v1

latestOpenAPI 3.1.02026-07-171921144.8 KB

realtime

Replay all persisted active or failed rules onto RTVI VLM

Trigger Alert Bridge to re-onboard every persisted active or failed rule from Elasticsearch onto RTVI VLM. Intended for use after RTVI VLM restarts. Returns 409 if a replay is already running. While a replay is in progress, POST and DELETE on /realtime return 503.

post/api/v1/realtime/replay

Response

Replay completed

statusstring

messagestring required

correlation_idstring required

Per-invocation UUID4 hex woven through every replay log line (stage=replay_start|replay_rule|replay_end). Operators grep their log aggregator with it to follow one invocation end-to-end across the per-rule fan-out.

replayedinteger required

Number of rules successfully re-onboarded

failedinteger required

Number of rules that failed re-onboard

totalinteger required

Total rules attempted

detailsobject[]

Per-rule outcome: id, alert_type, result, error (if failed)

Example response

{
  "correlation_id": "f47ac10b58cc4372a5670e02b2c3d479",
  "details": [
    {
      "alert_type": "collision",
      "id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
      "result": "success"
    },
    {
      "alert_type": "intrusion",
      "id": "b2c3d4e5-f6a7-8901-bcde-f12345678901",
      "result": "success"
    }
  ],
  "failed": 0,
  "message": "Replay completed: 3 replayed, 0 failed out of 3 total",
  "replayed": 3,
  "status": "success",
  "total": 3
}