Alert rules API
Alert rules endpoints in the Brix REST API: 6 operations (GET, POST, PATCH, DELETE), with auth, permissions and curl examples.
Base URL https://api.brixsignage.com. Send Authorization: Bearer $BRIX_API_KEY unless an operation says No auth. The permission chip names what the key must hold. See Authentication and scopes, Errors and rate limits and Pagination.
GET /v1/alert-rulesPOST /v1/alert-rulesGET /v1/alert-rules/{id}PATCH /v1/alert-rules/{id}DELETE /v1/alert-rules/{id}POST /v1/alert-rules/{id}/restore
GET/v1/alert-rules
List the alert rules configured for your workspace. Each rule includes its name, trigger, scope configuration, and whether it is enabled. Results are limited to the organization nodes you have access to. Microsoft Teams workflow URLs in config.teamsUrls and web addresses in config.recipients are credentials, so the response shows them masked: the host and the last four characters, for example https://prod-12.westus.logic.azure.com/…?sig=••••a1b2.
| Parameter | In | Type | Required | Description |
|---|---|---|---|---|
limit | query | integer | no | Page size. Omit to get every row; pass it to page by `cursor`. |
cursor | query | string | no | The `nextCursor` of the previous page. |
curl "https://api.brixsignage.com/v1/alert-rules" \
-H "Authorization: Bearer $BRIX_API_KEY" Response 200 Success.
| Field | Type | Description |
|---|---|---|
data | array of AlertRule | |
data[].id | string | Alert rule id. |
data[].spaceId | string | |
data[].name | string | |
data[].trigger | string | The first trigger code, e.g. `connection-lost`. |
data[].config | AlertRuleConfig | The rule's trigger, scope and delivery settings. Other keys pass through unchanged. |
data[].config.codes | array of string | Every trigger code the rule watches; the first is also `trigger`. |
data[].config.severity | string | |
data[].config.scopeKind | string | `workspace`, `org_unit`, `location`, `screen_group` or `screen`. |
data[].config.scopeId | string | |
data[].config.thresholds | object | |
data[].config.channels | array of string | `in-app`, `email`, `webhook`, `teams`. |
data[].config.recipients | array of string | Email addresses, `role:` tokens and webhook URLs. Webhook URLs are Masked: a delivery URL is a credential (a Microsoft Teams workflow URL carries it in `sig=`), so every response shows the host and the last four characters only — `https://prod-12.westus.logic.azure.com/…?sig=••••a1b2`. On update, send a masked value back unchanged to keep the saved URL, or a full URL to replace it. |
data[].config.teamsUrls | array of string | Microsoft Teams workflow URLs for the `teams` channel. Masked: a delivery URL is a credential (a Microsoft Teams workflow URL carries it in `sig=`), so every response shows the host and the last four characters only — `https://prod-12.westus.logic.azure.com/…?sig=••••a1b2`. On update, send a masked value back unchanged to keep the saved URL, or a full URL to replace it. |
data[].enabled | boolean | |
data[].nodeId | string | null | Home location; null = workspace root. |
data[].createdAt | string | ISO-8601 timestamp (UTC). |
data[].updatedAt | string | ISO-8601 timestamp (UTC). |
data[].deletedAt | string | null | |
nextCursor | string | null | Present when `?limit` was passed. Send it back as `?cursor=` for the next page; null on the last page. |
total | integer | Total matching rows, when the route computes it. |
Response 401 Missing, expired or revoked bearer token.
| Field | Type | Description |
|---|---|---|
error | string | Machine-readable code: `unauthorized`, `forbidden`, `not_found`, `validation_error`, `conflict`, `rate_limited`, `internal_error`, … |
message | string | Human-readable explanation. Safe to show an operator. |
requestId | string | Present on 5xx: quote it to support. |
Response 403 The token lacks the permission this operation needs (see `x-brix-permission`).
| Field | Type | Description |
|---|---|---|
error | string | Machine-readable code: `unauthorized`, `forbidden`, `not_found`, `validation_error`, `conflict`, `rate_limited`, `internal_error`, … |
message | string | Human-readable explanation. Safe to show an operator. |
requestId | string | Present on 5xx: quote it to support. |
Response 5XX Server error. The body carries a `requestId` to quote to support.
