---
title: "Create Alert"
method: POST
path: "/api/v2/alerts"
tags: ["Alerts", "Enterprise"]
---

# Create Alert

`POST /api/v2/alerts`

Creates a new alert with the supplied subscription bindings. The
`subscriptions` array is required but may be empty.

## Request body

- object — Request body for creating an alert. The `subscriptions` array is required but may be empty to create an alert with no channel bindings.
  - `name` string, required
  - `description` string
  - `subscriptions` ModelAlertSubscriptionRequest[], required
    - `channel_id` string, uuid, required
    - `event_type` string, required
    - `version` integer, required
    - `disabled` boolean

## Response `201`

Created

- object
  - `data` object
    - `alert` ModelAlert — Alert resource — a named, user-managed rule with an embedded set of subscriptions that bind it to channels (e.g. webhooks) for specific event types.
      - `id` string, uuid
      - `name` string
      - `description` string
      - `created_at` string, date-time
      - `created_by` string
      - `updated_at` string, date-time
      - `updated_by` string
      - `disabled_at` string, date-time, nullable — An RFC-3339 formatted string
      - `disabled_by` string, nullable
      - `subscriptions` object[]
        - `channel_id` string, uuid — ID of the alert channel (e.g. webhook) this subscription targets.
        - `event_type` string
        - `version` integer — Payload data version this subscription targets.
        - `created_at` string, date-time
        - `disabled_at` string, date-time, nullable — An RFC-3339 formatted string
        - `disabled_by` string, nullable

## Other responses

- `400` — **Bad Request** This could be due to one of the following reasons: - JSON payload is missing or malformed - Path or query parameters are missing or invalid/malformed - The data sent is not valid (ex- sending a `string` in an `integer` field)
- `401` — **Unauthorized** This endpoint failed an authentication requirement. Either the client tried to access a protected endpoint without being authenticated, or an auth validation failed (ex- invalid credentials or expired token).
- `403` — **Forbidden** This is most commonly caused by an authenticated client trying to access a resource that it does not have permission for.
- `409` — **Conflict** The supplied `name` collides with an existing alert
- `429` — **Too Many Requests** The client has sent too many requests within a certain time window and tripped the rate limiting middleware.
- `500` — **Internal Server Error** This is usually the result of either an unexpected database or application error. The client may try modifying or resending the request, but the error is likely not related to the client doing something wrong.

---

[API](https://skmtc.net/specterops/apis/bloodhound-api.md) · [All operations](https://skmtc.net/specterops/apis/bloodhound-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/specterops/bloodhound-api/revisions/e0b866156902/schema)