Skip to main content
POST
Preview alert pipeline processing

Restrictions

Usage

  • Nothing is saved and no alert or event is created.
  • The integration’s saved enrichment rules run first, then your rules in order, against the enriched event.
  • A recovery (Ok) event closes the alert without running the pipeline: is_recovery is true and every step comes back not_executed with detail recovery_event.
  • dropped and inhibited report which rule stopped the event: alert_drop discards it, alert_inhibit discards it while a matching source alert is active. Rules after that one are not_executed.
  • When no rule matches, after is the event as the notification templates render it, so the preview shows what the channel would deliver.

Authorizations

app_key
string
query
required

APP Key created in the Flashduty console under My → APP Key. Send it as the app_key query parameter or in the Fd-App-Key request header. Its effective access is the intersection of the key's permission scope and the creator's current role permissions. Keep it secret.

Body

application/json

Request body of POST /alert/pipeline/preview.

integration_id
integer<int64>
required

Integration whose saved enrichment runs first and whose pipeline context the preview uses.

Required range: x >= 1
event
object
required

The event to run the rules over.

rules
object[]

Alert processing rules to try, in order. At most 50. The integration's stored pipeline is not used.

Maximum array length: 50

Response

Success

Success response envelope. On every 2xx response, request_id identifies the call (also mirrored in the Flashcat-Request-Id header) and data holds the endpoint-specific payload. Failure responses use a different shape — see ErrorResponse.

request_id
string
required

Unique ID for this request. Mirrored in the Flashcat-Request-Id response header. Include it when reporting issues.

Example:

"01HK8XQE3Z7JM2NTFQ5YJ8P9R4"

data
object

Result of the pipeline preview.