| Field | Type | Description |
|---|---|---|
error | string | Machine-readable code: `unauthorized`, `forbidden`, `not_found`, `validation_error`, `conflict`, `rate_limited`, `internal_error`, … |
message | string | Human-readable explanation. Safe to show an operator. |
requestId | string | Present on 5xx: quote it to support. |
POST/v1/alert-rules
Create an alert rule with a name, trigger, optional config, optional enabled flag, and optional nodeId. If the scope named in config does not resolve to an existing target, the request is refused rather than saved. A Microsoft Teams channel is also refused unless config.teamsUrls contains at least one valid Microsoft Teams Workflow HTTPS URL. The response shows each URL masked.
**Notes.**
- The 201 body is the row as written, not re-read: nodeId is absent when the create did not set one.
Request body application/json
| Field | Type | Required | Description |
|---|---|---|---|
name | string | yes | |
trigger | string | yes | |
config | AlertRuleConfig | no | The rule's trigger, scope and delivery settings. Other keys pass through unchanged. |
config.codes | array of string | no | Every trigger code the rule watches; the first is also `trigger`. |
config.severity | string | no | |
config.scopeKind | string | no | `workspace`, `org_unit`, `location`, `screen_group` or `screen`. |
config.scopeId | string | no | |
config.thresholds | object | no | |
config.channels | array of string | no | `in-app`, `email`, `webhook`, `teams`. |
config.recipients | array of string | no | Email addresses, `role:` tokens and webhook URLs. Webhook URLs are Masked: a delivery URL is a credential (a Microsoft Teams workflow URL carries it in `sig=`), so every response shows the host and the last four characters only — `https://prod-12.westus.logic.azure.com/…?sig=••••a1b2`. On update, send a masked value back unchanged to keep the saved URL, or a full URL to replace it. |
config.teamsUrls | array of string | no | Microsoft Teams workflow URLs for the `teams` channel. Masked: a delivery URL is a credential (a Microsoft Teams workflow URL carries it in `sig=`), so every response shows the host and the last four characters only — `https://prod-12.westus.logic.azure.com/…?sig=••••a1b2`. On update, send a masked value back unchanged to keep the saved URL, or a full URL to replace it. |
enabled | boolean | no | |
nodeId | string | null | no |
curl -X POST "https://api.brixsignage.com/v1/alert-rules" \
-H "Authorization: Bearer $BRIX_API_KEY" \
-H "Content-Type: application/json" Response 201 Success.
| Field | Type | Description |
|---|---|---|
data | object | |
data.id | string | Alert rule id. |
data.spaceId | string | |
data.name | string | |
data.trigger | string | The first trigger code, e.g. `connection-lost`. |
data.config | AlertRuleConfig | The rule's trigger, scope and delivery settings. Other keys pass through unchanged. |
data.config.codes | array of string | Every trigger code the rule watches; the first is also `trigger`. |
data.config.severity | string | |
data.config.scopeKind | string | `workspace`, `org_unit`, `location`, `screen_group` or `screen`. |
data.config.scopeId | string | |
data.config.thresholds | object | |
data.config.channels | array of string | `in-app`, `email`, `webhook`, `teams`. |
data.config.recipients | array of string | Email addresses, `role:` tokens and webhook URLs. Webhook URLs are Masked: a delivery URL is a credential (a Microsoft Teams workflow URL carries it in `sig=`), so every response shows the host and the last four characters only — `https://prod-12.westus.logic.azure.com/…?sig=••••a1b2`. On update, send a masked value back unchanged to keep the saved URL, or a full URL to replace it. |
data.config.teamsUrls | array of string | Microsoft Teams workflow URLs for the `teams` channel. Masked: a delivery URL is a credential (a Microsoft Teams workflow URL carries it in `sig=`), so every response shows the host and the last four characters only — `https://prod-12.westus.logic.azure.com/…?sig=••••a1b2`. On update, send a masked value back unchanged to keep the saved URL, or a full URL to replace it. |
data.enabled | boolean | |
data.nodeId | string | null | |
data.createdAt | string | ISO-8601 timestamp (UTC). |
data.updatedAt | string | ISO-8601 timestamp (UTC). |
data.deletedAt | string | null |
Response 401 Missing, expired or revoked bearer token.
