ALalloy
Investigations

Get list of Investigations

Changed on

Retrieves a filterable paginated list of investigations.

Filters are passed as a JSON-encoded q query parameter. For example: /v1/investigations?q={"createdAtFrom":"2026-08-31T04:00:00.000Z","statuses":["alert_review"]}.

get/investigations

Request

Query parameters

JSON-encoded object of investigation filters. Pass q as a single JSON object value, not as exploded key=value pairs.

Correct: /v1/investigations?q={"createdAtFrom":1737742979000}

Correct: /v1/investigations?q={"createdAtFrom":"2026-08-31T04:00:00.000Z","statuses":["alert_review"]}

Incorrect: /v1/investigations?q=createdAtFrom=1737742979

Date fields accept a Unix timestamp in milliseconds (number) or an ISO 8601 string. ISO 8601 is recommended and matches the Investigations queue URL in the dashboard.

pageNumnumber

Which page number to return. Default is 1

numRowsPerPagenumber

Limits results per page. Up to 100.

sortColumn'updated_at' | 'created_at' | 'total_alerts' | 'risk_score'
sortOrder'DESC' | 'ASC'

Response

Success

errorobject

Example response

{
  "_embedded": {
    "pagination": {
      "total_investigations": 95,
      "total_pages": 4,
      "page": 1,
      "per_page": 20
    },
    "sorting": {
      "column": "update_at",
      "order": "DESC"
    }
  },
  "investigations": [
    {
      "investigation_token": "INV-EAx2xoAsqF1ibKTQzkXV",
      "name": "Nick Armstrong's investigation",
      "total_alerts": 2,
      "type": "Fraud",
      "state": "alert_review",
      "source": "alert",
      "outcome": "Dismissed",
      "created_at": "2024-11-26T16:00:14.677Z",
      "updated_at": "2024-11-26T16:00:14.677Z",
      "closed_at": "2024-12-05T20:05:43.643Z",
      "archived_at": "2024-12-05T20:05:43.643Z",
      "_embedded": {
        "entities": {
          "P-KaKZxdSGnbxXfKXnXdyp": {
            "entity_name": "Nick Armstrong",
            "entity_type": "person",
            "entity_token": "P-KaKZxdSGnbxXfKXnXdyp",
            "risk_score": 0.7
          }
        },
        "assigned_agent": {
          "first_name": "Mike",
          "last_name": "Alloy",
          "email": "agent@email.com",
          "token": "AG-L83m6iTwcXdNg3CHndS4"
        }
      },
      "device_ids": [
        "device_vendor_identifier"
      ],
      "program_names": [
        "Program name"
      ],
      "alert_assignees": [
        "Agent name"
      ]
    }
  ]
}

Changes

  • 615aa97a5ddbRevision changes
    • breaking

      the response property // became nullable for the status

    • breaking

      the response property // became nullable for the status

    • info

      added to the response body allOf list for the response status

    • info

      removed from the response body allOf list for the response status