Skip to main content
GET
List alert instances

Authorizations

​
Authorization
string
header
required

Use an Observe API key from the management console. The key selects the project and must grant the permission listed on the operation. Keep this key on your server.

Query Parameters

​
alertRuleID
string

Filter to instances of a single alert rule (format aru-<number>).

​
alertInstanceID
string

Filter to a single alert instance (format ain-<number>), so an alert email can deep-link to exactly the alert it names.

​
status
enum<string>[]

Filter by instance status - comma-separated, and read as "or". A set rather than one value because the panel's status cards are a multi-select: asking for firing and pending separately would page the two answers independently and leave them impossible to merge into one ordered list.

Maximum array length: 5
Available options:
normal,
pending,
firing,
no_data,
error
​
ruleName
string

Filter to alerts whose rule's name contains this text, so one search box can serve both the rules list and the flat alert list. It filters and does not project: the alerts that come back carry their rule's id, as they always do, and not its name.

Maximum string length: 255
​
orderBy
enum<string>
default:lastEvaluated

Field to order by. lastEvaluated, the default, is the order the panel's lists open in; the others are the columns those lists can be sorted on. status orders by urgency (normal, no_data, error, pending, firing) and severity by level (info, warning, critical) rather than alphabetically, so descending puts the alert that needs attention first; ties within such a column resolve newest-evaluated first. An instance with no value for the field - never notified, no severity yet - sorts as the lowest.

Available options:
lastEvaluated,
status,
severity,
currentValue,
lastStatusChange,
lastNotification
​
orderDirection
enum<string>
default:desc

Order direction.

Available options:
asc,
desc
​
page
integer
default:1

The page number to retrieve for paginated results.

Example:

1

​
pageSize
integer
default:10

The number of items to return per page. Useful for pagination.

Example:

20

Response

Paginated list of alert instances. Paging metadata is returned in X-Corbado-Page, X-Corbado-TotalPages, and X-Corbado-TotalItems response headers.

Maximum array length: 1000
​
id
string
required

Alert instance ID (format ain-<number>).

​
valueFormat
object
required

How the values and thresholds of a rule type are written for people. Values and thresholds stay raw numbers in every response; apply this to display them.

​
vocabulary
object
required

What the alert's rule calls its numbers, resolved from the rule's type and the variant it picks, so a list of alerts across rules names each value the way its rule does.

​
alertRuleID
string
required

Alert rule ID (format aru-<number>).

​
alertRuleName
string
required

Name of the rule this alert belongs to, resolved from alertRuleID so an alert can be displayed without a second request. Display-only - requests still reference the rule by alertRuleID.

​
ruleType
enum<string>
required

Type of the rule this alert belongs to; names what the alert measures and the shape of its evaluation details.

Available options:
login_success_rate,
relative_flow_count,
relative_subflow_count,
absolute_flow_count
​
labelSetHash
string
required
​
hasOverride
boolean
required

Whether this alert is judged by one of its rule's overrides rather than by the rule's own values, as of the rule's current configuration.

​
createdMs
integer<int64>
required
​
updatedMs
integer<int64>
required
​
status
enum<string>
required
Available options:
normal,
pending,
firing,
no_data,
error
​
labels
object
​
currentValue
number<double>
​
thresholdValue
number<double>
​
firstBreachedMs
integer<int64>
​
lastEvaluatedMs
integer<int64>
​
lastStatusChangeMs
integer<int64>
​
lastNotificationMs
integer<int64>
​
errorMessage
string
​
severity
enum<string>

The severity band matched at the last evaluation, absent when none matched. Status says whether the instance is firing, level says how badly, and the two move independently. The level is deliberately not part of labelSetHash - an identity that moved with the level would fork one incident into two.

Available options:
info,
warning,
critical
​
highWaterSeverity
enum<string>

The most severe level this firing episode has already notified at, reset when the instance returns to normal. It is why a de-escalation is silent and why a re-escalation below this mark does not mail again: an instance notifies once per level per episode, and only ever as things get worse.

Available options:
info,
warning,
critical
​
noDataReason
enum<string>

Why this instance has no value, absent when it has one. The first three come from the rule type - no rows at all, an empty denominator, or a group under the sample gate - and the rest from the framework: the rule produced more groups than maxInstances, its grouping was edited, a dimension it groups by is gone from the project, the series it reads is no longer available for the project, or the evaluation instant is outside the evaluation hours that apply to this instance. outside_evaluation_hours is the one reason that comes with any status, because outside its hours an instance keeps the status it had. Missing, zero and errored stay three distinct things, so a group with no logins never reads as a 0% success rate.

Available options:
no_data,
division_by_zero,
guard_not_met,
too_many_instances,
rule_changed,
dimension_not_available,
series_not_available,
outside_evaluation_hours
​
previousStatus
enum<string>
Available options:
normal,
pending,
firing,
no_data,
error
​
currentFiringID
string

While the alert is firing, a transition of its current firing (format atr-<number>), for GET /observe/alertFirings/{alertFiringID}. Absent otherwise.