---
title: "List alerts"
method: GET
path: "/api/v1/alerts"
tags: ["Alerts"]
---

# List alerts

`GET /api/v1/alerts`

## Request

- Base URL: `https://api.dmarc-examiner.com`
- URL: `https://api.dmarc-examiner.com/api/v1/alerts`
- Auth: API key in header `X-API-Key`

Returns security alerts with optional filtering and pagination.

## Query parameters

- `severity` 'info' | 'warning' | 'critical'
- `status` 'pending' | 'sent' | 'dismissed'
- `page` integer
- `limit` integer

## Response `200`

Paginated list of alerts

- object
  - `data` Alert[], required
    - `id` string, uuid, required
    - `domain_id` string, uuid, nullable: Domain the alert belongs to. Null for organization-level alerts.
    - `domain_name` string, nullable
    - `type` 'dmarc_fail' | 'new_sender' | 'volume_spike' | 'dns_change' | 'compliance_drop', required: - `dmarc_fail`: DMARC authentication failures - `new_sender`: New mail sender detected - `volume_spike`: Unusual increase in email volume - `dns_change`: DNS record changes detected - `compliance_drop`: Compliance dropped below threshold
    - `severity` 'info' | 'warning' | 'critical', required
    - `title` string, required
    - `description` string, required
    - `metadata` object, nullable: Additional context data (varies by alert type).
    - `status` 'pending' | 'sent' | 'dismissed', required: - `pending`: Alert created, not yet sent - `sent`: Notification sent to user - `dismissed`: Dismissed by user
    - `created_at` string, date-time, required
    - `sent_at` string, date-time, nullable
  - `pagination` Pagination, required
    - `total` integer, required: Total number of results.
    - `page` integer, required: Current page number.
    - `limit` integer, required: Results per page.
    - `total_pages` integer, required: Total number of pages.

## Other responses

- `400`: Request payload, body field, or query parameter is missing, malformed, outside documented bounds, or fails type/enum validation. Two body shapes can occur: - **Body validation errors** (e.g. missing `name`, wrong type) come from the controller and have the form `{"message": "..."}`. - **Query parameter errors** (e.g. `limit` out of range, `auth_failure` off-enum, `domain_id` not a UUID) flow through the API exception subscriber and add an `error: "bad_request"` machine-readable code: `{"error": "bad_request", "message": "Query parameter \"limit\" must be between 1 and 100, got 999"}`.
- `401`: Authentication failed. Two shapes are possible depending on cause: - **Invalid or revoked key** — body is `{"message": "..."}` only. - **Missing `X-API-Key` header** — body adds an `error: "unauthorized"` machine-readable code. Clients should treat both as the same outcome and read `message` for display.
- `403`: The organization's current plan does not include the feature required by this endpoint (e.g. `apiAccess`, `forensicReports`, `advancedAlerts`). Distinct from `PlanLimitExceeded` (HTTP 402), which signals a *quota* exhausted on a feature the plan does include. If a customer downgrades to Free, all `/api/v1/*` requests will start returning this response.
- `429`: Rate limit exceeded.
- `500`: Internal server error.

---

[API](https://skmtc.dev/dmarc-examiner/apis/dmarc-examiner-api.md) · [All operations](https://skmtc.dev/dmarc-examiner/apis/dmarc-examiner-api/llms.txt) · [OpenAPI document](https://skmtc.dev/dmarc-examiner/apis/dmarc-examiner-api/revisions/92f3f57969f5?raw)