Skip to main content
GET
Get a single monitor alert with evidence and lifecycle history

Authorizations

Authorization
string
header
required

JWT token (USER, AGENT, or SERVICE auth)

Path Parameters

alertId
string<uuid>
required

Response

200 - */*

OK

findingId
string<uuid>
detector
enum<string>
Available options:
POLICY_INVOCATION_ANOMALY,
POLICY_BLOCK_ANOMALY,
POLICY_WARN_ANOMALY,
POLICY_HITL_HOLD_ANOMALY,
AGENT_VOLUME_ANOMALY,
USER_VOLUME_ANOMALY,
MCP_SERVER_VOLUME_ANOMALY,
LLM_GATEWAY_VOLUME_ANOMALY,
CHANNEL_VOLUME_ANOMALY,
TENANT_ERROR_SPIKE,
TENANT_WARN_SPIKE,
TENANT_HITL_SPIKE,
LLM_PROVIDER_ERROR_RATE_SPIKE,
LLM_GATEWAY_FAILOVER_SPIKE,
MCP_SERVER_ERROR_RATE_SPIKE,
DORMANT_AGENT_REACTIVATION,
DORMANT_USER_REACTIVATION,
NOVEL_TOOL_CALL,
NEW_MCP_SERVER_BINDING
severity
enum<string>
Available options:
LOW,
MEDIUM,
HIGH,
CRITICAL
direction
enum<string>
Available options:
SPIKE,
DROP
status
enum<string>
Available options:
OPEN,
ACKNOWLEDGED,
RESOLVED,
DISMISSED
subject
object
detectedAt
string<date-time>
summary
string
evidence
object
history
object[]
acknowledgedByLabel
string
resolvedByLabel
string
suppressedUntil
string<date-time>
acknowledgedAt
string<date-time>
resolvedAt
string<date-time>
dismissedReason
enum<string>
Available options:
EXPECTED,
FALSE_POSITIVE,
KNOWN_ISSUE