> ## Documentation Index > Fetch the complete documentation index at: https://docs.flashduty.com/llms.txt > Use this file to discover all available pages before exploring further. # List alerts of incident > List all alerts merged into a specific incident. ## Restrictions | Aspect | Value | | ----------- | ------------------------------------------------------------- | | Rate limits | **1,000 requests/minute**; **50 requests/second** per account | | Permissions | **Incidents Read** (`on-call`) | ## Usage * Set `include_events=true` only when you need a preview of each alert's raw events. * Event previews are capped at the 20 newest events per alert. Use `POST /alert/event/list` for a full paginated event history. * `event_cnt` still reports the total number of raw events merged into each alert. ## OpenAPI ````yaml /api-reference/on-call.openapi.en.json post /incident/alert/list openapi: 3.1.0 info: title: Flashduty Open API description: >- Public HTTP API for the Flashduty incident management platform — incidents, notification templates, channels, schedules, monitors, RUM, and platform administration. Every operation is authenticated with an `app_key` query parameter issued from the Flashduty console under Account → APP Keys. Responses follow a uniform envelope: `{ request_id, data }` on success, `{ request_id, error }` on failure. version: 1.0.0 servers: - url: https://api.flashcat.cloud description: Flashduty Open API security: - AppKeyAuth: [] tags: - name: On-call/Incidents description: '' - name: On-call/Channels description: '' - name: On-call/Alerts description: >- Search, inspect, and act on alerts. Manage card views and alert processing pipelines. - name: On-call/Integrations description: '' - name: On-call/IM integrations description: IM integration queries, such as which integrations have war room enabled. - name: On-call/Schedules description: '' - name: On-call/Calendars description: '' - name: On-call/Notification templates description: '' - name: On-call/Alert enrichment description: Custom fields, enrichment rules, and data mapping (schema, data, API). - name: On-call/Analytics description: '' - name: On-call/Status pages description: '' - name: On-call/Changes description: '' paths: /incident/alert/list: post: tags: - On-call/Incidents summary: List alerts of incident description: List all alerts merged into a specific incident. operationId: incidentAlertList requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/ListIncidentAlertsRequest' example: incident_id: 69da451ef77b1b51f40e83ee is_active: true limit: 100 p: 1 include_events: true responses: '200': description: Success content: application/json: schema: allOf: - $ref: '#/components/schemas/SuccessEnvelope' - type: object properties: data: $ref: '#/components/schemas/ListIncidentAlertsResponse' example: request_id: 01HK8XQE3Z7JM2NTFQ5YJ8P9R4 data: total: 1 items: - alert_id: 69da451df77b1b51f40e83de integration_id: 2490562293131 data_source_id: 2490562293131 channel_id: 2551105804131 account_id: 2451002751131 description: '' title: CPU usage high - web-server-01 title_rule: '' alert_key: 100128:prom-10.99.1.107:A:1579244238440766834:anydata alert_severity: Critical alert_status: Critical start_time: 1775912219 last_time: 1775969819 end_time: 0 labels: check: cpu_usage_high resource: web-server-01 ever_muted: false created_at: 1775912221 updated_at: 1775969821 integration_name: FlashMonit integration_type: monit.alert integration_ref_id: a_2451002751131 channel_name: Ops Channel channel_status: enabled responder_name: '' responder_email: '' incident: incident_id: 69da451ef77b1b51f40e83ee title: CPU usage high - web-server-01 progress: Triggered event_cnt: 17 images: null data_source_name: FlashMonit data_source_type: monit.alert data_source_ref_id: a_2451002751131 events: - event_id: 69da451df77b1b51f40e83df alert_id: 69da451df77b1b51f40e83de title: CPU usage > 90% event_severity: Critical event_status: Critical event_time: 1712650000 labels: host: web-01 '400': $ref: '#/components/responses/BadRequest' '401': $ref: '#/components/responses/Unauthorized' '429': $ref: '#/components/responses/TooManyRequests' '500': $ref: '#/components/responses/ServerError' components: schemas: ListIncidentAlertsRequest: type: object description: Filters for alerts belonging to an incident. required: - incident_id properties: incident_id: type: string pattern: ^[0-9a-fA-F]{24}$ description: Incident ID (MongoDB ObjectID). include_events: type: boolean description: >- When true, include at most the 20 newest raw events in each alert item as a preview. is_active: type: - boolean - 'null' description: >- When true return only active alerts (Critical/Warning/Info); when false return only recovered alerts (Ok). Omit to include all. limit: type: integer format: int64 minimum: 0 maximum: 1000 default: 1000 description: Page size, at most 1000. p: type: integer format: int64 minimum: 0 default: 1 description: Page number starting at 1. SuccessEnvelope: type: object description: >- Success response envelope. On every 2xx response, `request_id` identifies the call (also mirrored in the `Flashcat-Request-Id` header) and `data` holds the endpoint-specific payload. Failure responses use a different shape — see `ErrorResponse`. properties: request_id: type: string description: >- Unique ID for this request. Mirrored in the Flashcat-Request-Id response header. Include it when reporting issues. example: 01HK8XQE3Z7JM2NTFQ5YJ8P9R4 data: description: Endpoint-specific payload. See each operation's 200 response schema. required: - request_id - data ListIncidentAlertsResponse: type: object description: Paginated list of alerts merged into an incident. required: - items - total properties: items: type: array items: $ref: '#/components/schemas/AlertInfo' description: Alert list. total: type: integer format: int64 description: Total matching alerts. AlertInfo: type: object description: Detailed alert item. required: - alert_id - integration_id - data_source_id - channel_id - account_id - description - title - title_rule - alert_key - alert_severity - alert_status - start_time - last_time - end_time - labels - ever_muted - created_at - updated_at - integration_name - integration_type - integration_ref_id - channel_name - channel_status - responder_name - responder_email - event_cnt - images - data_source_name - data_source_ref_id properties: alert_id: type: string pattern: ^[0-9a-fA-F]{24}$ description: Alert ID (MongoDB ObjectID). integration_id: type: integer format: int64 description: Integration ID that produced the alert. data_source_id: type: integer format: int64 description: Deprecated. Use `integration_id` instead. channel_id: type: integer format: int64 description: Channel ID. account_id: type: integer format: int64 description: Account ID. description: type: string description: Alert description. title: type: string description: Alert title. title_rule: type: string description: Title rendering rule. alert_key: type: string description: Deduplication key used to merge events into the alert. alert_severity: type: string enum: - Critical - Warning - Info - Ok description: Current severity. alert_status: type: string enum: - Critical - Warning - Info - Ok description: Current status. start_time: type: integer format: int64 description: Unix timestamp (seconds) when the alert first fired. last_time: type: integer format: int64 description: Unix timestamp (seconds) of the most recent event. end_time: type: integer format: int64 description: >- Unix timestamp (seconds) when the alert recovered. 0 if still active. labels: type: object additionalProperties: type: string description: Alert labels. ever_muted: type: boolean description: Whether this alert has ever been silenced. deleted_at: type: integer format: int64 description: Soft-delete timestamp (seconds). Zero if not deleted. created_at: type: integer format: int64 description: Creation timestamp (seconds). updated_at: type: integer format: int64 description: Last update timestamp (seconds). integration_name: type: string description: Integration display name. integration_type: type: string description: Integration type string. integration_ref_id: type: string description: Integration reference ID. channel_name: type: string description: Channel display name. channel_status: type: string description: Channel status. responder_name: type: string description: Primary responder name, if any. responder_email: type: string description: Primary responder email, if any. incident: $ref: '#/components/schemas/IncidentShort' description: Parent incident reference, if the alert has been merged into one. events: type: array items: $ref: '#/components/schemas/AlertEventItem' description: >- Raw alert event preview, populated only when requested. Capped at the 20 newest events per alert. event_cnt: type: integer format: int64 description: Total number of raw events merged into this alert. images: type: array items: $ref: '#/components/schemas/Image' description: