--- title: "Retrieve an alert" method: GET path: "/v2/alerts/{alert_id}" tags: ["Alerts"] --- # Retrieve an alert `GET /v2/alerts/{alert_id}` ## Request - Base URL: `https://my.orq.ai` - URL: `https://my.orq.ai/v2/alerts/{alert_id}` - Auth: HTTP bearer Retrieves an alert by ID. ## Path parameters - `alert_id` string, required ## Response `200` OK - GetAlertResponse - `alert` Alert, required - `alert_id` string, required: Unique alert identifier assigned by ORQ, for example `alert_01H...`. Use this value in retrieve, update, and delete requests. - `display_name` string, required: Workspace-unique display name. - `description` string, required: Short human-readable summary of what the alert watches. - `project_id` string, required: Project that owns a project-scoped alert. Empty for workspace alerts. Immutable after creation. - `signal` 'cost' | 'latency' | 'errors' | 'evals' | 'custom', required: UI signal preset the alert was created from. - `query` AlertQuery, required - `metric` string, required: Source-owned metric identifier. Trace metrics are validated against the Reporting catalogue; runtime metrics are validated against telemetry capabilities in the alert's scope. - `filters` MonitorFilter[]: Source-owned filters combined with AND. - `field` string, required: Reporting dimension to filter on. Valid fields depend on the metric; validated when the monitor is saved. - `op` 'eq' | 'neq' | 'in' | 'not_in' | 'gt' | 'gte' | 'lt' | 'lte' | 'between' | 'contains' | 'exists' | 'not_exists', required: Predicate operator. `eq` and `neq` accept exactly one value; `in` and `not_in` accept 1-100 values. - `values` string[], required: Values compared against the selected field. - `source` 'ALERT_TELEMETRY_SOURCE_TRACES' | 'ALERT_TELEMETRY_SOURCE_METRICS' - `operation` string: Aggregation operation advertised by the selected metric capability. Existing trace queries may omit it; the server resolves their canonical Reporting operation. - `condition` AlertCondition, required - `comparator` 'gt' | 'gte' | 'lt' | 'lte' | 'eq', required: Comparison applied as `value threshold`. - `threshold` number, double, required: Critical-tier threshold. Breaching it opens (or escalates) a trigger at critical severity. - `degraded_threshold` number, double: Optional degraded-tier threshold. Values past it but short of `threshold` open a trigger at degraded severity. Must sit on the recovery side of `threshold` for the chosen comparator and is not supported with `eq`. - `resolve_threshold` number, double: Optional custom resolve bound (hysteresis). An open trigger resolves only once the value recovers past this bound; defaults to the lowest configured tier. Must sit at or past that tier on the recovery side. Not supported with `eq`. - `window` '5m' | '15m' | '30m' | '1h' | '4h' | '1d', required: Look-back window aggregated on each evaluation tick. - `interval` '5m' | '15m' | '1h' | '1d', required: How often the alert is evaluated. Plan limits may enforce a minimum. - `delay` '30s' | '60s' | '120s' | '300s' | '600s': Ingestion delay subtracted from the evaluation window. Defaults to `30s`. - `notifier_ids` string[], required: Notifiers that receive trigger-open and trigger-resolve notifications. - `enabled` boolean, required: Whether the alert is evaluated. Disabled alerts keep their trigger history but stop firing. - `status` 'ok' | 'degraded' | 'triggered', required: Current runtime status, maintained by the evaluation engine. - `last_triggered_at` string, date-time, nullable: Time when the alert last opened a trigger. `null` until the alert first triggers. - `recent_runs` AlertRun[]: Rolling window of the most recent evaluation ticks, oldest first. Maintained by the evaluation engine; read-only. - `at` string, date-time, required: Time of the evaluation tick. - `value` number, double, required: Observed metric value. Zero when `has_data` is false. - `breached` boolean, required: Whether the value breached the alert condition. - `has_data` boolean, required: Whether the evaluation window contained any data. - `severity` 'critical' | 'degraded': Tier the value landed in when breached. Empty when not breached. - `created_at` string, date-time, required: Time when the alert was created. - `updated_at` string, date-time, required: Time when the alert was last updated. - `created_by_id` string, required: User ID that created the alert. - `updated_by_id` string, required: User ID that last updated the alert. - `display` AlertDisplay - `visualization` 'lines' | 'bars': Chart style for the alert activity chart. - `preview_range` '1h' | '4h' | '1d' | '7d': Default time range for the alert activity chart. - `scope` 'ALERT_SCOPE_PROJECT' | 'ALERT_SCOPE_WORKSPACE', required ## Other responses - `401`: Authentication required. See https://docs.orq.ai/reference/errors for the error codes. - `404`: The resource does not exist. See https://docs.orq.ai/reference/errors for the error codes. ## Changes > 554 revisions in range; 71 not diffed. - **2026-10-23** `0b4e519a544f`: 5 info - added the non-success response with the status `401` - added the non-success response with the status `404` - added the optional property `alert/allOf[#/components/schemas/Alert]/query/allOf[#/components/schemas/AlertQuery]/operation` to the response with the `200` status - added the optional property `alert/allOf[#/components/schemas/Alert]/query/allOf[#/components/schemas/AlertQuery]/source` to the response with the `200` status - …1 more - **2026-10-23** `732aed62833a`: 1 breaking, 2 warning, 2 info - removed the required property `alert/allOf[#/components/schemas/Alert]/scope` from the response with the `200` status - removed the optional property `alert/allOf[#/components/schemas/Alert]/query/allOf[#/components/schemas/AlertQuery]/operation` from the response with the `200` status - removed the optional property `alert/allOf[#/components/schemas/Alert]/query/allOf[#/components/schemas/AlertQuery]/source` from the response with the `200` status - removed the non-success response with the status `401` - …1 more - …earlier changes not shown [Operation history](https://skmtc.dev/orq-ai/apis/orq-ai-api/changes/v2/alerts/:alert_id/get.md) --- [API](https://skmtc.dev/orq-ai/apis/orq-ai-api.md) - [All operations](https://skmtc.dev/orq-ai/apis/orq-ai-api/llms.txt) - [OpenAPI document](https://skmtc.dev/orq-ai/apis/orq-ai-api/revisions/928a71e92252?raw)