Create Alert Rule

POST

/observability/v1/workspaces/{workspace}/engines/{engine}/alert-rules

const url = 'https://example.com/observability/v1/workspaces/example/engines/example/alert-rules';
const options = {
  method: 'POST',
  headers: {'Content-Type': 'application/json'},
  body: '{"location_id":"example","name":"example","kind":"ALERT_KIND_UNSPECIFIED","signal":"ALERT_SIGNAL_UNSPECIFIED","qibdo":{"expression":"example","for_seconds":"example","labels":{"additionalProperty":"example"},"annotations":{"additionalProperty":"example"},"route":{"group_by":["example"],"matchers":[{"label":"example","value":"example"}],"child_routes":[],"receivers":[{"webhook":{"url":"example"},"email":{"addresses":["example"]},"slack":{"channel":"example","credential_ref":"example"}}]}}}'
};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

curl --request POST \
  --url https://example.com/observability/v1/workspaces/example/engines/example/alert-rules \
  --header 'Content-Type: application/json' \
  --data '{ "location_id": "example", "name": "example", "kind": "ALERT_KIND_UNSPECIFIED", "signal": "ALERT_SIGNAL_UNSPECIFIED", "qibdo": { "expression": "example", "for_seconds": "example", "labels": { "additionalProperty": "example" }, "annotations": { "additionalProperty": "example" }, "route": { "group_by": [ "example" ], "matchers": [ { "label": "example", "value": "example" } ], "child_routes": [], "receivers": [ { "webhook": { "url": "example" }, "email": { "addresses": [ "example" ] }, "slack": { "channel": "example", "credential_ref": "example" } } ] } } }'

Creates an alert or recording rule in the workspace on the given provider. A specific provider is required.

Parameters

Path Parameters

workspace

required

string

The workspace to create the alert rule in.

engine

required

string

The provider: qibdo, aws, gcp, or azure (a specific provider is required for create).

Request Body^required

application/json

An alert rule evaluates a PromQL/LogQL expression over a signal (metric or log) and, for ALERT-kind rules, routes fired alerts through a notification tree to webhook, email, or app-message receivers. A RECORDING-kind rule instead precomputes a derived series and needs no route. The provider that evaluates the rule is reported by the read-only engine field.

object

The unique identifier of the alert rule.

stringOutput only

workspace_id

The workspace this rule belongs to. Derived from the {workspace} path segment on create; reported read-only thereafter.

stringOutput only

location_id

required

Weak reference to a topology Location — where the telemetry resides. Immutable after create.

string

name

required

The rule’s handle: a DNS-label (lowercase alphanumerics and hyphens, up to 63 characters), unique within the workspace. Set on create, immutable thereafter.

string

kind

required

Whether the rule raises notifications (ALERT) or precomputes a series (RECORDING). Immutable after create.

string format: enum

Allowed values: ALERT_KIND_UNSPECIFIED ALERT_KIND_ALERT ALERT_KIND_RECORDING

signal

required

The signal the rule’s expression evaluates over (metric or log). Immutable after create.

string format: enum

Allowed values: ALERT_SIGNAL_UNSPECIFIED ALERT_SIGNAL_METRIC ALERT_SIGNAL_LOG

engine

The provider that evaluates this rule.

string format: enum Output only

Allowed values: ENGINE_UNSPECIFIED ENGINE_QIBDO ENGINE_AWS ENGINE_GCP ENGINE_AZURE

created

Timestamp when the rule was created.

string format: date-time Output only

updated

Timestamp when the rule was last updated.

string format: date-time Output only

qibdo

Rule spec for a Qibdo-managed alert rule.

object

expression

required

The PromQL/LogQL expression the rule evaluates (required).

string

for_seconds

Pending duration in seconds the condition must hold before firing. 0 (or unset) means fire immediately.

string

labels

Labels stamped onto fired alerts.

object

key

additional properties

string

annotations

Annotations attached to fired alerts.

object

key

additional properties

string

route

The notification routing tree. Optional; a recording rule omits it.

object

group_by

Label keys to group fired alerts by before notifying.

Array<string>

matchers

Label-equality predicates selecting which fired alerts this route applies to.

