# List Sealing Rules

**Description:** Retrieves the list of sealing rules configured for your tenant, with options to filter the results by project name and vulnerable package name.

{% hint style="info" %}
A sealing rule says, for example, "in project `my-backend-service`, replace `log4j-core 2.14.1` with `log4j-core 2.14.1+sp1`". Other rules can apply tenant-wide, or to every package in a project. Multiple rules can match the same package; broader rules (e.g. tenant-wide, or `<ANY>` package) set the default, and narrower rules act as targeted overrides.

For background on how rules are authored and managed, see [The Sealing Rules tab](/new-documentation/new-docs/protection-page/sealing-rules-tab.md).
{% endhint %}

**Path:** <https://external.sealsecurity.io/authenticated/api/v1/sealing-rules>

**Method:** GET

**Authentication:** See detailed explanation [here](/apis.md#authentication).

#### Request Parameters

This endpoint accepts the following optional query parameters to filter the results:

<table><thead><tr><th width="202.333251953125">Parameter Name</th><th width="85.370361328125">Type</th><th width="259.7777099609375">Description</th><th width="273.4444580078125">Accepted Values</th></tr></thead><tbody><tr><td><code>project_name_filter</code></td><td>string</td><td>Filter rules by project name. When omitted, returns rules for every project, including tenant-wide rules. When set to a substring, returns rules whose <code>project_name</code> contains it (case-insensitive); does not match tenant-wide rules. When set to <code>&#x3C;ANY></code>, returns only tenant-wide rules.</td><td>Any string, or <code>&#x3C;ANY></code></td></tr><tr><td><code>package_name_filter</code></td><td>string</td><td>Filter rules by vulnerable package name. Same three-way behavior as <code>project_name_filter</code>: omitted returns all, a substring filters case-insensitively, and <code>&#x3C;ANY></code> returns only rules that cover all packages.</td><td>Any string, or <code>&#x3C;ANY></code></td></tr><tr><td><code>limit</code></td><td>integer</td><td>Maximum number of sealing rules to return in a single page.</td><td>1 to 100 (default <code>50</code>)</td></tr><tr><td><code>cursor</code></td><td>string</td><td>Opaque pagination cursor returned by a previous response's <code>next_page</code>. Omit on the first request.</td><td>Any string returned by a previous call</td></tr></tbody></table>

When both filters are provided, results must satisfy both (logical AND).

{% hint style="warning" %}
Only Remote (server-side) sealing rules — those created via the Seal UI or API — are returned. Local rules defined in a project's `.seal-actions.yml` are not included.
{% endhint %}

#### Response

The API returns a paginated JSON object containing a page of sealing rules and an opaque cursor for fetching the next page.

**Response Structure:**

JSON

```json
{
  "items": [
    {
      "project_name": "string",
      "vulnerable_package_name": "string",
      "vulnerable_package_version": "string",
      "sealed_package_name": "string",
      "sealed_package_version": "string",
      "created_on": "string"
    }
  ],
  "next_page": "string | null"
}
```

**Response Fields:**

<table><thead><tr><th width="227.5185546875">Field Name</th><th width="140.1109619140625">Type</th><th>Description</th></tr></thead><tbody><tr><td><code>items</code></td><td>array of sealing rule objects</td><td>The page of sealing rules. See the table below for each object's fields.</td></tr><tr><td><code>next_page</code></td><td>string or null</td><td>Opaque cursor for the next page. Pass it back as the <code>cursor</code> query parameter to fetch the next page; <code>null</code> when there are no further pages.</td></tr></tbody></table>

The sealing rule object is composed of the following fields:

<table><thead><tr><th width="227.5185546875">Field Name</th><th width="140.1109619140625">Type</th><th>Description</th></tr></thead><tbody><tr><td><code>project_name</code></td><td>string</td><td>The Seal project the rule applies to, or <code>&#x3C;ANY></code> to apply tenant-wide.</td></tr><tr><td><code>vulnerable_package_name</code></td><td>string</td><td>The name of the vulnerable package the rule replaces, or <code>&#x3C;ANY></code> (paired with <code>vulnerable_package_version: &#x3C;ANY></code>) to match every package.</td></tr><tr><td><code>vulnerable_package_version</code></td><td>string</td><td>The version of the vulnerable package the rule replaces, or <code>&#x3C;ANY></code> (paired with <code>vulnerable_package_name: &#x3C;ANY></code>) to match every version.</td></tr><tr><td><code>sealed_package_name</code></td><td>string</td><td>The name of the sealed package that replaces the vulnerable one, or <code>&#x3C;ANY></code> when <code>vulnerable_package_name</code> is also <code>&#x3C;ANY></code>.</td></tr><tr><td><code>sealed_package_version</code></td><td>string</td><td>One of: a specific sealed version string (pinned), <code>&#x3C;SAFEST></code> (resolves to the safest version at apply-time), or <code>&#x3C;ORIGIN></code> (do not seal, keep the origin version).</td></tr><tr><td><code>created_on</code></td><td>string</td><td>The date and time (ISO 8601 format, UTC) when the rule was created.</td></tr></tbody></table>

**Sentinel values:**

The response uses three reserved sentinel strings to express values that a normal package, project, or version name cannot. Each sentinel is enclosed in angle brackets.

