Retrieves a single alert by its ID from any context (dashboard or exploration).
URL parameters
The unique identifier of the alert.
Headers
Bearer $TOKEN
Returns the alert.
Response body
The specified alert was not found.
Response attributes
The ID of the alert.
Always alert.
The ID of the dashboard the alert's chart is on. Only present for alerts on a dashboard chart.
The ID of the chart the alert watches. Only present for alerts on a dashboard chart.
The ID of the exploration the alert watches. Only present for alerts on an exploration.
The name of the alert.
The type of alert: threshold for a static value, relative for a percentage change, or anomaly_rrcf for anomaly detection.
The time window of data each check looks at, in seconds, or null when it isn't set.
How long the condition must hold before an incident starts, in seconds, where 0 starts it immediately.
How long the condition must stay resolved before the incident recovers, in seconds, or null when incidents never recover automatically.
The size of the buckets the data is aggregated into before each bucket is evaluated, in seconds, or null when it isn't set.
The series the alert is limited to, where an empty array means every series.
The series the alert ignores while watching every other series, empty when series_names is used instead.
How the alert picks its sources: source_variable for the sources in source_variable, platforms_single_source for the one source in source_variable limited to source_platforms, or platforms_all_sources for every source matching source_platforms.
The platforms that narrow the alert's sources when source_mode is platforms_single_source or platforms_all_sources.
The sources the alert runs on, as source: followed by comma-separated source table names, or null when none is set.
The custom description of incidents the alert starts, or null when none is set.
The custom name of incidents the alert starts, or null when none is set.
Whether each series that breaches the condition starts its own incident.
Up to 4 more conditions combined with the alert's own condition using AND, so the alert fires only when all of them breach in the same time bucket.
The type of the condition: threshold or relative.
The comparison the condition makes, from the same values as operator.
The value the condition compares against, or null when it compares string_value.
The exact text the condition compares against, or null when it compares value.
The series the condition is limited to, where an empty array means every series.
The series the condition ignores.
Values the alert uses instead of the chart's own for its variables, matched by variable name.
The name of the variable.
The values the alert uses for the variable, as strings.
The label of the selected value. Only present when set.
When the alert was created, as an ISO 8601 date-time in UTC.
When the alert was last updated, as an ISO 8601 date-time in UTC.
The comparison operator: equal, not_equal, higher_than, higher_than_or_equal, lower_than, or lower_than_or_equal for threshold alerts, and increases_by, decreases_by, or changes_by for relative alerts. Omitted for anomaly_rrcf alerts.
The threshold for threshold alerts or the percentage change for relative alerts, or null when the alert compares string_value. Omitted for anomaly_rrcf alerts.
The exact text the alert compares against with equal or not_equal, or null when it compares value. Only present for threshold alerts.
What a check does when the query returns no data: treat_as_zero, dont_fire, treat_as_previous, or start_incident. Omitted for anomaly_rrcf alerts.
How far a value must deviate from its predicted value to trigger the alert, shown as Significance in the app. Only present for anomaly_rrcf alerts.
Which anomalies trigger the alert: any, higher, or lower. Only present for anomaly_rrcf alerts.
How many days of history the anomaly detection model is trained on, from 1 to 30. Only present for anomaly_rrcf alerts.
How often the alert is checked, in seconds. When it isn't set, it falls back to aggregation_interval, then query_period, then 60, and on a tail_chart it grows with query_period from 60 to 900. Omitted for anomaly_rrcf alerts.
Whether incidents notify by phone call. Omitted when escalation_target is an escalation policy.
Whether incidents notify by SMS. Omitted when escalation_target is an escalation policy.
Whether incidents notify by e-mail. Omitted when escalation_target is an escalation policy.
Whether incidents send push notifications. Omitted when escalation_target is an escalation policy.
Whether incidents send critical push notifications that bypass Do Not Disturb. Omitted when escalation_target is an escalation policy.
Whether the alert is paused.
Why the alert is paused, in the words the app shows, or null when the alert isn't paused.
Where the alert's incidents go: the string current_team, an object naming an escalation policy or a team, or the string unknown when the target can't be found.
The ID of the escalation policy. Only present when the target is a policy.
The name of the escalation policy. Only present when the target is a policy.
The ID of the team. Only present when the target is a team.
The name of the team. Only present when the target is a team.
Custom metadata added to the alert's incidents, mapping each key to an array of string values, or null when there is none.
The response shape varies by alert_type. Threshold and relative alerts include operator, value, on_missing_data, and check_period, and threshold alerts also include string_value. Anomaly alerts include anomaly_sensitivity and anomaly_trigger instead. Dashboard alerts include dashboard_id and chart_id. Exploration alerts include exploration_id.
We use cookies to authenticate users, improve the product user experience, and for personalized ads. Learn more.