ArchiveRule (V2) parity mapping

Supported in:

This guide details the request and response mapping specifications and property parity analysis for migrating from the legacy Backstory Rules Engine V2 API (ArchiveRule) to the modern Chronicle API (UpdateRuleDeployment).

Protocol and mapping overview

Feature Legacy API (ArchiveRule V2) Modern Chronicle API (UpdateRuleDeployment)
HTTP method POST PATCH
Permissions Partner token or legacy API keys chronicle.googleapis.com/ruleDeployments.update

Request payload field-by-field parity

The legacy backstory API implemented archiving as a dedicated POST RPC endpoint. The modern Chronicle API models archiving as a PATCH modification of the archived boolean attribute on RuleDeployment.

Legacy field (ArchiveRuleRequest) Modern field (UpdateRuleDeploymentRequest / RuleDeployment) Field type Parity & migration notes
version_id rule_deployment.name (in HTTP path) string Google Cloud scoping / resource unification: Legacy passed {rule_id} (or {rule_id}@{version_ts}) in version_id. Modern archiving targets the Rule's deployment path (excluding revisions): projects/{project}/locations/{location}/instances/{instance}/rules/{rule_id}/deployment.
— rule_deployment.archived bool Target attribute mapping: To archive a rule, set archived = true. To unarchive a rule (migrating from UnarchiveRule), set archived = false.
— update_mask FieldMask Required mask: Include archived in JSON updateMask.

[!CAUTION] Ensure that enabled = false (rule deployment is disabled) before setting archived = true, as active rules cannot be archived.

Response payload field-by-field parity

In legacy backstory, ArchiveRule returned an empty response. In the modern API, UpdateRuleDeployment returns the modified deployment state.

Legacy field (Empty response) Modern field (RuleDeployment response) Field type Parity & migration notes
google.protobuf.Empty name string Canonical resource path name: projects/{project}/locations/{location}/instances/{instance}/rules/{rule_id}/deployment.
— archived bool Returns true confirming rule archiving.
— archive_time Timestamp Populated timestamp indicating when archiving was applied. Rename to archiveTime in JSON.
— enabled, alerting, or run_frequency bool or enum Returns other deployment properties (where enabled = false and alerting = false are automatically applied upon successful archiving).

Key differences

  • Google Cloud project scoping integration:
    • Scoped natively under parent project instance folder bindings (rule_deployment.name path parameter).
  • Stateful attributes (archived):
    • Rather than launching custom POST endpoints :archive or :unarchive, archiving is parameterized as a boolean flag archived = true inside the sub-resource RuleDeployment.
  • Execution dependencies:
    • The modern API enforces validation rules: attempting to archive an active rule (enabled = true) fails. The client must disable rule execution before submitting the archiving request.
  • IAM permissions:
    • Request validation maps to standard Cloud IAM permission check (chronicle.googleapis.com/ruleDeployments.update).