---
title: "Replace alert triage routes"
method: PUT
path: "/api/alert-triage-routes"
tags: ["Alerts"]
---

# Replace alert triage routes

`PUT /api/alert-triage-routes`

## Request

- Base URL: `https://app.cotool.ai`
- URL: `https://app.cotool.ai/api/alert-triage-routes`
- Auth: HTTP bearer

Replace the ordered routes that choose which agent triages a new alert, and optionally the default agent for alerts no route matches, in one change. Routes are checked top to bottom; the first enabled route whose conditions all match wins. Returns 400 when the routes and default would send alerts between agents in a loop.

## Request body

- object
  - `routes` object[], required: Routes in the order they are checked: at most 50, or as many as are saved when more are
    - `id` string, uuid: ID of a saved route to keep; omitted for a new route
    - `name` string, required: Name shown in settings and wherever the route is credited
    - `enabled` boolean, required: Disabled routes are skipped
    - `conditions` union[], required: Conditions that must all match
      - union
        - object: Alerts from any of these code detections
          - `type` 'codeDetection', required
          - `codeDetectionIds` string[], required
        - object: Alerts from any of these agents: alerts an agent created with the create-alert tool, and alerts a legacy detection agent raised. Alerts created by triggers do not match
          - `type` 'agent', required
          - `agentIds` string[], required
        - object: Alerts from code detections that query any of these Cotool Logs tables
          - `type` 'logTable', required
          - `tables` object[], required
            - `source` string, required: Log ingest source id, e.g. okta or azure_event_hub
            - `stream` string: Declared stream of one of the source's tables, e.g. entra_logs; omitted means every table of the source
    - `action` 'triage' | 'leave_unassigned', required: triage starts the route agent on matching alerts; leave_unassigned leaves them open for a person
    - `responseAgentId` string, uuid, nullable, required: Agent that triages matching alerts; required for triage, null for leave_unassigned
  - `defaultResponseAgentId` string, uuid, nullable: Default agent for alerts no route matches, saved with the routes; null leaves them unassigned, omitted keeps the saved default

## Response `200`

Successful response

- object
  - `routes` object[], required: Routes in the order they are checked
    - `id` string, uuid, required: Route ID
    - `name` string, required: Name shown in settings and wherever the route is credited
    - `enabled` boolean, required: Disabled routes are skipped
    - `conditions` union[], required: Conditions that must all match
      - union
        - object: Alerts from any of these code detections
          - `type` 'codeDetection', required
          - `codeDetectionIds` string[], required
        - object: Alerts from any of these agents: alerts an agent created with the create-alert tool, and alerts a legacy detection agent raised. Alerts created by triggers do not match
          - `type` 'agent', required
          - `agentIds` string[], required
        - object: Alerts from code detections that query any of these Cotool Logs tables
          - `type` 'logTable', required
          - `tables` object[], required
            - `source` string, required: Log ingest source id, e.g. okta or azure_event_hub
            - `stream` string: Declared stream of one of the source's tables, e.g. entra_logs; omitted means every table of the source
    - `action` 'triage' | 'leave_unassigned', required: triage starts the route agent on matching alerts; leave_unassigned leaves them open for a person
    - `responseAgentId` string, uuid, nullable, required: Agent that triages matching alerts when action is triage; null for leave_unassigned
    - `responseAgentName` string, nullable, required: Name of the route agent, or null when it was deleted or can no longer triage alerts; such a route is skipped
  - `defaultSettings` object, required: Organization default agent for alerts no route matches
    - `organizationId` string, uuid, required: Organization that owns these alert routing defaults
    - `defaultResponseAgentId` string, uuid, nullable, required: Default agent for alerts without an explicit route
    - `defaultResponseAgentName` string, nullable, required: Display name for the configured default alert agent
    - `createdAt` string, required: ISO timestamp when the organization row was created
    - `updatedAt` string, required: ISO timestamp when the routing default was last updated
  - `huntAlertRouting` object, required: Agent that triages new Hunt Alerts, which skip the routes and the default
    - `responseAgentId` string, uuid, nullable, required: Response agent that triages new Hunt Alerts, or null to leave them unassigned
    - `responseAgentName` string, nullable, required: Display name for the Hunt Alert response agent
  - `responseAgents` object[], required: Agents a route can send alerts to
    - `id` string, uuid, required: Response agent identifier
    - `name` string, required: Response agent display name
  - `logTableOptions` object[], required: Cotool Logs tables a logTable condition can name
    - `source` string, required: Log ingest source id
    - `sourceDisplayName` string, required: Source name, e.g. Azure Event Hub
    - `toolId` string, required: Integration the source belongs to, for its logo
    - `stream` string, nullable, required: Declared stream of the table, for sources with several tables
    - `streamLabel` string, nullable, required: Stream name, e.g. Entra ID diagnostic logs

## Other responses

- `400`: Bad request — input validation failed or the request was malformed
- `401`: Unauthorized — missing or invalid API key / session
- `403`: Forbidden — the authenticated user lacks the required permissions
- `500`: Internal server error

---

[API](https://skmtc.dev/cotool/apis/cotool-api.md) - [All operations](https://skmtc.dev/cotool/apis/cotool-api/llms.txt) - [OpenAPI document](https://skmtc.dev/cotool/apis/cotool-api/revisions/f5abe0add203?raw)