Get top-K alerts grouped by check or resource
Return the top-K alert groups aggregated either by check or by resource label over the specified time range.
Restrictions
Authorizations
App key issued from the Flashduty console under Account → APP Keys. Required on every public API call. Keep it secret — it grants the same access as the owning account.
Body
Insight dimension-aggregation request. Extends InsightFilter with aggregation controls.
Start time, Unix seconds. Must be greater than 0.
End time, Unix seconds. Must be greater than start_time.
Aggregation dimension. check aggregates by the event's labels.check label (monitoring check); resource aggregates by the labels.resource label (monitored resource identifier).
check, resource Filter by team IDs. At most 100 entries.
Filter by channel IDs. At most 100 entries.
Filter by responder person IDs. At most 100 entries.
Filter by severity. At most 3 entries.
Critical, Warning, Info, Ok Filter by incident IDs (MongoDB ObjectIDs). At most 100 entries.
^[0-9a-fA-F]{24}$Full-text query applied to incident title and description.
Label filters (exact match).
Custom-field filters (exact match).
Sort field. total_alert_cnt sorts by alert count; total_alert_event_cnt sorts by raw alert event count.
Sort ascending when true, descending otherwise.
Restrict results to teams the caller belongs to. When true and the caller has no teams, the result set is empty.
IANA time zone name used to interpret the time range (e.g. Asia/Shanghai). Defaults to the account time zone.
Lower bound (inclusive) on time-to-close, in seconds.
Upper bound (exclusive) on time-to-close, in seconds. Must be greater than seconds_to_close_from when both are set.
Lower bound (inclusive) on time-to-acknowledge, in seconds.
Upper bound (exclusive) on time-to-acknowledge, in seconds. Must be greater than seconds_to_ack_from when both are set.
Subset of CSV column keys to include in the export. At most 50 entries. Only used by the export endpoints.
incident_id, title, severity, progress, channel_id, channel_name, team_id, team_name, created_at, seconds_to_ack, seconds_to_close, closed_by, engaged_seconds, hours, notifications, interruptions, acknowledgements, assignments, reassignments, escalations, manual_escalations, timeout_escalations, assigned_to, responders, description, labels, fields, creator_id, creator_name Strip HTML markup from the description column when exporting.
Include incidents that have ever been muted. By default, they are excluded.
When true, metrics are split into work/sleep/off hour buckets.
Aggregates metrics by time granularity. When set, the time range must be at least 24 hours; with day granularity the range must not exceed 31 days. day buckets by calendar day, week by calendar week, and month by calendar month, with boundaries aligned to time_zone.
day, week, month Number of top entries to return, between 1 and 100.
Response
Success
Success response envelope. On every 2xx response, request_id identifies the call (also mirrored in the Flashcat-Request-Id header) and data holds the endpoint-specific payload. Failure responses use a different shape — see ErrorResponse.