---
title: "Alert Chat Investigation"
method: POST
path: "/alerts/chat"
---

# Alert Chat Investigation

`POST /alerts/chat`

## Request

- Base URL: `https://api.traversal.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api.traversal.com/alerts/chat`
- Auth: none declared

Create a fast CHAT-mode investigation for alert exploration.

Returns ``session_id`` and ``user_chat_id`` immediately. A background
task runs the agent investigation pipeline.

## Request body

- InvestigationRequest: Model for the investigation request payload.
  - `files` RequestFile[]
    - `file_name` string, required
    - `base64_file` string
    - `mime_type` string, nullable
    - `url` string, nullable
  - `user_uuid` string, nullable
  - `config_name` string, required
  - `user_message` string, required
  - `incident_time` string, required
  - `incident_timezone` string, required
  - `services_context` ServiceContext[], required
    - `id` string, required
    - `name` string, required
    - `description` string, nullable
  - `relevant_context_ids` string[], nullable
  - `environment_context` EnvironmentContext
    - `name` string, required
  - `output_types` InvestigationOutputTypeEnum[], nullable
  - `trigger_type` 'manual' | 'auto-trigger' | 'chat_mention' | 'chat_dm' | 'chat_investigate_command' | 'chat_channel_join_auto_trigger' | 'chat_message_auto_trigger' | 'topology_explore' | 'alert_chat' | 'alert_event_manual_investigate' | 'alert_event_anomaly_detected_investigate' | 'alert_event_critical_severity_investigate' | 'proactive_followup' | 'alert_story' | 'alert_summary' | 'api' | 'mcp' | 'channel_agent' | 'deep_wiki' | 'autoresearch' | 'ensemble_member' | 'incident_monitor_postmortem' | 'slack_mention' | 'slack_dm' | 'slack_investigate_command' | 'slack_channel_join_auto_trigger' | 'slack_message_auto_trigger'
  - `context_items` ContextItem[], nullable
    - `id` string, required
    - `organization_id` string, required
    - `context_item_name` 'central_id' | 'function' | 'application' | 'service' | 'team' | 'url_endpoint' | 'correlation_id' | 'topology_node' | 'account' | 'storage' | 'environment' | 'cluster' | 'snow_alert' | 'snow_incident' | 'snow_problem' | 'snow_change_request' | 'customer_journey' | 'domain' | 'mim_id' | 'monitor_id', required: Enum for context item names.
    - `value` string, required
    - `metadata` object, required
  - `parent_session_id` string, nullable
  - `mode` 'rca' | 'chat' | 'triage' | 'alert_story'
  - `thinking_mode` 'auto' | 'deep' | 'fast' | 'lightning' | 'ultra': Determines the investigation depth and approach. - AUTO: Use message classifier to determine RCA vs CHAT - DEEP: Force RCA (root cause analysis) investigation - FAST: Force CHAT (exploratory) investigation - LIGHTNING: Fast, tool-rich investigation with tight iteration cap. Uses the union of all tools from fast + deep configs with a speed-focused prompt. - ULTRA: Same agent config as DEEP. The client-side trigger for first-turn ensembling. A no-op on follow-ups.
  - `agent_profile` 'rca' | 'fix': Which agent a session runs: its tools, prompt, budgets, and how a turn ends. Fixed when the session is created, so every follow-up runs the same agent. Asking a different agent means starting a new session.
  - `knowledge_version_id` string, nullable
  - `alert_params` AlertParams: Parameters for alert-based investigations.
    - `start_time` string, required
    - `end_time` string, required
    - `status` 'escalated' | 'anomalous' | 'dismissed': Derived status for an alert event based on escalation and anomaly detection.
    - `search_query` string, nullable
  - `additional_instructions` string, nullable

## Response `200`

Successful Response

- InvestigationResponse
  - `session_id` string, required
  - `user_chat_id` string, required
  - `system_chat_id` string, required

## Other responses

- `422`: Validation Error

## Changes

> 66 revisions in range; 9 not diffed.

- **2026-09-29** `c939e4d80cd7`: 6 info
  - added the new optional request property `agent_profile`
  - added the new `chat_channel_join_auto_trigger` enum value to the request property `trigger_type`
  - added the new `chat_dm` enum value to the request property `trigger_type`
  - added the new `chat_investigate_command` enum value to the request property `trigger_type`
  - …2 more
- **2026-09-11** `c5e1ea955e81`: 1 info
  - added the new `ultra` enum value to the request property `thinking_mode/anyOf[subschema #1: ThinkingMode]/`
- **2026-09-02** `3025330cc50d`: 1 info
  - added the new `alert_event_critical_severity_investigate` enum value to the request property `trigger_type`
- **2026-08-28** `6bbc7dd4088c`: 1 info
  - added the new `ensemble_member` enum value to the request property `trigger_type`
- **2026-08-20** `946736f3fe32`: 1 info
  - added the required property `system_chat_id` to the response with the `200` status

[Operation history](https://skmtc.dev/traversal/apis/traversal-api/changes/alerts/chat/post.md)

---

[API](https://skmtc.dev/traversal/apis/traversal-api.md) - [All operations](https://skmtc.dev/traversal/apis/traversal-api/llms.txt) - [OpenAPI document](https://skmtc.dev/traversal/apis/traversal-api/revisions/31e1a8b7cf89?raw)