PostHog

PostHog alerts API

The alerts API from PostHog — 6 operation(s) for alerts.

GitHub OpenAPI

Operations 14

GET /api/environments/{environment_id}/alerts/ #
POST /api/environments/{environment_id}/alerts/ #
GET /api/environments/{environment_id}/alerts/{id}/ #
PUT /api/environments/{environment_id}/alerts/{id}/ #
PATCH /api/environments/{environment_id}/alerts/{id}/ #
DELETE /api/environments/{environment_id}/alerts/{id}/ #
POST /api/environments/{environment_id}/alerts/simulate/ #
GET /api/projects/{project_id}/alerts/ #
POST /api/projects/{project_id}/alerts/ #
GET /api/projects/{project_id}/alerts/{id}/ #
PUT /api/projects/{project_id}/alerts/{id}/ #
PATCH /api/projects/{project_id}/alerts/{id}/ #
DELETE /api/projects/{project_id}/alerts/{id}/ #
POST /api/projects/{project_id}/alerts/simulate/ #

Documentation

📖
Documentation
https://posthog.com/docs/api
📖
GettingStarted
https://posthog.com/docs/api
📖
Authentication
https://posthog.com/docs/api#authentication

Specifications

⚙
OpenAPI
https://raw.githubusercontent.com/api-evangelist/posthog/refs/heads/main/openapi/posthog-alerts-api-openapi.yml
⚙
AsyncAPI
https://raw.githubusercontent.com/api-evangelist/posthog/refs/heads/main/asyncapi/posthog-webhooks-asyncapi.yml

Other Resources

🔗
GraphQL
https://raw.githubusercontent.com/api-evangelist/posthog/refs/heads/main/graphql/posthog-graphql.md

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this
  • find_apisBrowse and filter every API in the catalog.
  • get_api_artifactsOne API's artifacts, grouped by type.
  • get_openapiThe primary OpenAPI for this API.
  • find_similar_apisAPIs that look like this one.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This API 
curl "https://apis.io/api/v1/apis/posthog-alerts-api"
All apis 
curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

