---
title: "Search Alert Channels"
method: POST
path: "/api/v2/AlertChannels/search"
tags: ["AlertChannels"]
---

# Search Alert Channels

`POST /api/v2/AlertChannels/search`

Search alert channels by invoking the following endpoint:

  > `POST https://YourAccount.lacework.net/api/v2/AlertChannels/search`

 To limit the returned result, optionally specify one or more filters in the request body. For more information about using filters, see the [Simple & Advanced Search section](/api/v2/docs/#tag/OVERVIEW). 

  In the request body, optionally specify the list of fields to return in the response by specifying the list in the `returns` array, for example, `"returns":[ "name", "type", "enabled" ]`.

## Headers

- `Authorization` string, required
- `Content-Type` string, required
- `Org-Access` boolean
- `Account-Name` string

## Request body

- GETDATAREQUESTBODYFILTERS
  - `filters` object[] — One or more condition statements you can use to refine the data returned by the request. Only records that satisfy filtering conditions are returned. If there are multiple conditions, a record must satisfy all conditions for a match.
    - `expression` 'eq' | 'ne' | 'in' | 'not_in' | 'like' | 'ilike' | 'not_like' | 'not_ilike' | 'not_rlike' | 'rlike' | 'gt' | 'ge' | 'lt' | 'le' | 'between', required — The comparison operator for the filter condition.
    - `field` string, required — The name of the data field to which the condition applies.
    - `value` string — The value that the condition checks for in the specified field. Use this attribute when specifying a single value.
    - `values` string[] — The values that the condition checks for in the specified field. Use this attribute when specifying multiple values.
  - `returns` string[] — Use this attribute to specify which top-level fields of the response schema you want to receive.

## Response `200`

No Error (List of Alert Channels)

