GET /api/v1/alerts/rules
GET /api/v1/alerts/rules/{id}
alerts.read.
curl http://localhost:5080/api/v1/alerts/rules \
-H "authorization: Bearer $MS_JWT"
[
{
"id": "3KEDBLvTYO6DnWi8H9S9MNLpPT7",
"org_id": "<organization-id>",
"name": "High error rate",
"description": "More than 100 errors in five minutes",
"enabled": true,
"kind": "scheduled",
"query": {
"language": "sql",
"statement": "SELECT count(*) AS c FROM app WHERE level = 'error'",
"period_secs": 300,
"stream": { "name": "app", "stream_type": "logs" }
},
"trigger": { "operator": "gt", "threshold": 100.0, "for_periods": 2, "silence_secs": 0 },
"anomaly_params": null,
"thresholds": [],
"severity": "critical",
"escalation_policy_id": "default",
"labels": { "team": "checkout" },
"annotations": {},
"last_eval_at": null,
"last_state": { "kind": "healthy" },
"created_at": 1790000000000000,
"updated_at": 1790000000000000
}
]
| Field | Notes |
|---|---|
id, org_id | The rule and organization identifiers. |
created_at, updated_at | Microseconds since the Unix epoch. |
last_eval_at | The time of the latest completed evaluation, in microseconds. null until the first one. A query that fails or times out leaves it unchanged. |
last_state | The outcome of that evaluation: {"kind": "healthy"} when the condition did not match, {"kind": "pending", "consecutive": 1} while it matches for fewer than for_periods evaluations, and {"kind": "firing"} once it matched long enough. A firing rule inside its silence_secs cool-down opens no new incident. |
id answers 404.