---
title: "List alert Slack threads"
method: GET
path: "/api/alerts/{alertId}/slack-threads"
tags: ["Alerts"]
---

# List alert Slack threads

`GET /api/alerts/{alertId}/slack-threads`

## Request

- Base URL: `https://app.cotool.ai`
- URL: `https://app.cotool.ai/api/alerts/{alertId}/slack-threads`
- Auth: HTTP bearer

List the replies people posted in the alert's Slack threads, mirrored onto its timeline.

## Path parameters

- `alertId` string, required: Alert UUID or human-readable display ID

## Response `200`

Successful response

- object
  - `entries` object[], required: Every mirrored Slack thread on the alert's timeline, newest first, whatever page of the timeline it falls on
    - `id` string, uuid, required: Timeline entry identifier
    - `organizationId` string, uuid, required: Organization that owns the timeline entry
    - `alertId` string, uuid, required: Alert this entry belongs to
    - `createdAt` string, required: ISO timestamp when the entry was created
    - `actorType` 'human' | 'agent' | 'system', required: Actor class responsible for a timeline entry.
    - `actorUserId` string, uuid, nullable, required: Human actor user id, when actorType is human
    - `actorAgentId` string, uuid, nullable, required: Agent actor id, when actorType is agent
    - `actorRunId` string, uuid, nullable, required: Run responsible for this entry, stored as chats.id
    - `actorUserName` string, nullable, required: Resolved display name for a human actor, hydrated for rendering
    - `actorUserImageUrl` string, nullable, required: Resolved avatar image URL for a human actor, when one is available
    - `actorAgentName` string, nullable: Resolved display name for an agent actor or referenced assigned agent
    - `kind` 'external_event', required
    - `bodyMarkdown` string, nullable, required: Timeline body, when this entry has prose content
    - `beforeStatus` 'open' | 'in_progress' | 'escalated' | 'closed_true_positive' | 'closed_false_positive' | 'closed_true_positive_benign' | 'dismissed' | 'duplicate' | 'expired' | 'null', nullable, required: Status before a status transition
    - `afterStatus` 'open' | 'in_progress' | 'escalated' | 'closed_true_positive' | 'closed_false_positive' | 'closed_true_positive_benign' | 'dismissed' | 'duplicate' | 'expired' | 'null', nullable, required: Status after a status transition
    - `metadata` object, required: Metadata for externally mirrored alert timeline entries.
      - `slackThread` object: Replies people and apps posted in one of the alert's Slack threads, mirrored from Slack
        - `teamId` string, required
        - `channelId` string, required
        - `threadTs` string, required
        - `url` string, uri, nullable, required: Link to the thread root
        - `replies` object[], required: Replies oldest first, by Slack message timestamp
          - `messageTs` string, required
          - `userId` string, required: The author's Slack user ID, or the bot ID of an app that posted without a user
          - `userName` string
          - `text` string, required
          - `textTruncated` boolean
          - `permalink` string, uri
          - `editedAt` string, date-time: When the author last edited the reply in Slack

## Other responses

- `400`: Bad request — input validation failed or the request was malformed
- `401`: Unauthorized — missing or invalid API key / session
- `403`: Forbidden — the authenticated user lacks the required permissions
- `500`: Internal server error

## Changes

- **2026-11-05** `f5abe0add203`: 1 info
  - the `entries/items/metadata/slackThread/replies/items/userId` response's property pattern was changed from `^[UW][A-Z0-9]+$` to `^[UWB][A-Z0-9]+$` for the status `200`

[Operation history](https://skmtc.dev/cotool/apis/cotool-api/changes/api/alerts/:alertId/slack-threads/get.md)

---

[API](https://skmtc.dev/cotool/apis/cotool-api.md) - [All operations](https://skmtc.dev/cotool/apis/cotool-api/llms.txt) - [OpenAPI document](https://skmtc.dev/cotool/apis/cotool-api/revisions/f5abe0add203?raw)