Skip to main content
GET
List alert instances

Authorizations

Authorization
string
header
required

Use an Observe API key from the management console. The key selects the project and must grant the permission listed on the operation. Keep this key on your server.

Query Parameters

alertRuleID
string

Filter to instances of a single alert rule (format aru-<number>).

alertInstanceID
string

Filter to a single alert instance (format ain-<number>), so an alert email can deep-link to exactly the alert it names.

status
enum<string>[]

Filter by instance status - comma-separated, and read as "or". A set rather than one value because the panel's status cards are a multi-select: asking for firing and pending separately would page the two answers independently and leave them impossible to merge into one ordered list.

Maximum array length: 5
Available options:
normal,
pending,
firing,
no_data,
error
ruleName
string

Filter to alerts whose rule's name contains this text, so one search box can serve both the rules list and the flat alert list. It filters and does not project: the alerts that come back carry their rule's id, as they always do, and not its name.

Maximum string length: 255
orderBy
enum<string>
default:lastEvaluated

Field to order by. lastEvaluated, the default, is the order the panel's lists open in; the others are the columns those lists can be sorted on. status orders by urgency (normal, no_data, error, pending, firing) and severity by level (info, warning, critical) rather than alphabetically, so descending puts the alert that needs attention first; ties within such a column resolve newest-evaluated first. An instance with no value for the field - never notified, no severity yet - sorts as the lowest.

Available options:
lastEvaluated,
status,
severity,
currentValue,
lastStatusChange,
lastNotification
orderDirection
enum<string>
default:desc

Order direction.

Available options:
asc,
desc
page
integer
default:1

The page number to retrieve for paginated results.

Example:

1

pageSize
integer
default:10

The number of items to return per page. Useful for pagination.

Example:

20

Response

Paginated list of alert instances. Paging metadata is returned in X-Corbado-Page, X-Corbado-TotalPages, and X-Corbado-TotalItems response headers.

Maximum array length: 1000
id
string
required

Alert instance ID (format ain-<number>).

alertRuleID
string
required

Alert rule ID (format aru-<number>).

alertRuleName
string
required

Name of the rule this alert belongs to, resolved from alertRuleID so an alert can be displayed without a second request. Display-only - requests still reference the rule by alertRuleID.

labelSetHash
string
required
hasOverride
boolean
required

Whether this alert is judged by one of its rule's overrides rather than by the rule's own values, as of the rule's current configuration.

createdMs
integer<int64>
required
updatedMs
integer<int64>
required
status
enum<string>
required
Available options:
normal,
pending,
firing,
no_data,
error
labels
object
currentValue
number<double>
thresholdValue
number<double>
firstBreachedMs
integer<int64>
lastEvaluatedMs
integer<int64>
lastStatusChangeMs
integer<int64>
lastNotificationMs
integer<int64>
errorMessage
string
severity
enum<string>

The severity band matched at the last evaluation, absent when none matched. Status says whether the instance is firing, level says how badly, and the two move independently. The level is deliberately not part of labelSetHash - an identity that moved with the level would fork one incident into two.

Available options:
info,
warning,
critical
highWaterSeverity
enum<string>

The most severe level this firing episode has already notified at, reset when the instance returns to normal. It is why a de-escalation is silent and why a re-escalation below this mark does not mail again: an instance notifies once per level per episode, and only ever as things get worse.

Available options:
info,
warning,
critical
noDataReason
enum<string>

Why this instance has no value, absent when it has one. The first three come from the rule type - no rows at all, an empty denominator, or a group under the sample gate - and the rest from the framework: the rule produced more groups than maxInstances, its grouping was edited, a dimension it groups by is gone from the project, or the series it reads is no longer available for the project. Missing, zero and errored stay three distinct things, so a group with no logins never reads as a 0% success rate.

Available options:
no_data,
division_by_zero,
guard_not_met,
too_many_instances,
rule_changed,
dimension_not_available,
series_not_available
previousStatus
enum<string>
Available options:
normal,
pending,
firing,
no_data,
error