- object
  - `data` AlertChannelsResponseSchema[]
    - union
      - AlertChannelsAwsS3ResponseSchema
        - `name` string, required — When sending a request, use this attribute to specify an integration’s name. When included in a response, this attribute returns the specified integration’s name.
        - `type` 'AwsS3', required — When sending a request, use this attribute to specify the type of integration, from the following options. When included in a response, this attribute returns the specified integration’s type.
        - `enabled` number, required — When sending a request, use this attribute to enable or disable an integration. When included in a response, returns `1` for an enabled integration or `0` for a disabled integration.
        - `cloudId` string — The cloud account identifier.
        - `cloudIdType` 'AWS_ACCOUNT_ID' | 'AZURE_TENANT_ID' | 'GCP_PROJECT_ID' | 'GCP_ORGANIZATION_ID' | 'OCI_TENANT_ID' — The type of cloud account identifier.
        - `data` object, required
          - `s3CrossAccountCredentials` object, required
            - `externalId` string, required
            - `roleArn` string, required
            - `bucketArn` string, required
        - `isOrg` number — Returns `1` if the access token has organization admin permissions. Otherwise, returns `0`.
        - `props` object — The integration's properties.
        - `createdOrUpdatedBy` string — The user who created or who last updated the integration.
        - `createdOrUpdatedTime` string — The timestamp for when the integration was created or last updated.
        - `intgGuid` string — The integration’s globally unique identifier.
        - `state` object — The integration’s real-time state, such as Pending, Success, or Error.
      - AlertChannelsCiscoSparkWebhookResponseSchema
        - `name` string, required — When sending a request, use this attribute to specify an integration’s name. When included in a response, this attribute returns the specified integration’s name.
        - `type` 'CiscoSparkWebhook', required — When sending a request, use this attribute to specify the type of integration, from the following options. When included in a response, this attribute returns the specified integration’s type.
        - `enabled` number, required — When sending a request, use this attribute to enable or disable an integration. When included in a response, returns `1` for an enabled integration or `0` for a disabled integration.
        - `cloudId` string — The cloud account identifier.
        - `cloudIdType` 'AWS_ACCOUNT_ID' | 'AZURE_TENANT_ID' | 'GCP_PROJECT_ID' | 'GCP_ORGANIZATION_ID' | 'OCI_TENANT_ID' — The type of cloud account identifier.
        - `data` object, required
          - `webhook` string, required — The URL of your incoming webhook.
        - `isOrg` number — Returns `1` if the access token has organization admin permissions. Otherwise, returns `0`.
        - `props` object — The integration's properties.
        - `createdOrUpdatedBy` string — The user who created or who last updated the integration.
        - `createdOrUpdatedTime` string — The timestamp for when the integration was created or last updated.
        - `intgGuid` string — The integration’s globally unique identifier.
        - `state` object — The integration’s real-time state, such as Pending, Success, or Error.
      - AlertChannelsCloudwatchEbResponseSchema
        - `name` string, required — When sending a request, use this attribute to specify an integration’s name. When included in a response, this attribute returns the specified integration’s name.
        - `type` 'CloudwatchEb', required — When sending a request, use this attribute to specify the type of integration, from the following options. When included in a response, this attribute returns the specified integration’s type.
        - `enabled` number, required — When sending a request, use this attribute to enable or disable an integration. When included in a response, returns `1` for an enabled integration or `0` for a disabled integration.
        - `cloudId` string — The cloud account identifier.
        - `cloudIdType` 'AWS_ACCOUNT_ID' | 'AZURE_TENANT_ID' | 'GCP_PROJECT_ID' | 'GCP_ORGANIZATION_ID' | 'OCI_TENANT_ID' — The type of cloud account identifier.
        - `data` object, required
          - `issueGrouping` 'Events' | 'Resources' — Whether you want to group multiple events of a single type into a single event. Choosing `Events` results in a single event being created when FortiCNAPP detects compliance events of the same type on multiple resources. Choosing `Resources` results in multiple events being created, one for each resource. See [Create an Amazon CloudWatch Alert Channel](https://docs.fortinet.com/document/forticnapp/latest/administration-guide?cshid=onboardingAWSEventBridge).
          - `eventBusArn` string, required — The ARN of your Amazon CloudWatch event bus, which uses the following format: <br />`arn:aws:events:<REGION>:<YOUR-ACCOUNT-ID>:event-bus/<YOUR-EVENT-BUS-NAME>` <br />Replace `REGION` , `YOUR-ACCOUNT-ID` and `YOUR-EVENT-BUS-NAME` with your values.