posthog-alerts-api-openapi.yml Raw ↑ 
openapi: 3.2.0
info:
  title: PostHog actions Alerts API
  version: 1.0.0
  description: ''
servers:
- url: https://app.posthog.com/api
  description: Base URL declared by the provider in apis.yml (roadmap#122).
tags:
- name: alerts
paths:
  /api/environments/{environment_id}/alerts/:
    get:
      operationId: environments_alerts_list
      parameters:
      - $ref: '#/components/parameters/EnvironmentIdPath'
      - name: limit
        required: false
        in: query
        description: Number of results to return per page.
        schema:
          type: integer
      - name: offset
        required: false
        in: query
        description: The initial index from which to return the results.
        schema:
          type: integer
      tags:
      - alerts
      security:
      - PersonalAPIKeyAuth:
        - alert:read
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PaginatedAlertList'
          description: ''
      deprecated: true
      x-explicit-tags: []
    post:
      operationId: environments_alerts_create
      parameters:
      - $ref: '#/components/parameters/EnvironmentIdPath'
      tags:
      - alerts
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Alert'
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/Alert'
          multipart/form-data:
            schema:
              $ref: '#/components/schemas/Alert'
        required: true
      security:
      - PersonalAPIKeyAuth:
        - alert:write
      responses:
        '201':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Alert'
          description: ''
      deprecated: true
      x-explicit-tags: []
  /api/environments/{environment_id}/alerts/{id}/:
    get:
      operationId: environments_alerts_retrieve
      parameters:
      - in: query
        name: checks_date_from
        schema:
          type: string
        description: Relative date string for the start of the check history window (e.g. '-24h', '-7d', '-14d'). Returns checks created after this time. Max retention is 14 days.
      - in: query
        name: checks_date_to
        schema:
          type: string
        description: Relative date string for the end of the check history window (e.g. '-1h', '-1d'). Defaults to now if not specified.
      - in: query
        name: checks_limit
        schema:
          type: integer
        description: Maximum number of check results to return (default 5, max 500). Applied after date filtering.
      - in: query
        name: checks_offset
        schema:
          type: integer
        description: Number of newest checks to skip (0-based). Use with checks_limit for pagination. Default 0.
      - $ref: '#/components/parameters/EnvironmentIdPath'
      - in: path
        name: id
        schema:
          type: string
          format: uuid
        description: A UUID string identifying this alert configuration.
        required: true
      tags:
      - alerts
      security:
      - PersonalAPIKeyAuth:
        - alert:read
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Alert'
          description: ''
      deprecated: true
      x-explicit-tags: []
    put:
      operationId: environments_alerts_update
      parameters:
      - $ref: '#/components/parameters/EnvironmentIdPath'
      - in: path
        name: id
        schema:
          type: string
          format: uuid
        description: A UUID string identifying this alert configuration.
        required: true
      tags:
      - alerts
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Alert'
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/Alert'
          multipart/form-data:
            schema:
              $ref: '#/components/schemas/Alert'
        required: true
      security:
      - PersonalAPIKeyAuth:
        - alert:write
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Alert'
          description: ''
      deprecated: true
      x-explicit-tags: []
    patch:
      operationId: environments_alerts_partial_update
      parameters:
      - $ref: '#/components/parameters/EnvironmentIdPath'
      - in: path
        name: id
        schema:
          type: string
          format: uuid
        description: A UUID string identifying this alert configuration.
        required: true
      tags:
      - alerts
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PatchedAlert'
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/PatchedAlert'
          multipart/form-data:
            schema:
              $ref: '#/components/schemas/PatchedAlert'
      security:
      - PersonalAPIKeyAuth:
        - alert:write
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Alert'
          description: ''
      deprecated: true
      x-explicit-tags: []
    delete:
      operationId: environments_alerts_destroy
      parameters:
      - $ref: '#/components/parameters/EnvironmentIdPath'
      - in: path
        name: id
        schema:
          type: string
          format: uuid
        description: A UUID string identifying this alert configuration.
        required: true
      tags:
      - alerts
      security:
      - PersonalAPIKeyAuth:
        - alert:write
      responses:
        '204':
          description: No response body
      deprecated: true
      x-explicit-tags: []
  /api/environments/{environment_id}/alerts/simulate/:
    post:
      operationId: environments_alerts_simulate_create
      description: Simulate a detector on an insight's historical data. Read-only — no AlertCheck records are created.
      parameters:
      - $ref: '#/components/parameters/EnvironmentIdPath'
      tags:
      - alerts
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AlertSimulate'
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/AlertSimulate'
          multipart/form-data:
            schema:
              $ref: '#/components/schemas/AlertSimulate'
        required: true
      security:
      - PersonalAPIKeyAuth:
        - alert:read
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AlertSimulateResponse'
          description: ''
      deprecated: true
      x-explicit-tags: []
  /api/projects/{project_id}/alerts/:
    get:
      operationId: alerts_list
      parameters:
      - name: limit
        required: false
        in: query
        description: Number of results to return per page.
        schema:
          type: integer
      - name: offset
        required: false
        in: query
        description: The initial index from which to return the results.
        schema:
          type: integer
      - $ref: '#/components/parameters/ProjectIdPath'
      tags:
      - alerts
      security:
      - PersonalAPIKeyAuth:
        - alert:read
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PaginatedAlertList'
          description: ''
      x-explicit-tags: []
    post:
