URL parameters
The unique identifier of the alert to update.
Headers
Bearer $TOKEN
Body parameters
A new name for the alert.
The type of alert. threshold for static values, relative for percentage changes, or anomaly_rrcf for ML-based anomaly detection. Cannot be changed after creation.
The comparison operator. Required for threshold and relative alerts. For threshold: equal, not_equal, higher_than, higher_than_or_equal, lower_than, lower_than_or_equal. For relative: increases_by, decreases_by, changes_by. Not used for anomaly_rrcf alerts.
The numeric value for the alert condition. For threshold alerts, this is the static threshold. For relative alerts, this is the percentage change. Required for threshold and relative types unless string_value is set. A value of 0 is valid.
An alternative to value for threshold alerts when matching an exact string. If string_value is set, value is not required. Only valid with equal or not_equal operators.
How often to evaluate the alert condition, in seconds. Required for threshold and relative alert types. Not used for anomaly_rrcf alerts.
The time window in seconds for the data being analyzed. If not provided, falls back to aggregation_interval, then check_period.
The size of data buckets in seconds for aggregating and evaluating the metric. If not provided, falls back to query_period, then check_period.
The duration in seconds that a condition must be met before an alert is triggered. A value of 0 triggers the alert immediately.
The duration in seconds that a condition must be resolved before an incident is recovered.
The sensitivity of the anomaly detection model, from 0 to 100. Higher values result in more alerts. Only for anomaly_rrcf alerts.
Defines which anomalies trigger an alert: any (both higher and lower), higher, or lower. Only for anomaly_rrcf alerts.
An array of strings to filter the alert to specific data series.
The variable name for the source selection. If not provided, derived automatically from the dashboard/exploration preset's source variable.
The mode for source selection. Valid values: source_variable, platforms_single_source, platforms_all_sources.
An array of platform names to filter the sources this alert runs on.
A custom description template for the incident created by this alert. Supports {{value}} placeholder.
Whether a separate incident will be created for each data series that triggers the alert.
Defines where to send notifications. Defaults to current_team, for details see Escalation targets.
Enable phone call notifications. Only used if escalation_target is not a policy.
Enable SMS notifications. Only used if escalation_target is not a policy.
Enable email notifications. Only used if escalation_target is not a policy.
Enable push notifications. Only used if escalation_target is not a policy.
Enable critical push notifications that bypass Do Not Disturb. Only used if escalation_target is not a policy.
A key-value object for custom metadata to be included in incidents. Both keys and values must be strings. This will replace all existing metadata. For details, see Metadata.
Whether the alert should be paused or active.