---
title: "Validate a composite alert condition"
method: POST
path: "/api/v2/{org_id}/alerts/composites/validate"
tags: ["Alerts"]
---

# Validate a composite alert condition

`POST /api/v2/{org_id}/alerts/composites/validate`

## Request

- Base URL: `https://api.openobserve.ai` (the document declares no server; this is the origin it was published from)
- URL: `https://api.openobserve.ai/api/v2/{org_id}/alerts/composites/validate`
- Auth: API key in header `Authorization`
- TypeScript: <https://skmtc.dev/openobserve/apis/openobserve-api-http/docs/api/v2/:org_id/alerts/composites/validate/post.ts> (a function with typed inputs; its response is checked against the schema)

Parses and validates a composite alert's boolean expression over child alert IDs and returns the canonical form, resolved children, and an advisory result without persisting anything.

## Path parameters

- `org_id` string, required

## Request body

- object: Advisory validation/preview request. Persistence repeats all checks under the organization graph lock.
  - `composite_condition` CompositeCondition, required: Composite expression and truth-policy configuration.
    - `expression` string, required: Boolean expression over child alert IDs, e.g. `{child_a} && ({child_b} || {child_c})`.
    - `stale_child_policy` 'use_last_state' | 'treat_as_false' | 'treat_as_true': How a composite treats a child whose latest state is stale (no recent evaluation within its freshness deadline). The `storage_id` mapping below is persisted in the `stale_child_policy` column and is **append-only**: never renumber an existing variant, or rows already on disk will silently decode to the wrong policy.
    - `warning_counts_as_firing` boolean: Whether a child at `warning` severity counts as firing (`true`) or only `critical` does (`false`). Defaults to `true`.
  - `composite_id` string, nullable: When editing an existing composite, its ID (so the graph check can exempt the composite being updated); `None` when validating a new definition.
  - `folder_id` string, nullable: Reserved and currently unused: validation does not read this field, so callers must not rely on it to scope or validate the composite.

## Response `200`

- CompositeValidationResponse
  - `canonical_expression` string, nullable: Canonicalized form of the expression.
  - `children` CompositeChildResponse[], required: Resolved child references.
    - `accessible` boolean, required: Whether the caller may read this child.
    - `alert_id` string, required: Child alert ID.
    - `alert_type` string, nullable: Child alert type ("scheduled" | "composite" | "slo").
    - `effective_cadence_seconds` integer, nullable: Effective evaluation cadence in seconds. Reserved and currently unpopulated (always omitted) — cadence is not yet propagated through child evaluation. Do not rely on this field being set.
    - `enabled` boolean, nullable: Whether the child is enabled.
    - `folder_id` string, nullable: Folder containing the child.
    - `level` string, nullable: Current severity level of the child's last evaluation.
    - `level_at` integer, nullable: When `level` was last recorded.
    - `name` string, nullable: Child name; `None` when the child is not accessible to the caller.
    - `stale` boolean, nullable: Whether the child's latest state is stale.
    - `stale_deadline` integer, nullable: Deadline after which a missing evaluation marks the child stale.
    - `truth` boolean, nullable: Whether the child currently evaluates true.
  - `result` boolean, nullable: Advisory evaluation result (null when indeterminate).
  - `result_level` string, nullable: Advisory severity of the result.
  - `valid` boolean, required: Whether the expression is syntactically valid.
  - `warnings` CompositeValidationWarning[], required: Advisory warnings (e.g. disabled or never-evaluated children).
    - `alert_id` string, required: Alert ID the warning refers to.
    - `code` string, required: Machine-readable warning code.

---

[API](https://skmtc.dev/openobserve/apis/openobserve-api-http.md) - [All operations](https://skmtc.dev/openobserve/apis/openobserve-api-http/llms.txt) - [OpenAPI document](https://skmtc.dev/openobserve/apis/openobserve-api-http/revisions/0529b8a10252?raw)