---
title: "Get escalated alert notification defaults"
method: GET
path: "/api/alert-escalation-notification-defaults"
tags: ["Alerts"]
---

# Get escalated alert notification defaults

`GET /api/alert-escalation-notification-defaults`

## Request

- Base URL: `https://app.cotool.ai`
- URL: `https://app.cotool.ai/api/alert-escalation-notification-defaults`
- Auth: HTTP bearer

Get the organization-wide destinations notified when an alert moves into escalated status.

## Response `200`

Successful response

- object
  - `settings` object, required: Organization-wide notification settings for escalated alerts
    - `id` string, uuid, required: Unique identifier for the organization alert escalation notification settings
    - `organizationId` string, uuid, required: Organization that owns these settings
    - `enabled` boolean, required: Whether notifications are sent when an alert moves into escalated status
    - `destinationIds` string[], required: Destinations notified when an alert is escalated and no route matches it
    - `minSeverity` 'low' | 'medium' | 'high' | 'critical', required: Minimum alert severity eligible for escalated alert notifications; low means all severities notify
    - `destinationMinSeverities` object, required: Minimum alert severity per default destination, keyed by destination ID, on top of minSeverity
    - `routes` object[], required: Routes checked in order before the default destinations; the first enabled route that matches sends the notification
      - `id` string, uuid, required: Route ID
      - `name` string, required: Name shown in settings and wherever the route is credited
      - `enabled` boolean, required: Disabled routes are skipped
      - `conditions` union[], required: Conditions that must all match
        - union
          - object: Alerts from any of these code detections
            - `type` 'codeDetection', required
            - `codeDetectionIds` string[], required
          - object: Alerts from any of these agents: alerts an agent created with the create-alert tool, and alerts a legacy detection agent raised. Alerts created by triggers do not match
            - `type` 'agent', required
            - `agentIds` string[], required
          - object: Alerts from code detections that query any of these Cotool Logs tables
            - `type` 'logTable', required
            - `tables` object[], required
              - …
          - object: Alerts assigned to any of these response agents for triage. Escalation routes only: a triage route is chosen before any agent triages the alert
            - `type` 'triageAgent', required
            - `agentIds` string[], required
      - `destinationIds` string[], required: Destinations notified when the route matches; a route left with none is skipped
      - `destinationMinSeverities` object, required: Minimum alert severity per destination, keyed by destination ID; a destination without an entry receives every severity the escalation minimum allows
    - `createdAt` string, required: When the settings were created
    - `updatedAt` string, required: When the settings were last updated
  - `destinations` union[], required: Available output destinations for the organization
    - union
      - object
        - `id` string, uuid, required: Unique identifier for the destination
        - `organizationId` string, uuid, required: Organization that owns this destination
        - `name` string, required: Human-readable name for this destination
        - `createdAt` string, required: When the destination was created
        - `updatedAt` string, required: When the destination was last updated
        - `disabledAt` string, nullable: When the destination was disabled; nothing is delivered to a disabled destination. Null or absent when enabled.
        - `type` 'webhook', required
        - `config` object, required
          - `url` string, uri, required: The webhook URL to POST to
          - `authType` 'bearer' | 'header', required: Type of authentication: "bearer" for Authorization: Bearer <token>, "header" for custom header
          - `headerName` string: Custom header name when authType is "header" (e.g., "X-API-Key")
        - `token` string: The authentication token (only returned to authorized users)
        - `hasToken` boolean: Whether a token is configured
      - object
        - `id` string, uuid, required: Unique identifier for the destination
        - `organizationId` string, uuid, required: Organization that owns this destination
        - `name` string, required: Human-readable name for this destination
        - `createdAt` string, required: When the destination was created
        - `updatedAt` string, required: When the destination was last updated
        - `disabledAt` string, nullable: When the destination was disabled; nothing is delivered to a disabled destination. Null or absent when enabled.
        - `type` 'teams', required
        - `config` object, required
          - `url` string, uri, required: The Microsoft Teams workflow webhook URL to POST to
      - object
        - `id` string, uuid, required: Unique identifier for the destination
        - `organizationId` string, uuid, required: Organization that owns this destination
        - `name` string, required: Human-readable name for this destination
        - `createdAt` string, required: When the destination was created
        - `updatedAt` string, required: When the destination was last updated