        - `isOrg` number — Returns `1` if the access token has organization admin permissions. Otherwise, returns `0`.
        - `props` object — The integration's properties.
        - `createdOrUpdatedBy` string — The user who created or who last updated the integration.
        - `createdOrUpdatedTime` string — The timestamp for when the integration was created or last updated.
        - `intgGuid` string — The integration’s globally unique identifier.
        - `state` object — The integration’s real-time state, such as Pending, Success, or Error.
      - AlertChannelsDatadogResponseSchema
        - `name` string, required — When sending a request, use this attribute to specify an integration’s name. When included in a response, this attribute returns the specified integration’s name.
        - `type` 'Datadog', required — When sending a request, use this attribute to specify the type of integration, from the following options. When included in a response, this attribute returns the specified integration’s type.
        - `enabled` number, required — When sending a request, use this attribute to enable or disable an integration. When included in a response, returns `1` for an enabled integration or `0` for a disabled integration.
        - `cloudId` string — The cloud account identifier.
        - `cloudIdType` 'AWS_ACCOUNT_ID' | 'AZURE_TENANT_ID' | 'GCP_PROJECT_ID' | 'GCP_ORGANIZATION_ID' | 'OCI_TENANT_ID' — The type of cloud account identifier.
        - `data` object, required
          - `datadogType` 'Logs Detail' | 'Logs Summary' | 'Events Summary', required — The Datadog service to use in the alert channel such as Logs Detail, Logs Summary, or Events Summary.
          - `datadogSite` 'com' | 'eu' | 'us' | 'us3' | 'us5' | 'us1-fed', required — The Datadog site you want to store your logs, either the US or Europe.
          - `apiKey` string, password, required — YourApiKey
        - `isOrg` number — Returns `1` if the access token has organization admin permissions. Otherwise, returns `0`.
        - `props` object — The integration's properties.
        - `createdOrUpdatedBy` string — The user who created or who last updated the integration.
        - `createdOrUpdatedTime` string — The timestamp for when the integration was created or last updated.
        - `intgGuid` string — The integration’s globally unique identifier.
        - `state` object — The integration’s real-time state, such as Pending, Success, or Error.
      - AlertChannelsEmailUserResponseSchema
        - `name` string, required — When sending a request, use this attribute to specify an integration’s name. When included in a response, this attribute returns the specified integration’s name.
        - `type` 'EmailUser', required — When sending a request, use this attribute to specify the type of integration, from the following options. When included in a response, this attribute returns the specified integration’s type.
        - `enabled` number, required — When sending a request, use this attribute to enable or disable an integration. When included in a response, returns `1` for an enabled integration or `0` for a disabled integration.
        - `cloudId` string — The cloud account identifier.
        - `cloudIdType` 'AWS_ACCOUNT_ID' | 'AZURE_TENANT_ID' | 'GCP_PROJECT_ID' | 'GCP_ORGANIZATION_ID' | 'OCI_TENANT_ID' — The type of cloud account identifier.
        - `data` object, required
          - `channelProps` object, required
            - `recipients` string, required — The list of email addresses to send alerts to.
        - `isOrg` number — Returns `1` if the access token has organization admin permissions. Otherwise, returns `0`.
        - `props` object — The integration's properties.
        - `createdOrUpdatedBy` string — The user who created or who last updated the integration.
        - `createdOrUpdatedTime` string — The timestamp for when the integration was created or last updated.
        - `intgGuid` string — The integration’s globally unique identifier.
        - `state` object — The integration’s real-time state, such as Pending, Success, or Error.
      - AlertChannelsGcpPubsubResponseSchema
        - `name` string, required — When sending a request, use this attribute to specify an integration’s name. When included in a response, this attribute returns the specified integration’s name.
        - `type` 'GcpPubsub', required — When sending a request, use this attribute to specify the type of integration, from the following options. When included in a response, this attribute returns the specified integration’s type.
        - `enabled` number, required — When sending a request, use this attribute to enable or disable an integration. When included in a response, returns `1` for an enabled integration or `0` for a disabled integration.
        - `cloudId` string — The cloud account identifier.
