GET /alerts
List alert triggers and their dispositions · 1 credit per call
List alert triggers (cluster + CVE) with disposition state. The raw material behind the compliance attestation.
Each row's `trigger_id` + `alert_source` are what you pass to that you reviewed/actioned that specific alert firing.
Filters: mssp_customer_id (scope to one client), state (incl. 'open' for undispositioned), alert_source (cluster|cve), since (ISO timestamp on triggered_at). Rows are normalised across both alert systems.
Parameters
| Name | In | Type | Required | Meaning |
|---|---|---|---|---|
| mssp_customer_id | query | integer or null | ||
| state | query | string or null | ||
| alert_source | query | string or null | ||
| since | query | string or null | ||
| limit | query | integer | ||
| offset | query | integer |
curl -H "X-API-Key: $TC_KEY" \ "https://threatcluster.io/api/public/v1/alerts"