The metric alarms you can see in this org, with current state and channels.

Filtered per alarm, not per request: org-level alarms (credits, org-wide spend) need alarms.read, and an alarm tagged to a project needs projects.alarms.read on that project. Holding one and not the other returns the matching subset rather than a 403, so a role scoped to a single project sees exactly that project's alarms.

{
  "alarms": [
    {
      "stat": "p99"
    }
  ]
}