> For the complete documentation index, see [llms.txt](https://docs.sealsecurity.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.sealsecurity.io/legacy-documentation/apis/list-sealing-rules.md).

# List Sealing Rules

**Description:** Retrieves the list of sealing rules configured for your tenant, with options to filter the results by project name and vulnerable package name.

{% hint style="info" %}
A sealing rule says, for example, "in project `my-backend-service`, replace `log4j-core 2.14.1` with `log4j-core 2.14.1+sp1`". Other rules can apply tenant-wide, or to every package in a project. Multiple rules can match the same package; broader rules (e.g. tenant-wide, or `<ANY>` package) set the default, and narrower rules act as targeted overrides.

For background on how rules are authored and managed, see [The Sealing Rules tab](/discovering/protection-page/sealing-rules-tab.md).
{% endhint %}

**Path:** <https://external.sealsecurity.io/authenticated/api/v1/sealing-rules>

**Method:** GET

**Authentication:** See detailed explanation [here](/legacy-documentation/apis.md#authentication).

#### Request Parameters

This endpoint accepts the following optional query parameters to filter the results:

<table><thead><tr><th width="202.333251953125">Parameter Name</th><th width="85.370361328125">Type</th><th width="259.7777099609375">Description</th><th width="273.4444580078125">Accepted Values</th></tr></thead><tbody><tr><td><code>project_name_filter</code></td><td>string</td><td>Filter rules by project name. When omitted, returns rules for every project, including tenant-wide rules. When set to a substring, returns rules whose <code>project_name</code> contains it (case-insensitive); does not match tenant-wide rules. When set to <code>&#x3C;ANY></code>, returns only tenant-wide rules.</td><td>Any string, or <code>&#x3C;ANY></code></td></tr><tr><td><code>package_name_filter</code></td><td>string</td><td>Filter rules by vulnerable package name. Same three-way behavior as <code>project_name_filter</code>: omitted returns all, a substring filters case-insensitively, and <code>&#x3C;ANY></code> returns only rules that cover all packages.</td><td>Any string, or <code>&#x3C;ANY></code></td></tr><tr><td><code>limit</code></td><td>integer</td><td>Maximum number of sealing rules to return in a single page.</td><td>1 to 100 (default <code>50</code>)</td></tr><tr><td><code>cursor</code></td><td>string</td><td>Opaque pagination cursor returned by a previous response's <code>next_page</code>. Omit on the first request.</td><td>Any string returned by a previous call</td></tr></tbody></table>

When both filters are provided, results must satisfy both (logical AND).

{% hint style="warning" %}
Only Remote (server-side) sealing rules — those created via the Seal UI or API — are returned. Local rules defined in a project's `.seal-actions.yml` are not included.
{% endhint %}

#### Response

The API returns a paginated JSON object containing a page of sealing rules and an opaque cursor for fetching the next page.

**Response Structure:**

JSON

```json
{
  "items": [
    {
      "project_name": "string",
      "vulnerable_package_name": "string",
      "vulnerable_package_version": "string",
      "sealed_package_name": "string",
      "sealed_package_version": "string",
      "created_on": "string"
    }
  ],
  "next_page": "string | null"
}
```

**Response Fields:**

<table><thead><tr><th width="227.5185546875">Field Name</th><th width="140.1109619140625">Type</th><th>Description</th></tr></thead><tbody><tr><td><code>items</code></td><td>array of sealing rule objects</td><td>The page of sealing rules. See the table below for each object's fields.</td></tr><tr><td><code>next_page</code></td><td>string or null</td><td>Opaque cursor for the next page. Pass it back as the <code>cursor</code> query parameter to fetch the next page; <code>null</code> when there are no further pages.</td></tr></tbody></table>

The sealing rule object is composed of the following fields:

<table><thead><tr><th width="227.5185546875">Field Name</th><th width="140.1109619140625">Type</th><th>Description</th></tr></thead><tbody><tr><td><code>project_name</code></td><td>string</td><td>The Seal project the rule applies to, or <code>&#x3C;ANY></code> to apply tenant-wide.</td></tr><tr><td><code>vulnerable_package_name</code></td><td>string</td><td>The name of the vulnerable package the rule replaces, or <code>&#x3C;ANY></code> (paired with <code>vulnerable_package_version: &#x3C;ANY></code>) to match every package.</td></tr><tr><td><code>vulnerable_package_version</code></td><td>string</td><td>The version of the vulnerable package the rule replaces, or <code>&#x3C;ANY></code> (paired with <code>vulnerable_package_name: &#x3C;ANY></code>) to match every version.</td></tr><tr><td><code>sealed_package_name</code></td><td>string</td><td>The name of the sealed package that replaces the vulnerable one, or <code>&#x3C;ANY></code> when <code>vulnerable_package_name</code> is also <code>&#x3C;ANY></code>.</td></tr><tr><td><code>sealed_package_version</code></td><td>string</td><td>One of: a specific sealed version string (pinned), <code>&#x3C;SAFEST></code> (resolves to the safest version at apply-time), or <code>&#x3C;ORIGIN></code> (do not seal, keep the origin version).</td></tr><tr><td><code>created_on</code></td><td>string</td><td>The date and time (ISO 8601 format, UTC) when the rule was created.</td></tr></tbody></table>

**Sentinel values:**

The response uses three reserved sentinel strings to express values that a normal package, project, or version name cannot. Each sentinel is enclosed in angle brackets.

