---
title: "Create an alert rule"
method: POST
path: "/v1/alert-rules"
tags: ["Alert rules"]
---

# Create an alert rule

`POST /v1/alert-rules`

## Request

- Base URL: `https://api.upcheck.so`
- URL: `https://api.upcheck.so/v1/alert-rules`
- Auth: HTTP bearer

A rule watches one subject. Expiry subjects (`certificate`, `registration`) take `days`/`weeks`/`on_expiration` triggers; `http` (the uptime check) takes `http_down`, `http_slow` and `recovered`; `dns` takes `dns_changed` and `recovered`; `keyword` takes `keyword_failed` and `recovered`; `content` takes `content_changed`, `content_failed` and `recovered`; `port` takes `port_down` and `recovered`. An enabled rule is evaluated immediately against every website it covers, so a website already inside a threshold alerts straight away.

## Request body

- object
  - `name` string, required
  - `enabled` boolean
  - `subject` 'http' | 'certificate' | 'dns' | 'registration' | 'keyword' | 'content' | 'port': Which check a monitor, rule or history row is about.
  - `triggers` object[], required: Thresholds or events the rule fires on. Duplicates are collapsed and the list is sorted widest first.
    - `type` 'days' | 'weeks' | 'on_expiration' | 'http_down' | 'http_slow' | 'port_down' | 'dns_changed' | 'keyword_failed' | 'content_changed' | 'content_failed' | 'recovered', required
    - `value` integer, required: Days or weeks before expiry for `days`/`weeks`; ignored for event triggers.
  - `frequency` 'once' | 'daily' | 'every_12h' | 'every_6h' | 'hourly': How often a rule may re-deliver the same alert while the condition holds.
  - `channels` string[], required
  - `integrationIds` string[], nullable: Integrations the webhook channels deliver to. A selected channel with no integration listed here delivers to every integration on that channel. Ids outside this organization are ignored.
  - `emailListIds` string[]
  - `emailRecipients` string[]: Addresses the email channel delivers to, on top of any email lists. Falls back to the rule author when both are empty.
  - `domainIds` string[], nullable: Websites the rule is scoped to. Empty or null means every website in the organization.

## Response `201`

Created.

- object
  - `id` string, required: Opaque identifier.
  - `organizationId` string, required: Opaque identifier.
  - `name` string, required
  - `enabled` boolean, required
  - `subject` 'http' | 'certificate' | 'dns' | 'registration' | 'keyword' | 'content' | 'port', nullable, required: Which check a monitor, rule or history row is about.
  - `triggerType` 'days' | 'weeks' | 'on_expiration' | 'http_down' | 'http_slow' | 'port_down' | 'dns_changed' | 'keyword_failed' | 'content_changed' | 'content_failed' | 'recovered', required
  - `triggerValue` number, required
  - `triggers` object[], nullable, required
    - `type` 'days' | 'weeks' | 'on_expiration' | 'http_down' | 'http_slow' | 'port_down' | 'dns_changed' | 'keyword_failed' | 'content_changed' | 'content_failed' | 'recovered', required
    - `value` integer, required: Days or weeks before expiry for `days`/`weeks`; ignored for event triggers.
  - `domainIds` string[], nullable, required
  - `frequency` 'once' | 'daily' | 'every_12h' | 'every_6h' | 'hourly', required: How often a rule may re-deliver the same alert while the condition holds.
  - `channels` string[], required
  - `integrationIds` string[], nullable, required
  - `emailListIds` string[], nullable, required
  - `emailRecipients` string[], nullable, required
  - `createdByEmail` string, nullable, required
  - `createdAt` number, required

## Other responses

- `400`: The request body or parameters are invalid. `error` names the first problem.
- `401`: The API key is missing, invalid, or revoked.
- `403`: The key's role does not allow this action.
- `429`: The key's rate limit was exceeded. Honour `Retry-After`.

---

[API](https://skmtc.dev/upcheck/apis/upcheck-api.md) · [All operations](https://skmtc.dev/upcheck/apis/upcheck-api/llms.txt) · [OpenAPI document](https://skmtc.dev/upcheck/apis/upcheck-api/revisions/56f55512eb8a?raw)