URL parameters
The unique identifier of the exploration to add the alert to.
Headers
Bearer $TOKEN
Body parameters
The name of the alert.
The type of alert. threshold for static values, relative for percentage changes, and anomaly_rrcf for ML-based anomaly detection.
The comparison operator. Required for threshold and relative alerts. For threshold: equal, not_equal, higher_than, higher_than_or_equal, lower_than, lower_than_or_equal. For relative: increases_by, decreases_by, changes_by. Not used for anomaly_rrcf alerts.
The numeric value for the alert condition. For threshold alerts, this is the static threshold. For relative alerts, this is the percentage change. Required for threshold and relative types unless string_value is set. A value of 0 is valid.
An alternative to value for threshold alerts when matching an exact string. If string_value is set, value is not required. Only valid with equal or not_equal operators.
What to do when the query returns no data: treat_as_zero, dont_fire, treat_as_previous, or start_incident. Only for threshold and relative alerts. Default: dont_fire.
How often to evaluate the alert condition, in seconds. Required for threshold and relative alert types. Not used for anomaly_rrcf alerts.
The time window in seconds for the data being analyzed. If not provided, falls back to aggregation_interval, then check_period.
The size of data buckets in seconds for aggregating and evaluating the metric. If not provided, falls back to query_period, then check_period.
The duration in seconds that a condition must be met before an alert is triggered. A value of 0 triggers the alert immediately. Default: 60.
The duration in seconds that a condition must be resolved before an incident is recovered. A value of 0 recovers the alert immediately, null means never automatically recover an incident. Default: 60.
How far the value must deviate from its predicted value to trigger an alert, from 1 to 10. Higher values require a larger deviation and trigger fewer alerts. Shown as Significance in the app. Only for anomaly_rrcf alerts. Default: 5.
Defines which anomalies trigger an alert: any (both higher and lower), higher, or lower. Only for anomaly_rrcf alerts.
How many days of history the anomaly detection model is trained on, from 1 to 30. Only for anomaly_rrcf alerts. Default: 7.
An array of strings to filter the alert to specific data series. Cannot be combined with series_names_except. Send an empty array to alert on any series.
An array of strings to alert on all data series except the listed ones. Cannot be combined with series_names.
An array of up to 4 additional conditions, each combined with the primary condition using logical AND, so the alert only fires where every condition is breached in the same time bucket. Each condition is an object with an alert_type of threshold or relative, an operator, a value or string_value, and an optional series_names or series_names_except scope. Anomaly detection cannot be used as an additional condition. Send an empty array to clear all additional conditions. See Multiple conditions for an example.
The variable name for the source selection. If not provided, derived automatically from the exploration preset's source variable.
The mode for source selection. Valid values: source_variable, platforms_single_source, platforms_all_sources.
An array of platform names to filter the sources this alert runs on.
A custom description template for the incident created by this alert. Supports {{value}} placeholder.
Whether a separate incident will be created for each data series that triggers the alert.
Defines where to send notifications. Defaults to current_team, for details see Escalation targets.
Enable phone call notifications. Only used if escalation_target is not a policy.
Enable SMS notifications. Only used if escalation_target is not a policy.
Enable email notifications. Only used if escalation_target is not a policy.
Enable push notifications. Only used if escalation_target is not a policy.
Enable critical push notifications that bypass Do Not Disturb. Only used if escalation_target is not a policy.
A key-value object for custom metadata to be included in incidents. Both keys and values must be strings. For details, see Metadata.
Set to true to create the alert in a paused state.