      operationId: alerts_create
      parameters:
      - $ref: '#/components/parameters/ProjectIdPath'
      tags:
      - alerts
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Alert'
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/Alert'
          multipart/form-data:
            schema:
              $ref: '#/components/schemas/Alert'
        required: true
      security:
      - PersonalAPIKeyAuth:
        - alert:write
      responses:
        '201':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Alert'
          description: ''
      x-explicit-tags: []
  /api/projects/{project_id}/alerts/{id}/:
    get:
      operationId: alerts_retrieve
      parameters:
      - in: query
        name: checks_date_from
        schema:
          type: string
        description: Relative date string for the start of the check history window (e.g. '-24h', '-7d', '-14d'). Returns checks created after this time. Max retention is 14 days.
      - in: query
        name: checks_date_to
        schema:
          type: string
        description: Relative date string for the end of the check history window (e.g. '-1h', '-1d'). Defaults to now if not specified.
      - in: query
        name: checks_limit
        schema:
          type: integer
        description: Maximum number of check results to return (default 5, max 500). Applied after date filtering.
      - in: query
        name: checks_offset
        schema:
          type: integer
        description: Number of newest checks to skip (0-based). Use with checks_limit for pagination. Default 0.
      - in: path
        name: id
        schema:
          type: string
          format: uuid
        description: A UUID string identifying this alert configuration.
        required: true
      - $ref: '#/components/parameters/ProjectIdPath'
      tags:
      - alerts
      security:
      - PersonalAPIKeyAuth:
        - alert:read
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Alert'
          description: ''
      x-explicit-tags: []
    put:
      operationId: alerts_update
      parameters:
      - in: path
        name: id
        schema:
          type: string
          format: uuid
        description: A UUID string identifying this alert configuration.
        required: true
      - $ref: '#/components/parameters/ProjectIdPath'
      tags:
      - alerts
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Alert'
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/Alert'
          multipart/form-data:
            schema:
              $ref: '#/components/schemas/Alert'
        required: true
      security:
      - PersonalAPIKeyAuth:
        - alert:write
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Alert'
          description: ''
      x-explicit-tags: []
    patch:
      operationId: alerts_partial_update
      parameters:
      - in: path
        name: id
        schema:
          type: string
          format: uuid
        description: A UUID string identifying this alert configuration.
        required: true
      - $ref: '#/components/parameters/ProjectIdPath'
      tags:
      - alerts
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PatchedAlert'
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/PatchedAlert'
          multipart/form-data:
            schema:
              $ref: '#/components/schemas/PatchedAlert'
      security:
      - PersonalAPIKeyAuth:
        - alert:write
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Alert'
          description: ''
      x-explicit-tags: []
    delete:
      operationId: alerts_destroy
      parameters:
      - in: path
        name: id
        schema:
          type: string
          format: uuid
        description: A UUID string identifying this alert configuration.
        required: true
      - $ref: '#/components/parameters/ProjectIdPath'
      tags:
      - alerts
      security:
      - PersonalAPIKeyAuth:
        - alert:write
      responses:
        '204':
          description: No response body
      x-explicit-tags: []
  /api/projects/{project_id}/alerts/simulate/:
    post:
      operationId: alerts_simulate_create
      description: Simulate a detector on an insight's historical data. Read-only — no AlertCheck records are created.
      parameters:
      - $ref: '#/components/parameters/ProjectIdPath'
      tags:
      - alerts
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AlertSimulate'
          application/x-www-form-urlencoded:
            schema:
              $ref: '#/components/schemas/AlertSimulate'
          multipart/form-data:
            schema:
              $ref: '#/components/schemas/AlertSimulate'
        required: true
      security:
      - PersonalAPIKeyAuth:
        - alert:read
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AlertSimulateResponse'
          description: ''
      x-explicit-tags: []
components:
  schemas:
    PCADetectorConfig:
      additionalProperties: false
      properties:
        preprocessing:
          default: null
          description: Preprocessing transforms applied before detection
          allOf:
          - $ref: '#/components/schemas/PreprocessingConfig'
        threshold:
          default: null
          description: 'Anomaly probability threshold (default: 0.9)'
          title: Threshold
          type:
          - number
          - 'null'
        type:
          default: pca
          title: Type
          type: string
          enum:
          - pca
        window:
          default: null
          description: 'Rolling window size — how many historical data points to train on (default: based on calculation interval)'
          title: Window
          type:
          - integer
          - 'null'
      title: PCADetectorConfig
      type: object
    ZScoreDetectorConfig:
      additionalProperties: false
      properties:
        preprocessing:
          default: null
          description: Preprocessing transforms applied before detection
          allOf:
          - $ref: '#/components/schemas/PreprocessingConfig'
        threshold:
          default: null
          description: 'Anomaly probability threshold [0-1]. Points above this probability are flagged (default: 0.9)'
          title: Threshold
          type:
          - number
          - 'null'
        type:
          default: zscore
          title: Type
          type: string
          enum:
          - zscore
        window:
          default: null
          description: 'Rolling window size for calculating mean/std (default: 30)'
          title: Window
          type:
          - integer
          - 'null'
      title: ZScoreDetectorConfig
      type: object
    CalculationIntervalEnum:
      enum:
      - hourly
      - daily
      - weekly
      - monthly
      type: string
      description: '* `hourly` - hourly

