List active alerts

GET

Returns active alerts for the authenticated environment. By default this returns alerts active now. With at, it returns alerts active at the requested moment. You can optionally include the metrics list.

Query parameters

• at: optional, date-time; point-in-time selection. If omitted, uses now. With at, the system reconstructs alert state at the requested moment and returns only alerts active at that time
• expand: optional, comma-separated string; supported token: metrics; when used, each alert also includes the metrics array

Response

• 200 OK

Each item in the response is an Alert object.

[
  {
    "id": "alert-123",
    "lastSeenAt": "2025-11-13T12:34:56Z",
    "firstSeenAt": "2025-11-13T10:00:00Z",
    "active": true,
    "impact": "high",
    "activeNodes": 3,
    "activeMetrics": 5,
    "score": 2.1,
    "learningStatus": 0,
    "metrics": [
      {
        "nodeId": 10,
        "nodeName": "Order Service",
        "statTypeId": "3ef542f1-2c80-4c83-ae06-8741857ed78a",
        "statTypeName": "CPU Usage",
        "systemId": 101,
        "systemName": "Prod Cluster",
        "score": { "adjusted": 1.7, "contribution": 0.9 },
        "learningStatus": 0,
        "severity": "red"
      }
    ]
  }
]

Examples

• GET /v1/alerts
• GET /v1/alerts?expand=metrics
• GET /v1/alerts?at=2025-11-13T12:00:00Z
• GET /v1/alerts?at=2025-11-13T12:00:00Z&expand=metrics

Notes

• Without at, results come from current active snapshots and include score and learningStatus from the latest event