---
title: "List alert feedback questions"
method: GET
path: "/api/alerts/feedback-questions"
tags: ["Alerts"]
---

# List alert feedback questions

`GET /api/alerts/feedback-questions`

## Request

- Base URL: `https://app.cotool.ai`
- URL: `https://app.cotool.ai/api/alerts/feedback-questions`
- Auth: HTTP bearer

List the questions grouped from alternative explanations on escalated alerts, ordered by how many alerts confirming one would close. Empty unless the caller can triage every alert.

## Query parameters

- `limit` integer: Maximum number of questions to return

## Response `200`

Successful response

- object
  - `questions` object[], required: Questions ordered by how many alerts an answer settles
    - `id` string, uuid, required
    - `status` 'open' | 'confirmed', required
    - `question` string, nullable, required: The yes/no question asked for the group; a yes confirms the statement. Null on questions grouped before questions were written.
    - `statement` string, required: The claim a yes confirms
    - `basis` string, required: Basis offered on the most recent escalation in the group
    - `disposition` 'false_positive' | 'true_positive_benign', required: How the alert closes when a reviewer confirms this explanation: the activity happened but is expected (benign), or the detection claim is wrong (false positive).
    - `alertCount` integer, required: Escalated alerts that offer this statement
    - `resolvedAlertCount` integer, required: Alerts a confirmation settles: the escalated alerts plus their merged duplicates
    - `detectionNames` string[], required
    - `alerts` object[], required: Alerts a confirmation closes, newest escalation first, capped per request
      - `alertId` string, uuid, required
      - `displayId` string, required: Human-readable alert identifier
      - `title` string, required
      - `severity` 'low' | 'medium' | 'high' | 'critical' | 'null', nullable, required
      - `detectionName` string, nullable, required
      - `duplicateCount` integer, required: Alerts merged into this one; they inherit its verdict
      - `explanationId` string, uuid, required: The matching alternative explanation on the latest escalation of this alert
      - `statement` string, required: The explanation as worded on this alert, which can differ from the question
      - `escalatedAt` string, date-time, required

## Other responses

- `400`: Bad request — input validation failed or the request was malformed
- `401`: Unauthorized — missing or invalid API key / session
- `403`: Forbidden — the authenticated user lacks the required permissions
- `500`: Internal server error

---

[API](https://skmtc.dev/cotool/apis/cotool-api.md) - [All operations](https://skmtc.dev/cotool/apis/cotool-api/llms.txt) - [OpenAPI document](https://skmtc.dev/cotool/apis/cotool-api/revisions/f5abe0add203?raw)