REST API — Alerts

Method	Path	What it does
GET	/api/alerts	This workspace’s alerts, most severe first, then most recently seen. Without status, the active ones (include_suppressed adds what the triage held back); mine narrows to alerts routed to the caller.
POST	/api/alerts/ingest/{token}	Send an event to the workspace’s triage. Idempotent on external_id (a retry answers duplicate); oversized text is capped, not refused. 202: triage runs in the background.
GET	/api/alerts/sources	The workspace’s ingest sources. Tokens are never listed.
POST	/api/alerts/sources	A new ingest source. Its token is in this response and nowhere else.
DELETE	/api/alerts/sources/{source_id}	Remove a source. Its events and alerts stay.
PATCH	/api/alerts/sources/{source_id}	Turn a source off (its token stops working) or back on.
POST	/api/alerts/sources/{source_id}/rotate	A new token for a source; the old one stops working at once.
GET	/api/alerts/suppressions	The workspace’s mutes, newest first.
POST	/api/alerts/suppressions	Mute a source, a dedup key or a topic for the whole workspace.
DELETE	/api/alerts/suppressions/{suppression_id}	Lift a mute. Its author or the workspace owner.
GET	/api/alerts/{alert_id}	One alert of this workspace, with the events filed under it.
POST	/api/alerts/{alert_id}/acknowledge	Take it: an open or snoozed alert becomes acknowledged, by the caller.
POST	/api/alerts/{alert_id}/mute	Resolve it as noise AND mute its like: by its dedup_key (default), its source, or one of its topics — until expires_at, or until the mute is deleted.
POST	/api/alerts/{alert_id}/resolve	Close it, optionally saying whether it was useful or noise. Noise verdicts are shown to the triage; they never mute by themselves.
POST	/api/alerts/{alert_id}/snooze	Hide an open or acknowledged alert until until (at most 30 days); it comes back open then.