---
title: "Get alert execution history"
method: GET
path: "/api/v2/{org_id}/alerts/history"
tags: ["Alerts"]
---

# Get alert execution history

`GET /api/v2/{org_id}/alerts/history`

## Request

- Base URL: `https://api.openobserve.ai` (the document declares no server; this is the origin it was published from)
- URL: `https://api.openobserve.ai/api/v2/{org_id}/alerts/history`
- Auth: API key in header `Authorization`
- TypeScript: <https://skmtc.dev/openobserve/apis/openobserve-api-http/docs/api/v2/:org_id/alerts/history/get.ts> (a function with typed inputs; its response is checked against the schema)

Retrieves the execution history of alerts for the organization. This endpoint queries the organization's own triggers stream to provide details about when alerts were triggered, their status, and execution details.

## Path parameters

- `org_id` string, required

## Query parameters

- `alert_id` string
- `anomaly_id` string
- `start_time` integer
- `end_time` integer
- `from` integer
- `size` integer
- `sort_by` string
- `sort_order` string

## Response `200`

Success

- object
  - `from` integer, required
  - `hits` AlertHistoryEntry[], required
    - `ack_action` string, nullable: `ack`, `unack` or `take_over`, on `ack_event` rows.
    - `ack_source` string, nullable
    - `acked_by` string, nullable: Whose ack withheld this run's send, or who acted on an `ack_event` row.
    - `actual_value` number, double, nullable: The value that was compared (row count, or the aggregate).
    - `alert_name` string, required
    - `anomaly_count` integer, nullable: Number of anomalies found in this evaluation run (anomaly detection only).
    - `delay_in_secs` integer, nullable
    - `downtime_id` string, nullable: The downtime that suppressed this run.
    - `end_time` integer, required
    - `error` string, nullable
    - `evaluation_took_in_secs` number, double, nullable
    - `group_label` string, nullable: Which group/series produced `actual_value` ("host=b,region=eu"); absent for count alerts and pre-change rows.
    - `group_size` integer, nullable
    - `grouped` boolean, nullable
    - `is_partial` boolean, nullable
    - `is_realtime` boolean, required
    - `is_silenced` boolean, required
    - `level` string, nullable: Severity of the matched threshold: "ok" | "warning" | "critical".
    - `org` string, required
    - `query_took` integer, nullable
    - `repeat_suppressed` boolean, nullable: `suppress_repeats` withheld this run because it repeated the last delivered state.
    - `retries` integer, required
    - `source_node` string, nullable
    - `start_time` integer, required
    - `status` string, required
    - `success_response` string, nullable
    - `taken_over_from` string, nullable
    - `threshold_operator` string, nullable: Operator, so the row reads standalone ("112 >= 100").
    - `threshold_value` number, double, nullable: The threshold that matched. Absent on `normal` rows — T-10 renders those as actual value + Ok, with no threshold.
    - `timestamp` integer, required
    - `value_is_lower_bound` boolean, nullable: True when `actual_value` is a LOWER BOUND (legacy capped count fetch, §7.5) — the UI renders "≥ N". Absent = exact.
  - `size` integer, required
  - `total` integer, required

## Other responses

- `400`: Bad Request
- `403`: Forbidden
- `404`: Alert or anomaly config not found
- `500`: Internal Server Error

---

[API](https://skmtc.dev/openobserve/apis/openobserve-api-http.md) - [All operations](https://skmtc.dev/openobserve/apis/openobserve-api-http/llms.txt) - [OpenAPI document](https://skmtc.dev/openobserve/apis/openobserve-api-http/revisions/0529b8a10252?raw)