# /alerts - List active alerts (cross-hierarchy)

**GET /alerts**

Retrieves active alerts from Mimir for the caller's scope, paginated. Each
alert is enriched with a `system` object (`name`, `type`) looked up from the
local `systems` table, so the UI can render the system column without an
extra round-trip per row.

Sortable by `starts_at` (default desc), `severity` (criticality rank: critical
> warning > info), `alertname`, or `status` (Alertmanager state). `fingerprint`
is used as a stable tiebreaker so pagination doesn't shift between requests.

Scope follows the same three modes as `/alerts/totals`:
- `organization_id` omitted → caller's full hierarchy (cross-tenant fan-out).
- `organization_id=X` → single tenant `X`.
- `organization_id=X&include=descendants` → `X` plus its sub-tree.

All filter params support **multiple values** (repeat the param): values within
the same filter are matched as OR; different filters AND together. Example:
`?severity=critical&severity=warning&alertname=CVE-2024-1234` returns
CVE-2024-1234 alerts that are critical or warning.

Per-tenant failures during fan-out (timeout, 5xx) are non-fatal: the rest of the
result is returned and the failure is reported in the `warnings` array.



## Servers
- Backend API server: https://my.nethesis.it/backend/api (Backend API server)


## Authentication methods
- Bearer auth


## Parameters


### Query parameters

- **organization_id** (array[string])
  Target organization ID(s). Repeat the param to pass multiple values.
  Optional for all roles except Customer (where it is ignored).

- **include** (string)
  Set to `descendants` together with `organization_id` to expand each value to its sub-tree.

- **page** (integer)
  1-based page number.

- **page_size** (integer)
  Page size. Default 50, max 100.

- **sort_by** (string)
  Sort column (allowlist). `assigned_user_name` sorts by the current
  assignee's display name (case-insensitive; unassigned alerts group
  together at one end) — active list only, history falls back to its
  default.

- **sort_direction** (string)

- **status** (array[string])
  Filter alerts by Alertmanager state. Supports multiple values.

- **severity** (array[string])
  Filter alerts by severity label. Supports multiple values.

- **system_key** (array[string])
  Filter alerts by system_key label. Supports multiple values.

- **alertname** (array[string])
  Filter alerts by alertname label (the alert "type" — e.g. `HighCPU`,
  `DiskFull`, `CVE-2024-1234`). Supports multiple values.

- **search** (string)
  Free-text search: case-insensitive substring match on the alert
  type, its summary and description (any language), the `service`
  label, the system name/key/FQDN, the company name and the
  assignee's name. Combines with the other filters (AND).

- **assigned_user_id** (array[string])
  Filter alerts by current assignee (logto_id of the user, as
  returned in `assigned_to.user_id`). Supports multiple values. The
  literal value `none` matches unassigned alerts, so
  `assigned_user_id=<my-id>&assigned_user_id=none` means "mine or up
  for grabs".



## Responses
### 200
Paginated list of active alerts

#### Body: application/json (object)
- **code** (integer)

- **message** (string)

- **data** (object)


### 400
Bad request - validation error

#### Body: application/json (object)
- **code** (integer)
  HTTP error code

- **message** (string)
  Error message

- **data** (object)


### 401
Unauthorized - invalid or missing token

#### Body: application/json (object)
- **code** (integer)

- **message** (string)

- **data** (object | null)


### 403
Forbidden - insufficient permissions

#### Body: application/json (object)
- **code** (integer)

- **message** (string)

- **data** (object | null)


### 500
Internal server error

#### Body: application/json (object)
- **code** (integer)

- **message** (string)

- **data** (object | null)



[Powered by Bump.sh](https://bump.sh)