--- title: "List alerts (optionally matching certain criteria that are specified by query parameters)." method: GET path: "/alerts" tags: ["Alerts"] --- # List alerts (optionally matching certain criteria that are specified by query parameters). `GET /alerts` **Sample URLs** * List only alerts that are either in state `PENDING` or `ACCEPTED`:
https://api.ilert.com/api/alerts?states=PENDING&states=ACCEPTED * List only alerts that belong to the alert source with ID `1243` or `1743` and where user `jd` is a responder:
https://api.ilert.com/api/alerts?sources=1243&sources=1743&responders=jd * Paginate first batch for a range of alerts (note: query parameters should be url encoded):
https://api.ilert.com/api/alerts?start-index=0&max-results=100&from=2021-03-01T21:24:56.771Z&until=2021-04-01T21:24:56.771Z * Fetch next page, assuming equal to max-results were returned:
https://api.ilert.com/api/alerts?start-index=100&max-results=100&from=2021-03-01T21:24:56.771Z&until=2021-04-01T21:24:56.771Z * Pagination should be done based on the `reportTime` field using the parameters `from` and `until` as well as `start-index`. When building a local alert state store the `id` field should be used as identifier. The `alertKey` field is not suitable for this, as it is used to group related alerts to each other. ## Query parameters - `start-index` integer - `max-results` integer - `include` string[] - `states` string[] - `sources` integer[] - `policies` integer[] - `responders` string[] - `from` string, date-time - `until` string, date-time ## Response `200` OK - Alert[] - `id` integer - `summary` string - `details` string - `reportTime` string, date-time - `resolvedOn` string, date-time - `status` 'PENDING' | 'ACCEPTED' | 'RESOLVED' - `alertSource` AlertSource - `id` integer - `teams` TeamRel[] - `id` integer - `name` string - `name` string, required - `iconUrl` string - `lightIconUrl` string - `darkIconUrl` string - `escalationPolicy` EscalationPolicy, required - `id` integer - `name` string, required - `escalationRules` EscalationRule[], required - `escalationTimeout` integer, required - `user` object — This field (type: User) is deprecated, please use 'users' instead - `id` number - `schedule` object — This field (type: Schedule) is deprecated, please use 'schedules' instead - `id` number - `team` object — This field (type: Team) is deprecated, please use 'teams' instead - `id` number - `users` UserRel[] - `id` integer, required - `firstName` string - `lastName` string - `schedules` ScheduleRel[] - `id` integer - `name` string - `type` 'STATIC' | 'RECURRING' - `teams` TeamRel[] - `id` integer - `name` string - `teams` TeamRel[] - `id` integer - `name` string - `repeating` boolean - `frequency` integer - `delayMin` integer - `routingKey` string — optional - `integrationType` 'NAGIOS' | 'ICINGA' | 'EMAIL2' | 'SMS' | 'API' | 'HEARTBEAT2' | 'PRTG' | 'PINGDOM' | 'CLOUDWATCH' | 'AWSPHD' | 'STACKDRIVER' | 'INSTANA' | 'ZABBIX' | 'SOLARWINDS' | 'PROMETHEUS' | 'NEWRELIC' | 'GRAFANA' | 'GITHUB' | 'DATADOG' | 'UPTIMEROBOT' | 'APPDYNAMICS' | 'DYNATRACE' | 'TOPDESK' | 'STATUSCAKE' | 'MONITOR' | 'TOOL' | 'CHECKMK' | 'AUTOTASK' | 'AWSBUDGET' | 'SYSDIG' | 'SERVERDENSITY' | 'ZAPIER' | 'KENTIXAM' | 'JIRA' | 'CONSUL' | 'ZAMMAD' | 'SPLUNK' | 'SERVICENOW' | 'SEARCHGUARD' | 'KUBERNETES' | 'SIGNALFX' | 'AZUREALERTS' | 'TERRAFORMCLOUD' | 'SENTRY' | 'SEMATEXT' | 'SUMOLOGIC' | 'RAYGUN' | 'MXTOOLBOX' | 'ESWATCHER' | 'AMAZONSNS' | 'KAPACITOR' | 'CORTEXXSOAR' | 'ZENDESK' | 'AUVIK' | 'SENSU' | 'NCENTRAL' | 'JUMPCLOUD' | 'SALESFORCE' | 'GUARDDUTY' | 'STATUSHUB' | 'IXON' | 'APIFORTRESS' | 'FRESHSERVICE' | 'APPSIGNAL' | 'LIGHTSTEP' | 'IBMCLOUDFUNCTIONS' | 'CROWDSTRIKE' | 'HUMIO' | 'OHDEAR' | 'MONGODBATLAS' | 'GITLAB' | 'HYPERPING' | 'PAPRISMACLOUD' | 'SAMSARA' | 