        - `disabledAt` string, nullable: When the destination was disabled; nothing is delivered to a disabled destination. Null or absent when enabled.
        - `type` 'slack', required
        - `config` object, required
          - `channelIds` string[], required: Slack channel IDs to post messages to
          - `configurationRevision` integer: Revision of user-managed Slack delivery configuration
          - `blockedChannels` object: Channels that delivery will skip until a user updates the destination
      - object
        - `id` string, uuid, required: Unique identifier for the destination
        - `organizationId` string, uuid, required: Organization that owns this destination
        - `name` string, required: Human-readable name for this destination
        - `createdAt` string, required: When the destination was created
        - `updatedAt` string, required: When the destination was last updated
        - `disabledAt` string, nullable: When the destination was disabled; nothing is delivered to a disabled destination. Null or absent when enabled.
        - `type` 'pagerduty', required
        - `config` object, required
          - `severity` 'critical' | 'error' | 'warning' | 'info', required: Default severity level for alerts
          - `source` string: Optional source identifier (defaults to detection name)
      - object
        - `id` string, uuid, required: Unique identifier for the destination
        - `organizationId` string, uuid, required: Organization that owns this destination
        - `name` string, required: Human-readable name for this destination
        - `createdAt` string, required: When the destination was created
        - `updatedAt` string, required: When the destination was last updated
        - `disabledAt` string, nullable: When the destination was disabled; nothing is delivered to a disabled destination. Null or absent when enabled.
        - `type` 'linear', required
        - `config` object, required
          - `teamId` string, required: Linear team ID where issues should be created
          - `teamName` string: Cached team name for display purposes
          - `labelIds` string[]: Linear label IDs to apply to created issues
          - `labelNames` string[]: Cached Linear label names for display purposes
          - `workflowStateId` string: Linear workflow state ID for created issues
          - `workflowStateName` string: Cached Linear workflow state name for display purposes
      - object
        - `id` string, uuid, required: Unique identifier for the destination
        - `organizationId` string, uuid, required: Organization that owns this destination
        - `name` string, required: Human-readable name for this destination
        - `createdAt` string, required: When the destination was created
        - `updatedAt` string, required: When the destination was last updated
        - `disabledAt` string, nullable: When the destination was disabled; nothing is delivered to a disabled destination. Null or absent when enabled.
        - `type` 'tines', required
        - `config` object, required
          - `teamId` string, required: Tines team ID where cases should be created
          - `teamName` string: Cached team name for display purposes
      - object
        - `id` string, uuid, required: Unique identifier for the destination
        - `organizationId` string, uuid, required: Organization that owns this destination
        - `name` string, required: Human-readable name for this destination
        - `createdAt` string, required: When the destination was created
        - `updatedAt` string, required: When the destination was last updated
        - `disabledAt` string, nullable: When the destination was disabled; nothing is delivered to a disabled destination. Null or absent when enabled.
        - `type` 'incidentio', required
        - `config` object, required
          - `visibility` 'private' | 'public', required: Whether declared incidents are visible to everyone in incident.io ("public") or only to invited responders ("private")
          - `severityId` string, required: incident.io severity ID for declared incidents
          - `severityName` string: Cached incident.io severity name for display purposes
          - `incidentTypeId` string: incident.io incident type ID for declared incidents; incident.io applies its default when omitted
          - `incidentTypeName` string: Cached incident.io incident type name for display purposes
  - `logTableOptions` object[], required: Cotool Logs tables a route can match on
    - `source` string, required: Log ingest source id
    - `sourceDisplayName` string, required: Source name, e.g. Azure Event Hub
    - `toolId` string, required: Integration the source belongs to, for its logo
    - `stream` string, nullable, required: Declared stream of the table, for sources with several tables
    - `streamLabel` string, nullable, required: Stream name, e.g. Entra ID diagnostic logs

## Other responses

- `400`: Bad request — input validation failed or the request was malformed
- `401`: Unauthorized — missing or invalid API key / session
- `403`: Forbidden — the authenticated user lacks the required permissions
- `500`: Internal server error

---

[API](https://skmtc.dev/cotool/apis/cotool-api.md) - [All operations](https://skmtc.dev/cotool/apis/cotool-api/llms.txt) - [OpenAPI document](https://skmtc.dev/cotool/apis/cotool-api/revisions/f5abe0add203?raw)