> ## Documentation Index
> Fetch the complete documentation index at: https://docs.infraudit.com/llms.txt
> Use this file to discover all available pages before exploring further.

# REST API endpoints for alerts — GET /alerts

> List, filter by severity and status, acknowledge, and resolve InfraAudit security, cost, compliance, and performance alerts via the REST API.

Alerts are generated automatically by InfraAudit when drift, vulnerability, compliance, or cost anomaly findings exceed configured thresholds. You can also create alerts manually. The alerts endpoints let you list, filter, acknowledge, and resolve alert findings.

Base path: `/api/v1/alerts`

***

## GET /alerts — list alerts

Returns a paginated list of alerts.

```http theme={null}
GET /api/v1/alerts
Authorization: Bearer <token>
```

### Query parameters

<ParamField query="severity" type="string">
  Filter by severity: `critical`, `high`, `medium`, or `low`.
</ParamField>

<ParamField query="type" type="string">
  Filter by alert type: `security`, `cost`, `compliance`, or `performance`.
</ParamField>

<ParamField query="status" type="string">
  Filter by status: `open`, `acknowledged`, or `resolved`.
</ParamField>

<ParamField query="provider_id" type="integer">
  Filter by provider.
</ParamField>

<ParamField query="page" type="integer" default="1">
  Page number.
</ParamField>

<ParamField query="per_page" type="integer" default="20">
  Results per page. Maximum is 100.
</ParamField>

### Response

```json theme={null}
{
  "data": [
    {
      "id": 1,
      "title": "S3 bucket made public",
      "type": "security",
      "severity": "critical",
      "status": "open",
      "resource_id": 5,
      "resource_name": "data-lake-bucket",
      "created_at": "2024-01-15T14:35:00Z"
    }
  ],
  "meta": { "total": 7, "page": 1, "per_page": 20 }
}
```

***

## GET /alerts/{id} — get alert

Returns full details for a single alert.

```http theme={null}
GET /api/v1/alerts/{id}
Authorization: Bearer <token>
```

***

## POST /alerts — create alert (manual)

Creates a manual alert for a resource.

```http theme={null}
POST /api/v1/alerts
Authorization: Bearer <token>
Content-Type: application/json
```

### Request body

<ParamField body="title" type="string" required>
  A short description of the alert.
</ParamField>

<ParamField body="type" type="string" required>
  Alert type: `security`, `cost`, `compliance`, or `performance`.
</ParamField>

<ParamField body="severity" type="string" required>
  Severity: `critical`, `high`, `medium`, or `low`.
</ParamField>

<ParamField body="resource_id" type="integer">
  Resource the alert is associated with.
</ParamField>

<ParamField body="description" type="string">
  Extended description or context.
</ParamField>

```json theme={null}
{
  "title": "Manual security review required",
  "type": "security",
  "severity": "high",
  "resource_id": 15,
  "description": "Audit requested by CISO"
}
```

***

## POST /alerts/{id}/acknowledge — acknowledge an alert

Marks an alert as acknowledged. Returns `200` with the updated alert.

```http theme={null}
POST /api/v1/alerts/{id}/acknowledge
Authorization: Bearer <token>
```

***

## POST /alerts/{id}/resolve — resolve an alert

Marks an alert as resolved with an optional resolution note.

```http theme={null}
POST /api/v1/alerts/{id}/resolve
Authorization: Bearer <token>
Content-Type: application/json
```

### Request body (optional)

<ParamField body="resolution_note" type="string">
  A note describing how the issue was resolved.
</ParamField>

```json theme={null}
{
  "resolution_note": "Reverted security group change"
}
```

***

## POST /alerts/bulk — bulk update alerts

Acknowledge or resolve multiple alerts in a single request.

```http theme={null}
POST /api/v1/alerts/bulk
Authorization: Bearer <token>
Content-Type: application/json
```

### Request body

<ParamField body="ids" type="array" required>
  Array of alert IDs to update.
</ParamField>

<ParamField body="action" type="string" required>
  Action to apply: `acknowledge` or `resolve`.
</ParamField>

```json theme={null}
{
  "ids": [1, 2, 3],
  "action": "acknowledge"
}
```