---
title: "Get detection alert routing"
method: GET
path: "/api/detections/{id}/alert-routing"
tags: ["Alerts"]
---

# Get detection alert routing

`GET /api/detections/{id}/alert-routing`

## Request

- Base URL: `https://app.cotool.ai`
- URL: `https://app.cotool.ai/api/detections/{id}/alert-routing`
- Auth: HTTP bearer

Return a detection agent alert routing override and effective routing setting.

## Path parameters

- `id` string, uuid, required: Detection agent id

## Response `200`

Successful response

- object
  - `override` object, nullable, required: The triage route that acts as this detection override (see effective.source), or null
    - `id` string, uuid, required: Detection alert routing override id
    - `detectionAgentId` string, uuid, required: Detection agent this override applies to
    - `organizationId` string, uuid, required: Organization that owns this override
    - `responseAgentId` string, uuid, nullable, required: Response agent override, or null to leave alerts unassigned
    - `responseAgentName` string, nullable, required: Display name for the override response agent
    - `createdAt` string, required: ISO timestamp when the override was created
    - `updatedAt` string, required: ISO timestamp when the override was last updated
  - `effective` object, required
    - `detectionAgentId` string, uuid, required: Detection agent this effective routing applies to
    - `responseAgentId` string, uuid, nullable, required: Response agent that will handle new alerts, if configured
    - `responseAgentName` string, nullable, required: Display name for the effective response agent
    - `source` 'detection_override' | 'triage_route' | 'organization_default', required: detection_override when the matching triage route applies only to agents named in one agent condition, which includes this detection; triage_route for any other route; organization_default when no route matches
    - `routeId` string, uuid, nullable, required: Triage route that matched, when source is triage_route
    - `routeName` string, nullable, required: Name of the triage route that matched
    - `inheritedDefaultResponseAgentId` string, uuid, nullable, required: Organization default response agent id used when no route matches
    - `inheritedDefaultResponseAgentName` string, nullable, required: Organization default response agent name used when no route matches
  - `defaultSettings` object, required
    - `organizationId` string, uuid, required: Organization that owns these alert routing defaults
    - `defaultResponseAgentId` string, uuid, nullable, required: Default agent for alerts without an explicit route
    - `defaultResponseAgentName` string, nullable, required: Display name for the configured default alert agent
    - `createdAt` string, required: ISO timestamp when the organization row was created
    - `updatedAt` string, required: ISO timestamp when the routing default was last updated
  - `responseAgents` object[], required
    - `id` string, uuid, required: Response agent identifier
    - `name` string, required: Response agent display name

## Other responses

- `400`: Bad request — input validation failed or the request was malformed
- `401`: Unauthorized — missing or invalid API key / session
- `403`: Forbidden — the authenticated user lacks the required permissions
- `500`: Internal server error

---

[API](https://skmtc.dev/cotool/apis/cotool-api.md) - [All operations](https://skmtc.dev/cotool/apis/cotool-api/llms.txt) - [OpenAPI document](https://skmtc.dev/cotool/apis/cotool-api/revisions/f5abe0add203?raw)