<table><thead><tr><th width="120">Sentinel</th><th width="280">Used in fields</th><th>Description</th></tr></thead><tbody><tr><td><code>&#x3C;ANY></code></td><td><code>project_name</code>, <code>vulnerable_package_name</code>, <code>vulnerable_package_version</code>, <code>sealed_package_name</code></td><td>Wildcard. The rule matches any value for that field. <code>vulnerable_package_name</code>, <code>vulnerable_package_version</code>, and <code>sealed_package_name</code> are paired: when one is <code>&#x3C;ANY></code>, all three are.</td></tr><tr><td><code>&#x3C;SAFEST></code></td><td><code>sealed_package_version</code></td><td>Un-pinned. Resolves at apply-time to the safest available version of the matched package.</td></tr><tr><td><code>&#x3C;ORIGIN></code></td><td><code>sealed_package_version</code></td><td>For this specific origin version, leave it as-is. Useful as a narrow exception that overrides a broader rule. <code>&#x3C;ORIGIN></code> only applies to rules that target a concrete vulnerable version; it cannot pair with <code>vulnerable_package_version: &#x3C;ANY></code>.</td></tr></tbody></table>

#### Example Requests and Responses

**1. List the first page of sealing rules:**

To retrieve every rule, follow `next_page` until it is `null`.

**Request (cURL):**

Bash

```bash
curl -X GET \
  'https://external.sealsecurity.io/authenticated/api/v1/sealing-rules' \
  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN'
```

**Example Response (Truncated):**

JSON

```json
{
  "items": [
    {
      "project_name": "my-backend-service",
      "vulnerable_package_name": "log4j-core",
      "vulnerable_package_version": "2.14.1",
      "sealed_package_name": "log4j-core",
      "sealed_package_version": "2.14.1+sp1",
      "created_on": "2026-04-22T09:14:08Z"
    },
    {
      "project_name": "<ANY>",
      "vulnerable_package_name": "lodash",
      "vulnerable_package_version": "4.17.20",
      "sealed_package_name": "lodash",
      "sealed_package_version": "<SAFEST>",
      "created_on": "2026-04-18T16:02:51Z"
    },
    {
      "project_name": "my-backend-service",
      "vulnerable_package_name": "<ANY>",
      "vulnerable_package_version": "<ANY>",
      "sealed_package_name": "<ANY>",
      "sealed_package_version": "<SAFEST>",
      "created_on": "2026-04-10T11:30:00Z"
    },
    {
      "project_name": "my-backend-service",
      "vulnerable_package_name": "requests",
      "vulnerable_package_version": "2.28.1",
      "sealed_package_name": "requests",
      "sealed_package_version": "<ORIGIN>",
      "created_on": "2026-04-05T08:47:23Z"
    }
  ],
  "next_page": "eyJsYXN0X2tleSI6ICJydWxlLTEyMyJ9"
}
```

**2. Filter rules by project name:**

**Request (cURL):**

Bash

```bash
curl -X GET \
  'https://external.sealsecurity.io/authenticated/api/v1/sealing-rules?project_name_filter=backend' \
  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN'
```

**Example Response:**

JSON

```json
{
  "items": [
    {
      "project_name": "my-backend-service",
      "vulnerable_package_name": "log4j-core",
      "vulnerable_package_version": "2.14.1",
      "sealed_package_name": "log4j-core",
      "sealed_package_version": "2.14.1+sp1",
      "created_on": "2026-04-22T09:14:08Z"
    },
    {
      "project_name": "my-backend-service",
      "vulnerable_package_name": "<ANY>",
      "vulnerable_package_version": "<ANY>",
      "sealed_package_name": "<ANY>",
      "sealed_package_version": "<SAFEST>",
      "created_on": "2026-04-10T11:30:00Z"
    }
  ],
  "next_page": null
}
```

**3. Get only tenant-wide rules (those that apply to every project):**

**Request (cURL):**

Bash

```bash
curl -X GET \
  'https://external.sealsecurity.io/authenticated/api/v1/sealing-rules?project_name_filter=%3CANY%3E' \
  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN'
```

**Example Response:**

JSON

```json
{
  "items": [
    {
      "project_name": "<ANY>",
      "vulnerable_package_name": "lodash",
      "vulnerable_package_version": "4.17.20",
      "sealed_package_name": "lodash",
      "sealed_package_version": "<SAFEST>",
      "created_on": "2026-04-18T16:02:51Z"
    }
  ],
  "next_page": null
}
```

**4. Filter by package name and paginate:**

**Request (cURL):**

Bash

```bash
curl -X GET \
  'https://external.sealsecurity.io/authenticated/api/v1/sealing-rules?package_name_filter=log4j&limit=25' \
  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN'
```

**Example Response (first page, truncated):**

JSON

```json
{
  "items": [
    {
      "project_name": "my-backend-service",
      "vulnerable_package_name": "log4j-core",
      "vulnerable_package_version": "2.14.1",
      "sealed_package_name": "log4j-core",
      "sealed_package_version": "2.14.1+sp1",
      "created_on": "2026-04-22T09:14:08Z"
    }
  ],
  "next_page": "eyJsYXN0X2tleSI6ICJydWxlLTEyMyJ9"
}
```

To fetch the next page, pass the previous response's `next_page` value as the `cursor` query parameter:

Bash

```bash
curl -X GET \
  'https://external.sealsecurity.io/authenticated/api/v1/sealing-rules?package_name_filter=log4j&limit=25&cursor=eyJsYXN0X2tleSI6ICJydWxlLTEyMyJ9' \
  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN'
```