        * `daily` - daily

        * `weekly` - weekly

        * `monthly` - monthly'
    NullEnum:
      enum:
      - null
    PreprocessingConfig:
      additionalProperties: false
      properties:
        diffs_n:
          default: null
          description: 'Order of differencing. 0 = raw values, 1 = first-order diffs (default: 0)'
          title: Diffs N
          type:
          - integer
          - 'null'
        lags_n:
          default: null
          description: 'Number of lag features. 0 = none, >0 = include n lagged values (default: 0)'
          title: Lags N
          type:
          - integer
          - 'null'
        smooth_n:
          default: null
          description: 'Moving average window size. 0 = no smoothing, >1 = smooth over n points (default: 0)'
          title: Smooth N
          type:
          - integer
          - 'null'
      title: PreprocessingConfig
      type: object
    AlertCheck:
      type: object
      properties:
        id:
          type: string
          format: uuid
          readOnly: true
        created_at:
          type: string
          format: date-time
          readOnly: true
        calculated_value:
          type:
          - number
          - 'null'
          format: double
          readOnly: true
        state:
          allOf:
          - $ref: '#/components/schemas/AlertCheckStateEnum'
          readOnly: true
        targets_notified:
          type: boolean
          readOnly: true
        anomaly_scores:
          readOnly: true
        triggered_points:
          readOnly: true
        triggered_dates:
          readOnly: true
        interval:
          type:
          - string
          - 'null'
          readOnly: true
        triggered_metadata:
          readOnly: true
        investigation_status:
          readOnly: true
          oneOf:
          - $ref: '#/components/schemas/InvestigationStatusEnum'
          - $ref: '#/components/schemas/NullEnum'
        investigation_verdict:
          readOnly: true
          oneOf:
          - $ref: '#/components/schemas/InvestigationVerdictEnum'
          - $ref: '#/components/schemas/NullEnum'
        investigation_summary:
          type:
          - string
          - 'null'
          readOnly: true
        investigation_notebook_short_id:
          type:
          - string
          - 'null'
          readOnly: true
          description: Short ID of the Notebook produced by the investigation agent, when the agent ran for this check.
        notification_sent_at:
          type:
          - string
          - 'null'
          format: date-time
          readOnly: true
        notification_suppressed_by_agent:
          type: boolean
          readOnly: true
      required:
      - anomaly_scores
      - calculated_value
      - created_at
      - id
      - interval
      - investigation_notebook_short_id
      - investigation_status
      - investigation_summary
      - investigation_verdict
      - notification_sent_at
      - notification_suppressed_by_agent
      - state
      - targets_notified
      - triggered_dates
      - triggered_metadata
      - triggered_points
    EnsembleDetectorConfig:
      additionalProperties: false
      properties:
        detectors:
          description: Sub-detector configurations (minimum 2)
          items:
            anyOf:
            - $ref: '#/components/schemas/ZScoreDetectorConfig'
            - $ref: '#/components/schemas/MADDetectorConfig'
            - $ref: '#/components/schemas/IQRDetectorConfig'
            - $ref: '#/components/schemas/ThresholdDetectorConfig'
            - $ref: '#/components/schemas/ECODDetectorConfig'
            - $ref: '#/components/schemas/COPODDetectorConfig'
            - $ref: '#/components/schemas/IsolationForestDetectorConfig'
            - $ref: '#/components/schemas/KNNDetectorConfig'
            - $ref: '#/components/schemas/HBOSDetectorConfig'
            - $ref: '#/components/schemas/LOFDetectorConfig'
            - $ref: '#/components/schemas/OCSVMDetectorConfig'
            - $ref: '#/components/schemas/PCADetectorConfig'
          title: Detectors
          type: array
        operator:
          description: How to combine sub-detector results
          allOf:
          - $ref: '#/components/schemas/EnsembleOperator'
        type:
          default: ensemble
          title: Type
          type: string
          enum:
          - ensemble
      required:
      - detectors
      - operator
      title: EnsembleDetectorConfig
      type: object
    COPODDetectorConfig:
      additionalProperties: false
      properties:
        preprocessing:
          default: null
          description: Preprocessing transforms applied before detection
          allOf:
          - $ref: '#/components/schemas/PreprocessingConfig'
        threshold:
          default: null
          description: 'Anomaly probability threshold (default: 0.9)'
          title: Threshold
          type:
          - number
          - 'null'
        type:
          default: copod
          title: Type
          type: string
          enum:
          - copod
        window:
          default: null
          description: 'Rolling window size — how many historical data points to train on (default: based on calculation interval)'
          title: Window
          type:
          - integer
          - 'null'
      title: COPODDetectorConfig
      type: object
    AlertScheduleRestriction:
      additionalProperties: false
      properties:
        blocked_windows:
          description: Blocked local time windows when the alert must not run. Overlapping or identical windows are merged when saved. At most five windows before normalization; empty array clears quiet hours.
          items:
            $ref: '#/components/schemas/AlertScheduleRestrictionWindow'
          title: Blocked Windows
          type: array
      required:
      - blocked_windows
      title: AlertScheduleRestriction
      type: object
    OCSVMDetectorConfig:
      additionalProperties: false
      properties:
        kernel:
          default: null
          description: 'SVM kernel type (default: "rbf")'
          title: Kernel
          type:
          - string
          - 'null'
        nu:
          default: null
          description: 'Upper bound on training errors fraction (default: 0.1)'
          title: Nu
          type:
          - number
          - 'null'
        preprocessing:
          default: null
          description: Preprocessing transforms applied before detection
          allOf:
          - $ref: '#/components/schemas/PreprocessingConfig'
        threshold:
          default: null
          description: 'Anomaly probability threshold (default: 0.9)'
          title: Threshold
          type:
          - number
          - 'null'
        type:
          default: ocsvm
          title: Type
          type: string
          enum:
          - ocsvm
        window:
          default: null
          description: 'Rolling window size — how many historical data points to train on (default: based on calculation interval)'
          title: Window
          type:
          - integer
          - 'null'
      title: OCSVMDetectorConfig
      type: object
    AlertConditionType:
      enum:
      - absolute_value
      - relative_increase
      - relative_decrease
      title: AlertConditionType
      type: string
    AlertSimulate:
      type: object
      properties:
        insight:
          type: integer
          description: Insight ID to simulate the detector on.
        detector_config:
          allOf:
          - $ref: '#/components/schemas/DetectorConfig'
          description: Detector configuration to simulate.
        series_index:
          type: integer
          default: 0
          description: Zero-based index of the series to analyze.
        date_from:
          type:
          - string
          - 'null'
          description: Relative date string for how far back to simulate (e.g. '-24h', '-30d', '-4w'). If not provided, uses the detector's minimum required samples.
      required:
      - detector_config
      - insight
    AlertScheduleRestrictionWindow:
      additionalProperties: false
      properties:
        start:
          description: Start time HH:MM (24-hour, project timezone). Inclusive. Each window must span ≥ 30 minutes on the local daily timeline (half-open [start, end)).
          title: Start
          type: string
        end:
          description: End time HH:MM (24-hour). Exclusive (half-open interval). Each window must span ≥ 30 minutes locally.
          title: End
          type: string
      required:
      - start
      - end
      title: AlertScheduleRestrictionWindow
      type: object
    InvestigationStatusEnum:
      enum:
      - pending
      - running
      - done
      - failed
      - skipped
      type: string
      description: '* `pending` - pending

