---
title: "Triage Flow"
method: POST
path: "/cron/triage/trigger"
---

# Triage Flow

`POST /cron/triage/trigger`

Execute the full alert triage flow.

Args:
    request: TriageFlowRequest containing organization_id, integration, and query_string
    m2m_token: Machine-to-machine authentication token

Returns:
    TriageFlowResponse with success status and number of investigations started

## Request body

- TriageFlowRequest
  - `organization_id` string, required
  - `integration` string, required
  - `query_string` string, nullable
  - `number_of_alerts_to_run_per_period` integer
  - `lookback_minutes` integer, nullable
  - `end_time` string, date-time, nullable
  - `trigger_source` 'cron' | 'slack' | 'manual' | 'system' | 'webhook' — Enum for alert triage trigger sources. Indicates what initiated an alert investigation.
  - `skip_fetch_and_persist` boolean
  - `skip_anomaly_detection` boolean
  - `skip_investigation` boolean

## Response `200`

Successful Response

- TriageFlowResponse
  - `success` boolean, required
  - `number_of_investigation_started` integer, required

## Other responses

- `422` — Validation Error

---

[API](https://skmtc.net/traversal/apis/fastapi.md) · [All operations](https://skmtc.net/traversal/apis/fastapi/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/traversal/fastapi/revisions/2134ebffd1ef/schema)