        - `cloudIdType` 'AWS_ACCOUNT_ID' | 'AZURE_TENANT_ID' | 'GCP_PROJECT_ID' | 'GCP_ORGANIZATION_ID' | 'OCI_TENANT_ID' — The type of cloud account identifier.
        - `data` object, required
          - `issueGrouping` 'Events' | 'Resources' — Whether you want to group multiple events of a single type into a single message. Choosing `Events` results in a single message being created when FortiCNAPP detects compliance events of the same type on multiple resources. Choosing `Resources` results in multiple messages being created, one for each resource. See [Create a GCP Pub/Sub Alert Channel](https://docs.fortinet.com/document/forticnapp/latest/administration-guide?cshid=gcpPubSubUrl).
          - `credentials` object, required — Your GCP Pub/Sub's credentials.
            - `clientId` string, required — Your GCP Pub/Sub's client ID.
            - `privateKeyId` string, required — Your GCP Pub/Sub's private key.
            - `clientEmail` string, required — The Client Email name provided when creating the new service account.
            - `privateKey` string, required — Your GCP Pub/Sub's private key certificate.
          - `projectId` string, required — Your GCP Pub/Sub's project ID.
          - `topicId` string, required — The topic ID to use in this alert channel.
        - `isOrg` number — Returns `1` if the access token has organization admin permissions. Otherwise, returns `0`.
        - `props` object — The integration's properties.
        - `createdOrUpdatedBy` string — The user who created or who last updated the integration.
        - `createdOrUpdatedTime` string — The timestamp for when the integration was created or last updated.
        - `intgGuid` string — The integration’s globally unique identifier.
        - `state` object — The integration’s real-time state, such as Pending, Success, or Error.
      - AlertChannelsIbmQradarResponseSchema
        - `name` string, required — When sending a request, use this attribute to specify an integration’s name. When included in a response, this attribute returns the specified integration’s name.
        - `type` 'IbmQradar', required — When sending a request, use this attribute to specify the type of integration, from the following options. When included in a response, this attribute returns the specified integration’s type.
        - `enabled` number, required — When sending a request, use this attribute to enable or disable an integration. When included in a response, returns `1` for an enabled integration or `0` for a disabled integration.
        - `cloudId` string — The cloud account identifier.
        - `cloudIdType` 'AWS_ACCOUNT_ID' | 'AZURE_TENANT_ID' | 'GCP_PROJECT_ID' | 'GCP_ORGANIZATION_ID' | 'OCI_TENANT_ID' — The type of cloud account identifier.
        - `data` object, required
          - `issueGrouping` 'Events' | 'Resources' — Whether you want to group multiple events of a single type into a single event. Choosing Events results in a single event being created when FortiCNAPP detects compliance events of the same type on multiple resources. Choosing Resources results in multiple events being created, one for each resource. See [Create a IBM QRadar Alert Channel](https://docs.fortinet.com/document/forticnapp/latest/administration-guide?cshid=ibmQradarUrl).
          - `qradarCommType` 'HTTPS' | 'HTTPS Self Signed Cert', required — The issue group to use in this alert channel such as Events, Resources.
          - `qradarHostUrl` string, required — Your domain name or IP address of QRadar.
          - `qradarHostPort` number — Your listen port defined in QRadar.
        - `isOrg` number — Returns `1` if the access token has organization admin permissions. Otherwise, returns `0`.
        - `props` object — The integration's properties.
        - `createdOrUpdatedBy` string — The user who created or who last updated the integration.
        - `createdOrUpdatedTime` string — The timestamp for when the integration was created or last updated.
        - `intgGuid` string — The integration’s globally unique identifier.
        - `state` object — The integration’s real-time state, such as Pending, Success, or Error.
      - AlertChannelsJiraResponseSchema
        - `name` string, required — When sending a request, use this attribute to specify an integration’s name. When included in a response, this attribute returns the specified integration’s name.
        - `type` 'Jira', required — When sending a request, use this attribute to specify the type of integration, from the following options. When included in a response, this attribute returns the specified integration’s type.
        - `enabled` number, required — When sending a request, use this attribute to enable or disable an integration. When included in a response, returns `1` for an enabled integration or `0` for a disabled integration.
        - `cloudId` string — The cloud account identifier.
        - `cloudIdType` 'AWS_ACCOUNT_ID' | 'AZURE_TENANT_ID' | 'GCP_PROJECT_ID' | 'GCP_ORGANIZATION_ID' | 'OCI_TENANT_ID' — The type of cloud account identifier.
        - `data` union, required