        * `running` - running

        * `done` - done

        * `failed` - failed

        * `skipped` - skipped'
    Threshold:
      type: object
      properties:
        id:
          type: string
          format: uuid
          readOnly: true
        created_at:
          type: string
          format: date-time
          readOnly: true
        name:
          type: string
          description: Optional name for the threshold.
        configuration:
          allOf:
          - $ref: '#/components/schemas/InsightThreshold'
          description: Threshold bounds and type. Includes bounds (lower/upper floats) and type (absolute or percentage).
      required:
      - configuration
      - created_at
      - id
    Alert:
      type: object
      properties:
        id:
          type: string
          format: uuid
          readOnly: true
        created_by:
          allOf:
          - $ref: '#/components/schemas/UserBasic'
          readOnly: true
        created_at:
          type: string
          format: date-time
          readOnly: true
        insight:
          type: integer
          description: 'Insight ID monitored by this alert. Note: Response returns full InsightBasicSerializer object.'
        name:
          type: string
          description: Human-readable name for the alert.
        subscribed_users:
          type: array
          items:
            type: integer
          description: 'User IDs to subscribe to this alert. Note: Response returns full UserBasicSerializer object.'
        threshold:
          allOf:
          - $ref: '#/components/schemas/Threshold'
          description: Threshold configuration with bounds and type for evaluating the alert.
        condition:
          allOf:
          - $ref: '#/components/schemas/AlertCondition'
          description: 'Alert condition type. Determines how the value is evaluated: absolute_value, relative_increase, or relative_decrease.'
        state:
          type: string
          readOnly: true
          description: 'Current alert state: Firing, Not firing, Errored, or Snoozed.'
        enabled:
          type: boolean
          description: Whether the alert is actively being evaluated.
        last_notified_at:
          type:
          - string
          - 'null'
          format: date-time
          readOnly: true
        last_checked_at:
          type:
          - string
          - 'null'
          format: date-time
          readOnly: true
        next_check_at:
          type:
          - string
          - 'null'
          format: date-time
          readOnly: true
        checks:
          type: array
          items:
            $ref: '#/components/schemas/AlertCheck'
          readOnly: true
          description: Alert check results. By default returns the last 5. Use checks_date_from and checks_date_to (e.g. '-24h', '-7d') to get checks within a time window, checks_limit to cap how many are returned (default 5, max 500), and checks_offset to skip the newest N checks for pagination (0-based). Newest checks first. Only populated on retrieve.
        checks_total:
          type:
          - integer
          - 'null'
          readOnly: true
          description: Total alert checks matching the retrieve filters (date window). Only set on alert retrieve; omitted otherwise.
        config:
          allOf:
          - $ref: '#/components/schemas/TrendsAlertConfig'
          description: Trends-specific alert configuration. Includes series_index (which series to monitor) and check_ongoing_interval (whether to check the current incomplete interval).
        detector_config:
          allOf:
          - $ref: '#/components/schemas/DetectorConfig'
        calculation_interval:
          allOf:
          - $ref: '#/components/schemas/CalculationIntervalEnum'
          description: 'How often the alert is checked: hourly, daily, weekly, or monthly.


