> ## Documentation Index > Fetch the complete documentation index at: https://docs.swarmd.ai/llms.txt > Use this file to discover all available pages before exploring further. # Acknowledge a monitor alert > **Security Requirements** | Auth Types | Entities | Permissions | Required Roles | |------------|----------|-------------|----------------| | USER | AUDIT | WRITE | AUDIT:WRITE | ## OpenAPI ````yaml /openapi/swarmd.json post /audit/v1/monitors/alerts/{alertId}/acknowledge openapi: 3.1.0 info: title: Relay version: v0 servers: - url: https://api.dev.swarmd.ai description: Development security: [] tags: - name: Policy Groups x-displayName: Policy Groups - name: Policy Bindings x-displayName: Policy Bindings - name: Evaluation Packs x-displayName: Evaluation Packs - name: Webhooks x-displayName: Webhooks - name: MCP JSON-RPC x-displayName: MCP JSON-RPC - name: Conversations x-displayName: Conversations - name: Human JSON-RPC x-displayName: Human JSON-RPC - name: Channel JSON-RPC x-displayName: Channel JSON-RPC - name: HITL Approvals x-displayName: HITL Approvals - name: Agent JSON-RPC x-displayName: Agent JSON-RPC - name: Tasks x-displayName: Tasks - name: Push Notifications x-displayName: Push Notifications - name: Messaging x-displayName: Messaging - name: LLM Runtime x-displayName: LLM Runtime - name: Agent Discovery x-displayName: Agent Discovery - name: MCP Servers x-displayName: MCP Servers - name: LLM Gateways x-displayName: LLM Gateways - name: Agents x-displayName: Agents - name: User Subscriptions x-displayName: User Subscriptions - name: LLM Providers x-displayName: LLM Providers - name: LLM Gateway Subscriptions x-displayName: LLM Gateway Subscriptions - name: Kill Switches x-displayName: Kill Switches - name: Channels x-displayName: Channels - name: Channel Subscriptions x-displayName: Channel Subscriptions - name: Agent Subscriptions x-displayName: Agent Subscriptions - name: Marketplace x-displayName: Marketplace - name: Identity Providers x-displayName: Identity Providers - name: Groups x-displayName: Groups - name: Authentication x-displayName: Authentication - name: Users x-displayName: Users - name: Tenants x-displayName: Tenants - name: mcp-consent-controller x-displayName: mcp-consent-controller - name: Audit Monitors x-displayName: Audit Monitors - name: Audit Integrity x-displayName: Audit Integrity - name: Audit Events x-displayName: Audit Events - name: Audit Traces x-displayName: Audit Traces - name: audit-rest-controller x-displayName: audit-rest-controller - name: Audit Dashboard x-displayName: Audit Dashboard - name: A2A Payments x-displayName: A2A Payments paths: /audit/v1/monitors/alerts/{alertId}/acknowledge: post: tags: - Audit Monitors summary: Acknowledge a monitor alert description: |- **Security Requirements** | Auth Types | Entities | Permissions | Required Roles | |------------|----------|-------------|----------------| | USER | AUDIT | WRITE | AUDIT:WRITE | operationId: acknowledgeMonitorAlert parameters: - name: alertId in: path required: true schema: type: string format: uuid requestBody: content: application/json: schema: $ref: '#/components/schemas/Audit_MonitorAlertLifecycleActionRequest' required: true responses: '200': description: OK content: '*/*': schema: $ref: '#/components/schemas/Audit_MonitorAlertDetail' security: - Audit_bearerAuth: [] components: schemas: Audit_MonitorAlertLifecycleActionRequest: type: object properties: note: type: string Audit_MonitorAlertDetail: type: object properties: findingId: type: string format: uuid detector: type: string enum: - POLICY_INVOCATION_ANOMALY - POLICY_BLOCK_ANOMALY - POLICY_WARN_ANOMALY - POLICY_HITL_HOLD_ANOMALY - AGENT_VOLUME_ANOMALY - USER_VOLUME_ANOMALY - MCP_SERVER_VOLUME_ANOMALY - LLM_GATEWAY_VOLUME_ANOMALY - CHANNEL_VOLUME_ANOMALY - TENANT_ERROR_SPIKE - TENANT_WARN_SPIKE - TENANT_HITL_SPIKE - LLM_PROVIDER_ERROR_RATE_SPIKE - LLM_GATEWAY_FAILOVER_SPIKE - MCP_SERVER_ERROR_RATE_SPIKE - DORMANT_AGENT_REACTIVATION - DORMANT_USER_REACTIVATION - NOVEL_TOOL_CALL - NEW_MCP_SERVER_BINDING severity: type: string enum: - LOW - MEDIUM - HIGH - CRITICAL direction: type: string enum: - SPIKE - DROP status: type: string enum: - OPEN - ACKNOWLEDGED - RESOLVED - DISMISSED subject: oneOf: - $ref: '#/components/schemas/Audit_Agent' - $ref: '#/components/schemas/Audit_Channel' - $ref: '#/components/schemas/Audit_LlmGateway' - $ref: '#/components/schemas/Audit_LlmProvider' - $ref: '#/components/schemas/Audit_McpServer' - $ref: '#/components/schemas/Audit_Policy' - $ref: '#/components/schemas/Audit_Tenant' - $ref: '#/components/schemas/Audit_User' detectedAt: type: string format: date-time summary: type: string evidence: oneOf: - $ref: '#/components/schemas/Audit_CustomQuery' - $ref: '#/components/schemas/Audit_DormantReactivation' - $ref: '#/components/schemas/Audit_EntityVolume' - $ref: '#/components/schemas/Audit_FirstSeen' - $ref: '#/components/schemas/Audit_InfraIncident' - $ref: '#/components/schemas/Audit_PolicyMetric' - $ref: '#/components/schemas/Audit_TenantActionSpike' history: type: array items: $ref: '#/components/schemas/Audit_MonitorAlertLifecycleEvent' acknowledgedByLabel: type: string resolvedByLabel: type: string suppressedUntil: type: string format: date-time acknowledgedAt: type: string format: date-time resolvedAt: type: string format: date-time dismissedReason: type: string enum: - EXPECTED - FALSE_POSITIVE - KNOWN_ISSUE Audit_Agent: allOf: - $ref: '#/components/schemas/Audit_MonitorSubject' - type: object properties: id: type: string format: uuid required: - id Audit_Channel: allOf: - $ref: '#/components/schemas/Audit_MonitorSubject' - type: object properties: id: type: string format: uuid required: - id Audit_LlmGateway: allOf: - $ref: '#/components/schemas/Audit_MonitorSubject' - type: object properties: id: type: string format: uuid required: - id Audit_LlmProvider: allOf: - $ref: '#/components/schemas/Audit_MonitorSubject' - type: object properties: id: type: string format: uuid required: - id Audit_McpServer: allOf: - $ref: '#/components/schemas/Audit_MonitorSubject' - type: object properties: id: type: string format: uuid required: - id Audit_Policy: allOf: - $ref: '#/components/schemas/Audit_MonitorSubject' - type: object properties: id: type: string format: uuid required: - id Audit_Tenant: allOf: - $ref: '#/components/schemas/Audit_MonitorSubject' - type: object properties: id: type: string format: uuid required: - id Audit_User: allOf: - $ref: '#/components/schemas/Audit_MonitorSubject' - type: object properties: id: type: string format: uuid required: - id Audit_CustomQuery: allOf: - $ref: '#/components/schemas/Audit_MonitorEvidence' - type: object properties: monitorType: type: string enum: - SYSTEM_TEMPLATE - THRESHOLD - CHANGE - OUTLIER metric: type: string enum: - REQUESTS - BLOCKS - WARNS - MASKS - HITL_HOLDS - ERRORS - ERROR_RATE_PCT - LATENCY_AVG_MS - LATENCY_P50_MS - LATENCY_P95_MS - LATENCY_P99_MS - LLM_CALLS - LLM_FAILOVERS - TOOL_CALLS - MCP_REQUESTS - USER_DISTINCT - AGENT_DISTINCT aggregation: type: string enum: - SUM - AVG - MIN - MAX - P50 - P95 - P99 - COUNT - COUNT_DISTINCT - RATE_PER_MIN window: type: string enum: - LAST_5M - LAST_15M - LAST_1H - LAST_4H - LAST_24H - LAST_7D groupBy: type: string enum: - NONE - AGENT - USER - MCP_SERVER - LLM_GATEWAY - LLM_PROVIDER - CHANNEL - POLICY observedValue: type: number comparisonValue: type: number threshold: type: number subjectLabel: type: string required: - aggregation - groupBy - metric - monitorType - window Audit_DormantReactivation: allOf: - $ref: '#/components/schemas/Audit_MonitorEvidence' - type: object properties: subjectType: type: string enum: - TENANT - AGENT - USER - LLM_PROVIDER - LLM_GATEWAY - MCP_SERVER - POLICY - CHANNEL subjectId: type: string format: uuid dormantDays: type: integer format: