> ## Documentation Index
> Fetch the complete documentation index at: https://docs.getimmutable.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Alerts

> List triggered alert notifications.

## GET /api/v1/alerts

Retrieve a paginated list of triggered alerts for your workspace.

### Query Parameters

<ParamField query="from" type="string">
  ISO 8601 timestamp. Return alerts triggered at or after this time.
</ParamField>

<ParamField query="to" type="string">
  ISO 8601 timestamp. Return alerts triggered at or before this time.
</ParamField>

<ParamField query="rule_type" type="string">
  Filter by alert rule type. One of: `new_country`, `high_volume_destructive`, `ingestion_spike`, `repeated_action`, `off_hours`.
</ParamField>

<ParamField query="limit" type="integer" default="25">
  Number of alerts per page (max 100).
</ParamField>

<ParamField query="cursor" type="string">
  Pagination cursor from a previous response.
</ParamField>

### Response

```json theme={null}
{
  "data": [
    {
      "id": "alt_4f7a8b9c-0d1e-2f3a-4b5c-6d7e8f9a0b1c",
      "rule_id": "rul_1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d",
      "rule_name": "Suspicious Login",
      "rule_type": "new_country",
      "event_id": "9b1deb4d-3b7d-4bad-9bdd-2b0d7b3dcb6d",
      "reason": "Actor user_2hG9kLm logged in from DE for the first time",
      "triggered_at": "2026-03-26T08:45:12.000000Z"
    }
  ],
  "pagination": {
    "has_more": false,
    "next_cursor": null,
    "total": 1
  }
}
```

### Alert Rule Types

| Type                      | Description                                                |
| ------------------------- | ---------------------------------------------------------- |
| `new_country`             | Actor performed an action from a previously unseen country |
| `high_volume_destructive` | High volume of destructive actions in a short window       |
| `ingestion_spike`         | Event ingestion volume exceeded normal baseline            |
| `repeated_action`         | Same action repeated by the same actor rapidly             |
| `off_hours`               | Action occurred outside configured business hours          |

### Examples

<CodeGroup>
  ```bash cURL theme={null}
  curl "https://getimmutable.dev/api/v1/alerts?rule_type=new_country&limit=10" \
    -H "Authorization: Bearer imk_your_api_key_here"
  ```

  ```typescript JavaScript theme={null}
  const alerts = await client.getAlerts({
    rule_type: "new_country",
    limit: 10,
  });
  ```

  ```php Laravel theme={null}
  $alerts = AuditLog::getAlerts([
      'rule_type' => 'new_country',
      'limit' => 10,
  ]);
  ```
</CodeGroup>

### Alert Delivery

Alerts are also delivered in real time via:

* **Email** -- Sent to workspace members with admin or owner roles.
* **Webhook** -- POSTed to your endpoint with an HMAC-SHA256 signature in the `X-Immutable-Signature` header. See [Webhook Signatures](/security/webhook-signatures).

### Plan Quotas

| Plan       | Alert Rule Limit |
| ---------- | ---------------- |
| Free       | 2                |
| Starter    | 10               |
| Pro        | 50               |
| Enterprise | Unlimited        |