| Field | Type | Description |
|---|---|---|
error | string | Machine-readable code: `unauthorized`, `forbidden`, `not_found`, `validation_error`, `conflict`, `rate_limited`, `internal_error`, … |
message | string | Human-readable explanation. Safe to show an operator. |
requestId | string | Present on 5xx: quote it to support. |
Response 403 The token lacks the permission this operation needs (see `x-brix-permission`).
| Field | Type | Description |
|---|---|---|
error | string | Machine-readable code: `unauthorized`, `forbidden`, `not_found`, `validation_error`, `conflict`, `rate_limited`, `internal_error`, … |
message | string | Human-readable explanation. Safe to show an operator. |
requestId | string | Present on 5xx: quote it to support. |
Response 404 The location does not exist.
| Field | Type | Description |
|---|---|---|
error | string | Machine-readable code: `unauthorized`, `forbidden`, `not_found`, `validation_error`, `conflict`, `rate_limited`, `internal_error`, … |
message | string | Human-readable explanation. Safe to show an operator. |
requestId | string | Present on 5xx: quote it to support. |
Response 422 `name` or `trigger` is missing, the scope target does not exist, or a Microsoft Teams URL is not a workflow URL.
| Field | Type | Description |
|---|---|---|
error | string | Machine-readable code: `unauthorized`, `forbidden`, `not_found`, `validation_error`, `conflict`, `rate_limited`, `internal_error`, … |
message | string | Human-readable explanation. Safe to show an operator. |
requestId | string | Present on 5xx: quote it to support. |
Response 5XX Server error. The body carries a `requestId` to quote to support.
| Field | Type | Description |
|---|---|---|
error | string | Machine-readable code: `unauthorized`, `forbidden`, `not_found`, `validation_error`, `conflict`, `rate_limited`, `internal_error`, … |
message | string | Human-readable explanation. Safe to show an operator. |
requestId | string | Present on 5xx: quote it to support. |
GET/v1/alert-rules/{id}
Get one alert rule, including its full trigger configuration. Access is limited to the organization nodes you can see. Microsoft Teams workflow URLs in config.teamsUrls and web addresses in config.recipients are credentials, so the response shows them masked: the host and the last four characters, for example https://prod-12.westus.logic.azure.com/…?sig=••••a1b2.
| Parameter | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string | yes | Alert rule id. |
curl "https://api.brixsignage.com/v1/alert-rules/{id}" \
-H "Authorization: Bearer $BRIX_API_KEY" Response 200 Success.
| Field | Type | Description |
|---|---|---|
data | AlertRule | |
data.id | string | Alert rule id. |
data.spaceId | string | |
data.name | string | |
data.trigger | string | The first trigger code, e.g. `connection-lost`. |
data.config | AlertRuleConfig | The rule's trigger, scope and delivery settings. Other keys pass through unchanged. |
data.config.codes | array of string | Every trigger code the rule watches; the first is also `trigger`. |
data.config.severity | string | |
data.config.scopeKind | string | `workspace`, `org_unit`, `location`, `screen_group` or `screen`. |
data.config.scopeId | string | |
data.config.thresholds | object | |
data.config.channels | array of string | `in-app`, `email`, `webhook`, `teams`. |
data.config.recipients | array of string | Email addresses, `role:` tokens and webhook URLs. Webhook URLs are Masked: a delivery URL is a credential (a Microsoft Teams workflow URL carries it in `sig=`), so every response shows the host and the last four characters only — `https://prod-12.westus.logic.azure.com/…?sig=••••a1b2`. On update, send a masked value back unchanged to keep the saved URL, or a full URL to replace it. |
data.config.teamsUrls | array of string | Microsoft Teams workflow URLs for the `teams` channel. Masked: a delivery URL is a credential (a Microsoft Teams workflow URL carries it in `sig=`), so every response shows the host and the last four characters only — `https://prod-12.westus.logic.azure.com/…?sig=••••a1b2`. On update, send a masked value back unchanged to keep the saved URL, or a full URL to replace it. |
data.enabled | boolean | |
data.nodeId | string | null | Home location; null = workspace root. |
data.createdAt | string | ISO-8601 timestamp (UTC). |
data.updatedAt | string | ISO-8601 timestamp (UTC). |
data.deletedAt | string | null |
Response 401 Missing, expired or revoked bearer token.
