---
title: "Post a schema-change alert to Slack"
method: POST
path: "/api/phantombuster-monitor/alerts"
tags: ["PhantomBuster monitor"]
---

# Post a schema-change alert to Slack

`POST /api/phantombuster-monitor/alerts`

## Request

- Base URL: `https://api.sponsorunited.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api.sponsorunited.com/api/phantombuster-monitor/alerts`
- Auth: HTTP bearer

core-api writes the Slack message from the structured fields and posts it to a channel fixed in its own config; the request cannot choose the channel. Slack mentions and links are removed from every free-text field. An alert whose fingerprint was posted in the last 12 hours is not posted again and comes back with suppressed=true. Requires the phantombuster-monitor-alert permission; limited to 30 alerts an hour per caller.

## Request body

- SendPhantomBusterAlertRequest
  - `group` 'linkedin.visitor' | 'linkedin.search' | 'linkedin.ondemand' | 'linkedin.company' | 'linkedin.scraper' | 'facebook', required: The phantom group the change was seen in, as listed by GET /api/phantombuster-monitor/agents.
  - `severity` 'info' | 'warning' | 'critical', required
  - `fingerprint` string, required: Identifies the change. The same fingerprint is posted at most once every 12 hours.
  - `findings` PhantomBusterMonitorAlertFinding[], required
    - `kind` string, required: What changed, e.g. field_removed or type_changed.
    - `path` string, required: Where in the container it changed, e.g. resultObject[].profileUrl.
    - `detail` string, nullable: One line on the change.
  - `narrative` string, nullable: A short summary. Slack mentions and links are removed from it before posting.

## Response `200`

Posted, or left out as a repeat

- object
  - `sent` boolean, required
  - `suppressed` boolean, required

## Other responses

- `401`: No valid token
- `403`: Caller lacks the phantombuster-monitor-alert permission
- `422`: Invalid request, including too many findings or a narrative over 2000 characters
- `429`: More than 30 alerts in the last hour
- `502`: Slack did not accept the alert; the fingerprint is not recorded, so a retry is posted
- `503`: No Slack webhook is configured

---

[API](https://skmtc.dev/sponsorunited/apis/sponsorunited-api.md) - [All operations](https://skmtc.dev/sponsorunited/apis/sponsorunited-api/llms.txt) - [OpenAPI document](https://skmtc.dev/sponsorunited/apis/sponsorunited-api/revisions/cbf1ca5bff8f?raw)