Discovery

curl "http://localhost:5080/api/v1/alerts/discovery/findings?status=open" \
  -H "authorization: Bearer $MS_TOKEN"

[
  {
    "id": "3KF0Yb6n1VxP8a2Qm7Ld4Rs9Tu1",
    "org_id": "<organization-id>",
    "kind": "apm_anomaly",
    "key": "apm_anomaly|default/checkout|production|error_rate",
    "severity": "critical",
    "subject": "default/checkout",
    "environment": "production",
    "metric": "error_rate",
    "title": "Error rate of checkout moved",
    "value": 0.12,
    "baseline": 0.004,
    "started_at": 1790000000000000,
    "last_seen_at": 1790002400000000,
    "ended_at": null,
    "missed_rounds": 0,
    "detail": {"previous": 0.004, "last_week": 0.005, "changes": []},
    "created_at": 1790000300000000,
    "updated_at": 1790002400000000
  }
]

curl "http://localhost:5080/api/v1/alerts/discovery/findings?status=open" \
  -H "authorization: Bearer $MS_TOKEN"

[
  {
    "id": "3KF0Yb6n1VxP8a2Qm7Ld4Rs9Tu1",
    "org_id": "<organization-id>",
    "kind": "apm_anomaly",
    "key": "apm_anomaly|default/checkout|production|error_rate",
    "severity": "critical",
    "subject": "default/checkout",
    "environment": "production",
    "metric": "error_rate",
    "title": "Error rate of checkout moved",
    "value": 0.12,
    "baseline": 0.004,
    "started_at": 1790000000000000,
    "last_seen_at": 1790002400000000,
    "ended_at": null,
    "missed_rounds": 0,
    "detail": {"previous": 0.004, "last_week": 0.005, "changes": []},
    "created_at": 1790000300000000,
    "updated_at": 1790002400000000
  }
]

GET /api/v1/alerts/discovery/findings
GET /api/v1/alerts/discovery/findings/{id}

Lists what discovery found, the most recently seen first, or reads one finding. Requires alerts.discovery.read. Query parameters

Parameter	Description
`status`	`open` (default), `ended`, or `all`.
`kind`	`apm_anomaly`, `apm_regression`, `rum_new_issue`, or `rum_regressed_issue`.
`limit`	100 by default, at most 500.

Finding fields

Field	Description
`kind`	As above.
`key`	What tells the same problem: the kind, the subject, and the metric.
`severity`	`warning`, `error`, or `critical`.
`subject`	An APM service (`namespace/name`) or a RUM application id.
`environment`, `metric`	The environment; the metric of an APM move: `error_rate`, `p95` (microseconds), or `throughput` (requests per second).
`title`	A sentence.
`value`, `baseline`	The figure now and what it is compared with.
`started_at`, `last_seen_at`, `ended_at`	When it started, was last seen, and ended (microseconds); no `ended_at` means open.
`missed_rounds`	Rounds in a row it was not seen; it ends at 3.
`detail`	An APM finding has `previous`, `last_week`, `version`, `previous_version`, and nearby `changes`; a RUM finding has `issue_id`, `application`, `error_type`, `location`, and `version`.

curl "http://localhost:5080/api/v1/alerts/discovery/findings?status=open" \
  -H "authorization: Bearer $MS_TOKEN"

[
  {
    "id": "3KF0Yb6n1VxP8a2Qm7Ld4Rs9Tu1",
    "org_id": "<organization-id>",
    "kind": "apm_anomaly",
    "key": "apm_anomaly|default/checkout|production|error_rate",
    "severity": "critical",
    "subject": "default/checkout",
    "environment": "production",
    "metric": "error_rate",
    "title": "Error rate of checkout moved",
    "value": 0.12,
    "baseline": 0.004,
    "started_at": 1790000000000000,
    "last_seen_at": 1790002400000000,
    "ended_at": null,
    "missed_rounds": 0,
    "detail": {"previous": 0.004, "last_week": 0.005, "changes": []},
    "created_at": 1790000300000000,
    "updated_at": 1790002400000000
  }
]

To turn findings into incidents, create a rule with query.discovery: {"kinds": [...], "subjects": [...], "environments": [...], "min_severity": "warning"}, each left out to take all. Saving gives the rule its one shape: split by finding, one incident per finding it takes, as severe as the finding, and low urgency unless trigger.urgency says otherwise.

Last modified on October 31, 2026

Overview

Authentication

Intake

Query

APM

RUM

Streams

Alerting

Correlation & Web

Platform & Administration