OPopenobserve
Alerts

Get alert details

Retrieves detailed information about a specific alert including its configuration, conditions, triggers, notification settings, and current status. Useful for viewing and understanding existing alert setups. Composite alerts return a composite-shaped body (alert_type="composite", composite_condition, children, evaluation) rather than GetAlertResponseBody.

get/api/v2/{org_id}/alerts/{alert_id}

Request

Path parameters

org_idstring required

Organization name

alert_idstring required

Alert ID

Query parameters

folderstring

Folder ID (Required if RBAC enabled)

Response

Success

context_attributesobject nullable
creates_incidentboolean

When true, this alert creates/joins incidents instead of sending direct notifications. Notification is sent only when a new incident is created or a new alert type joins an existing incident. Repeated firings are suppressed. When false (default), the alert sends notifications directly and does not correlate to any incident.

descriptionstring
destinationsstring[]
enabledboolean
idstring nullable
incident_title_templatestring nullable
is_real_timeboolean
keep_firing_forinteger

Seconds the condition must stay clear before the episode recovers. 0 recovers on the first clear evaluation, which is what every alert does today. Named after Prometheus' keep_firing_for, with the same meaning.

last_edited_bystring nullable
last_satisfied_atinteger nullable

Will be removed in the future.

last_triggered_atinteger nullable

Will be removed in the future.

namestring
notify_on_recoveryboolean

Send one notification when this alert, or each group of a multi-alert, stops firing. Off by default: an existing template that never mentions {alert_status} would otherwise render the firing wording twice.

oncall_teamstring nullable

On-call team this alert pages, overriding ownership discovery. None means "work it out from the identity dimensions", which is the normal case — an explicit value is for the alert whose owner the dimensions cannot express.

org_idstring
ownerstring nullable
pending_period_secinteger
priorityinteger nullable

How much humans care about this alert (PT-1). None = unset, which is every pre-Feature-2 alert.

Mutable configuration — editable on any update, like name. Display + propagation only: it must never influence evaluation, silence, or delivery (PT-5 / D19). B-29 carved out one exception: when set, it takes precedence over the eval_level default for incident severity at creation/escalation — see config::meta::alerts::priority and core::alerts::incidents::create_new_incident.

value_type is required here because the enum serializes as an integer via serde try_from/into; without it the generated OpenAPI would advertise a string enum and lie about the payload.

recovery_destinationsstring[]

Where the recovery MESSAGE goes when it should not follow the firing. Empty = the firing's own destinations. Ticket closes are unaffected either way — a resolve has to carry the correlation key of the trigger that opened it, so it cannot be redirected.

row_templatestring
row_template_type'String' | 'Json'
runbook_urlstring nullable

Where the fix for this alert is written down.

Copied onto every on-call response record the alert opens, so the person woken is handed the runbook in the page. Validated at save — a malformed link is refused rather than stored, because the moment it is read is the one moment nobody has the patience to debug a URL.

stream_namestring
stream_type'logs' | 'metrics' | 'traces' | 'profiles' | 'service_graph' | 'enrichment_tables' | 'file_list' | 'metadata' | 'index'
suppress_repeatsboolean

Notify once per state change; enterprise only, other builds ignore it.

tagsstring[]

Selection tags (PT-6): bare (prod) or key:value (service:checkout), normalized and validated at save by tags::normalize_tags.

NOT context_attributes — that field is free-form KV shipped into notification payloads with no validation. These are the filtering / scoping primitive.

Skipped when empty so alerts that set no tags serialize exactly as they did before Feature 2 (G5).

templatestring nullable

Optional template name. When specified, this template is used for all destinations instead of destination-level templates. This allows using different templates for different alerts while reusing the same destinations.

tz_offsetinteger

Timezone offset in minutes. The negative secs means the Western Hemisphere

updated_atstring date-time
workflowsstring[]
locked_target_namesobject

Display names of the alert's locked workflows and on-call team, by id, for the edit form.

Example response

{
  "priority": 3
}

Changes

No recorded changes to this operation across all 1 revision of this API.