Alerts API

Alerts are the triage surface for suspicious events. They may come from transaction monitoring, rules, screening, AccessGate, or other enabled modules.

Queue Operations

GET/v1/org/{orgId}/alert-queues

List alert queues and queue metrics for an organization.

GET/v1/alerts

List alerts for the current organization with filters.

GET/v1/alerts/{alertId}

Fetch one alert and its supporting evidence.

Assignment And Resolution

POST/v1/alerts/{alertId}/claim

Claim an unassigned alert.

POST/v1/alerts/{alertId}/assign

Assign an alert to another analyst.

POST/v1/alerts/{alertId}/release

Release an alert back to the queue.

POST/v1/alerts/{alertId}/resolve

Resolve an alert with a disposition or outcome.

POST/v1/alerts/{alertId}/case

Link an alert to an existing case or create a new case from it.

Workflow Notes

Use alerts for triage. Use cases when investigation needs ownership, notes, multiple linked alerts, disposition review, or longer-running evidence collection.

See Cases And Investigations.