--- title: "Get alert routing overview" method: GET path: "/api/alert-routing" tags: ["Alerts"] --- # Get alert routing overview `GET /api/alert-routing` ## Request - Base URL: `https://app.cotool.ai` - URL: `https://app.cotool.ai/api/alert-routing` - Auth: HTTP bearer Return detection alert routing defaults, per-detection effective routing, alert producers, and response-agent handling summary. ## Response `200` Successful response - object - `defaultSettings` object, required - `organizationId` string, uuid, required: Organization that owns these alert routing defaults - `defaultResponseAgentId` string, uuid, nullable, required: Default agent for alerts without an explicit route - `defaultResponseAgentName` string, nullable, required: Display name for the configured default alert agent - `createdAt` string, required: ISO timestamp when the organization row was created - `updatedAt` string, required: ISO timestamp when the routing default was last updated - `responseAgents` object[], required - `id` string, uuid, required: Response agent identifier - `name` string, required: Response agent display name - `detections` object[], required - `detectionAgentId` string, uuid, required: Detection agent identifier - `detectionAgentName` string, required: Detection agent name - `isAutonomousHunt` boolean, required: True for the built-in Autonomous Hunt orchestrator, which has no navigable detection detail page for non-admins - `override` object, nullable, required: Deprecated: always null. Per-detection overrides were replaced by triage routes; see effective for where alerts go - `id` string, uuid, required: Detection alert routing override id - `detectionAgentId` string, uuid, required: Detection agent this override applies to - `organizationId` string, uuid, required: Organization that owns this override - `responseAgentId` string, uuid, nullable, required: Response agent override, or null to leave alerts unassigned - `responseAgentName` string, nullable, required: Display name for the override response agent - `createdAt` string, required: ISO timestamp when the override was created - `updatedAt` string, required: ISO timestamp when the override was last updated - `effective` object, required: Effective alert routing for this detection - `detectionAgentId` string, uuid, required: Detection agent this effective routing applies to - `responseAgentId` string, uuid, nullable, required: Response agent that will handle new alerts, if configured - `responseAgentName` string, nullable, required: Display name for the effective response agent - `source` 'triage_route' | 'organization_default', required: Whether the effective routing comes from a triage route or the organization default - `routeId` string, uuid, nullable, required: Triage route that matched, when source is triage_route - `routeName` string, nullable, required: Name of the triage route that matched - `inheritedDefaultResponseAgentId` string, uuid, nullable, required: Organization default response agent id used when no route matches - `inheritedDefaultResponseAgentName` string, nullable, required: Organization default response agent name used when no route matches - `alertCount30d` integer, required: Detection-created alert count over the last 30 days - `runCount30d` integer: Runs of this detection agent over the last 30 days - `openUnassignedCount` integer, required: Open unassigned alerts for this detection - `agentSources` object[] - `agentId` string, uuid, required: Alert-producing agent identifier - `agentName` string, required: Alert-producing agent name - `targetAgentId` string, uuid, nullable, required: Agent that will handle new alerts, or null when unassigned - `routeId` string, uuid, nullable: Triage route that sends this agent's alerts, or null when they go to the organization default - `routeName` string, nullable: Name of the triage route that sends this agent's alerts - `alertCount30d` integer, required: Agent-created alert count over the last 30 days - `runCount30d` integer: Runs of this agent over the last 30 days - `openUnassignedCount` integer, required: Open unassigned alerts created by this agent - `huntAlerts` object: Hunt Alert routing and recent volume; omitted on older payloads - `responseAgentId` string, uuid, nullable, required: Response agent that triages new Hunt Alerts, or null to leave them unassigned - `responseAgentName` string, nullable, required: Display name for the Hunt Alert response agent - `alertCount30d` integer, required: Hunt Alerts created over the last 30 days - `openUnassignedCount` integer, required: Active Hunt Alerts with no assigned agent - `triggers` object[], required - `triggerId` string, uuid, required: Trigger identifier - `triggerName` string, required: Trigger name - `triggerSource` 'jira' | 'jira-automation' | 'slack' | 'linear' | 'cron' | 'webhook' | 'email' | 'bugcrowd' | 'hackerone' | 'zscaler' | 'darktrace' | 'seon', required: Trigger source - `sourceLogoToolType` string, nullable, required: Tool logo key used to brand this alert source, or null when unset - `responseAgentId` string, uuid, required: Owning response agent id - `responseAgentName` string, required: Owning response agent name - `createAlert` boolean, required: Deprecated compatibility field; true when eventMode is alert_source - `eventMode` 'direct' | 'alert_source': Direct agent trigger or explicit alert source - `alertCount30d` integer, required: Trigger-created alert count over the last 30 days - `runCount30d` integer: Runs started by this trigger or alert source over the last 30 days - `enabled` boolean: False when the trigger is turned off; omitted on older payloads, treated as enabled - `isSyncManaged` boolean: True when the owning agent is GitOps-managed, so the trigger can only change in its source repository - `responseAgentSummaries` object[], required - `responseAgentId` string, uuid, required: Response agent identifier - `responseAgentName` string, required: Response agent name - `activeAssignedAlertCount` integer, required: Active alerts currently assigned to this response agent - `alertCount30d` integer, required: Alerts assigned to this response agent over the last 30 days - `lastTriageRunAt` string, nullable, required: ISO timestamp of the most recent triage run for this agent - `sourceNames` string[], required: Alert source names recently handled by this response agent - `isLegacyDetection` boolean: Migrated legacy customer detection (stored agentType detection); its triggers always run direct during the compatibility window - `subAgents` object[]: Agents this agent can invoke as sub-agents via its agent tools - `agentId` string, uuid, required: Sub-agent identifier - `agentName` string, required: Sub-agent display name - `runCount30d` integer, required: Runs delegated to this sub-agent by the parent agent over the last 30 days ## Other responses - `400`: Bad request — input validation failed or the request was malformed - `401`: Unauthorized — missing or invalid API key / session - `403`: Forbidden — the authenticated user lacks the required permissions - `500`: Internal server error --- [API](https://skmtc.dev/cotool/apis/cotool-api.md) - [All operations](https://skmtc.dev/cotool/apis/cotool-api/llms.txt) - [OpenAPI document](https://skmtc.dev/cotool/apis/cotool-api/revisions/f5abe0add203?raw)