<table><thead><tr><th width="120">Sentinel</th><th width="280">Used in fields</th><th>Description</th></tr></thead><tbody><tr><td><code>&#x3C;ANY></code></td><td><code>project_name</code>, <code>vulnerable_package_name</code>, <code>vulnerable_package_version</code>, <code>sealed_package_name</code></td><td>Wildcard. The rule matches any value for that field. <code>vulnerable_package_name</code>, <code>vulnerable_package_version</code>, and <code>sealed_package_name</code> are paired: when one is <code>&#x3C;ANY></code>, all three are.</td></tr><tr><td><code>&#x3C;SAFEST></code></td><td><code>sealed_package_version</code></td><td>Un-pinned. Resolves at apply-time to the safest available version of the matched package.</td></tr><tr><td><code>&#x3C;ORIGIN></code></td><td><code>sealed_package_version</code></td><td>For this specific origin version, leave it as-is. Useful as a narrow exception that overrides a broader rule. <code>&#x3C;ORIGIN></code> only applies to rules that target a concrete vulnerable version; it cannot pair with <code>vulnerable_package_version: &#x3C;ANY></code>.</td></tr></tbody></table>

#### Example Requests and Responses

**1. List the first page of sealing rules:**

To retrieve every rule, follow `next_page` until it is `null`.

**Request (cURL):**

Bash

```bash
curl -X GET \
  'https://external.sealsecurity.io/authenticated/api/v1/sealing-rules' \
  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN'
```

**Example Response (Truncated):**

JSON

```json
{
  "items": [
    {
      "project_name": "my-backend-service",
      "vulnerable_package_name": "log4j-core",
      "vulnerable_package_version": "2.14.1",
      "sealed_package_name": "log4j-core",
      "sealed_package_version": "2.14.1+sp1",
      "created_on": "2026-04-22T09:14:08Z"
    },
    {
      "project_name": "<ANY>",
      "vulnerable_package_name": "lodash",
      "vulnerable_package_version": "4.17.20",
      "sealed_package_name": "lodash",
      "sealed_package_version": "<SAFEST>",
      "created_on": "2026-04-18T16:02:51Z"
    },
    {
      "project_name": "my-backend-service",
      "vulnerable_package_name": "<ANY>",
      "vulnerable_package_version": "<ANY>",
      "sealed_package_name": "<ANY>",
      "sealed_package_version": "<SAFEST>",
      "created_on": "2026-04-10T11:30:00Z"
    },
    {
      "project_name": "my-backend-service",
      "vulnerable_package_name": "requests",
      "vulnerable_package_version": "2.28.1",
      "sealed_package_name": "requests",
      "sealed_package_version": "<ORIGIN>",
      "created_on": "2026-04-05T08:47:23Z"
    }
  ],
  "next_page": "eyJsYXN0X2tleSI6ICJydWxlLTEyMyJ9"
}
```

**2. Filter rules by project name:**

**Request (cURL):**

Bash

```bash
curl -X GET \
  'https://external.sealsecurity.io/authenticated/api/v1/sealing-rules?project_name_filter=backend' \
  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN'
```

**Example Response:**

JSON

```json
{
  "items": [
    {
      "project_name": "my-backend-service",
      "vulnerable_package_name": "log4j-core",
      "vulnerable_package_version": "2.14.1",
      "sealed_package_name": "log4j-core",
      "sealed_package_version": "2.14.1+sp1",
      "created_on": "2026-04-22T09:14:08Z"
    },
    {
      "project_name": "my-backend-service",
      "vulnerable_package_name": "<ANY>",
      "vulnerable_package_version": "<ANY>",
      "sealed_package_name": "<ANY>",
      "sealed_package_version": "<SAFEST>",
      "created_on": "2026-04-10T11:30:00Z"
    }
  ],
  "next_page": null
}
```

**3. Get only tenant-wide rules (those that apply to every project):**

**Request (cURL):**

Bash

```bash
curl -X GET \
  'https://external.sealsecurity.io/authenticated/api/v1/sealing-rules?project_name_filter=%3CANY%3E' \
  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN'
```

**Example Response:**

JSON

```json
{
  "items": [
    {
      "project_name": "<ANY>",
      "vulnerable_package_name": "lodash",
      "vulnerable_package_version": "4.17.20",
      "sealed_package_name": "lodash",
      "sealed_package_version": "<SAFEST>",
      "created_on": "2026-04-18T16:02:51Z"
    }
  ],
  "next_page": null
}
```

**4. Filter by package name and paginate:**

**Request (cURL):**

Bash

```bash
curl -X GET \
  'https://external.sealsecurity.io/authenticated/api/v1/sealing-rules?package_name_filter=log4j&limit=25' \
  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN'
```

**Example Response (first page, truncated):**

JSON

```json
{
  "items": [
    {
      "project_name": "my-backend-service",
      "vulnerable_package_name": "log4j-core",
      "vulnerable_package_version": "2.14.1",
      "sealed_package_name": "log4j-core",
      "sealed_package_version": "2.14.1+sp1",
      "created_on": "2026-04-22T09:14:08Z"
    }
  ],
  "next_page": "eyJsYXN0X2tleSI6ICJydWxlLTEyMyJ9"
}
```

To fetch the next page, pass the previous response's `next_page` value as the `cursor` query parameter:

Bash

```bash
curl -X GET \
  'https://external.sealsecurity.io/authenticated/api/v1/sealing-rules?package_name_filter=log4j&limit=25&cursor=eyJsYXN0X2tleSI6ICJydWxlLTEyMyJ9' \
  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN'
```


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.sealsecurity.io/apis/list-sealing-rules.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.