int32 recentEventCount: type: integer format: int64 required: - dormantDays - recentEventCount - subjectId - subjectType Audit_EntityVolume: allOf: - $ref: '#/components/schemas/Audit_MonitorEvidence' - type: object properties: subjectType: type: string enum: - TENANT - AGENT - USER - LLM_PROVIDER - LLM_GATEWAY - MCP_SERVER - POLICY - CHANNEL subjectId: type: string format: uuid direction: type: string enum: - SPIKE - DROP observedTotal: type: number observedPerMinute: type: number baselinePerMinute: type: number ratio: type: number sampleMinutes: type: integer format: int32 required: - baselinePerMinute - direction - observedPerMinute - observedTotal - ratio - sampleMinutes - subjectId - subjectType Audit_FirstSeen: allOf: - $ref: '#/components/schemas/Audit_MonitorEvidence' - type: object properties: subjectType: type: string enum: - TENANT - AGENT - USER - LLM_PROVIDER - LLM_GATEWAY - MCP_SERVER - POLICY - CHANNEL subjectId: type: string format: uuid observation: type: string enum: - TOOL_CALL - MCP_SERVER_BINDING key: type: string minLength: 1 lookbackDays: type: integer format: int32 occurrencesInRecent: type: integer format: int64 required: - key - lookbackDays - observation - occurrencesInRecent - subjectId - subjectType Audit_InfraIncident: allOf: - $ref: '#/components/schemas/Audit_MonitorEvidence' - type: object properties: subjectType: type: string enum: - TENANT - AGENT - USER - LLM_PROVIDER - LLM_GATEWAY - MCP_SERVER - POLICY - CHANNEL subjectId: type: string format: uuid incidentType: type: string enum: - ERROR_RATE - FAILOVER direction: type: string enum: - SPIKE - DROP observedTotal: type: number observedPerMinute: type: number baselinePerMinute: type: number ratio: type: number sampleMinutes: type: integer format: int32 required: - baselinePerMinute - direction - incidentType - observedPerMinute - observedTotal - ratio - sampleMinutes - subjectId - subjectType Audit_PolicyMetric: allOf: - $ref: '#/components/schemas/Audit_MonitorEvidence' - type: object properties: policyId: type: string format: uuid metric: type: string enum: - INVOCATIONS - BLOCKS - WARNS - HITL_HOLDS direction: type: string enum: - SPIKE - DROP observedTotal: type: number observedPerMinute: type: number baselinePerMinute: type: number ratio: type: number sampleMinutes: type: integer format: int32 required: - baselinePerMinute - direction - metric - observedPerMinute - observedTotal - policyId - ratio - sampleMinutes Audit_TenantActionSpike: allOf: - $ref: '#/components/schemas/Audit_MonitorEvidence' - type: object properties: action: type: string enum: - LOG - MASK - BLOCK - WARN - HUMAN_REVIEW_REQUIRED - ERROR direction: type: string enum: - SPIKE - DROP observedTotal: type: number observedPerMinute: type: number baselinePerMinute: type: number ratio: type: number sampleMinutes: type: integer format: int32 topContributors: type: array items: $ref: '#/components/schemas/Audit_PolicyContribution' unattributedCount: type: integer format: int64 required: - action - baselinePerMinute - direction - observedPerMinute - observedTotal - ratio - sampleMinutes - topContributors - unattributedCount Audit_MonitorAlertLifecycleEvent: type: object properties: at: type: string format: date-time action: type: string enum: - ACKNOWLEDGED - RESOLVED - DISMISSED - REOPENED actorId: type: string format: uuid actorLabel: type: string note: type: string Audit_MonitorSubject: discriminator: propertyName: type properties: type: type: string required: - type Audit_MonitorEvidence: discriminator: propertyName: kind properties: kind: type: string required: - kind Audit_PolicyContribution: type: object properties: policyId: type: string format: uuid count: type: integer format: int64 percentage: type: number required: - count - percentage - policyId securitySchemes: Audit_bearerAuth: type: http scheme: bearer bearerFormat: JWT description: JWT token (USER, AGENT, or SERVICE auth) ````