---
title: "List the org's auto-investigate decisions"
method: GET
path: "/api/v2/{org_id}/alerts/auto_investigate/decisions"
tags: ["Alerts"]
---

# List the org's auto-investigate decisions

`GET /api/v2/{org_id}/alerts/auto_investigate/decisions`

## Request

- Base URL: `https://api.openobserve.ai` (the document declares no server; this is the origin it was published from)
- URL: `https://api.openobserve.ai/api/v2/{org_id}/alerts/auto_investigate/decisions`
- Auth: API key in header `Authorization`
- TypeScript: <https://skmtc.dev/openobserve/apis/openobserve-api-http/docs/api/v2/:org_id/alerts/auto_investigate/decisions/get.ts> (a function with typed inputs; its response is checked against the schema)

Lists the auto-investigate gate's decisions for this org's alerts, newest first, skips included, with the figures and settings each decision used. Reads this region's log only. An org with no decisions yet gets an empty list.

## Path parameters

- `org_id` string, required

## Query parameters

- `alert_id` string
- `group_key` string
- `start_time` integer
- `end_time` integer
- `reason` string
- `limit` integer

## Response `200`

Success

- DecisionsResponse: Body of the decisions route, newest first.
  - `decisions` DecisionRow[], required
    - `_timestamp` integer, required: Decision time, microseconds.
    - `alert_id` string, required
    - `base_cooldown_secs` integer, required
    - `budget_check` 'allowed' | 'turn_limit' | 'ai_usage_refused': Outcome of the caller's budget checks for this investigation.
    - `cooldown_applied_secs` integer, nullable
    - `decision_kind` string, required
    - `destination` string, required
    - `entity_type` string, required
    - `evaluations_7d` integer, required
    - `fire_share_7d` number, double, required
    - `firing_started_at` integer, required: Microseconds.
    - `flapping_cooldown_secs` integer, required
    - `flapping_onsets_7d` integer, required
    - `group_key` string, required
    - `last_run_at` integer, nullable: Previous auto-investigation of this alert + group, microseconds.
    - `level` 'ok' | 'warning' | 'critical' | 'no_data': Severity of a matched threshold.
    - `mark_lookup` 'ok' | 'failed' | 'not_checked', required: Whether the caller's protection lookup answered; only `Ok` lets `protected` reach the gate.
    - `node` string, required
    - `onsets_7d` integer, required
    - `org_id` string, required
    - `protected` boolean, required
    - `rca_run_id` string, nullable
    - `reason` 'not_fire' | 'not_critical' | 'rca_running' | 'cooldown' | 'flapping' | 'always_firing' | 'budget' | 'eligible', required: Why the gate ran or skipped an investigation; the first matching rule wins.
    - `run` boolean, required
    - `settings_version` integer, required: `updated_at` of the settings row used; 0 = code defaults.

## Other responses

- `400`: Invalid filter
- `500`: The log could not be read

---

[API](https://skmtc.dev/openobserve/apis/openobserve-api-http.md) - [All operations](https://skmtc.dev/openobserve/apis/openobserve-api-http/llms.txt) - [OpenAPI document](https://skmtc.dev/openobserve/apis/openobserve-api-http/revisions/0529b8a10252?raw)