          - AlertChannelsJiraDataJIRACLOUDCreateSchema
            - `jiraType` 'JIRA_CLOUD' — The Jira product you are using such as Jira Cloud or Jira Server.
            - `bidirectionalConfig` 'Unidirectional' | 'Bidirectional' — Whether you want to enable bidirectional updates, which allows FortiCNAPP to update Jira. See [Bidirectional Integration](https://docs.fortinet.com/document/forticnapp/latest/administration-guide?cshid=onboardingJira).
            - `issueGrouping` 'Events' | 'Resources' — Whether you want to group multiple events of a single type into a single Jira issue. Choosing `Events` results in a single Jira issue being created when FortiCNAPP detects compliance events of the same type on multiple resources. Choosing `Resources` results in multiple Jira issues being created, one for each resource. See [Create a Jira Alert Channel](https://docs.fortinet.com/document/forticnapp/latest/administration-guide?cshid=onboardingJira).
            - `jiraUrl` string, required — The URL of your Jira implementation.
            - `projectId` string, required — The Jira project where the new Jira issues should be created. Note that the specified Jira Issue type must exist in the specified Jira project prior to creating the FortiCNAPP Jira channel.
            - `issueType` string, required — The Jira Issue type (such as a Bug) to create when a new Jira issue is created.
            - `username` string, required — The Jira user name. FortiCNAPP recommends a dedicated Jira user.
            - `apiToken` string, password, required — Your Jira API Token.
            - `customTemplateFile` string, data-url — The custom template file to populate values from a custom template JSON file.
          - AlertChannelsJiraDataJIRASERVERCreateSchema
            - `jiraType` 'JIRA_SERVER' — The Jira product you are using such as Jira Cloud or Jira Server.
            - `bidirectionalConfig` 'Unidirectional' | 'Bidirectional' — Whether you want to enable bidirectional updates, which allows FortiCNAPP to update Jira. See [Bidirectional Integration](https://docs.fortinet.com/document/forticnapp/latest/administration-guide?cshid=onboardingJira).
            - `issueGrouping` 'Events' | 'Resources' — Whether you want to group multiple events of a single type into a single Jira issue. Choosing `Events` results in a single Jira issue being created when FortiCNAPP detects compliance events of the same type on multiple resources. Choosing `Resources` results in multiple Jira issues being created, one for each resource. See [Create a Jira Alert Channel](https://docs.fortinet.com/document/forticnapp/latest/administration-guide?cshid=onboardingJira).
            - `jiraUrl` string, required — The URL of your Jira implementation.
            - `projectId` string, required — The Jira project where the new Jira issues should be created. Note that the specified Jira Issue type must exist in the specified Jira project prior to creating the FortiCNAPP Jira channel.
            - `issueType` string, required — The Jira Issue type (such as a Bug) to create when a new Jira issue is created.
            - `username` string, required — The Jira user name. FortiCNAPP recommends using a dedicated Jira user.
            - `password` string, password, required — The password to the Jira user specified in the `username` attribute.
            - `customTemplateFile` string, data-url — The custom template file to populate values from a custom template JSON file.
        - `isOrg` number — Returns `1` if the access token has organization admin permissions. Otherwise, returns `0`.
        - `props` object — The integration's properties.
        - `createdOrUpdatedBy` string — The user who created or who last updated the integration.
        - `createdOrUpdatedTime` string — The timestamp for when the integration was created or last updated.
        - `intgGuid` string — The integration’s globally unique identifier.
        - `state` object — The integration’s real-time state, such as Pending, Success, or Error.
      - AlertChannelsMicrosoftTeamsResponseSchema
        - `name` string, required — When sending a request, use this attribute to specify an integration’s name. When included in a response, this attribute returns the specified integration’s name.
        - `type` 'MicrosoftTeams', required — When sending a request, use this attribute to specify the type of integration, from the following options. When included in a response, this attribute returns the specified integration’s type.
        - `enabled` number, required — When sending a request, use this attribute to enable or disable an integration. When included in a response, returns `1` for an enabled integration or `0` for a disabled integration.
        - `cloudId` string — The cloud account identifier.
        - `cloudIdType` 'AWS_ACCOUNT_ID' | 'AZURE_TENANT_ID' | 'GCP_PROJECT_ID' | 'GCP_ORGANIZATION_ID' | 'OCI_TENANT_ID' — The type of cloud account identifier.
        - `data` object, required
