Sign in

v1

latestOpenAPI 3.1.02026-08-042010999.7 KB
Monitoring: Entity Management

Retrieve a listing of Alerts

This endpoint retrieves the alerts listing. By default, it will return open alerts. An alert is a list of new risks seen since the last alert was closed. You can paginate with a cursor using the 'id' column.

post/alerts

Query parameters

sortBystring nullable

The field name that you want to sort by. Many fields in the response are sortable, but not all.

The field name that you want to sort by. Many fields in the response are sortable, but not all.

sortOrderstring nullable

ASC or DESC. Defaults: DESC

Example:asc

ASC or DESC. Defaults: DESC

pageinteger

Page number, 1-indexed. Default: 1

Example:1

Page number, 1-indexed. Default: 1

pageSizeinteger

Number of results per page. Maximum: 100, Default: 10

Example:10

Number of results per page. Maximum: 100, Default: 10

{"stackTrail":"paths:/alerts:post:parameters:4:schema","oasType":"schema","type":"unknown","nullable":true}

Request body

string[] nullable required

Response

OK

closedAtstring date-time nullable

When the alert was closed. Null if the alert is still open. Alerts cannot be reopened once closed.

closedByUserNamestring nullable

Name of the user who closed the alert.

closedByUserURNstring nullable

URN of the user who closed the alert.

createdAtstring date-time

When the alert was first created.

entityCreatedAtstring date-time
entityCustomerKeystring

The customer key of the entity associated with this alert.

entityEscalatedboolean

Whether the entity has been escalated for review.

entityEscalatedByUserNamestring nullable

If escalated, the name of the user who escalated the entity.

entityEscalatedByUserUrnstring nullable

If escalated, the URN of the user who escalated the entity.

entityEscalatedTimestring date-time nullable

If escalated, the time when the entity was escalated.

entityFilterSetIDinteger
entityFilterSetNamestring
entityNamestring

The name of the entity associated with this alert.

entityRiskScoreinteger

The current risk score of the entity.

entityType'company' | 'person' | 'vessel' | 'aircraft' | ''

The type that the entity was searched with

entityURNstring

The URN of the entity associated with this alert. You can use the "Retrieve an entity's current state" endpoint with this value.

idinteger

Unique identifier for the alert.

originsstring[] nullable

A user-friendly list of where the entity was seen, e.g. in Monitoring entities, or in one-off searches.

status'open' | 'closed'

Current status of the alert.

updatedAtstring date-time

When the alert was last updated, typically when new indicators were added.

Example response

{
  "alertIndicatorSummary": [
    {
      "category": "Sanctions",
      "count": 2,
      "maxScore": 100
    }
  ],
  "entityDispositionState": {
    "dispositionSetAtTime": "2020-01-01T00:00:00Z",
    "dispositionSetByUserName": "John Hammond",
    "dispositionSetByUserURN": "urn:sigma:user:f6ba1259b3a35de80aab7733c5d5",
    "dispositionState": "pending"
  },
  "entityReviewState": {
    "lastReviewDate": "2020-01-01T00:00:00Z",
    "reviewLockedByName": "John Hammond",
    "reviewLockedByURN": "urn:sigma:user:f6ba1259b3a35de80aab7733c5d5",
    "reviewLockedSince": "2020-01-01T00:00:00Z",
    "reviewStatus": "needs_review",
    "unreviewedItems": {
      "numIndicators": 5,
      "numMatches": 2,
      "numNews": 16,
      "total": 3
    }
  },
  "entityType": "company",
  "riskMetadata": {
    "newsMetadata": [
      {
        "count": 3,
        "eventNewsType": "Legal Risk",
        "samplePublishers": [
          "The New York Times"
        ],
        "unformattedEventNewsType": "legal_risk"
      }
    ],
    "pepLevels": [
      "PEP Level 1"
    ],
    "sanctionLists": [
      "sanctions_ofac"
    ]
  }
}