---
title: "Get threat intel notification settings"
method: GET
path: "/api/intel/notification-settings"
tags: ["Intel"]
---

# Get threat intel notification settings

`GET /api/intel/notification-settings`

## Request

- Base URL: `https://app.cotool.ai`
- URL: `https://app.cotool.ai/api/intel/notification-settings`
- Auth: HTTP bearer

Retrieve organization-wide threat intel notification settings and available destinations.

## Response `200`

Successful response

- object
  - `settings` object, required: Organization-wide notification settings for threat intel
    - `id` string, uuid, required: Unique identifier for threat intel notification settings
    - `organizationId` string, uuid, required: Organization that owns these settings
    - `notifyAllItems` boolean, required: Whether every assessed threat should notify
    - `notifyRelevantItems` boolean, required: Whether threats relevant to the environment should notify
    - `notifyExposedItems` boolean, required: Whether exposed threats (Hunt Alert created/refreshed) should notify
    - `destinationIds` string[], required: Destinations for threat intel hunt notifications
    - `createdAt` string, required: When the settings were created
    - `updatedAt` string, required: When the settings were last updated
  - `destinations` union[], required: Available output destinations for the organization
    - union
      - object
        - `id` string, uuid, required: Unique identifier for the destination
        - `organizationId` string, uuid, required: Organization that owns this destination
        - `name` string, required: Human-readable name for this destination
        - `createdAt` string, required: When the destination was created
        - `updatedAt` string, required: When the destination was last updated
        - `disabledAt` string, nullable: When the destination was disabled; nothing is delivered to a disabled destination. Null or absent when enabled.
        - `type` 'webhook', required
        - `config` object, required
          - `url` string, uri, required: The webhook URL to POST to
          - `authType` 'bearer' | 'header', required: Type of authentication: "bearer" for Authorization: Bearer <token>, "header" for custom header
          - `headerName` string: Custom header name when authType is "header" (e.g., "X-API-Key")
        - `token` string: The authentication token (only returned to authorized users)
        - `hasToken` boolean: Whether a token is configured
      - object
        - `id` string, uuid, required: Unique identifier for the destination
        - `organizationId` string, uuid, required: Organization that owns this destination
        - `name` string, required: Human-readable name for this destination
        - `createdAt` string, required: When the destination was created
        - `updatedAt` string, required: When the destination was last updated
        - `disabledAt` string, nullable: When the destination was disabled; nothing is delivered to a disabled destination. Null or absent when enabled.
        - `type` 'teams', required
        - `config` object, required
          - `url` string, uri, required: The Microsoft Teams workflow webhook URL to POST to
      - object
        - `id` string, uuid, required: Unique identifier for the destination
        - `organizationId` string, uuid, required: Organization that owns this destination
        - `name` string, required: Human-readable name for this destination
        - `createdAt` string, required: When the destination was created
        - `updatedAt` string, required: When the destination was last updated
        - `disabledAt` string, nullable: When the destination was disabled; nothing is delivered to a disabled destination. Null or absent when enabled.
        - `type` 'slack', required
        - `config` object, required
          - `channelIds` string[], required: Slack channel IDs to post messages to
          - `configurationRevision` integer: Revision of user-managed Slack delivery configuration
          - `blockedChannels` object: Channels that delivery will skip until a user updates the destination
      - object
        - `id` string, uuid, required: Unique identifier for the destination
        - `organizationId` string, uuid, required: Organization that owns this destination
        - `name` string, required: Human-readable name for this destination
        - `createdAt` string, required: When the destination was created
        - `updatedAt` string, required: When the destination was last updated
        - `disabledAt` string, nullable: When the destination was disabled; nothing is delivered to a disabled destination. Null or absent when enabled.
        - `type` 'pagerduty', required
        - `config` object, required
          - `severity` 'critical' | 'error' | 'warning' | 'info', required: Default severity level for alerts
          - `source` string: Optional source identifier (defaults to detection name)
      - object
        - `id` string, uuid, required: Unique identifier for the destination
        - `organizationId` string, uuid, required: Organization that owns this destination
        - `name` string, required: Human-readable name for this destination
        - `createdAt` string, required: When the destination was created
        - `updatedAt` string, required: When the destination was last updated
        - `disabledAt` string, nullable: When the destination was disabled; nothing is delivered to a disabled destination. Null or absent when enabled.
        - `type` 'linear', required
        - `config` object, required
          - `teamId` string, required: Linear team ID where issues should be created
          - `teamName` string: Cached team name for display purposes
          - `labelIds` string[]: Linear label IDs to apply to created issues
          - `labelNames` string[]: Cached Linear label names for display purposes
          - `workflowStateId` string: Linear workflow state ID for created issues
          - `workflowStateName` string: Cached Linear workflow state name for display purposes
      - object
        - `id` string, uuid, required: Unique identifier for the destination
        - `organizationId` string, uuid, required: Organization that owns this destination
        - `name` string, required: Human-readable name for this destination
        - `createdAt` string, required: When the destination was created
        - `updatedAt` string, required: When the destination was last updated
        - `disabledAt` string, nullable: When the destination was disabled; nothing is delivered to a disabled destination. Null or absent when enabled.
        - `type` 'tines', required
        - `config` object, required
          - `teamId` string, required: Tines team ID where cases should be created
          - `teamName` string: Cached team name for display purposes
      - object
        - `id` string, uuid, required: Unique identifier for the destination
        - `organizationId` string, uuid, required: Organization that owns this destination
        - `name` string, required: Human-readable name for this destination
        - `createdAt` string, required: When the destination was created
        - `updatedAt` string, required: When the destination was last updated
        - `disabledAt` string, nullable: When the destination was disabled; nothing is delivered to a disabled destination. Null or absent when enabled.
        - `type` 'incidentio', required
        - `config` object, required
          - `visibility` 'private' | 'public', required: Whether declared incidents are visible to everyone in incident.io ("public") or only to invited responders ("private")
          - `severityId` string, required: incident.io severity ID for declared incidents
          - `severityName` string: Cached incident.io severity name for display purposes
          - `incidentTypeId` string: incident.io incident type ID for declared incidents; incident.io applies its default when omitted
          - `incidentTypeName` string: Cached incident.io incident type name for display purposes

## Other responses

- `400`: Bad request — input validation failed or the request was malformed
- `401`: Unauthorized — missing or invalid API key / session
- `403`: Forbidden — the authenticated user lacks the required permissions
- `500`: Internal server error

---

[API](https://skmtc.dev/cotool/apis/cotool-api.md) - [All operations](https://skmtc.dev/cotool/apis/cotool-api/llms.txt) - [OpenAPI document](https://skmtc.dev/cotool/apis/cotool-api/revisions/f5abe0add203?raw)