          - `teamsUrl` string, required — The URL of your Microsoft Teams incoming webhook.
        - `isOrg` number — Returns `1` if the access token has organization admin permissions. Otherwise, returns `0`.
        - `props` object — The integration's properties.
        - `createdOrUpdatedBy` string — The user who created or who last updated the integration.
        - `createdOrUpdatedTime` string — The timestamp for when the integration was created or last updated.
        - `intgGuid` string — The integration’s globally unique identifier.
        - `state` object — The integration’s real-time state, such as Pending, Success, or Error.
      - AlertChannelsNewRelicInsightsResponseSchema
        - `name` string, required — When sending a request, use this attribute to specify an integration’s name. When included in a response, this attribute returns the specified integration’s name.
        - `type` 'NewRelicInsights', required — When sending a request, use this attribute to specify the type of integration, from the following options. When included in a response, this attribute returns the specified integration’s type.
        - `enabled` number, required — When sending a request, use this attribute to enable or disable an integration. When included in a response, returns `1` for an enabled integration or `0` for a disabled integration.
        - `cloudId` string — The cloud account identifier.
        - `cloudIdType` 'AWS_ACCOUNT_ID' | 'AZURE_TENANT_ID' | 'GCP_PROJECT_ID' | 'GCP_ORGANIZATION_ID' | 'OCI_TENANT_ID' — The type of cloud account identifier.
        - `data` object, required
          - `insertKey` string, required — Your New Relic Insert Key. See [Add an Insert Key](https://docs.fortinet.com/document/forticnapp/latest/administration-guide?cshid=newRelicUrl)
          - `accountId` number, required — Your New Relic account ID.
          - `region` 'US' | 'EU' — The data center (US or EU) to access.
        - `isOrg` number — Returns `1` if the access token has organization admin permissions. Otherwise, returns `0`.
        - `props` object — The integration's properties.
        - `createdOrUpdatedBy` string — The user who created or who last updated the integration.
        - `createdOrUpdatedTime` string — The timestamp for when the integration was created or last updated.
        - `intgGuid` string — The integration’s globally unique identifier.
        - `state` object — The integration’s real-time state, such as Pending, Success, or Error.
      - AlertChannelsPagerDutyApiResponseSchema
        - `name` string, required — When sending a request, use this attribute to specify an integration’s name. When included in a response, this attribute returns the specified integration’s name.
        - `type` 'PagerDutyApi', required — When sending a request, use this attribute to specify the type of integration, from the following options. When included in a response, this attribute returns the specified integration’s type.
        - `enabled` number, required — When sending a request, use this attribute to enable or disable an integration. When included in a response, returns `1` for an enabled integration or `0` for a disabled integration.
        - `cloudId` string — The cloud account identifier.
        - `cloudIdType` 'AWS_ACCOUNT_ID' | 'AZURE_TENANT_ID' | 'GCP_PROJECT_ID' | 'GCP_ORGANIZATION_ID' | 'OCI_TENANT_ID' — The type of cloud account identifier.
        - `data` object, required
          - `apiIntgKey` string, required — Your Integration Key.
        - `isOrg` number — Returns `1` if the access token has organization admin permissions. Otherwise, returns `0`.
        - `props` object — The integration's properties.
        - `createdOrUpdatedBy` string — The user who created or who last updated the integration.
        - `createdOrUpdatedTime` string — The timestamp for when the integration was created or last updated.
        - `intgGuid` string — The integration’s globally unique identifier.
        - `state` object — The integration’s real-time state, such as Pending, Success, or Error.
      - AlertChannelsServiceNowRestResponseSchema
        - `name` string, required — When sending a request, use this attribute to specify an integration’s name. When included in a response, this attribute returns the specified integration’s name.
        - `type` 'ServiceNowRest', required — When sending a request, use this attribute to specify the type of integration, from the following options. When included in a response, this attribute returns the specified integration’s type.
        - `enabled` number, required — When sending a request, use this attribute to enable or disable an integration. When included in a response, returns `1` for an enabled integration or `0` for a disabled integration.
        - `cloudId` string — The cloud account identifier.
        - `cloudIdType` 'AWS_ACCOUNT_ID' | 'AZURE_TENANT_ID' | 'GCP_PROJECT_ID' | 'GCP_ORGANIZATION_ID' | 'OCI_TENANT_ID' — The type of cloud account identifier.
        - `data` object, required
