curl --request GET \
--url https://api.cloud.corbado.io/v1/observe/alertInstances \
--header 'Authorization: Bearer <token>'import requests
url = "https://api.cloud.corbado.io/v1/observe/alertInstances"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://api.cloud.corbado.io/v1/observe/alertInstances', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.cloud.corbado.io/v1/observe/alertInstances",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.cloud.corbado.io/v1/observe/alertInstances"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://api.cloud.corbado.io/v1/observe/alertInstances")
.header("Authorization", "Bearer <token>")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.cloud.corbado.io/v1/observe/alertInstances")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'
response = http.request(request)
puts response.read_body[
{
"id": "<string>",
"alertRuleID": "<string>",
"alertRuleName": "<string>",
"labelSetHash": "<string>",
"hasOverride": true,
"createdMs": 123,
"updatedMs": 123,
"status": "normal",
"labels": {},
"currentValue": 123,
"thresholdValue": 123,
"firstBreachedMs": 123,
"lastEvaluatedMs": 123,
"lastStatusChangeMs": 123,
"lastNotificationMs": 123,
"errorMessage": "<string>",
"severity": "info",
"highWaterSeverity": "info",
"noDataReason": "no_data",
"previousStatus": "normal"
}
]{
"error": {
"message": "Validation failed",
"details": [
{
"field": "projectID",
"message": "required"
}
]
}
}List alert instances
Lists Observe alert instances for the project. Paginated; newest-evaluated first unless orderBy says otherwise. Empty until the alerting evaluator runs.
Required API key permission: observe:alerts:read.
curl --request GET \
--url https://api.cloud.corbado.io/v1/observe/alertInstances \
--header 'Authorization: Bearer <token>'import requests
url = "https://api.cloud.corbado.io/v1/observe/alertInstances"
headers = {"Authorization": "Bearer <token>"}
response = requests.get(url, headers=headers)
print(response.text)const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};
fetch('https://api.cloud.corbado.io/v1/observe/alertInstances', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.cloud.corbado.io/v1/observe/alertInstances",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "GET",
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.cloud.corbado.io/v1/observe/alertInstances"
req, _ := http.NewRequest("GET", url, nil)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.get("https://api.cloud.corbado.io/v1/observe/alertInstances")
.header("Authorization", "Bearer <token>")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.cloud.corbado.io/v1/observe/alertInstances")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'
response = http.request(request)
puts response.read_body[
{
"id": "<string>",
"alertRuleID": "<string>",
"alertRuleName": "<string>",
"labelSetHash": "<string>",
"hasOverride": true,
"createdMs": 123,
"updatedMs": 123,
"status": "normal",
"labels": {},
"currentValue": 123,
"thresholdValue": 123,
"firstBreachedMs": 123,
"lastEvaluatedMs": 123,
"lastStatusChangeMs": 123,
"lastNotificationMs": 123,
"errorMessage": "<string>",
"severity": "info",
"highWaterSeverity": "info",
"noDataReason": "no_data",
"previousStatus": "normal"
}
]{
"error": {
"message": "Validation failed",
"details": [
{
"field": "projectID",
"message": "required"
}
]
}
}Authorizations
Use an Observe API key from the management console. The key selects the project and must grant the permission listed on the operation. Keep this key on your server.
Query Parameters
Filter to instances of a single alert rule (format aru-<number>).
Filter to a single alert instance (format ain-<number>), so an alert email can deep-link to exactly
the alert it names.
Filter by instance status - comma-separated, and read as "or". A set rather than one value because the panel's status cards are a multi-select: asking for firing and pending separately would page the two answers independently and leave them impossible to merge into one ordered list.
5normal, pending, firing, no_data, error Filter to alerts whose rule's name contains this text, so one search box can serve both the rules list and the flat alert list. It filters and does not project: the alerts that come back carry their rule's id, as they always do, and not its name.
255Field to order by. lastEvaluated, the default, is the order the panel's lists open in; the others are the columns those lists can be sorted on. status orders by urgency (normal, no_data, error, pending, firing) and severity by level (info, warning, critical) rather than alphabetically, so descending puts the alert that needs attention first; ties within such a column resolve newest-evaluated first. An instance with no value for the field - never notified, no severity yet - sorts as the lowest.
lastEvaluated, status, severity, currentValue, lastStatusChange, lastNotification Order direction.
asc, desc The page number to retrieve for paginated results.
1
The number of items to return per page. Useful for pagination.
20
Response
Paginated list of alert instances. Paging metadata is returned in X-Corbado-Page, X-Corbado-TotalPages, and X-Corbado-TotalItems response headers.
1000Alert instance ID (format ain-<number>).
Alert rule ID (format aru-<number>).
Name of the rule this alert belongs to, resolved from alertRuleID so an alert can be displayed without a second request. Display-only - requests still reference the rule by alertRuleID.
Whether this alert is judged by one of its rule's overrides rather than by the rule's own values, as of the rule's current configuration.
normal, pending, firing, no_data, error Show child attributes
Show child attributes
The severity band matched at the last evaluation, absent when none matched. Status says whether the instance is firing, level says how badly, and the two move independently. The level is deliberately not part of labelSetHash - an identity that moved with the level would fork one incident into two.
info, warning, critical The most severe level this firing episode has already notified at, reset when the instance returns to normal. It is why a de-escalation is silent and why a re-escalation below this mark does not mail again: an instance notifies once per level per episode, and only ever as things get worse.
info, warning, critical Why this instance has no value, absent when it has one. The first three come from the rule type - no rows at all, an empty denominator, or a group under the sample gate - and the rest from the framework: the rule produced more groups than maxInstances, its grouping was edited, a dimension it groups by is gone from the project, or the series it reads is no longer available for the project. Missing, zero and errored stay three distinct things, so a group with no logins never reads as a 0% success rate.
no_data, division_by_zero, guard_not_met, too_many_instances, rule_changed, dimension_not_available, series_not_available normal, pending, firing, no_data, error Was this page helpful?