Expression syntax

An expression in a condition follows a lean syntax, inspired by spreadsheet formulas. It always results in true or false, and is made up of at least one variable, one operation, and one value.

$merchant_id == "XYZ"

The expression above is true when the event’s merchant_id field equals "XYZ".

The three prefixes

Every variable starts with a symbol that indicates where the value comes from and how long it lasts:

Prefix	Holds	Duration
`$field`	a field of the event	persisted with the event
`@list`	a list of values in the account	maintained by the account, across events
`%temporary`	a value computed during this run	only exists while the rule runs

Event fields (`$`)

The available variables are exactly the fields of the event type the rule belongs to; there is no fixed list. If the event type has an amount field, the rule can use $amount; a different event type will have a different set of variables.

The panel offers the available fields as you write the condition and highlights the expression as it is written. Fields starting with _ are reserved by the platform and are not available for use in expressions.

Beyond the event type’s fields, $id contains the event identifier supplied in POST /events, and can be used both in conditions and as the dimension of an analysis.

The field type determines how the value is compared:

Field type	Comparison example
Text	`$status == "approved"`
Integer	`$installments > 6`
Decimal	`$amount >= 1500.00`
Boolean	`$is_first_purchase == true`
Date and time	`$signup_at > "30 days ago"`

A field that did not come in the event is treated as empty. To test that absence, compare it with null, without quotes:

$device_fingerprint_id == null

The expression above is true when the event carried no device fingerprint. Use != for the opposite case.

Operations

Operation	Meaning
`==`	Equality
`!=`	Inequality
`>`	Greater than
`>=`	Greater than or equal
`<`	Less than
`<=`	Less than or equal
`in`	Belongs to a collection
`not in`	Does not belong to a collection
`any in`	At least one of the values belongs to a collection
`all in`	All values belong to a collection

Values

The value compared with a variable can be text, a number, or a boolean:

Text: always between double quotes, such as "XYZ". Single quotes and unquoted text are not accepted.
Number: without quotes, using a dot as the decimal separator, such as 1000 or 99.01.
Boolean: true or false, without quotes.

Since all text goes between double quotes, values such as an IP, a date, or a word used in the syntax itself (for example, in) also need the quotes to be treated as text.

Dates

Date and time fields accept relative and absolute values, always between quotes:

$signup_at > "30 days ago"
$signup_at == "2026-03-15"

The relative format is [number] [hour|day|week|month|year]s ago. The absolute format accepts a year ("2026"), a year and month ("2026-03"), or a full date ("2026-03-15"); in the first two cases, the comparison covers the whole period.

Combining expressions

Use and and or to combine expressions. and takes precedence over or: in a combination without parentheses, the parts joined by and are evaluated first. So A and B or C is equivalent to (A and B) or C.

Use parentheses to group expressions and change that precedence:

($amount > 1000 and $user_email_domain == "gmail.com") or $issuer_country != "BR"

A line break works as a space between the terms. A long combination can be spread across several lines for readability, without changing the result:

($amount > 1000 and $user_email_domain == "gmail.com")
  or $issuer_country != "BR"

`true` and `false` as an entire condition

An expression can consist of just true or false, with no variable or comparison. true is always true and keeps the condition always active; false is always false and disables the condition without removing it. It differs from comparing a boolean field with true or false, described in Values: in that case the literal is on the right of a comparison; as an entire condition, it makes up the whole expression.

Collections (`@`)

The account’s lists are available as collections, identified by the @ prefix. For example, to check whether a customer is on a quarantine list:

$user_id in @quarantined_customers

You can also write the collection directly in the expression, between brackets and with the values separated by commas:

$issuer_country not in ["BR", "AR", "CL"]

Beyond the format above, in and not in accept:

fixed text on the left, to test a known value against a collection: "BR" in @served_countries;
a field on both sides, to test whether one field’s value is contained in another’s: $user_id in $allowed_users.

Testing several values at once

When the left side is a collection written between brackets, you must state how many of the values need to belong to the collection on the right:

Operation	True when
`any in`	at least one of the values belongs
`all in`	all values belong
`not in`	none of the values belongs

["susp_59", "susp_83"] any in %ruler.triggered_cells
["BR", "AR"] all in @served_countries
["tor", "vpn"] not in @allowed_types

There is no form without a quantifier: writing ["a", "b"] in @list is an authoring error. “A and B are on the list” is ambiguous between “at least one” and “both”, and a risk condition cannot depend on which of the two readings the author had in mind. In the negative there is no ambiguity, since “A and B are not on the list” can only mean that neither one is, and so not in needs no quantifier. For the same reason, not any in and not all in are not accepted.

The collection on the right can be an account list, a set-valued temporary variable, a field, or another literal collection.

Temporary variables (`%`)

A temporary variable holds a value computed while the rule runs: an action produces it and the following conditions can read it. It is not written to the event, does not appear in the API response and is not carried over to the next event: a value that has to outlive the event must be written to a field.

Temporary variables come in two forms.

Simple values, set by a set temporary variable action:

%manual_review == "1"

Analysis results, published by a run analysis action under the result name, with attributes accessed through a dot:

Attribute	Holds	Type
`score`	score calculated by the analysis	Decimal
`score_cell`	name of the cell the score came from	Text
`triggered`	whether the analysis was triggered	Boolean
`triggered_count`	how many cells were triggered	Integer
`triggered_cells`	names of the triggered cells	Set

%bot.triggered_count >= 2

The triggered_cells attribute is a set, not a single value: it can only be used on the right of a membership operation, to test which cells were triggered.

"email_velocity" in %bot.triggered_cells
["susp_59", "susp_83"] any in %bot.triggered_cells

Comparing it with ==, or using it in any other operation, is an authoring error and the condition is not accepted.

A set can also be held in a simple temporary variable, through an action in expression mode, and it stays a set, testable in the same way.

Functions

`concat`

The concat function joins several values into a single piece of text, which can then be compared with a value. Each argument is a field of the event ($field), a temporary variable (%temporary), or fixed text, separated by commas:

concat($user_id, "-", $merchant_id) == "customer-1234-store-1234"
concat($merchant_id, "-", %bot.score_cell) == "store-1234-email_velocity"

The first expression is true when the combination of the user ID and the merchant ID, joined by a hyphen, results in "customer-1234-store-1234".

Considerations about the joined values:

Variables with no value are treated as empty text.
Numeric values are converted to text in their original form (for example, 99.01 and 0.9).
A set, such as %bot.triggered_cells, cannot go inside a concat: it can only be tested with a membership operation.

The result of concat also accepts in and not in, which makes it possible to compare the combination against a list:

concat($user_id, "-", $merchant_id) in @blocked_pairs

Authoring errors

The expression is validated the moment the condition is saved. The rule is not published while there is an error, and the panel points out the problem. The most common cases:

unknown field: the variable does not match any field of the event type bound to the rule;
incompatible type: the compared value does not make sense for the field type, such as comparing a numeric field with "approved";
unknown temporary variable: the name or the attribute is not produced by any action of the rule;
temporary variable read too early: no earlier condition produces it. Since conditions are evaluated in order, the producer must come before the reader;
unquoted text: text values need double quotes.

Each expression has a size limit. See limits and parameters.