            * `hourly` - hourly

            * `daily` - daily

            * `weekly` - weekly

            * `monthly` - monthly'
        snoozed_until:
          type:
          - string
          - 'null'
          description: Snooze the alert until this time. Pass a relative date string (e.g. '2h', '1d') or null to unsnooze.
        skip_weekend:
          type:
          - boolean
          - 'null'
          description: Skip alert evaluation on weekends (Saturday and Sunday, local to project timezone).
        schedule_restriction:
          allOf:
          - $ref: '#/components/schemas/AlertScheduleRestriction'
          description: 'Blocked local time windows (HH:MM in the project timezone). Interval is half-open [start, end): start inclusive, end exclusive. Use blocked_windows array of {start, end}. Null disables.'
        last_value:
          type:
          - number
          - 'null'
          format: double
          readOnly: true
          description: The last calculated value from the most recent alert check.
        investigation_agent_enabled:
          type: boolean
          description: When enabled, an investigation agent runs on the state transition to firing and writes findings to a Notebook linked from the alert check. Only effective for detector-based (anomaly) alerts.
        investigation_gates_notifications:
          type: boolean
          description: When enabled (and investigation_agent_enabled is on), notification dispatch is held until the investigation agent produces a verdict. Notifications are suppressed when the verdict is false_positive (and optionally when inconclusive). A safety-net task force-fires after a few minutes if the investigation stalls.
        investigation_inconclusive_action:
          allOf:
          - $ref: '#/components/schemas/InvestigationInconclusiveActionEnum'
          description: 'How to handle an ''inconclusive'' verdict when notifications are gated. ''notify'' is the safe default — an agent that can''t be sure is itself useful signal.


            * `notify` - Notify

            * `suppress` - Suppress'
      required:
      - checks
      - checks_total
      - created_at
      - created_by
      - id
      - insight
      - last_checked_at
      - last_notified_at
      - last_value
      - next_check_at
      - state
      - subscribed_users
      - threshold
    LOFDetectorConfig:
      additionalProperties: false
      properties:
        n_neighbors:
          default: null
          description: 'Number of neighbors for LOF (default: 20)'
          title: N Neighbors
          type:
          - integer
          - 'null'
        preprocessing:
          default: null
          description: Preprocessing transforms applied before detection
          allOf:
          - $ref: '#/components/schemas/PreprocessingConfig'
        threshold:
          default: null
          description: 'Anomaly probability threshold (default: 0.9)'
          title: Threshold
          type:
          - number
          - 'null'
        type:
          default: lof
          title: Type
          type: string
          enum:
          - lof
        window:
          default: null
          description: 'Rolling window size — how many historical data points to train on (default: based on calculation interval)'
          title: Window
          type:
          - integer
          - 'null'
      title: LOFDetectorConfig
      type: object
    InsightThreshold:
      additionalProperties: false
      properties:
        bounds:
          default: null
          allOf:
          - $ref: '#/components/schemas/InsightsThresholdBounds'
        type:
          description: Whether bounds are compared as absolute values or as percentage change from the previous interval.
          allOf:
          - $ref: '#/components/schemas/InsightThresholdType'
      required:
      - type
      title: InsightThreshold
      type: object
    HBOSDetectorConfig:
      additionalProperties: false
      properties:
        n_bins:
          default: null
          description: 'Number of histogram bins (default: 10)'
          title: N Bins
          type:
          - integer
          - 'null'
        preprocessing:
 

# --- truncated at 32 KB (55 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/posthog/refs/heads/main/openapi/posthog-alerts-api-openapi.yml