---
title: "Create Alert"
method: POST
path: "/api/v2/alerts"
tags: ["Alerts"]
---

# Create Alert

`POST /api/v2/alerts`

Creates a new alert

## Request body

- CreateAlertRequest — At least one of "channel" or "channels" must be provided. Sending both is allowed only when "channel" matches the first entry of "channels", so a response body can be echoed back unchanged. Responses always include both, with "channel" mirroring the first entry of "channels".
  - `dashboardId` string, nullable — Dashboard ID for tile-based alerts.
  - `tileId` string, nullable — Tile ID for tile-based alerts. Must be a line, stacked bar, or number type tile.
  - `savedSearchId` string, nullable — Saved search ID for saved_search alerts.
  - `groupBy` string, nullable — Group-by key for saved search alerts.
  - `threshold` number, required — Threshold value for triggering the alert. For between and not_between threshold types, this is the lower bound.
  - `thresholdMax` number, nullable — Upper bound for between and not_between threshold types. Required when thresholdType is between or not_between, must be >= threshold.
  - `interval` '1m' | '5m' | '15m' | '30m' | '1h' | '6h' | '12h' | '1d', required — Evaluation interval.
  - `scheduleOffsetMinutes` integer, nullable — Offset from the interval boundary in minutes. For example, 2 with a 5m interval evaluates windows at :02, :07, :12, etc. (UTC).
  - `scheduleStartAt` string, date-time, nullable — Absolute UTC start time anchor. Alert windows start from this timestamp and repeat every interval.
  - `source` 'saved_search' | 'tile' — Alert source type.
  - `thresholdType` 'above' | 'below' | 'above_exclusive' | 'below_or_equal' | 'equal' | 'not_equal' | 'between' | 'not_between', required — Threshold comparison direction.
  - `channel` AlertChannel
    - `type` 'webhook', required — Channel type.
    - `webhookId` string, required — Webhook destination ID.
  - `channels` AlertChannel[] — Notification channels to trigger when the alert fires or resolves. Between 1 and 10 channels; duplicates are rejected.
    - `type` 'webhook', required — Channel type.
    - `webhookId` string, required — Webhook destination ID.
  - `name` string, nullable — Human-friendly alert name.
  - `message` string, nullable — Alert message template.
  - `note` string, nullable — Freeform note for the alert. Supports markdown formatting.
  - `numConsecutiveWindows` integer, nullable — Fire the alert only after its condition has been met for this many consecutive evaluation windows. While the condition is met but fewer than this many consecutive windows have violated, the alert is in the PENDING state.

## Response `200`

Successfully created alert

- AlertResponseEnvelope
  - `data` AlertResponse
    - `dashboardId` string, nullable — Dashboard ID for tile-based alerts.
    - `tileId` string, nullable — Tile ID for tile-based alerts. Must be a line, stacked bar, or number type tile.
    - `savedSearchId` string, nullable — Saved search ID for saved_search alerts.
    - `groupBy` string, nullable — Group-by key for saved search alerts.
    - `threshold` number — Threshold value for triggering the alert. For between and not_between threshold types, this is the lower bound.
    - `thresholdMax` number, nullable — Upper bound for between and not_between threshold types. Required when thresholdType is between or not_between, must be >= threshold.
    - `interval` '1m' | '5m' | '15m' | '30m' | '1h' | '6h' | '12h' | '1d' — Evaluation interval.
    - `scheduleOffsetMinutes` integer, nullable — Offset from the interval boundary in minutes. For example, 2 with a 5m interval evaluates windows at :02, :07, :12, etc. (UTC).
    - `scheduleStartAt` string, date-time, nullable — Absolute UTC start time anchor. Alert windows start from this timestamp and repeat every interval.
    - `source` 'saved_search' | 'tile' — Alert source type.
    - `thresholdType` 'above' | 'below' | 'above_exclusive' | 'below_or_equal' | 'equal' | 'not_equal' | 'between' | 'not_between' — Threshold comparison direction.
    - `channel` AlertChannel
      - `type` 'webhook', required — Channel type.
      - `webhookId` string, required — Webhook destination ID.
    - `channels` AlertChannel[] — Notification channels to trigger when the alert fires or resolves. Between 1 and 10 channels; duplicates are rejected.
      - `type` 'webhook', required — Channel type.
      - `webhookId` string, required — Webhook destination ID.
    - `name` string, nullable — Human-friendly alert name.
    - `message` string, nullable — Alert message template.
    - `note` string, nullable — Freeform note for the alert. Supports markdown formatting.
    - `numConsecutiveWindows` integer, nullable — Fire the alert only after its condition has been met for this many consecutive evaluation windows. While the condition is met but fewer than this many consecutive windows have violated, the alert is in the PENDING state.
    - `id` string — Unique alert identifier.
    - `state` 'ALERT' | 'OK' | 'INSUFFICIENT_DATA' | 'DISABLED' | 'PENDING' — Current alert state.
    - `teamId` string — Team identifier.
    - `silenced` AlertSilenced — Silencing metadata.
      - `by` string, nullable — User ID who silenced the alert.
      - `at` string, date-time — Silence start timestamp.
      - `until` string, date-time — Silence end timestamp.
    - `executionErrors` AlertExecutionError[], nullable — Errors recorded during the most recent alert execution, if any.
      - `timestamp` string, date-time, required — When the error occurred.
      - `type` 'QUERY_ERROR' | 'QUERY_TIMEOUT' | 'WEBHOOK_ERROR' | 'INVALID_ALERT' | 'UNKNOWN', required — Category of error recorded during alert execution.
      - `message` string, required — Human-readable error message.
    - `createdAt` string, date-time, nullable — Creation timestamp.
    - `updatedAt` string, date-time, nullable — Last update timestamp.

## Other responses

- `401` — Unauthorized
- `403` — Forbidden
- `500` — Server error or validation failure

## Changes

- **2026-08-21** `578ecc427dd8` — 2 info
  - added the new optional request property `allOf[#/components/schemas/Alert]/channels`
  - added the optional property `data/allOf[#/components/schemas/Alert]/channels` to the response with the `200` status
- **2026-08-11** `0c6c6e744406` — 1 warning
  - added the new `QUERY_TIMEOUT` enum value to the `data/allOf[subschema #2]/executionErrors/items/type` response property for the response status `200`
- **2026-07-08** `6f4381730123` — 1 info
  - added the non-success response with the status `403`
- **2026-07-06** `e3a538a92f67` — 1 warning, 2 info
  - added the new `PENDING` enum value to the `data/allOf[subschema #2]/state` response property for the response status `200`
  - added the new optional request property `allOf[#/components/schemas/Alert]/numConsecutiveWindows`
  - added the optional property `data/allOf[#/components/schemas/Alert]/numConsecutiveWindows` to the response with the `200` status
- **2026-05-13** `b3055248af4f` — 2 info
  - added the new optional request property `allOf[#/components/schemas/Alert]/note`
  - added the optional property `data/allOf[#/components/schemas/Alert]/note` to the response with the `200` status

[Full history](https://skmtc.dev/hyperdxio/apis/hyperdx-external-api/changes/api/v2/alerts/post.md)

---

[API](https://skmtc.dev/hyperdxio/apis/hyperdx-external-api.md) · [All operations](https://skmtc.dev/hyperdxio/apis/hyperdx-external-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/hyperdxio/hyperdx-external-api/revisions/3399efdca551/schema)