `400 Bad Request`   | Missing or malformed query/body parameter.                                     |
| `401 Unauthorized`  | Missing or invalid credentials.                                                |
| `403 Forbidden`     | Token lacks permission for this operation.                                     |
| `404 Not Found`     | Target entity does not exist.                                                  |
| `5xx`               | Service is unreachable, restarting, or internally errored. Inspect device logs under `System > Support`. |

> **TLS note**: edge devices use a self-signed certificate by default. Either install the device CA in your client trust store or disable certificate verification when calling this endpoint directly.


### Response

**Status**: 200 OK

```json
{
  "ruleKey": "platform.connector.status",
  "name": "Connector Status",
  "description": "Identify unplanned disconnections",
  "summary": "CC connector $name is offline more than $alertDelay seconds",
  "category": "CONNECTOR",
  "templateCode": "CONNECTOR_ONLINE_STATUS",
  "sourceType": "METRICS",
  "enabled": true,
  "severity": 3,
  "targetValue": null,
  "alertDelay": 60,
  "projects": "ALL",
  "attributes": []
}
```

---

## Update Platform Rule

**POST** `{{LEM_adminURL}}/admin/v1/platform-rule/{{platform_rule_key}}`

> **New in 2.35.**

# Update Platform Rule

Writes the installation-wide override for one platform rule: switch it off, or change its severity, threshold or delay. Fields left out keep their current value. Each change is recorded and shows in `Get Platform Rule Audit`.
## Endpoint

```http
POST {{LEM_adminURL}}/admin/v1/platform-rule/{{platform_rule_key}}
```
## Authentication

API key in a request header (case sensitive). The value is the LEM admin API token.

| URL prefix | Auth header |
|---|---|
| `{{LEM_URL}}/api/v1/...` (main fleet API) | `X-AuthToken: <token>` |
| `{{LEM_adminURL}}/admin/v1/...` (admin console, port 8446) | `X-AuthToken: <token>` |
| `{{LEM_URL}}/mpcs/...` (Marketplace Catalog) | `Authorization: <token>` (3.0.x also accepts `X-AuthToken`) |
## Parameters

| Parameter | In | Notes |
|---|---|---|
| `ruleKey` | path | **Required.** Rule key from `Get Platform Rule Catalog`, e.g. `platform.devicehub.device.offline`. |

## Request body

| Field | Type | Description |
|---|---|---|
| `enabled` | boolean | Turn the rule on or off. |
| `severity` | integer | Incident severity. |
| `targetValue` | string | Threshold, for rules that have one (e.g. disk / memory / CPU). |
| `alertDelay` | integer | Seconds the condition must hold before an incident opens. |

```json
{ "enabled": true, "severity": 2, "alertDelay": 120 }
```

## Response

`ApiResponse` `{ code, message, messageDetails }`.
## Errors

| HTTP status         | When it happens                                                                |
|---------------------|--------------------------------------------------------------------------------|
| `400 Bad Request`   | Missing or malformed query/body parameter.                                     |
| `401 Unauthorized`  | Missing or invalid credentials.                                                |
| `403 Forbidden`     | Token lacks permission for this operation.                                     |
| `404 Not Found`     | Target entity does not exist.                                                  |
| `5xx`               | Service is unreachable, restarting, or internally errored. Inspect device logs under `System > Support`. |

> **TLS note**: edge devices use a self-signed certificate by default. Either install the device CA in your client trust store or disable certificate verification when calling this endpoint directly.


### Request Body

```json
{
  "enabled": true,
  "severity": 0,
  "targetValue": "string",
  "alertDelay": 0
}
```

---

## Get Platform Rule Audit

**GET** `{{LEM_adminURL}}/admin/v1/platform-rule/{{platform_rule_key}}/audit?requestedPage=0&limit=1`

> **New in 2.35.**

# Get Platform Rule Audit

Returns the change history of a platform rule's override, as audit records.
## Endpoint

```http
GET {{LEM_adminURL}}/admin/v1/platform-rule/{{platform_rule_key}}/audit
```
## Authentication

API key in a request header (case sensitive). The value is the LEM admin API token.