'PANDORAFMS' | 'MSSCOM' | 'TWILIO' | 'CISCOMERAKI' | 'CHECKLY' | 'POSTHOG' | 'GOOGLESCC' | 'SLACK' | 'MSTEAMS' | 'UPTIMEKUMA' | 'TWILIOERRORS' | 'PARTICLE' | 'CLOUDFLARE' | 'TULIP' | 'GRAYLOG' | 'CATCHPOINT' | 'LOKI' | 'CORTEX' | 'MIMIR' | 'HALOPSA' | 'INFLUXDB' | 'CALLFLOW' | 'HALOITSM' | 'KIBANA' | 'VICTORIAMETRICS' | 'HONEYCOMB' | 'FOURME' | 'KEEP' | 'UBIDOTS' | 'HETRIXTOOLS' | 'POSTMAN' | 'CLUSTERCONTROL' | 'NETDATA' | 'AWX' | 'KAFKA' | 'MQTT' | 'RAPIDSPIKE' | 'HONEYBADGER' | 'HEALTHCHECKSIO' | 'MEZMO' | 'SERVERGUARD24' | 'CISCOTHOUSANDEYES' | 'SITE24X7' | 'ITCONDUCTOR' | 'SAPFRUN' | 'APICA' | 'DASH0' | 'ROLLBAR' | 'GATUS' | 'LIBRENMS' | 'PANTHER' | 'TEAMCITY' | 'ALIBABACLOUD' | 'FLEETDM' | 'CONNECTWISEPSA' | 'DEADMANSSNITCH' | 'FORTISOAR' | 'OPMANAGER' | 'CRONITOR' | 'DOMOTZ' | 'LIVEWATCH' | 'AZUREDEVOPS' | 'LEVELIO' | 'EKARA' | 'SYSAID' | 'PHAREIO' | 'OPSGENIE' | 'WHATAP' | 'SIGNOZ' | 'GOOGLECHAT' | 'DOTCOMMONITOR' | 'UPTIME' | 'HELPSCOUT' | 'SCIENCELOGIC' | 'PULSETIC' | 'WAZUH' | 'SEKOIA', required - `integrationKey` string - `integrationUrl` string - `autoResolutionTimeout` string, ISO-8601 - `alertGroupingWindow` string, ISO-8601 - `alertCreation` 'ONE_ALERT_PER_EMAIL' | 'ONE_ALERT_PER_EMAIL_SUBJECT' | 'ONE_PENDING_ALERT_ALLOWED' | 'ONE_OPEN_ALERT_ALLOWED' | 'OPEN_RESOLVE_ON_EXTRACTION' | 'ONE_ALERT_GROUPED_PER_WINDOW' | 'INTELLIGENT_GROUPING' - `status` 'PENDING' | 'ALL_ACCEPTED' | 'ALL_RESOLVED' | 'IN_MAINTENANCE' | 'DISABLED' - `active` boolean - `alertPriorityRule` 'HIGH' | 'LOW' | 'HIGH_DURING_SUPPORT_HOURS' | 'LOW_DURING_SUPPORT_HOURS' - `supportHours` SupportHour - `id` integer - `name` string, required - `teams` TeamRel[] - `id` integer - `name` string - `timezone` 'Europe/Berlin' | 'America/New_York' | 'America/Los_Angeles' | 'Asia/Istanbul', required - `supportDays` object, required - `MONDAY` SupportDay - `start` string, time, required - `end` string, time, required - `TUESDAY` SupportDay - `start` string, time, required - `end` string, time, required - `WEDNESDAY` SupportDay - `start` string, time, required - `end` string, time, required - `THURSDAY` SupportDay - `start` string, time, required - `end` string, time, required - `FRIDAY` SupportDay - `start` string, time, required - `end` string, time, required - `SATURDAY` SupportDay - `start` string, time, required - `end` string, time, required - `SUNDAY` SupportDay - `start` string, time, required - `end` string, time, required - `exceptions` SupportHourException[] - `name` string, required - `start` string, date, required - `end` string, date, required - `supportStatus` 'DURING' | 'OUTSIDE', required - `bidirectional` boolean - `summaryTemplate` AlertSourceTemplate - `textTemplate` string — For more information on alert source templating, please visit: https://docs.ilert.com/alerting/alert-sources#alert-template. Example:
`Hi {{ users[0].name }} there!` You can use the text template instead of elements by adding the include `textTemplate` to your request. Any version can be used for POST or PUT requests. - `elements` AlertSourceTemplateElement[] - `type` 'TEXT' | 'VAR' | 'RAW' - `val` string - `func` string - `args` AlertSourceTemplateElementArg[] - `S` string - `N` integer - `detailsTemplate` AlertSourceTemplate - `textTemplate` string — For more information on alert source templating, please visit: https://docs.ilert.com/alerting/alert-sources#alert-template. Example:
`Hi {{ users[0].name }} there!` You can use the text template instead of elements by adding the include `textTemplate` to your request. Any version can be used for POST or PUT requests. - `elements` AlertSourceTemplateElement[] - `type` 'TEXT' | 'VAR' | 'RAW' - `val` string - `func` string - `args` AlertSourceTemplateElementArg[] - `S` string - `N` integer - `routingTemplate` AlertSourceTemplate - `textTemplate` string — For more information on alert source templating, please visit: https://docs.ilert.com/alerting/alert-sources#alert-template. Example:
