---
title: "Investigate Alert Event"
method: POST
path: "/alerts/investigate"
---

# Investigate Alert Event

`POST /alerts/investigate`

Start an RCA investigation for an alert event.

This endpoint creates a new investigation session using ThinkingMode.DEEP
(full RCA workflow) and automatically links it to the alert event.

Supports both v2 alert events (AlertEvent table) and legacy alerts (Alert table)
for organizations like Pepsi that haven't migrated to the v2 schema.

Args:
    request: Request containing alert_event_id
    authorized_user: Authorized user with roles (for RBAC checks)

Returns:
    InvestigateAlertEventResponse containing session_id and alert_event_id

Raises:
    HTTPException: If alert event not found or user unauthorized

## Request body

- InvestigateAlertEventRequest — Request to start investigation for an alert event.
  - `alert_event_id` string, required

## Response `200`

Successful Response

- InvestigateAlertEventResponse — Response after starting alert event investigation.
  - `session_id` string, required
  - `alert_event_id` string, required

## Other responses

- `422` — Validation Error

---

[API](https://skmtc.net/traversal/apis/fastapi.md) · [All operations](https://skmtc.net/traversal/apis/fastapi/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/traversal/fastapi/revisions/2134ebffd1ef/schema)