Skip to main content
GET
Scope: alerts:read. A paginated list (items, total, page, pageSize); see Requests and responses. What each kind of alert means: Alerts.
string
default:"all"
open (open or investigating), resolved (resolved or false positive) or all.
string
opened, severity (low to critical) or status; prefix with - for descending (-severity puts critical first). Without it, or with any other value, newest first.
integer
default:"1"
integer
default:"20"
Up to 200.
Each item:
string
required
Such as ALR-2291.
string
required
clone_pattern, grey_market, signature_failure, revoked_scanned, enumeration, unknown_format, consumer_report or seat_sharing.
string
required
string
required
critical, high, medium or low.
string
required
open, investigating, resolved or false_positive.
object
id, name and email of the person it’s assigned to.
string
required
ISO 8601; updatedAt likewise.
string[]
required
string[]
required
Batch numbers, such as B-1045.
integer
required
integer
required
Scans that contributed; list them with GET /v1/scans?alert=.
object[]
required
Where those scans happened: district, state, country, and point when known.
string
string
Set while the alert is resolved.
object
What resolving it achieved: kind (stock_seized, listing_removed, distributor_action, legal_action or no_action), and optionally units, value (money) and note. See Alert outcomes.
object[]
required
What happened, oldest first: at, text and, when a person did it, actor.