Sign in

Alert Chat Investigation

Create a fast CHAT-mode investigation for alert exploration.

Returns session_id and user_chat_id immediately. A background task runs a lightweight LLM call to check whether the user's message implies alert console filters (time range, status, search query). If filters are detected the stream END event carries them; otherwise the full agent investigation pipeline executes.

post/alerts/chat

Request body

user_uuidstring nullable
config_namestring required
user_messagestring required
incident_timestring required
incident_timezonestring required
relevant_context_idsstring[] nullable
output_typesInvestigationOutputTypeEnum[] nullable
trigger_type'manual' | 'auto-trigger' | 'slack_mention' | 'slack_dm' | 'slack_investigate_command' | 'slack_channel_join_auto_trigger' | 'slack_message_auto_trigger' | 'topology_explore' | 'alert_chat' | 'alert_event_manual_investigate' | 'alert_event_anomaly_detected_investigate' | 'alert_event_critical_severity_investigate' | 'proactive_followup' | 'alert_story' | 'alert_summary' | 'api' | 'mcp' | 'channel_agent' | 'deep_wiki' | 'autoresearch' | 'ensemble_member' | 'incident_monitor_postmortem'
parent_session_idstring nullable
mode'rca' | 'chat' | 'triage' | 'alert_story'
thinking_mode'auto' | 'deep' | 'fast' | 'lightning' | 'ultra'

Determines the investigation depth and approach.

  • AUTO: Use message classifier to determine RCA vs CHAT
  • DEEP: Force RCA (root cause analysis) investigation
  • FAST: Force CHAT (exploratory) investigation
  • LIGHTNING: Fast, tool-rich investigation with tight iteration cap. Uses the union of all tools from fast + deep configs with a speed-focused prompt.
  • ULTRA: Same agent config as DEEP. The client-side trigger for first-turn ensembling. A no-op on follow-ups.
knowledge_version_idstring nullable
additional_instructionsstring nullable

Response

Successful Response

session_idstring required
user_chat_idstring required
system_chat_idstring required

Changes

Changed in 5 of the 57 revisions of this API.5

  • c5e1ea955e811See the full diff
    • ○

      added the new ultra enum value to the request property /

      request-property-enum-value-added

  • 3025330cc50d1See the full diff
    • ○

      added the new alert_event_critical_severity_investigate enum value to the request property

      request-property-enum-value-added

  • 6bbc7dd4088c1See the full diff
    • ○

      added the new ensemble_member enum value to the request property

      request-property-enum-value-added

    This revision also has 3 changes that name no endpoint, such as unreferenced schemas being removed. See the revision's changelog

  • 946736f3fe321See the full diff
    • ○

      added the required property to the response with the status

      response-required-property-added

  • e0a48df02b411See the full diff
    • ○

      added the new autoresearch enum value to the request property

      request-property-enum-value-added

Of the 57 revisions, 9 have no diff computed.