---
title: "Get alert source payload"
method: GET
path: "/api/alerts/{alertId}/source-payloads/{sourcePayloadId}"
tags: ["Alerts"]
---

# Get alert source payload

`GET /api/alerts/{alertId}/source-payloads/{sourcePayloadId}`

## Request

- Base URL: `https://app.cotool.ai`
- URL: `https://app.cotool.ai/api/alerts/{alertId}/source-payloads/{sourcePayloadId}`
- Auth: HTTP bearer

Retrieve the stored raw source payload for an alert.

## Path parameters

- `alertId` string, required: Alert UUID or human-readable display ID
- `sourcePayloadId` string, uuid, required: Alert source payload UUID

## Response `200`

Successful response

- object
  - `sourcePayload` object, required
    - `id` string, uuid, required: Source payload identifier
    - `organizationId` string, uuid, required: Organization that owns the payload
    - `alertId` string, uuid, required: Alert this payload belongs to
    - `source` object, required: Filter-oriented source attribution for an alert.
      - `category` 'detection' | 'trigger' | 'hunt' | 'api' | 'agent', required: Broad alert source category. Hunt covers threat-intel exposure alerts minted by the Hunt surface; api covers alerts submitted through an API source; agent covers alerts deliberately created by an agent.
      - `name` 'cotool_detection' | 'cotool_code' | 'cotool_signal' | 'hunt' | 'hunt_v2' | 'api' | 'agent' | 'jira' | 'jira-automation' | 'slack' | 'linear' | 'cron' | 'webhook' | 'email' | 'bugcrowd' | 'hackerone' | 'zscaler' | 'darktrace' | 'seon', required: Filter-oriented alert source name. Trigger-created alerts use the trigger type.
      - `triggerType` 'jira' | 'jira-automation' | 'slack' | 'linear' | 'cron' | 'webhook' | 'email' | 'bugcrowd' | 'hackerone' | 'zscaler' | 'darktrace' | 'seon' | 'null', nullable, required: Trigger source when category is trigger
    - `externalProvider` 'jira' | 'jira-automation' | 'slack' | 'linear' | 'cron' | 'webhook' | 'email' | 'bugcrowd' | 'hackerone' | 'zscaler' | 'darktrace' | 'seon' | 'null', nullable, required: External trigger provider when the source is an external trigger
    - `originTriggerId` string, uuid, nullable, required: Trigger that produced the payload, when applicable
    - `originRunId` string, uuid, nullable, required: Run that produced the payload, when applicable
    - `contentType` 'application/json', required
    - `storageKind` 'inline_json' | 'kv', required
    - `sha256` string, required: SHA-256 digest of the JSON payload
    - `sizeBytes` integer, required
    - `payload` union, required: A JSON value (string, number, boolean, null, array, or object)
      - string
      - number
      - boolean
      - JsonValue[]
      - object
    - `detectionDefinition` string, nullable: Originating agent definition: run version when available, otherwise current definition. Context separate from the stored source payload.
    - `createdAt` string, required: ISO timestamp when the payload was created
    - `updatedAt` string, required: ISO timestamp when the payload was last updated

## Other responses

- `400`: Bad request — input validation failed or the request was malformed
- `401`: Unauthorized — missing or invalid API key / session
- `403`: Forbidden — the authenticated user lacks the required permissions
- `500`: Internal server error

---

[API](https://skmtc.dev/cotool/apis/cotool-api.md) - [All operations](https://skmtc.dev/cotool/apis/cotool-api/llms.txt) - [OpenAPI document](https://skmtc.dev/cotool/apis/cotool-api/revisions/f5abe0add203?raw)