---
title: "Get alert filter options"
method: GET
path: "/api/alerts/filter-options"
tags: ["Alerts"]
---

# Get alert filter options

`GET /api/alerts/filter-options`

## Request

- Base URL: `https://app.cotool.ai`
- URL: `https://app.cotool.ai/api/alerts/filter-options`
- Auth: HTTP bearer

Return alert filter options derived from readable alerts, including Cotool and externally extracted detections.

## Response `200`

Successful response

- object
  - `detections` object[], required: Detection filter options derived from readable alerts
    - `key` string, required: Opaque detection filter key accepted by the list alerts endpoint
    - `label` string, required: Human-readable detection name
    - `kind` 'cotool' | 'cotool_code' | 'cotool_signal' | 'external', required: Whether this is a Cotool detection, a promoted Cotool signal type, or an extracted external detection
    - `id` string, uuid, nullable, required: Cotool detection id, when applicable
    - `name` string, required: Detection name stored on alert rows
    - `count` integer, required: Number of readable alerts for this detection filter
  - `sources` object[], required: Source filter options actually present on readable alerts
    - `name` 'cotool_detection' | 'cotool_code' | 'cotool_signal' | 'hunt' | 'hunt_v2' | 'api' | 'agent' | 'jira' | 'jira-automation' | 'slack' | 'linear' | 'cron' | 'webhook' | 'email' | 'bugcrowd' | 'hackerone' | 'zscaler' | 'darktrace' | 'seon', required: Source filter key accepted by the list alerts endpoint
    - `category` 'detection' | 'trigger' | 'hunt' | 'api' | 'agent', required: Source category for the option (agent, detection, trigger, or hunt)
    - `count` integer, required: Number of readable alerts for this source

## Other responses

- `400`: Bad request — input validation failed or the request was malformed
- `401`: Unauthorized — missing or invalid API key / session
- `403`: Forbidden — the authenticated user lacks the required permissions
- `500`: Internal server error

---

[API](https://skmtc.dev/cotool/apis/cotool-api.md) - [All operations](https://skmtc.dev/cotool/apis/cotool-api/llms.txt) - [OpenAPI document](https://skmtc.dev/cotool/apis/cotool-api/revisions/f5abe0add203?raw)