`Hi {{ users[0].name }} there!` You can use the text template instead of elements by adding the include `textTemplate` to your request. Any version can be used for POST or PUT requests. - `elements` AlertSourceTemplateElement[] - `type` 'TEXT' | 'VAR' | 'RAW' - `val` string - `func` string - `args` AlertSourceTemplateElementArg[] - `S` string - `N` integer - `linkTemplates` AlertSourceLinkTemplate[] - `text` string, required - `hrefTemplate` AlertSourceTemplate, required - `textTemplate` string — For more information on alert source templating, please visit: https://docs.ilert.com/alerting/alert-sources#alert-template. Example:
`Hi {{ users[0].name }} there!` You can use the text template instead of elements by adding the include `textTemplate` to your request. Any version can be used for POST or PUT requests. - `elements` AlertSourceTemplateElement[] - `type` 'TEXT' | 'VAR' | 'RAW' - `val` string - `func` string - `args` AlertSourceTemplateElementArg[] - `S` string - `N` integer - `priorityTemplate` AlertSourcePriorityTemplate - `valueTemplate` AlertSourceTemplate, required - `textTemplate` string — For more information on alert source templating, please visit: https://docs.ilert.com/alerting/alert-sources#alert-template. Example:
`Hi {{ users[0].name }} there!` You can use the text template instead of elements by adding the include `textTemplate` to your request. Any version can be used for POST or PUT requests. - `elements` AlertSourceTemplateElement[] - `type` 'TEXT' | 'VAR' | 'RAW' - `val` string - `func` string - `args` AlertSourceTemplateElementArg[] - `S` string - `N` integer - `mappings` AlertSourcePriorityTemplateMapping[], required - `value` string, required - `priority` 'LOW' | 'HIGH', required - `severityTemplate` AlertSourceSeverityTemplate - `valueTemplate` AlertSourceTemplate, required - `textTemplate` string — For more information on alert source templating, please visit: https://docs.ilert.com/alerting/alert-sources#alert-template. Example:
`Hi {{ users[0].name }} there!` You can use the text template instead of elements by adding the include `textTemplate` to your request. Any version can be used for POST or PUT requests. - `elements` AlertSourceTemplateElement[] - `type` 'TEXT' | 'VAR' | 'RAW' - `val` string - `func` string - `args` AlertSourceTemplateElementArg[] - `S` string - `N` integer - `mappings` AlertSourceSeverityTemplateMapping[], required - `value` string, required - `severity` integer, required - `eventFilter` string — Defines an optional event filter condition in ICL language. This is a code based implementation, more info on syntax: https://docs.ilert.com/rest-api/icl-ilert-condition-language. For block based configuration please use the web UI. It has no effect on manually created alerts. Note: this field is an ?include, it will not appear in lists. - `alertKeyTemplate` AlertSourceTemplate - `textTemplate` string — For more information on alert source templating, please visit: https://docs.ilert.com/alerting/alert-sources#alert-template. Example:
`Hi {{ users[0].name }} there!` You can use the text template instead of elements by adding the include `textTemplate` to your request. Any version can be used for POST or PUT requests. - `elements` AlertSourceTemplateElement[] - `type` 'TEXT' | 'VAR' | 'RAW' - `val` string - `func` string - `args` AlertSourceTemplateElementArg[] - `S` string - `N` integer - `servicesTemplate` AlertSourceTemplate[] — Optional list of templates that extract service identifiers from the inbound event payload. Each rendered value is comma-split, and each resulting token is resolved against the tenant's services by alias or name (case-insensitive). Unmatched tokens are silently dropped. Capped at 10 templates and at the alert's per-event services limit. Note: this field is an ?include, it will not appear in lists. - `textTemplate` string — For more information on alert source templating, please visit: https://docs.ilert.com/alerting/alert-sources#alert-template. Example:
