AlertsCreate a rule

Create a rule

Route alerts to channels. A rule does not set thresholds: each detector decides what counts as a problem, and the rule decides who hears about it. When several rules point at the same channel, each alert is sent to it once. Up to 50 rules per agency and 10 channels per rule.

curl -X POST "https://mythic-analytics.gulp.workers.dev/client/v1/alerts/rules" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer YOUR_API_TOKEN" \
  -d '{
  "name": "Critical to Slack",
  "min_severity": "critical",
  "channel_ids": [
    "0b6f4c5e-3a0e-4a53-9d1d-6e2f7c1a9b10"
  ]
}'
{
  "success": true,
  "data": {
    "name": "John Doe",
    "sources": [
      "contracts"
    ],
    "location_ids": [
      "example_string"
    ],
    "min_severity": "info",
    "channel_ids": [
      "123e4567-e89b-12d3-a456-426614174000"
    ],
    "notify_on_resolve": true,
    "enabled": true,
    "id": "123e4567-e89b-12d3-a456-426614174000",
    "created_at": "2024-12-25T10:00:00Z",
    "updated_at": "2024-12-25T10:00:00Z"
  }
}
POST
/client/v1/alerts/rules
POST
Base URLstring

Target server for requests. Edit to use your own host.

Bearer Token
Bearer Tokenstring
Required

Agency key (ak_) only; a location secret key (sk_) gets 403 agency_required. Agency-wide scoped keys (mcp_) are accepted and need alerts:read or alerts:write. Keys are server-side credentials; this surface serves no CORS headers.

Agency key (ak_) only; a location secret key (sk_) gets 403 agency_required. Agency-wide scoped keys (mcp_) are accepted and need alerts:read or alerts:write. Keys are server-side credentials; this surface serves no CORS headers.
Content-Typestring
Required

The media type of the request body

Options: application/json
namestring
Max length: 120
sourcesarray

Empty or omitted = every source.

location_idsarray

Client ids. Empty or omitted = every client, including ones added later. Agency-level alerts (quota) only match rules that cover every client.

min_severitystring

The default, info, receives every alert. drift and 80% quota raise only info.

Options: info, warning, critical
channel_idsarray

Required on create, at least one. Channels must belong to the agency.

Request Preview
Response

Response will appear here after sending the request

Authentication

header
Authorizationstring
Required

Bearer token. Agency key (ak_) only; a location secret key (sk_) gets 403 agency_required. Agency-wide scoped keys (mcp_) are accepted and need alerts:read or alerts:write. Keys are server-side credentials; this surface serves no CORS headers.

Body

application/json
sourcesarray

Empty or omitted = every source.

location_idsarray

Client ids. Empty or omitted = every client, including ones added later. Agency-level alerts (quota) only match rules that cover every client.

min_severitystring

The default, info, receives every alert. drift and 80% quota raise only info.

Allowed values:infowarningcritical
channel_idsarray

Required on create, at least one. Channels must belong to the agency.

Responses