| URL prefix | Auth header |
|---|---|
| `{{LEM_URL}}/api/v1/...` (main fleet API) | `X-AuthToken: <token>` |
| `{{LEM_adminURL}}/admin/v1/...` (admin console, port 8446) | `X-AuthToken: <token>` |
| `{{LEM_URL}}/mpcs/...` (Marketplace Catalog) | `Authorization: <token>` (3.0.x also accepts `X-AuthToken`) |
## Parameters

| Parameter | In | Notes |
|---|---|---|
| `ruleKey` | path | **Required.** Rule key from `Get Platform Rule Catalog`, e.g. `platform.devicehub.device.offline`. |
| `requestedPage` / `limit` | query | Pagination; `requestedPage` is 0-based. |

## Response

Paged audit records, same shape as `Get API Activity Records` elements. Empty until the rule has been changed.
## Errors

| HTTP status         | When it happens                                                                |
|---------------------|--------------------------------------------------------------------------------|
| `400 Bad Request`   | Missing or malformed query/body parameter.                                     |
| `401 Unauthorized`  | Missing or invalid credentials.                                                |
| `403 Forbidden`     | Token lacks permission for this operation.                                     |
| `404 Not Found`     | Target entity does not exist.                                                  |
| `5xx`               | Service is unreachable, restarting, or internally errored. Inspect device logs under `System > Support`. |

> **TLS note**: edge devices use a self-signed certificate by default. Either install the device CA in your client trust store or disable certificate verification when calling this endpoint directly.


### Response

**Status**: 200 OK

```json
{
  "pageNum": 0,
  "pagesCount": 0,
  "size": 0,
  "totalSize": 0,
  "elements": []
}
```

---

## Get Platform Rule Incidents

**GET** `{{LEM_adminURL}}/admin/v1/platform-rule/{{platform_rule_key}}/incidents?requestedPage=0&limit=1`

> **New in 2.35.**

# Get Platform Rule Incidents

Returns the incidents a platform rule has opened, across all projects.
## Endpoint

```http
GET {{LEM_adminURL}}/admin/v1/platform-rule/{{platform_rule_key}}/incidents
```
## Authentication

API key in a request header (case sensitive). The value is the LEM admin API token.

| URL prefix | Auth header |
|---|---|
| `{{LEM_URL}}/api/v1/...` (main fleet API) | `X-AuthToken: <token>` |
| `{{LEM_adminURL}}/admin/v1/...` (admin console, port 8446) | `X-AuthToken: <token>` |
| `{{LEM_URL}}/mpcs/...` (Marketplace Catalog) | `Authorization: <token>` (3.0.x also accepts `X-AuthToken`) |
## Parameters

| Parameter | In | Notes |
|---|---|---|
| `ruleKey` | path | **Required.** Rule key from `Get Platform Rule Catalog`, e.g. `platform.devicehub.device.offline`. |
| `requestedPage` / `limit` | query | Pagination; `requestedPage` is 0-based. |

## Response

Paged `{ ..., elements: [IncidentEx] }`. Each incident has `id`, `triggerId` (the rule key), `startedAt` / `resolvedAt` (epoch ms; `resolvedAt` is null while open), `deviceId`, `severity`, `scopeType` (`GLOBAL` for platform rules), `subject`, `message`, `messageResolved`, `allVariables` and `triggerName`.

## Errors

| HTTP status         | When it happens                                                                |
|---------------------|--------------------------------------------------------------------------------|
| `400 Bad Request`   | Missing or malformed query/body parameter.                                     |
| `401 Unauthorized`  | Missing or invalid credentials.                                                |
| `403 Forbidden`     | Token lacks permission for this operation.                                     |
| `404 Not Found`     | Target entity does not exist.                                                  |
| `5xx`               | Service is unreachable, restarting, or internally errored. Inspect device logs under `System > Support`. |

> **TLS note**: edge devices use a self-signed certificate by default. Either install the device CA in your client trust store or disable certificate verification when calling this endpoint directly.


### Response

**Status**: 200 OK

```json
{
  "pageNum": 0,
  "pagesCount": 8,
  "size": 1,
  "totalSize": 8,
  "elements": [
    {
      "id": "arj85ww8ohsfxgxyog2ewbl91",
      "triggerId": "platform.connector.status",
      "startedAt": 1791845322000,
      "resolvedAt": null,
      "deviceId": "18e9cuixrkx8t7ty78tsi8xmn",
      "severity": 3,
      "showOnDashboard": true,
      "scopeType": "GLOBAL",
      "subject": "CC connector default-ssl is offline more than 60 seconds",
      "message": "CC connector default-ssl is offline for Edge device ",
      "messageResolved": "CC connector default-ssl is back online for Edge device ",
      "hostname": null,
      "allVariables": {
        "$devicename": "null",
        "$target_value": "null",
        "$value": "0e+00",
        "$hostname": "f15b6b50aa43",
        "$alert_delay": "60",
        "$severity": "warning"
      },
      "triggerName": "Connector Status",
      "triggerDescription": "Identify unplanned disconnections"
    }
  ]
}
```