Attached images. data_source_name: type: string description: Deprecated. Use `integration_name`. data_source_type: type: string description: Deprecated. Use `integration_type`. data_source_ref_id: type: string description: Deprecated. Use `integration_ref_id`. ErrorResponse: type: object description: Response envelope for errors. `error` is required; `data` is absent. properties: request_id: type: string example: 01HK8XQE3Z7JM2NTFQ5YJ8P9R4 error: $ref: '#/components/schemas/DutyError' required: - request_id - error IncidentShort: type: object description: Brief incident reference embedded in an alert. properties: incident_id: type: string description: Incident ID (ObjectID hex string). title: type: string description: Incident title. progress: type: string description: Incident progress — one of `Triggered`, `Processing`, `Closed`. AlertEventItem: type: object description: A raw alert event. properties: event_id: type: string pattern: ^[0-9a-fA-F]{24}$ description: Event ID (MongoDB ObjectID). alert_id: type: string pattern: ^[0-9a-fA-F]{24}$ description: Parent alert ID (MongoDB ObjectID). account_id: type: integer format: int64 description: Account ID. channel_id: type: integer format: int64 description: Channel ID the event is routed to. integration_id: type: integer format: int64 description: Integration that produced this event. integration_type: type: string description: Type/plugin key of the integration that produced this event. data_source_id: type: integer format: int64 description: Deprecated. Use `integration_id` instead. title: type: string description: Event title. title_rule: type: string description: Title template used to derive `title` from labels. description: type: string description: Event description. alert_key: type: string description: Deduplication key used to merge events into an alert. event_severity: type: string enum: - Critical - Warning - Info - Ok description: Severity of this event. event_status: type: string enum: - Critical - Warning - Info - Ok description: Status of this event. event_time: type: integer format: int64 description: Event timestamp, Unix epoch seconds. labels: type: object additionalProperties: type: string description: Label key-value pairs. images: type: array items: $ref: '#/components/schemas/AlertImage' description: Images attached to the event. created_at: type: integer format: int64 description: Record creation time, Unix epoch seconds. updated_at: type: integer format: int64 description: Record update time, Unix epoch seconds. deleted_at: type: integer format: int64 description: Soft-delete timestamp (seconds). Zero if not deleted. Image: type: object description: Image or attachment reference. required: - src properties: src: type: string description: Image source. Either an `img_` upload token or an `http(s)` URL. href: type: string description: Optional link the image points to. alt: type: string description: Alt text. DutyError: type: object description: >- Error payload inside the response envelope. Present only on non-2xx responses. properties: code: $ref: '#/components/schemas/ErrorCode' message: type: string description: >- Human-readable error message, localized by the caller's Accept-Language. May contain field names, IDs, or other context from the failing request. example: The specified parameter template_id is not valid. required: - code - message AlertImage: type: object description: An image attachment on an alert or event. required: - src properties: href: type: string description: Optional link URL when the image is clicked. src: type: string description: >- Image source URL or internal image reference (starts with `img_` or `http`). alt: type: string description: Alt text. ErrorCode: type: string description: >- Flashduty error code enum. Every failed API response sets `error.code` to one of these stable wire strings. HTTP status is informational — the authoritative signal is the enum value. | Code | HTTP | Meaning | |---|---|---| | `OK` | 200 | Reserved — not returned on real errors. | | `InvalidParameter` | 400 | A required parameter is missing or failed validation. | | `BadRequest` | 400 | Generic 400 used when no more specific code fits. | | `InvalidContentType` | 400 | The `Content-Type` header is not `application/json`. | | `ResourceNotFound` | 400 | The referenced resource does not exist. Note: returned as HTTP 400, not 404 (historical choice). | | `NoLicense` | 400 | The feature is license-gated and no active license was found. | | `ReferenceExist` | 