# /alerts/config - Save the caller's alerting layer

**POST /alerts/config**

Saves the CALLER's alerting configuration layer (one row per
organization in alert_config_layers). The body is an
`AlertingConfigLayer`: three channel toggles plus three recipient
lists. Each recipient carries its own `severities[]`; email
recipients additionally carry `language` and `format`.

After save, the effective per-tenant Mimir YAML is recomputed
server-side (merge of all layers walking up to the Owner) and
pushed to every tenant in the caller's hierarchy with bounded
concurrency. Per-tenant push failures are returned in `warnings[]`;
the caller's layer is saved regardless of push outcome (Mimir can
be reconciled by saving again).

Additive-only contract: descendants can ADD recipients but cannot
disable channels enabled by ancestors. The server normalises any
explicit `false` in `enabled.{email,webhook,telegram}` from
non-Owner layers to null on storage.

Save+propagate is serialised per-organization (in-process mutex) to
prevent two concurrent saves from racing at the Mimir push step.
Body is capped at 1 MiB; oversized payloads are rejected with 413.

Requires `manage:alerts` permission.



## Servers
- Backend API server: https://my.nethesis.it/backend/api (Backend API server)


## Authentication methods
- Bearer auth


## Parameters



### Body: application/json (object)

- **enabled** (object)
  Per-layer enable/disable for each notification channel. Each value
  is tri-state:
    * `true`  — explicitly enabled at this layer
    * `false` — explicitly disabled (Owner only; non-Owner false is
               normalised to null on save)
    * `null`  — no opinion at this layer; effective state inherits
               from the merge of any ancestor layer that took a
               position. If no layer in the chain enables a channel,
               the channel stays off.

- **email_recipients** (array[object])

- **webhook_recipients** (array[object])

- **telegram_recipients** (array[object])



## Responses
### 200
Layer saved (and propagation attempted)

#### Body: application/json (object)
- **code** (integer)

- **message** (string)

- **data** (object)


### 400
Validation failed. `data.type` is always `validation_error`.
`data.errors[]` lists per-field failures with `key` set to the
JSON path (with dotted array indices, e.g.
`email_recipients.2.address`), `message` to a stable machine
code (`required`, `invalid_format`, `invalid_value`,
`invalid_scheme`, `host_not_allowed`, `must_be_future`, ...)
and `value` to the offending input when not sensitive.


#### Body: application/json (object)
- **code** (integer)
  HTTP error code

- **message** (string)
  Error message

- **data** (object)


### 401
Unauthorized - invalid or missing token

#### Body: application/json (object)
- **code** (integer)

- **message** (string)

- **data** (object | null)


### 403
Forbidden - insufficient permissions

#### Body: application/json (object)
- **code** (integer)

- **message** (string)

- **data** (object | null)


### 413
Request body exceeds the configured maximum (1 MiB).

#### Body: application/json (object)
- **code** (integer)

- **message** (string)


### 500
Internal server error

#### Body: application/json (object)
- **code** (integer)

- **message** (string)

- **data** (object | null)



[Powered by Bump.sh](https://bump.sh)