---

## Get Platform Rule Projects

**GET** `{{LEM_adminURL}}/admin/v1/platform-rule/{{platform_rule_key}}/projects`

> **New in 2.35.**

# Get Platform Rule Projects

Returns which projects a platform rule applies to.
## Endpoint

```http
GET {{LEM_adminURL}}/admin/v1/platform-rule/{{platform_rule_key}}/projects
```
## Authentication

API key in a request header (case sensitive). The value is the LEM admin API token.

| URL prefix | Auth header |
|---|---|
| `{{LEM_URL}}/api/v1/...` (main fleet API) | `X-AuthToken: <token>` |
| `{{LEM_adminURL}}/admin/v1/...` (admin console, port 8446) | `X-AuthToken: <token>` |
| `{{LEM_URL}}/mpcs/...` (Marketplace Catalog) | `Authorization: <token>` (3.0.x also accepts `X-AuthToken`) |
## Parameters

| Parameter | In | Notes |
|---|---|---|
| `ruleKey` | path | **Required.** Rule key from `Get Platform Rule Catalog`, e.g. `platform.devicehub.device.offline`. |

## Response

```json
{ "ruleKey": "platform.devicehub.device.offline", "appliesToAllProjects": true, "projectIds": [] }
```

## Errors

| HTTP status         | When it happens                                                                |
|---------------------|--------------------------------------------------------------------------------|
| `400 Bad Request`   | Missing or malformed query/body parameter.                                     |
| `401 Unauthorized`  | Missing or invalid credentials.                                                |
| `403 Forbidden`     | Token lacks permission for this operation.                                     |
| `404 Not Found`     | Target entity does not exist.                                                  |
| `5xx`               | Service is unreachable, restarting, or internally errored. Inspect device logs under `System > Support`. |

> **TLS note**: edge devices use a self-signed certificate by default. Either install the device CA in your client trust store or disable certificate verification when calling this endpoint directly.


### Response

**Status**: 200 OK

```json
{
  "ruleKey": "platform.connector.status",
  "appliesToAllProjects": true,
  "projectIds": []
}
```

---

## Set Platform Rule Projects

**POST** `{{LEM_adminURL}}/admin/v1/platform-rule/{{platform_rule_key}}/projects`

> **New in 2.35.**

# Set Platform Rule Projects

Replaces the list of projects a platform rule applies to. The list is replaced, not merged.
## Endpoint

```http
POST {{LEM_adminURL}}/admin/v1/platform-rule/{{platform_rule_key}}/projects
```
## Authentication

API key in a request header (case sensitive). The value is the LEM admin API token.

| URL prefix | Auth header |
|---|---|
| `{{LEM_URL}}/api/v1/...` (main fleet API) | `X-AuthToken: <token>` |
| `{{LEM_adminURL}}/admin/v1/...` (admin console, port 8446) | `X-AuthToken: <token>` |
| `{{LEM_URL}}/mpcs/...` (Marketplace Catalog) | `Authorization: <token>` (3.0.x also accepts `X-AuthToken`) |
## Parameters

| Parameter | In | Notes |
|---|---|---|
| `ruleKey` | path | **Required.** Rule key from `Get Platform Rule Catalog`, e.g. `platform.devicehub.device.offline`. |

## Request body

```json
{ "projectIds": ["{{project_id}}"] }
```

## Response

`ApiResponse` `{ code, message, messageDetails }`.
## Errors

| HTTP status         | When it happens                                                                |
|---------------------|--------------------------------------------------------------------------------|
| `400 Bad Request`   | Missing or malformed query/body parameter.                                     |
| `401 Unauthorized`  | Missing or invalid credentials.                                                |
| `403 Forbidden`     | Token lacks permission for this operation.                                     |
| `404 Not Found`     | Target entity does not exist.                                                  |
| `5xx`               | Service is unreachable, restarting, or internally errored. Inspect device logs under `System > Support`. |

> **TLS note**: edge devices use a self-signed certificate by default. Either install the device CA in your client trust store or disable certificate verification when calling this endpoint directly.


### Request Body

```json
{
  "projectIds": [
    "5etr7qxq0js0rdnboccvw90h7"
  ]
}
```

---