Array<object>

A label-equality predicate selecting which fired alerts a route applies to.

object

label

required

The alert label to match on.

string

value

required

The value the label must equal.

string

child_routes

More specific routes evaluated within this one.

Array<object>

A node in an alert rule’s notification routing tree: group fired alerts, select them by matchers, deliver to receivers, and recurse into more specific child routes.

object

group_by

Label keys to group fired alerts by before notifying.

Array<string>

matchers

Label-equality predicates selecting which fired alerts this route applies to.

Array<object>

A label-equality predicate selecting which fired alerts a route applies to.

object

label

required

The alert label to match on.

string

value

required

The value the label must equal.

string

child_routes

Array<object> recursive

receivers

The receivers fired alerts matching this route are delivered to.

Array<object>

A delivery target for a fired alert — exactly one channel arm is set.

object

webhook

Generic HTTP callback delivery.

object

url

required

The callback URL fired alerts are POSTed to.

string

email

Email delivery.

object

addresses

The recipient email addresses.

Array<string>

slack

Slack delivery.

object

channel

required

The Slack channel fired alerts are delivered to.

string

credential_ref

required

A weak reference to the Slack credential (never an inline secret).

string

receivers

The receivers fired alerts matching this route are delivered to.

Array<object>

A delivery target for a fired alert — exactly one channel arm is set.

object

webhook

Generic HTTP callback delivery.

object

url

required

The callback URL fired alerts are POSTed to.

string

email

Email delivery.

object

addresses

The recipient email addresses.

Array<string>

slack

Slack delivery.

object

channel

required

The Slack channel fired alerts are delivered to.

string

credential_ref

required

A weak reference to the Slack credential (never an inline secret).

string

Responses

200

application/json

ObservabilityOperation

Tracks the synchronous result of an observability config-plane command (retention, sink, or ingestion mutation). Engine-neutral — operations carry no engine axis.

object

The unique operation identifier.

stringOutput only

resource_id

The id of the affected resource.

stringOutput only

resource_type

The type of resource the operation acted upon (URN).

stringOutput only

operation_type

The operation type (CREATE, UPDATE, DELETE).

string format: enum Output only

Allowed values: OBSERVABILITY_OPERATION_TYPE_UNSPECIFIED OBSERVABILITY_OPERATION_TYPE_CREATE OBSERVABILITY_OPERATION_TYPE_UPDATE OBSERVABILITY_OPERATION_TYPE_DELETE

status

The operation status (DONE for synchronous config mutations).

string format: enum Output only

Allowed values: OBSERVABILITY_OPERATION_STATUS_UNSPECIFIED OBSERVABILITY_OPERATION_STATUS_PENDING OBSERVABILITY_OPERATION_STATUS_RUNNING OBSERVABILITY_OPERATION_STATUS_DONE OBSERVABILITY_OPERATION_STATUS_ERROR

insert_time

When the operation was recorded.

string format: date-time Output only

start_time

When execution started.

string format: date-time Output only

end_time

When execution completed.

string format: date-time Output only

progress

Progress percentage (0–100).

integer format: int32 Output only

Example

{
  "operation_type": "OBSERVABILITY_OPERATION_TYPE_UNSPECIFIED",
  "status": "OBSERVABILITY_OPERATION_STATUS_UNSPECIFIED"
}

default

Default error response

application/json

The Status type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by gRPC. Each Status message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the API Design Guide.

object

code

The status code, which should be an enum value of [google.rpc.Code][google.rpc.Code].

integer format: int32

message

A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the [google.rpc.Status.details][google.rpc.Status.details] field, or localized by the client.

string

details

A list of messages that carry the error details. There is a common set of message types for APIs to use.

Array<object>

Contains an arbitrary serialized message along with a @type that describes the type of the serialized message.

object

@type

The type of the serialized message.

string

key

additional properties

any

Example ^generated

{
  "code": 1,
  "message": "example",
  "details": [
    {
      "@type": "example"
    }
  ]
}

Create Alert Rule

Parameters

Path Parameters

Request Body required

Responses

200

Example

default

Example generated

Request Body^required

Example ^generated