Explore documentation
  1. Welcome to Telemetry 👋
  2. Quick start guide
  3. Wide events vs. metrics
  4. Ingesting data
    1. Better Stack collector
    2. Vector
    3. OpenTelemetry
    4. Ingesting via HTTP API
    5. Ingesting metrics
    6. Ingesting logs
    7. Migrating to Better Stack
  5. Using the product
    1. AI SRE ↗
    2. MCP server ↗
    3. Transforming ingested data
    4. Querying data
    5. Tracing
    6. Alerts
  6. Telemetry API
    1. Getting an API token
    2. Sources & collectors
    3. Dashboards
    4. Explorations
      1. Explorations API
      2. Exploration alerts API
        1. List exploration alerts GET
        2. Get a single alert GET
        3. Create an alert POST
        4. Update an alert PATCH
        5. Remove an alert DELETE
      3. Exploration groups API
    5. Alerts API
    6. Connections API
    7. Query API ↗
  7. Alternative to
    1. Lightstep

Get a single exploration alert

Retrieves a single alert by its ID, scoped to a specific exploration.

GET https://telemetry.betterstack.com/api/v2/explorations/{exploration_id}/alerts/{id}

URL parameters

exploration_id
required integer

The unique identifier of the exploration.

id
required integer

The unique identifier of the alert.

Headers

Authorization
required string

Bearer $TOKEN

200

The details of the specified alert.

Response body


  

    

  Threshold alert


  Anomaly alert



    
    

  

  

  

  
{
  "data": {
    "id": "12345",
    "type": "alert",
    "attributes": {
      "exploration_id": 789,
      "name": "High Error Rate",
      "alert_type": "threshold",
      "operator": "lower_than",
      "value": 50.0,
      "string_value": null,
      "check_period": 300,
      "query_period": 600,
      "confirmation_period": 120,
      "recovery_period": 60,
      "aggregation_interval": 300,
      "series_names": [],
      "source_variable": null,
      "source_mode": "source_variable",
      "source_platforms": [],
      "incident_cause": "Value dropped below threshold",
      "incident_per_series": false,
      "call": false,
      "sms": false,
      "email": true,
      "push": false,
      "critical_alert": false,
      "paused": false,
      "paused_reason": null,
      "escalation_target": "current_team",
      "metadata": {},
      "created_at": "2026-03-25T10:00:00.000Z",
      "updated_at": "2026-03-25T10:00:00.000Z"
    }
  }
}








  

  
{
  "data": {
    "id": "12346",
    "type": "alert",
    "attributes": {
      "exploration_id": 789,
      "name": "Anomaly Detection",
      "alert_type": "anomaly_rrcf",
      "anomaly_sensitivity": 75.0,
      "anomaly_trigger": "any",
      "query_period": 60,
      "confirmation_period": 60,
      "recovery_period": 0,
      "aggregation_interval": 60,
      "series_names": [],
      "source_variable": null,
      "source_mode": "source_variable",
      "source_platforms": [],
      "incident_cause": null,
      "incident_per_series": false,
      "call": false,
      "sms": false,
      "email": true,
      "push": false,
      "critical_alert": false,
      "paused": false,
      "paused_reason": null,
      "escalation_target": "current_team",
      "metadata": {},
      "created_at": "2026-03-25T10:00:00.000Z",
      "updated_at": "2026-03-25T10:00:00.000Z"
    }
  }
}
404

The specified exploration or alert was not found.

Example request

cURL
curl --request GET \
     --url "https://telemetry.betterstack.com/api/v2/explorations/123/alerts/789" \
     --header "Authorization: Bearer $TOKEN"


Alert response shape

The attributes in the alert response vary based on the alert_type.

Threshold response Relative response Anomaly response 
{
  "attributes": {
    "alert_type": "threshold",
    "operator": "higher_than",
    "value": 100,
    "string_value": null,
    "check_period": 300
  }
}
{
  "attributes": {
    "alert_type": "relative",
    "operator": "increases_by",
    "value": 50,
    "check_period": 300
  }
}
{
  "attributes": {
    "alert_type": "anomaly_rrcf",
    "anomaly_sensitivity": 75.0,
    "anomaly_trigger": "any"
  }
}

For threshold and relative alerts, the fields anomaly_sensitivity and anomaly_trigger are omitted. For anomaly_rrcf alerts, the fields operator, value, string_value, and check_period are omitted.

Previous article

List all alerts in an exploration

Next article

Create an exploration alert