`Hi {{ users[0].name }} there!` You can use the text template instead of elements by adding the include `textTemplate` to your request. Any version can be used for POST or PUT requests. - `elements` AlertSourceTemplateElement[] - `type` 'TEXT' | 'VAR' | 'RAW' - `val` string - `func` string - `args` AlertSourceTemplateElementArg[] - `S` string - `N` integer - `eventTypeFilterCreate` string — Defines an optional create alert rule in ICL language. This is a code based implementation, more info on syntax: https://docs.ilert.com/rest-api/icl-ilert-condition-language. For block based configuration please use the web UI. It has no effect on manually created alerts. Note: this field is an ?include, it will not appear in lists. - `eventTypeFilterAccept` string — Defines an optional accept alert rule in ICL language This is a code based implementation, more info on syntax: https://docs.ilert.com/rest-api/icl-ilert-condition-language. For block based configuration please use the web UI. It has no effect on manually created alerts. Note: this field is an ?include, it will not appear in lists. - `eventTypeFilterResolve` string — Defines an optional resolve alert rule in ICL language This is a code based implementation, more info on syntax: https://docs.ilert.com/rest-api/icl-ilert-condition-language. For block based configuration please use the web UI. It has no effect on manually created alerts. Note: this field is an ?include, it will not appear in lists. - `autoRaiseAlerts` boolean — Only effective when a support hour is linked to this alert source. - `scoreThreshold` number, double — Only used when alertCreation is set to INTELLIGENT_GROUPING. - `severity` integer - `services` Service[] - `id` number - `name` string - `alias` string - `status` 'OPERATIONAL' | 'UNDER_MAINTENANCE' | 'DEGRADED' | 'PARTIAL_OUTAGE' | 'MAJOR_OUTAGE' — the service status - `description` string - `oneOpenIncidentOnly` boolean - `showUptimeHistory` boolean - `teams` TeamRel[] - `id` integer - `name` string - `subscribed` boolean - `uptime` ServiceUptime - `rangeStart` string, date-time - `rangeEnd` string, date-time - `outages` ServiceOutage[] - `status` 'OPERATIONAL' | 'UNDER_MAINTENANCE' | 'DEGRADED' | 'PARTIAL_OUTAGE' | 'MAJOR_OUTAGE' — the service status - `from` string, date-time - `until` string, date-time - `uptimePercentage` ServiceUptimePercentage - `uptimePercentage` object - `p90` number, float - `p60` number, float - `p30` number, float - `incidents` IncidentNoIncludes[] — Note that this only contains the latest 10 unresolved incidents, use /api/incidents?service=x if more or specific results are needed - `id` number - `summary` string - `status` 'INVESTIGATING' | 'IDENTIFIED' | 'MONITORING' | 'RESOLVED' — the incident status - `message` string - `sendNotification` boolean - `createdAt` string, date-time — May be overwritten during the creation of the incident, otherwise read-only - `updatedAt` string, date-time — May be overwritten during the creation of the incident, otherwise read-only - `affectedServices` object[] - `impact` 'OPERATIONAL' | 'UNDER_MAINTENANCE' | 'DEGRADED' | 'PARTIAL_OUTAGE' | 'MAJOR_OUTAGE' — the service status - `service` ServiceNoIncludes - `id` number - `name` string - `alias` string - `status` 'OPERATIONAL' | 'UNDER_MAINTENANCE' | 'DEGRADED' | 'PARTIAL_OUTAGE' | 'MAJOR_OUTAGE' — the service status - `description` string - `oneOpenIncidentOnly` boolean - `showUptimeHistory` boolean - `teams` TeamRel[] - … - `resolvedOn` string, date-time - `setupStatus` 'CREATED' | 'CREATED_ADVANCED' | 'CREATED_BIDIRECTIONAL' | 'FINISHED' - `autoCreateServices` boolean - `createdAt` string - `updatedAt` string - `escalationPolicy` EscalationPolicy - `id` integer - `name` string, required - `escalationRules` EscalationRule[], required - `escalationTimeout` integer, required - `user` object — This field (type: User) is deprecated, please use 'users' instead - `id` number - `schedule` object — This field (type: Schedule) is deprecated, please use 'schedules' instead - `id` number - `team` object — This field (type: Team) is deprecated, please use 'teams' instead - `id` number - `users` UserRel[] - `id` integer, required - `firstName` string - `lastName` string - `schedules` ScheduleRel[] - `id` integer - `name` string - `type` 'STATIC' | 'RECURRING' - `teams` TeamRel[] - `id` integer - `name` string - `teams` TeamRel[] - `id` integer - `name` string - `repeating` boolean - `frequency` integer - `delayMin` integer - `routingKey` string — optional - `priority` 'HIGH' | 'LOW' - `alertKey` string - `assignedTo` object — This field (type: User) is deprecated, please use 'responders' instead - `id` number - `nextEscalation` string, date-time - `escalationRules` EscalationRule[] - `escalationTimeout` integer, required - `user` object — This field (type: User) is deprecated, please use 'users' instead - `id` number - `schedule` object — This field (type: Schedule) is deprecated, please use 'schedules' instead - `id` number - `team` object — This field (type: Team) is deprecated, please use 'teams' instead - `id` number - `users` UserRel[] - `id` integer, required - `firstName` string - `lastName` string - `schedules` ScheduleRel[] - `id` integer - `name` string - `type` 'STATIC' | 'RECURRING' - `teams` TeamRel[] - `id` integer - `name` string - `nextEscalationUser` User - `id` integer - `firstName` string, required - `lastName` string, required - `email` string, required - `timezone` 'Europe/Berlin' | 'America/New_York' | 'America/Los_Angeles' | 'Asia/Istanbul' - `position` string - `department` string - `avatarUrl` string - `language` 'de' | 'en' - `region` 'DE' | 'GB' | 'CH' | 'CN' | 'IN' | 'US' | 'FR' | 'ES' | 'CA' | 'IE' - `role` 'STAKEHOLDER' | 'GUEST' | 'RESPONDER' | 'USER' | 'ADMIN' - `shiftColor` string — Optional hex-color code for the user's shifts in schedules calendars - `mutedUntil` string, date-time — Date in ISO-8601 - `createdAt` string, date-time — Date in ISO-8601 - `updatedAt` string, date-time — Date in ISO-8601 - `nextEscalationRuleIndex` number - `images` EventImage[] - `src` string - `href` string - `alt` string - `links` EventLink[] - `href` string - `text` string - `responders` AlertResponder[] - `user` UserRel - `id` integer, required - `firstName` string - `lastName` string - `status` 'PENDING' | 'ACCEPTED' - `acceptedAt` string, date-time - `severity` integer — Optional severity in range 1..5. - `labels` object — Optional key/value labels that are attached to the alert. - `customDetails` object — Free-form custom key/value details attached to the alert. This is the original event payload of the integration. Only present with ?include=customDetails on the single-alert GET (not on the list endpoint). - `linkedIncidentId` integer — Id of the incident this alert is linked to, if any. - `mergedIntoId` integer — Id of the alert this alert has been merged into, if any. - `mergeState` 'NONE' | 'MAIN' | 'MERGED' — The merge state of the alert. --- [API](https://skmtc.dev/ilert/apis/ilert-rest-api.md) · [All operations](https://skmtc.dev/ilert/apis/ilert-rest-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/ilert/ilert-rest-api/revisions/cb7d5a5f9ab8/schema)