---
title: "Update an alert"
method: PATCH
path: "/v2/alerts/{alert_id}"
tags: ["Alerts"]
---

# Update an alert

`PATCH /v2/alerts/{alert_id}`

Updates alert metadata, query, condition, notifiers, or enabled state. Query and condition changes restart the evaluation schedule; disabling stops it. `project_id` is immutable.

## Path parameters

- `alert_id` string, required

## Request body

- UpdateAlertRequest
  - `display_name` string — New workspace-unique display name. Omit to keep the current name.
  - `description` string — New description. Omit to keep the current description.
  - `signal` string — New UI signal preset. Omit to keep the current value.
  - `query` AlertQuery
    - `metric` string, required — Reporting API catalogue metric, e.g. `genai.cost` or `genai.latency.avg`. Validated against the catalogue when the alert is saved.
    - `filters` MonitorFilter[] — Reporting filters combined with AND.
      - `field` string, required — Reporting dimension to filter on. Valid fields depend on the metric; validated when the monitor is saved.
      - `op` 'eq' | 'neq' | 'in' | 'not_in', required — Predicate operator. `eq` and `neq` accept exactly one value; `in` and `not_in` accept 1-100 values.
      - `values` string[], required — Values compared against the selected field.
  - `condition` AlertCondition
    - `comparator` 'gt' | 'gte' | 'lt' | 'lte' | 'eq', required — Comparison applied as `value <comparator> threshold`.
    - `threshold` number, double, required — Critical-tier threshold. Breaching it opens (or escalates) a trigger at critical severity.
    - `degraded_threshold` number, double — Optional degraded-tier threshold. Values past it but short of `threshold` open a trigger at degraded severity. Must sit on the recovery side of `threshold` for the chosen comparator and is not supported with `eq`.
    - `resolve_threshold` number, double — Optional custom resolve bound (hysteresis). An open trigger resolves only once the value recovers past this bound; defaults to the lowest configured tier. Must sit at or past that tier on the recovery side. Not supported with `eq`.
    - `window` '5m' | '15m' | '30m' | '1h' | '4h' | '1d', required — Look-back window aggregated on each evaluation tick.
    - `interval` '30s' | '5m' | '15m' | '1h' | '1d', required — How often the alert is evaluated. `30s` is a testing cadence.
    - `delay` '30s' | '60s' | '120s' | '300s' | '600s' — Ingestion delay subtracted from the evaluation window. Defaults to `120s`.
  - `notifier_ids` string[] — Replacement notifier set. Omit to keep the current notifiers.
  - `enabled` boolean — New enabled state. Omit to keep the current state.

## Response `200`

OK

- UpdateAlertResponse
  - `alert` Alert, required
    - `alert_id` string, required — Unique alert identifier assigned by ORQ, for example `alert_01H...`. Use this value in retrieve, update, and delete requests.
    - `display_name` string, required — Workspace-unique display name.
    - `description` string, required — Short human-readable summary of what the alert watches.
    - `project_id` string, required — Project that owns the alert. Immutable after creation.
    - `signal` 'cost' | 'latency' | 'errors' | 'evals' | 'custom', required — UI signal preset the alert was created from.
    - `query` AlertQuery, required
      - `metric` string, required — Reporting API catalogue metric, e.g. `genai.cost` or `genai.latency.avg`. Validated against the catalogue when the alert is saved.
      - `filters` MonitorFilter[] — Reporting filters combined with AND.
        - `field` string, required — Reporting dimension to filter on. Valid fields depend on the metric; validated when the monitor is saved.
        - `op` 'eq' | 'neq' | 'in' | 'not_in', required — Predicate operator. `eq` and `neq` accept exactly one value; `in` and `not_in` accept 1-100 values.
        - `values` string[], required — Values compared against the selected field.
    - `condition` AlertCondition, required
      - `comparator` 'gt' | 'gte' | 'lt' | 'lte' | 'eq', required — Comparison applied as `value <comparator> threshold`.
      - `threshold` number, double, required — Critical-tier threshold. Breaching it opens (or escalates) a trigger at critical severity.
      - `degraded_threshold` number, double — Optional degraded-tier threshold. Values past it but short of `threshold` open a trigger at degraded severity. Must sit on the recovery side of `threshold` for the chosen comparator and is not supported with `eq`.
      - `resolve_threshold` number, double — Optional custom resolve bound (hysteresis). An open trigger resolves only once the value recovers past this bound; defaults to the lowest configured tier. Must sit at or past that tier on the recovery side. Not supported with `eq`.
      - `window` '5m' | '15m' | '30m' | '1h' | '4h' | '1d', required — Look-back window aggregated on each evaluation tick.
      - `interval` '30s' | '5m' | '15m' | '1h' | '1d', required — How often the alert is evaluated. `30s` is a testing cadence.
      - `delay` '30s' | '60s' | '120s' | '300s' | '600s' — Ingestion delay subtracted from the evaluation window. Defaults to `120s`.
    - `notifier_ids` string[], required — Notifiers that receive trigger-open and trigger-resolve notifications.
    - `enabled` boolean, required — Whether the alert is evaluated. Disabled alerts keep their trigger history but stop firing.
    - `status` 'ok' | 'degraded' | 'triggered', required — Current runtime status, maintained by the evaluation engine.
    - `last_triggered_at` string, date-time — Time when the alert last opened a trigger.
    - `recent_runs` AlertRun[] — Rolling window of the most recent evaluation ticks, oldest first. Maintained by the evaluation engine; read-only.
      - `at` string, date-time, required — Time of the evaluation tick.
      - `value` number, double, required — Observed metric value. Zero when `has_data` is false.
      - `breached` boolean, required — Whether the value breached the alert condition.
      - `has_data` boolean, required — Whether the evaluation window contained any data.
      - `severity` 'critical' | 'degraded' — Tier the value landed in when breached. Empty when not breached.
    - `created_at` string, date-time, required — Time when the alert was created.
    - `updated_at` string, date-time, required — Time when the alert was last updated.
    - `created_by_id` string, required — User ID that created the alert.
    - `updated_by_id` string, required — User ID that last updated the alert.

---

[API](https://skmtc.net/orq-ai/apis/orq-ai-api.md) · [All operations](https://skmtc.net/orq-ai/apis/orq-ai-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/orq-ai/orq-ai-api/versions/1072e5ba28ab/schema)