curl http://localhost:5080/api/v1/alerts/rules \
  -H "authorization: Bearer $MS_JWT"

[
  {
    "id": "3KEDBLvTYO6DnWi8H9S9MNLpPT7",
    "org_id": "<organization-id>",
    "name": "High error rate",
    "description": "More than 100 errors in five minutes",
    "enabled": true,
    "kind": "scheduled",
    "query": {
      "language": "sql",
      "statement": "SELECT count(*) AS c FROM app WHERE level = 'error'",
      "period_secs": 300,
      "stream": { "name": "app", "stream_type": "logs" }
    },
    "trigger": { "operator": "gt", "threshold": 100.0, "for_periods": 2, "silence_secs": 0 },
    "anomaly_params": null,
    "thresholds": [],
    "severity": "critical",
    "escalation_policy_id": "default",
    "labels": { "team": "checkout" },
    "annotations": {},
    "last_eval_at": null,
    "last_state": { "kind": "healthy" },
    "created_at": 1790000000000000,
    "updated_at": 1790000000000000
  }
]