| Field | Type | Description |
|---|---|---|
error | string | Machine-readable code: `unauthorized`, `forbidden`, `not_found`, `validation_error`, `conflict`, `rate_limited`, `internal_error`, … |
message | string | Human-readable explanation. Safe to show an operator. |
requestId | string | Present on 5xx: quote it to support. |
Response 403 The token lacks the permission this operation needs (see `x-brix-permission`).
| Field | Type | Description |
|---|---|---|
error | string | Machine-readable code: `unauthorized`, `forbidden`, `not_found`, `validation_error`, `conflict`, `rate_limited`, `internal_error`, … |
message | string | Human-readable explanation. Safe to show an operator. |
requestId | string | Present on 5xx: quote it to support. |
Response 5XX Server error. The body carries a `requestId` to quote to support.
| Field | Type | Description |
|---|---|---|
error | string | Machine-readable code: `unauthorized`, `forbidden`, `not_found`, `validation_error`, `conflict`, `rate_limited`, `internal_error`, … |
message | string | Human-readable explanation. Safe to show an operator. |
requestId | string | Present on 5xx: quote it to support. |
PATCH/v1/alert-rules/{id}
Update an alert rule's name, trigger, config, enabled flag, or nodeId. The same scope validation used when creating a rule applies here. To keep a saved URL, send its masked value back unchanged. To replace it, send the new URL. A masked value that matches no saved URL is refused.
| Parameter | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string | yes | Alert rule id. |
Request body application/json
| Field | Type | Required | Description |
|---|---|---|---|
name | string | no | |
trigger | string | no | |
config | AlertRuleConfig | no | The rule's trigger, scope and delivery settings. Other keys pass through unchanged. |
config.codes | array of string | no | Every trigger code the rule watches; the first is also `trigger`. |
config.severity | string | no | |
config.scopeKind | string | no | `workspace`, `org_unit`, `location`, `screen_group` or `screen`. |
config.scopeId | string | no | |
config.thresholds | object | no | |
config.channels | array of string | no | `in-app`, `email`, `webhook`, `teams`. |
config.recipients | array of string | no | Email addresses, `role:` tokens and webhook URLs. Webhook URLs are Masked: a delivery URL is a credential (a Microsoft Teams workflow URL carries it in `sig=`), so every response shows the host and the last four characters only — `https://prod-12.westus.logic.azure.com/…?sig=••••a1b2`. On update, send a masked value back unchanged to keep the saved URL, or a full URL to replace it. |
config.teamsUrls | array of string | no | Microsoft Teams workflow URLs for the `teams` channel. Masked: a delivery URL is a credential (a Microsoft Teams workflow URL carries it in `sig=`), so every response shows the host and the last four characters only — `https://prod-12.westus.logic.azure.com/…?sig=••••a1b2`. On update, send a masked value back unchanged to keep the saved URL, or a full URL to replace it. |
enabled | boolean | no | |
nodeId | string | null | no | |
baseUpdatedAt | string | no | The `updatedAt` your edit is based on; 409 with the current row if it moved. |
curl -X PATCH "https://api.brixsignage.com/v1/alert-rules/{id}" \
-H "Authorization: Bearer $BRIX_API_KEY" \
-H "Content-Type: application/json" Response 200 Success.
