---
title: "Retrieve a listing of Alerts"
method: POST
path: "/alerts"
tags: ["Monitoring: Entity Management"]
---

# Retrieve a listing of Alerts

`POST /alerts`

This endpoint retrieves the alerts listing. By default, it will return open alerts. An alert is a list of new risks seen since the last alert was closed. You can paginate with a cursor using the 'id' column.

## Query parameters

- `sortBy` string, nullable — The field name that you want to sort by. Many fields in the response are sortable, but not all.
- `sortOrder` string, nullable — ASC or DESC. Defaults: DESC
- `page` integer — Page number, 1-indexed. Default: 1
- `pageSize` integer — Number of results per page. Maximum: 100, Default: 10
- `cursor` unknown

## Request body

- string[], nullable

## Response `200`

OK

- ResponseAlertSummary
  - `alertIndicatorSummary` ResponseAlertIndicatorSummary[], nullable — The indicators in this alert, which is different from the full list of indicators in the entity.
    - `category` string
    - `count` integer
    - `isNetwork` boolean — Indicates whether the indicator is describes this entity or one of its network connections
    - `lastAddedAt` string, date-time — The most recent time an indicator was added to the alert.
    - `maxScore` integer
  - `closedAt` string, date-time, nullable — When the alert was closed. Null if the alert is still open. Alerts cannot be reopened once closed.
  - `closedByUserName` string, nullable — Name of the user who closed the alert.
  - `closedByUserURN` string, nullable — URN of the user who closed the alert.
  - `createdAt` string, date-time — When the alert was first created.
  - `entityCreatedAt` string, date-time
  - `entityCustomFields` SigmaidCustomEntityField[], nullable
    - `key` string
    - `value` string
  - `entityCustomerKey` string — The customer key of the entity associated with this alert.
  - `entityDispositionState` ResponseEntityDispositionState
    - `dispositionSetAtTime` string, date-time, nullable — The time when the disposition was last set
    - `dispositionSetByUserName` string, nullable — The name of the user who last set the disposition
    - `dispositionSetByUserURN` string, nullable — The URN of the user who last set the disposition
    - `dispositionState` string — The current disposition state of the entity. Should be unsnaked and titlecased before UI display
  - `entityEscalated` boolean — Whether the entity has been escalated for review.
  - `entityEscalatedByUserName` string, nullable — If escalated, the name of the user who escalated the entity.
  - `entityEscalatedByUserUrn` string, nullable — If escalated, the URN of the user who escalated the entity.
  - `entityEscalatedTime` string, date-time, nullable — If escalated, the time when the entity was escalated.
  - `entityFilterSetID` integer
  - `entityFilterSetName` string
  - `entityGroups` ResponseMinimalEntityGroup[], nullable — The groups that this entity belongs to.
    - `entityGroupName` string
    - `id` integer
  - `entityName` string — The name of the entity associated with this alert.
  - `entityReviewState` ResponseEntityReviewState
    - `isAllowedToEndReview` boolean — Whether the current user is allowed to cancel / submit a review
    - `isEditingLocked` boolean — Whether the current user is allowed to change this entity
    - `lastReviewDate` string, date-time, nullable — Time of the last review submission
    - `reviewLockedByName` string, nullable — The name of the user who locked the entity for review
    - `reviewLockedByURN` string, nullable — The URN of the user who locked the entity for review
    - `reviewLockedSince` string, date-time, nullable — The time when the entity was locked for review
    - `reviewStatus` 'no_review_necessary' | 'needs_review' | 'review_locked' | 'reviewed'
    - `unreviewedItems` ResponseUnreviewedItems
      - `numIndicators` integer — The number of indicators inside the entity that require review
      - `numMatches` integer — The number of matches inside the entity that require review
      - `numNews` integer — The number of news events inside the entity that require review
      - `total` integer — The number of items inside the entity that require review
  - `entityRiskScore` integer — The current risk score of the entity.
  - `entityType` 'company' | 'person' | 'vessel' | 'aircraft' | '' — The type that the entity was searched with
  - `entityURN` string — The URN of the entity associated with this alert. You can use the "Retrieve an entity's current state" endpoint with this value.
  - `id` integer — Unique identifier for the alert.
  - `origins` string[], nullable — A user-friendly list of where the entity was seen, e.g. in Monitoring entities, or in one-off searches.
  - `riskMetadata` ResponseRiskMetadata
    - `newsMetadata` ResponseNewsMetadata[], nullable — The news events that are currently detected
      - `count` integer — The number of news events for this type that are currently detected
      - `eventNewsType` string — The event news type currently detected
      - `samplePublishers` string[], nullable — A sample of the publishers that are currently detected
      - `unformattedEventNewsType` string — The unformatted event news type currently detected
    - `pepLevels` string[], nullable — The PEP levels that are currently detected
    - `sanctionLists` string[], nullable — The sanction lists that are currently detected
  - `status` 'open' | 'closed' — Current status of the alert.
  - `updatedAt` string, date-time — When the alert was last updated, typically when new indicators were added.

## Other responses

- `400` — Bad Request
- `401` — Unauthorized
- `429` — Too Many Requests
- `500` — Internal Server Error

---

[API](https://skmtc.dev/sigma360/apis/sigma360-api.md) · [All operations](https://skmtc.dev/sigma360/apis/sigma360-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/sigma360/sigma360-api/revisions/fcdda6232c62/schema)