          - `issueGrouping` 'Events' | 'Resources' — Whether you want to group multiple events of a single type into a single ServiceNow incident. Choosing `Events` results in a single ServiceNow incident being created when FortiCNAPP detects compliance events of the same type on multiple resources. Choosing `Resources` results in multiple compliance incidents being created, one for each resource. See [Create a ServiceNow Alert Channel](https://docs.fortinet.com/document/forticnapp/latest/administration-guide?cshid=serviceNowUrl).
          - `userName` string, required — Your ServiceNow username.
          - `password` string, password, required — Your ServiceNow password.
          - `instanceUrl` string, required — Your ServiceNow server.
          - `customTemplateFile` string, data-url — The custom template file to populate values from a custom template JSON file.
        - `isOrg` number — Returns `1` if the access token has organization admin permissions. Otherwise, returns `0`.
        - `props` object — The integration's properties.
        - `createdOrUpdatedBy` string — The user who created or who last updated the integration.
        - `createdOrUpdatedTime` string — The timestamp for when the integration was created or last updated.
        - `intgGuid` string — The integration’s globally unique identifier.
        - `state` object — The integration’s real-time state, such as Pending, Success, or Error.
      - AlertChannelsSlackChannelResponseSchema
        - `name` string, required — When sending a request, use this attribute to specify an integration’s name. When included in a response, this attribute returns the specified integration’s name.
        - `type` 'SlackChannel', required — When sending a request, use this attribute to specify the type of integration, from the following options. When included in a response, this attribute returns the specified integration’s type.
        - `enabled` number, required — When sending a request, use this attribute to enable or disable an integration. When included in a response, returns `1` for an enabled integration or `0` for a disabled integration.
        - `cloudId` string — The cloud account identifier.
        - `cloudIdType` 'AWS_ACCOUNT_ID' | 'AZURE_TENANT_ID' | 'GCP_PROJECT_ID' | 'GCP_ORGANIZATION_ID' | 'OCI_TENANT_ID' — The type of cloud account identifier.
        - `data` object, required
          - `slackUrl` string, required — The URL of your Slack incoming webhook.
        - `isOrg` number — Returns `1` if the access token has organization admin permissions. Otherwise, returns `0`.
        - `props` object — The integration's properties.
        - `createdOrUpdatedBy` string — The user who created or who last updated the integration.
        - `createdOrUpdatedTime` string — The timestamp for when the integration was created or last updated.
        - `intgGuid` string — The integration’s globally unique identifier.
        - `state` object — The integration’s real-time state, such as Pending, Success, or Error.
      - AlertChannelsSplunkHecResponseSchema
        - `name` string, required — When sending a request, use this attribute to specify an integration’s name. When included in a response, this attribute returns the specified integration’s name.
        - `type` 'SplunkHec', required — When sending a request, use this attribute to specify the type of integration, from the following options. When included in a response, this attribute returns the specified integration’s type.
        - `enabled` number, required — When sending a request, use this attribute to enable or disable an integration. When included in a response, returns `1` for an enabled integration or `0` for a disabled integration.
        - `cloudId` string — The cloud account identifier.
        - `cloudIdType` 'AWS_ACCOUNT_ID' | 'AZURE_TENANT_ID' | 'GCP_PROJECT_ID' | 'GCP_ORGANIZATION_ID' | 'OCI_TENANT_ID' — The type of cloud account identifier.
        - `data` object, required
          - `issueGrouping` 'Events' | 'Resources' — Whether you want to group multiple events of a single type into a single event. Choosing Events results in a single event being created when FortiCNAPP detects compliance events of the same type on multiple resources. Choosing Resources results in multiple events being created, one for each resource. See [Create a Splunk Alert Channel](https://docs.fortinet.com/document/forticnapp/latest/administration-guide?cshid=splunkUrl).
          - `hecToken` string, required — Your Splunk HEC token. To find your HEC token, navigate to Splunk Web, then click **Data Inputs > HttpEvent Collector**.
          - `channel` string — Channels are designed so that you assign a unique channel to each client that sends data to HEC. Each channel has a channel identifier (ID), which must be a Globally Unique Identifier (GUID) but can be randomly generated. You assign channel IDs simply by including them in requests as shown in the examples above. When Splunk Enterprise sees a new channel identifier, it creates a new channel.