| Field | Type | Description |
|---|---|---|
data | AlertRule | |
data.id | string | Alert rule id. |
data.spaceId | string | |
data.name | string | |
data.trigger | string | The first trigger code, e.g. `connection-lost`. |
data.config | AlertRuleConfig | The rule's trigger, scope and delivery settings. Other keys pass through unchanged. |
data.config.codes | array of string | Every trigger code the rule watches; the first is also `trigger`. |
data.config.severity | string | |
data.config.scopeKind | string | `workspace`, `org_unit`, `location`, `screen_group` or `screen`. |
data.config.scopeId | string | |
data.config.thresholds | object | |
data.config.channels | array of string | `in-app`, `email`, `webhook`, `teams`. |
data.config.recipients | array of string | Email addresses, `role:` tokens and webhook URLs. Webhook URLs are Masked: a delivery URL is a credential (a Microsoft Teams workflow URL carries it in `sig=`), so every response shows the host and the last four characters only — `https://prod-12.westus.logic.azure.com/…?sig=••••a1b2`. On update, send a masked value back unchanged to keep the saved URL, or a full URL to replace it. |
data.config.teamsUrls | array of string | Microsoft Teams workflow URLs for the `teams` channel. Masked: a delivery URL is a credential (a Microsoft Teams workflow URL carries it in `sig=`), so every response shows the host and the last four characters only — `https://prod-12.westus.logic.azure.com/…?sig=••••a1b2`. On update, send a masked value back unchanged to keep the saved URL, or a full URL to replace it. |
data.enabled | boolean | |
data.nodeId | string | null | Home location; null = workspace root. |
data.createdAt | string | ISO-8601 timestamp (UTC). |
data.updatedAt | string | ISO-8601 timestamp (UTC). |
data.deletedAt | string | null |
Response 401 Missing, expired or revoked bearer token.
| Field | Type | Description |
|---|---|---|
error | string | Machine-readable code: `unauthorized`, `forbidden`, `not_found`, `validation_error`, `conflict`, `rate_limited`, `internal_error`, … |
message | string | Human-readable explanation. Safe to show an operator. |
requestId | string | Present on 5xx: quote it to support. |
Response 403 The token lacks the permission this operation needs (see `x-brix-permission`).
| Field | Type | Description |
|---|---|---|
error | string | Machine-readable code: `unauthorized`, `forbidden`, `not_found`, `validation_error`, `conflict`, `rate_limited`, `internal_error`, … |
message | string | Human-readable explanation. Safe to show an operator. |
requestId | string | Present on 5xx: quote it to support. |
Response 404 No rule with this id.
| Field | Type | Description |
|---|---|---|
error | string | Machine-readable code: `unauthorized`, `forbidden`, `not_found`, `validation_error`, `conflict`, `rate_limited`, `internal_error`, … |
message | string | Human-readable explanation. Safe to show an operator. |
requestId | string | Present on 5xx: quote it to support. |
Response 409 `conflict`: changed since `baseUpdatedAt`; the body carries `current`.
| Field | Type | Description |
|---|---|---|
error | string | Machine-readable code: `unauthorized`, `forbidden`, `not_found`, `validation_error`, `conflict`, `rate_limited`, `internal_error`, … |
message | string | Human-readable explanation. Safe to show an operator. |
requestId | string | Present on 5xx: quote it to support. |
Response 422 The scope target does not exist, a Microsoft Teams URL is not a workflow URL, or a masked URL matches no saved URL.
| Field | Type | Description |
|---|---|---|
error | string | Machine-readable code: `unauthorized`, `forbidden`, `not_found`, `validation_error`, `conflict`, `rate_limited`, `internal_error`, … |
message | string | Human-readable explanation. Safe to show an operator. |
requestId | string | Present on 5xx: quote it to support. |
Response 5XX Server error. The body carries a `requestId` to quote to support.
| Field | Type | Description |
|---|---|---|
error | string | Machine-readable code: `unauthorized`, `forbidden`, `not_found`, `validation_error`, `conflict`, `rate_limited`, `internal_error`, … |
message | string | Human-readable explanation. Safe to show an operator. |
requestId | string | Present on 5xx: quote it to support. |
DELETE/v1/alert-rules/{id}
Delete an alert rule. It moves to the recycle bin and stops firing immediately.
| Parameter | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string | yes | Alert rule id. |
curl -X DELETE "https://api.brixsignage.com/v1/alert-rules/{id}" \
-H "Authorization: Bearer $BRIX_API_KEY" Response 200 Success.
