Read and acknowledge alerts

An alert is one time a rule turned true: a budget passed its threshold, a pool lost capacity, errors spiked. The operations of this page read the feed of alerts and mark an alert as seen. The rules are written in the console, on the Rules tab of Alerts.

How an alert lives

Slen checks the active rules once a minute.

• When a rule turns true, an alert opens. occurred_at is that moment.

• While the rule stays true, the alert stays one alert. Its payload, severity and title are refreshed at every check, so an alert that opened as a warning may turn critical.

• When the rule is no longer true, the alert is resolved: resolved_at is set. Pausing or deleting the rule resolves its open alert too. Nothing has to be closed by hand.

A rule of the whole organization is checked in each project of the organization and still has one open alert at a time, about the project where the rule turned true. The alert stays with that project while the rule is true there. When that project recovers and another one is still in trouble, the alert is resolved and a new one opens about the other project.

title is an English sentence that says what happened, and payload carries the numbers behind it.

The webhook events alert.opened and alert.resolved report the moment an alert opens and the moment it is resolved. A refresh of an open alert sends no event.

Reading the feed

The feed answers with the newest alerts first, at most 100 of them, and is not paged. An alert names the project it is about in project_id, also when its rule watches the whole organization. A key reads the alerts about its own project and the alerts about no project, such as one about a budget or a pool of the whole organization.

Send open=1 to read only the alerts that are not resolved. A boolean of the query string is written 1 or 0, and open=true is refused with 422.

Acknowledging

To acknowledge an alert is to say that somebody has seen it. The operation sets acknowledged_at and changes nothing else: the alert stays open until its rule is no longer true, or until the rule is paused or deleted. A second acknowledgement keeps the time of the first.

acknowledged_by_user_id names the person who acknowledged the alert in the console. It is null when an API key did.

An alert that does not exist, or an alert of another project, answers 404 with the code alert_not_found.

Operations

{
  "data": [
    {
      "alert_id": "74438200973594624",
      "alert_rule_id": "74438200973594624",
      "project_id": "74438200973594624",
      "type": "budget_threshold",
      "severity": "warning",
      "title": "string",
      "payload": {},
      "occurred_at": "2026-10-02T09:30:00Z",
      "resolved_at": "2026-10-02T09:30:00Z",
      "acknowledged_at": "2026-10-02T09:30:00Z",
      "acknowledged_by_user_id": "74438200973594624"
    }
  ]
}

{
  "data": {
    "alert_id": "74438200973594624",
    "alert_rule_id": "74438200973594624",
    "project_id": "74438200973594624",
    "type": "budget_threshold",
    "severity": "warning",
    "title": "string",
    "payload": {},
    "occurred_at": "2026-10-02T09:30:00Z",
    "resolved_at": "2026-10-02T09:30:00Z",
    "acknowledged_at": "2026-10-02T09:30:00Z",
    "acknowledged_by_user_id": "74438200973594624"
  }
}

Examples

Read the open alerts

One alert is open: a monthly budget has passed the threshold of its rule.

curl "https://api.slen.ai/api/v1/alerts?open=1" \
  -H "Authorization: Bearer $SLEN_API_KEY"

{
  "data": [
    {
      "alert_id": "74441250346041344",
      "alert_rule_id": "74440612744429568",
      "project_id": "74438200973594624",
      "type": "budget_threshold",
      "severity": "warning",
      "title": "Monthly budget is 86.40% used",
      "payload": {
        "budget_id": "74437302811459584",
        "budget_name": "Production",
        "budget_type": "monthly",
        "currency": "USD",
        "limit": "500.00000000",
        "used": "432.00000000",
        "used_percent": "86.40",
        "threshold_percent": "80.00"
      },
      "occurred_at": "2026-10-02T07:12:00+00:00",
      "resolved_at": null,
      "acknowledged_at": null,
      "acknowledged_by_user_id": null
    }
  ]
}

Acknowledge an alert

The answer is the alert with acknowledged_at set. resolved_at is still null: the budget is still over the threshold.

curl -X POST https://api.slen.ai/api/v1/alerts/74441250346041344/ack \
  -H "Authorization: Bearer $SLEN_API_KEY"

{
  "data": {
    "alert_id": "74441250346041344",
    "alert_rule_id": "74440612744429568",
    "project_id": "74438200973594624",
    "type": "budget_threshold",
    "severity": "warning",
    "title": "Monthly budget is 86.40% used",
    "payload": {
      "budget_id": "74437302811459584",
      "budget_name": "Production",
      "budget_type": "monthly",
      "currency": "USD",
      "limit": "500.00000000",
      "used": "432.00000000",
      "used_percent": "86.40",
      "threshold_percent": "80.00"
    },
    "occurred_at": "2026-10-02T07:12:00+00:00",
    "resolved_at": null,
    "acknowledged_at": "2026-10-02T08:41:00+00:00",
    "acknowledged_by_user_id": null
  }
}

Where to go next

• Alerts — the rules and the feed in the console.

• Authentication — what a key reaches in its project and in its organization.

• Overview — the shape of a 422 for a parameter that fails validation.

• Webhooks — how alert.opened and alert.resolved arrive.