---
title: "Scrape one integration's alert counters"
method: GET
path: "/api/v1/observability/metrics/{integration}"
tags: ["Observability integrations"]
---

# Scrape one integration's alert counters

`GET /api/v1/observability/metrics/{integration}`

## Request

- Base URL: `https://wardenpoint.com` (the document declares no server; this is the origin it was published from)
- URL: `https://wardenpoint.com/api/v1/observability/metrics/{integration}`
- Auth: HTTP bearer

Returns this integration's alert counters as a Prometheus text exposition (`text/plain; version=0.0.4`), not JSON. Intended as a scrape target for the customer's own Prometheus, and usable as a cheap check of whether an integration has ever received anything.

**Authentication is the integration secret, exactly as on the alert endpoint** — `Authorization: Bearer <secret>`, `X-WardenPoint-Secret`, or `?secret=` for CloudWatch integrations. No API key is involved. If the integration has `hmac_enabled`, this GET must be signed the same way an alert POST is: `X-WardenPoint-Timestamp` plus `X-WardenPoint-Signature` over `"<timestamp>."` and the (empty) body, each signature usable once. A stock Prometheus scrape config cannot produce that, so keep HMAC off on integrations you intend to scrape.

Three metric families are exposed, all scoped to this integration and all counted over its whole lifetime — there is no time-range parameter:

* `wardenpoint_external_alerts_total{integration,type}` — alerts ever created.
* `wardenpoint_external_alert_events_total{integration,action}` — occurrences, one series per accumulation action (`suppress`, `message`, `escalate`). An action with no occurrences yet has no series at all rather than a zero.
* `wardenpoint_external_alerts_active{integration}` — alerts currently `firing`.

These count what the source system sent, not what was delivered: an integration whose alerts are all suppressed still shows a rising events total. Unlike the alert endpoint, this one does not care whether the integration is active, and it works for `email` integrations too.

## Path parameters

- `integration` string, uuid, required

## Response `200`

Prometheus text exposition. Not JSON — parse it as metrics, or hand the URL to a scraper.

## Other responses

- `401`: The integration secret is missing or wrong — or, on an HMAC integration, the request was not signed, the timestamp drifted beyond 300 seconds, or the signature was already used.
- `404`: No integration with this UUID.
- `429`: More than 60 scrapes a minute from one IP. A 15-second scrape interval is well inside it.

---

[API](https://skmtc.dev/wardenpoint/apis/wardenpoint-api.md) · [All operations](https://skmtc.dev/wardenpoint/apis/wardenpoint-api/llms.txt) · [OpenAPI document](https://skmtc.dev/wardenpoint/apis/wardenpoint-api/revisions/259ee445728e?raw)