          - `host` string, required — The resolvable hostname or IP address of your Splunk instance (such as `http-inputs-<host>.splunkcloud.com`).
          - `port` number, required — The destination port for forwarding alerts [80 or 443].
          - `ssl` boolean — When sending a request, use this attribute to enable or disable the SSL encryption. When included in a response, returns `1` for enabled SSL encryption, or returns `0` for disabled SSL encryption.
          - `eventData` object, required — Details of the event's data structure.
            - `index` string, required — The Splunk index to use in this alert channel.
            - `source` string, required — The Splunk source to use in this alert channel.
            - `sourceType` '_json' | 'lacework:alerts'
        - `isOrg` number — Returns `1` if the access token has organization admin permissions. Otherwise, returns `0`.
        - `props` object — The integration's properties.
        - `createdOrUpdatedBy` string — The user who created or who last updated the integration.
        - `createdOrUpdatedTime` string — The timestamp for when the integration was created or last updated.
        - `intgGuid` string — The integration’s globally unique identifier.
        - `state` object — The integration’s real-time state, such as Pending, Success, or Error.
      - AlertChannelsVictorOpsResponseSchema
        - `name` string, required — When sending a request, use this attribute to specify an integration’s name. When included in a response, this attribute returns the specified integration’s name.
        - `type` 'VictorOps', required — When sending a request, use this attribute to specify the type of integration, from the following options. When included in a response, this attribute returns the specified integration’s type.
        - `enabled` number, required — When sending a request, use this attribute to enable or disable an integration. When included in a response, returns `1` for an enabled integration or `0` for a disabled integration.
        - `cloudId` string — The cloud account identifier.
        - `cloudIdType` 'AWS_ACCOUNT_ID' | 'AZURE_TENANT_ID' | 'GCP_PROJECT_ID' | 'GCP_ORGANIZATION_ID' | 'OCI_TENANT_ID' — The type of cloud account identifier.
        - `data` object, required
          - `intgUrl` string, required — The VictorOps REST endpoint URL.
        - `isOrg` number — Returns `1` if the access token has organization admin permissions. Otherwise, returns `0`.
        - `props` object — The integration's properties.
        - `createdOrUpdatedBy` string — The user who created or who last updated the integration.
        - `createdOrUpdatedTime` string — The timestamp for when the integration was created or last updated.
        - `intgGuid` string — The integration’s globally unique identifier.
        - `state` object — The integration’s real-time state, such as Pending, Success, or Error.
      - AlertChannelsWebhookResponseSchema
        - `name` string, required — When sending a request, use this attribute to specify an integration’s name. When included in a response, this attribute returns the specified integration’s name.
        - `type` 'Webhook', required — When sending a request, use this attribute to specify the type of integration, from the following options. When included in a response, this attribute returns the specified integration’s type.
        - `enabled` number, required — When sending a request, use this attribute to enable or disable an integration. When included in a response, returns `1` for an enabled integration or `0` for a disabled integration.
        - `cloudId` string — The cloud account identifier.
        - `cloudIdType` 'AWS_ACCOUNT_ID' | 'AZURE_TENANT_ID' | 'GCP_PROJECT_ID' | 'GCP_ORGANIZATION_ID' | 'OCI_TENANT_ID' — The type of cloud account identifier.
        - `data` object, required
          - `webhookUrl` string, required — The Webhook URL endpoint.
          - `headers` object — A set of custom HTTP headers represented as key-value pairs. Keys are header names and values are header values.
        - `isOrg` number — Returns `1` if the access token has organization admin permissions. Otherwise, returns `0`.
        - `props` object — The integration's properties.
        - `createdOrUpdatedBy` string — The user who created or who last updated the integration.
        - `createdOrUpdatedTime` string — The timestamp for when the integration was created or last updated.
        - `intgGuid` string — The integration’s globally unique identifier.
        - `state` object — The integration’s real-time state, such as Pending, Success, or Error.

## Other responses

- `204` — No Data
- `4XX` — Client Error
- `5XX` — Internal Server Error

---

[API](https://skmtc.net/lacework/apis/forticnapp-api-2-0-documentation.md) · [All operations](https://skmtc.net/lacework/apis/forticnapp-api-2-0-documentation/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/lacework/forticnapp-api-2-0-documentation/revisions/7015f76895f2/schema)