Alerts API

Alert management, acknowledgment, and resolution. This page lists all 8 endpoints in the Alerts area of the Visual Sentinel REST API.

Base URL: https://visualsentinel.com. Unless an endpoint says otherwise it accepts an API key or a session cookie, see Authentication. Most error responses use the ErrorResponse shape, see Errors and Rate limits.

Endpoints

List alerts: GET /api/alerts
Acknowledge alert: POST /api/alerts/{id}/acknowledge
Resolve alert: POST /api/alerts/{id}/resolve
Get alerts paused status: GET /api/alerts/pause-all
Pause all alerts: POST /api/alerts/pause-all
Get where slow and speed alerts go: GET /api/alerts/summary-routing
Set where slow and speed alerts go: PUT /api/alerts/summary-routing
List alert deliveries: GET /api/alerts/deliveries

List alerts

GET /api/alerts

Get all alerts with filtering and pagination.

Parameters

page (query, integer, optional): Default: 1.
limit (query, integer, optional): Default: 20. Maximum 100.
state (query, string, optional): One of: OPEN, ACKNOWLEDGED, RESOLVED.
severity (query, string, optional): One of: INFO, WARNING, CRITICAL.
monitorId (query, string (uuid), optional)

Responses

200: List of alerts. Body: AlertListResponse.

Acknowledge alert

POST /api/alerts/{id}/acknowledge

Mark an alert as acknowledged. Applies to alert-rule alerts: entries of the alert list with canAcknowledge true.

Parameters

id (path, string, required): Alert id from the alert list.

Request body (optional): object.

Field	Type	Required	Description
`note`	string	No	Max length 500.

Responses

200: Alert acknowledged. Body: Alert.
400: NOT_AN_ALERT: the id is an incident, recovery, server alert or notice entry of the alert list (source-prefixed id). The body carries source, and incidentId for incident entries. Also returned when the alert is already acknowledged. Body: ErrorResponse and object.
404: Alert not found.

Resolve alert

POST /api/alerts/{id}/resolve

Mark an alert as resolved. Applies to alert-rule alerts: entries of the alert list with canResolve true.

Parameters

id (path, string, required): Alert id from the alert list.

Request body (optional): object.

Field	Type	Required	Description
`note`	string	No	Max length 500.

Responses

200: Alert resolved. Body: Alert.
400: NOT_AN_ALERT: the id is an incident, recovery, server alert or notice entry of the alert list (source-prefixed id). The body carries source, and incidentId for incident entries. Also returned when the alert is already resolved. Body: ErrorResponse and object.
404: Alert not found.

Get alerts paused status

GET /api/alerts/pause-all

Check whether all alerts are currently paused.

Responses

200: Paused status. Body: object.

Field	Type	Required	Description
`paused`	boolean	No
`pausedAt`	string (date-time) or null (date-time)	No
`partiallyPaused`	boolean	No	Alerts are not paused, but some channels are switched off.

Pause all alerts

POST /api/alerts/pause-all

Pause or resume all alerting for the organization. While paused, no notification channel receives alerts; alerts still appear in the dashboard. Each channel keeps its own on or off setting, so resuming does not turn on a channel that was switched off.

Request body (required): object.

Field	Type	Required	Description
`paused`	boolean	Yes

Responses

200: Alerts paused or resumed. Body: object.

Field	Type	Required
`success`	boolean	No
`paused`	boolean	No
`pausedAt`	string (date-time) or null (date-time)	No
`channelsUpdated`	integer	No
`message`	string	No

Get where slow and speed alerts go

GET /api/alerts/summary-routing

Whether slow-response and speed-score alerts reach the workspace's channels right away or go in a weekly summary email. Down, visual change, certificate and domain alerts are not affected by this setting.

Responses

200: Current routing. Body: object.

Field	Type	Required	Description
`enabled`	boolean	No	False while the setting is not available yet: every route reads right away and PUT answers 409.
`slowResponse`	object	No
`slowResponse.route`	string	No	One of: `immediate`, `summary`.
`slowResponse.source`	string	No	chosen: someone picked it. quiet_default: the default for a workspace created after this setting was introduced that reached 3 sites. default: right away by default. One of: `chosen`, `quiet_default`, `default`.
`speedScore`	object	No
`speedScore.route`	string	No	One of: `immediate`, `summary`.
`speedScore.source`	string	No	chosen: someone picked it. quiet_default: the default for a workspace created after this setting was introduced that reached 3 sites. default: right away by default. One of: `chosen`, `quiet_default`, `default`.
`quietDefaultsAt`	string (date-time) or null (date-time)	No	When the workspace first reached 3 sites, for a workspace that starts on the weekly summary.
`siteThreshold`	integer	No
`summaryDay`	string	No	One of: `Monday`.

Set where slow and speed alerts go

PUT /api/alerts/summary-routing

Send slow-response or speed-score alerts right away, or put them in the weekly summary email (sent on Mondays to the email channels that get those alerts). The choice is stored even when it equals the current default. Needs write access.

Request body (required): object.

Field	Type	Required	Description
`slowResponse`	string	No	One of: `immediate`, `summary`.
`speedScore`	string	No	One of: `immediate`, `summary`.

Responses

200: Routing saved. Body: object.
400: Unknown field or value, or no field.
409: Not available yet.

Field	Type	Required	Description
`enabled`	boolean	No	False while the setting is not available yet: every route reads right away and PUT answers 409.
`slowResponse`	object	No
`slowResponse.route`	string	No	One of: `immediate`, `summary`.
`slowResponse.source`	string	No	chosen: someone picked it. quiet_default: the default for a workspace created after this setting was introduced that reached 3 sites. default: right away by default. One of: `chosen`, `quiet_default`, `default`.
`speedScore`	object	No
`speedScore.route`	string	No	One of: `immediate`, `summary`.
`speedScore.source`	string	No	chosen: someone picked it. quiet_default: the default for a workspace created after this setting was introduced that reached 3 sites. default: right away by default. One of: `chosen`, `quiet_default`, `default`.
`quietDefaultsAt`	string (date-time) or null (date-time)	No	When the workspace first reached 3 sites, for a workspace that starts on the weekly summary.
`siteThreshold`	integer	No
`summaryDay`	string	No	One of: `Monday`.

List alert deliveries

GET /api/alerts/deliveries

Lists the alerts sent for your monitors, grouped per alert event with the outcome for each channel, plus a seven-day summary. 50 events per page. Results may be up to 15 seconds old. API keys need the alerts:read scope.

Parameters

range (query, string, optional): today starts at 00:00 UTC today; 7d (the default, also used for any other value) starts six days before the current time. One of: today, 7d. Default: 7d.
status (query, string, optional): not_sent returns only channel deliveries that were not sent; any other value returns all. One of: all, not_sent. Default: all.
page (query, integer, optional): Page number. Values below 1 or not numeric are treated as 1. Default: 1. Minimum 1.

Responses

200: Delivery log. Body: AlertDeliveryLog.
401: Not signed in, or no valid API key.

Data models

Request and response shapes these endpoints use: AlertListResponse, Alert, AlertDeliveryLog.

Generated from the OpenAPI 3.1 specification at https://docs.visualsentinel.com/openapi.json, the same file the interactive reference reads.