Test rules on history

In the dashboard

Open Rules, apply your edits to the draft, select 7 or 30 days, then choose Test on history. The test uses unsaved rules. It does not save, enable, meter or audit them, and it does not change past events. The result shows a decision matrix, first-match counts per rule, and up to 20 changed event references, newest first. Select a reference to find that event.

Portal API

Use an owner session and a same-origin request. The public demo also accepts read-only simulations without signing in. Site secrets do not authenticate this portal endpoint.

POST /api/sites/:key/rules/simulate
Content-Type: application/json

{
  "rules": [{"id":"country-limit","name":"Limit US","enabled":true,
    "when":[{"field":"country","op":"in","value":["US"]}],"then":"limit"}],
  "range": "7d"
}

{
  "scanned": 12, "truncated": false, "changed": 3,
  "matrix": [{"from":"allow","to":"allow","count":9},
             {"from":"allow","to":"limit","count":3}],
  "byRule": [{"id":"country-limit","name":"Limit US","matches":3}],
  "samples": [{"ref":"ev_2s","ts":1792713600000,
               "from":"allow","to":"limit","rule":"Limit US"}],
  "missingFields": {"emailDomain":8}
}

range is required: 7d or 30d. Rules use the same validation as saving rules. The first enabled matching rule wins; disabled rules are included in counts with zero matches. A match counts even when its decision stays the same. Matrix cells include unchanged decisions; samples include only changes.

History limits

The newest 50,000 verify events in the range are scanned; truncated reports when older events were omitted. Collect events and other sites are excluded. Signals come from the stored verdict, score, reason IDs, country, ASN, action, browser family, verified agent name and email domain. Past rule reasons are removed before evaluation.

The baseline is the effective decision before customer rules, which is not always the final decision originally returned. New events preserve this baseline, including login protection. Observe-mode events use the enforcement decision rather than the observed allow. Older events without rule effects use wouldDecide ?? decision. For older rule-affected events, the baseline is reconstructed from verdict and abuse reasons using the site's current mode and agent policy; changes to those settings and historical agent or login decisions can make that reconstruction approximate.

Email domains and verified agent names are stored for new verify events only. No full email address is stored for simulation. missingFields.emailDomain counts unavailable domains, including verifies without an account email. Missing fields follow live rule semantics: in does not match; not_in does. An unavailable agent cannot match an agent rule. Backtesting cannot predict future traffic or recover signals that were never recorded.