400 | Deletion blocked — other entities still reference this resource. | | `Unauthorized` | 401 | `app_key` is missing, invalid, or expired. | | `BalanceNotEnough` | 402 | Billing-gated operation with insufficient account balance. | | `AccessDenied` | 403 | Authenticated but lacking the permission required for this operation. | | `RouteNotFound` | 404 | The request URL path is not a known route. | | `MethodNotAllowed` | 405 | The HTTP method is not allowed on this otherwise-known path. | | `UndonedOrderExist` | 409 | An outstanding billing order blocks this new one. Wait and retry. | | `RequestLocked` | 423 | Operation temporarily locked due to repeated failures. | | `EntityTooLarge` | 413 | Request body exceeds the configured max size. | | `RequestTooFrequently` | 429 | Rate limit hit — API-global, per-account, or per-integration. | | `RequestVerifyRequired` | 428 | Second-factor verification required but not supplied. | | `DangerousOperation` | 428 | High-risk operation requires MFA verification. | | `InternalError` | 500 | Unhandled server-side error. Include `request_id` in the bug report. | | `ServiceUnavailable` | 503 | A backend dependency is unavailable. Try again later. | enum: - OK - InvalidParameter - BadRequest - InvalidContentType - ResourceNotFound - NoLicense - ReferenceExist - Unauthorized - BalanceNotEnough - AccessDenied - RouteNotFound - MethodNotAllowed - UndonedOrderExist - RequestLocked - EntityTooLarge - RequestTooFrequently - RequestVerifyRequired - DangerousOperation - InternalError - ServiceUnavailable x-enumDescriptions: OK: Reserved — not returned on real errors. InvalidParameter: A required parameter is missing or failed validation. BadRequest: Generic 400 used when no more specific code fits. InvalidContentType: The `Content-Type` header is not `application/json`. ResourceNotFound: >- The referenced resource does not exist. Note: returned as HTTP 400, not 404 (historical choice). NoLicense: The feature is license-gated and no active license was found. ReferenceExist: Deletion blocked — other entities still reference this resource. Unauthorized: '`app_key` is missing, invalid, or expired.' BalanceNotEnough: Billing-gated operation with insufficient account balance. AccessDenied: Authenticated but lacking the permission required for this operation. RouteNotFound: The request URL path is not a known route. MethodNotAllowed: The HTTP method is not allowed on this otherwise-known path. UndonedOrderExist: An outstanding billing order blocks this new one. Wait and retry. RequestLocked: Operation temporarily locked due to repeated failures. EntityTooLarge: Request body exceeds the configured max size. RequestTooFrequently: Rate limit hit — API-global, per-account, or per-integration. RequestVerifyRequired: Second-factor verification required but not supplied. DangerousOperation: High-risk operation requires MFA verification. InternalError: Unhandled server-side error. Include `request_id` in the bug report. ServiceUnavailable: A backend dependency is unavailable. Try again later. example: InvalidParameter responses: BadRequest: description: Invalid request — usually a missing or malformed parameter. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: missingParameter: value: request_id: 01HK8XQE3Z7JM2NTFQ5YJ8P9R4 error: code: InvalidParameter message: The specified parameter is not valid. Unauthorized: description: Missing or invalid app_key. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: missingAppKey: value: request_id: 01HK8XQE3Z7JM2NTFQ5YJ8P9R4 error: code: Unauthorized message: You are unauthorized. TooManyRequests: description: >- Rate limit hit. Either the global API limit, a per-account limit, or a per-integration limit. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: rateLimited: value: request_id: 01HK8XQE3Z7JM2NTFQ5YJ8P9R4 error: code: RequestTooFrequently message: Request too frequently. ServerError: description: Unexpected server-side error. Include the request_id when reporting. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' examples: internal: value: request_id: 01HK8XQE3Z7JM2NTFQ5YJ8P9R4 error: code: InternalError message: >- We encountered an internal error, and it has been reported. Please try again later. securitySchemes: AppKeyAuth: type: apiKey in: query name: app_key description: >- App key issued from the Flashduty console under Account → APP Keys. Required on every public API call. Keep it secret — it grants the same access as the owning account. ````