Alert timing (e.g., '30d', '1w'). Required for expiration previews, omit for other event types.