---
title: "GET /alerts/trends"
method: GET
path: "/alerts/trends"
tags: ["alerts"]
---

# GET /alerts/trends

`GET /alerts/trends`

## Query parameters

- `days` integer

## Response `200`

Opened/resolved per day plus MTTR percentiles for the signed-in scope

- AlertTrendsResponse — GET /alerts/trends response (`api/alerts.rs::trends`)
  - `bucket` string, required — Bucket size — always `day`
  - `days` integer, required — Effective window in days (clamped to 7-90)
  - `mttr` AlertTrendsMttr, required — MTTR percentiles in hours
    - `avgHours` number, double, required
    - `medianHours` number, double, required
    - `p95Hours` number, double, required
  - `timeSeries` AlertTrendPoint[], required
    - `opened` integer, required — Alerts opened that day
    - `resolved` integer, required — Alerts resolved that day
    - `time` string, required — Day bucket start (RFC 3339)
  - `totals` AlertTrendsTotals, required — Alert trends totals over the window
    - `opened` integer, required
    - `resolved` integer, required

## Other responses

- `401` — Unauthorized

## Changes

- **2026-08-31** `9d9ef31d83e5` — 3 breaking, 5 info
  - the response property `message` became nullable for the status `401`
  - the response property `message` became optional for the status `401`
  - removed the required property `data` from the response with the `200` status
  - added the required property `bucket` to the response with the `200` status
  - …4 more

[Change history](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api/changes/alerts/trends/get.md)

---

[API](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api.md) · [All operations](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api/llms.txt) · [OpenAPI document](https://skmtc.dev/ismalicious/apis/ismalicious-threat-intelligence-api/revisions/fe46a64acc79?raw)