Get an alert
The alerts.get operation: GET /api/v1/alerts/{id} in the REST API and the alerts_get tool in the MCP server.
GET
/api/v1/alerts/{id}Returns one alert of the organization in the mode of the request: what happened (code, severity,
message), where to act on it (link, a console page), how often it was raised while unresolved
(occurrences), who acknowledged or resolved it, and how it was delivered (emails sent, Slack channels).
An alert your role may not see answers resource_not_found, as if it didn't exist.
At a glance
- REST:
GET /api/v1/alerts/{id} - MCP tool:
alerts_get - Operation ID:
alerts.get - Scope: Organization
- Permission:
org:read - Risk tier:
read - Dry run: Not supported
- Idempotency: Not needed (read only)
- Modes: Test and live
- Authentication: API key with the
org:readscope - Since: M7
Request
Path parameters
| Field | Type | Description |
|---|---|---|
id | alr_… ID |
Query parameters
This operation takes no query parameters.
Response
200 OK with a JSON object:
| Field | Type | Description |
|---|---|---|
id | alr_… ID | |
object | "alert" | |
code | string | |
severity | one of info, high, critical | |
family | one of 14 values, e.g. registrations, filings, ledger (all in the OpenAPI document) | |
message | string | |
link | string | |
entityId | ent_… ID or null | |
brandId | brd_… ID or null | |
livemode | boolean | |
status | one of open, acked, resolved | |
occurrences | integer (at least 1) | |
lastRaisedAt | date-time | |
acknowledgedAt | date-time or null | |
acknowledgedBy | string or null | |
resolvedAt | date-time or null | |
resolvedBy | string or null | |
delivery | object | |
delivery.status | one of none, pending, delivered, failed | |
delivery.attempts | integer (at least 0) | |
delivery.lastError | string or null | |
delivery.email | object | |
delivery.email.sent | integer (at least 0) | |
delivery.email.failed | integer (at least 0) | |
delivery.slack | array of object | |
delivery.slack[].channelId | string | |
delivery.slack[].status | one of sent, failed | |
delivery.slack[].at | date-time | |
delivery.slack[].error | string or null | |
createdAt | date-time | |
updatedAt | date-time | |
version | integer (at least 1) |
Examples
An automatic block
HTTP
GET /api/v1/alerts/alr_01m4ttwd3veh9apbewxheq5xab
Authorization: Bearer or_test_…
Response (200):
JSON
{
"id": "alr_01m4ttwd3veh9apbewxheq5xab",
"object": "alert",
"code": "REG_AUTO_BLOCKED",
"severity": "critical",
"family": "registrations",
"message": "EU_OSS_NON_UNION was blocked for new consumer sales on 2026-11-07: the grace deadline 2026-11-10 is near and no application was submitted.",
"link": "/console/acme/e/acme-hr/jurisdictions/EU_OSS_NON_UNION",
"entityId": "ent_01m4ttwd3veh9apbewxheq5xh4",
"brandId": null,
"livemode": true,
"status": "open",
"occurrences": 1,
"lastRaisedAt": "2026-10-13T12:00:00.000Z",
"acknowledgedAt": null,
"acknowledgedBy": null,
"resolvedAt": null,
"resolvedBy": null,
"delivery": {
"status": "delivered",
"attempts": 1,
"lastError": null,
"email": {
"sent": 2,
"failed": 0
},
"slack": [
{
"channelId": "sec_01m4ttwd3veh9apbewxheq5xad",
"status": "sent",
"at": "2026-10-13T12:00:00.000Z",
"error": null
}
]
},
"createdAt": "2026-10-13T12:00:00.000Z",
"updatedAt": "2026-10-13T12:00:00.000Z",
"version": 1
}
Errors
| Code | HTTP status | When | What to do |
|---|---|---|---|
resource_not_found | 404 | No alert with this ID that you may see, in this organization and mode. | Check the ID and that your credentials are scoped to the right organization, entity, brand and mode. |
permission_denied | 403 | You can't read this organization's inbox. | Ask an organization owner or admin for a role or scope that allows this action. |
It can also return these common errors: validation_failed, api_version_unsupported, authentication_required, api_key_invalid, dry_run_not_supported, rate_limited, internal_error.