> ## Documentation Index
> Fetch the complete documentation index at: https://developers.essal.cloud/llms.txt
> Use this file to discover all available pages before exploring further.

# Alerts

> API reference for Essal Guard alerts — rules, active alerts, lifecycle management, and notification channels.

## List Alert Rules

`GET /v1/guard/alert-rules`

***

## Create an Alert Rule

`POST /v1/guard/alert-rules`

```json theme={null}
{
  "name": "Excessive Failed Logins",
  "condition": {
    "event": "access.user.login",
    "outcome": "failure",
    "threshold": 10,
    "window_seconds": 300,
    "group_by": "actor_id"
  },
  "severity": "high",
  "channels": ["slack_security"]
}
```

***

## Create from Template

`POST /v1/guard/alert-rules/from-template`

```json theme={null}
{ "template": "impossible_travel" }
```

Available templates: `impossible_travel`, `mass_download`, `privilege_escalation`, `policy_disabled`, `api_key_mass_creation`.

***

## List Active Alerts

`GET /v1/guard/alerts`

**Query Parameters**

| Parameter  | Type   | Description                                                                |
| ---------- | ------ | -------------------------------------------------------------------------- |
| `status`   | enum   | `triggered`, `acknowledged`, `investigating`, `resolved`, `false_positive` |
| `severity` | enum   | `critical`, `high`, `medium`, `low`                                        |
| `sort`     | string | e.g. `triggered_at:desc`                                                   |

***

## Update Alert Status

`PATCH /v1/guard/alerts/{id}`

```json theme={null}
{
  "status": "investigating",
  "assignee_id": "usr_01HXYZ5678",
  "note": "Reviewing login logs."
}
```

***

## List Notification Channels

`GET /v1/guard/notification-channels`

***

## Create a Notification Channel

`POST /v1/guard/notification-channels`

```json theme={null}
{
  "name": "slack_security",
  "type": "slack",
  "config": { "webhook_url": "https://hooks.slack.com/...", "channel": "#security" },
  "min_severity": "medium"
}
```

Supported types: `slack`, `email`, `pagerduty`, `webhook`, `ms_teams`.