| Field | Type | Description |
|---|---|---|
data | object | |
data.id | string | |
data.deleted | true |
Response 401 Missing, expired or revoked bearer token.
| Field | Type | Description |
|---|---|---|
error | string | Machine-readable code: `unauthorized`, `forbidden`, `not_found`, `validation_error`, `conflict`, `rate_limited`, `internal_error`, … |
message | string | Human-readable explanation. Safe to show an operator. |
requestId | string | Present on 5xx: quote it to support. |
Response 403 The token lacks the permission this operation needs (see `x-brix-permission`).
| Field | Type | Description |
|---|---|---|
error | string | Machine-readable code: `unauthorized`, `forbidden`, `not_found`, `validation_error`, `conflict`, `rate_limited`, `internal_error`, … |
message | string | Human-readable explanation. Safe to show an operator. |
requestId | string | Present on 5xx: quote it to support. |
Response 404 No such alert rule in this workspace.
| Field | Type | Description |
|---|---|---|
error | string | Machine-readable code: `unauthorized`, `forbidden`, `not_found`, `validation_error`, `conflict`, `rate_limited`, `internal_error`, … |
message | string | Human-readable explanation. Safe to show an operator. |
requestId | string | Present on 5xx: quote it to support. |
Response 5XX Server error. The body carries a `requestId` to quote to support.
| Field | Type | Description |
|---|---|---|
error | string | Machine-readable code: `unauthorized`, `forbidden`, `not_found`, `validation_error`, `conflict`, `rate_limited`, `internal_error`, … |
message | string | Human-readable explanation. Safe to show an operator. |
requestId | string | Present on 5xx: quote it to support. |
POST/v1/alert-rules/{id}/restore
Restore an alert rule that was deleted within the last 30 days. The rule resumes firing once restored.
| Parameter | In | Type | Required | Description |
|---|---|---|---|---|
id | path | string | yes | Alert rule id. |
curl -X POST "https://api.brixsignage.com/v1/alert-rules/{id}/restore" \
-H "Authorization: Bearer $BRIX_API_KEY" Response 200 Success.
| Field | Type | Description |
|---|---|---|
data | object | |
data.id | string | |
data.restored | true |
Response 401 Missing, expired or revoked bearer token.
| Field | Type | Description |
|---|---|---|
error | string | Machine-readable code: `unauthorized`, `forbidden`, `not_found`, `validation_error`, `conflict`, `rate_limited`, `internal_error`, … |
message | string | Human-readable explanation. Safe to show an operator. |
requestId | string | Present on 5xx: quote it to support. |
Response 403 The token lacks the permission this operation needs (see `x-brix-permission`).
| Field | Type | Description |
|---|---|---|
error | string | Machine-readable code: `unauthorized`, `forbidden`, `not_found`, `validation_error`, `conflict`, `rate_limited`, `internal_error`, … |
message | string | Human-readable explanation. Safe to show an operator. |
requestId | string | Present on 5xx: quote it to support. |
Response 404 No such alert rule in this workspace, or it was purged.
| Field | Type | Description |
|---|---|---|
error | string | Machine-readable code: `unauthorized`, `forbidden`, `not_found`, `validation_error`, `conflict`, `rate_limited`, `internal_error`, … |
message | string | Human-readable explanation. Safe to show an operator. |
requestId | string | Present on 5xx: quote it to support. |
Response 409 `not_deleted`: the rule is not in the recycle bin.
| Field | Type | Description |
|---|---|---|
error | string | Machine-readable code: `unauthorized`, `forbidden`, `not_found`, `validation_error`, `conflict`, `rate_limited`, `internal_error`, … |
message | string | Human-readable explanation. Safe to show an operator. |
requestId | string | Present on 5xx: quote it to support. |
Response 5XX Server error. The body carries a `requestId` to quote to support.
| Field | Type | Description |
|---|---|---|
error | string | Machine-readable code: `unauthorized`, `forbidden`, `not_found`, `validation_error`, `conflict`, `rate_limited`, `internal_error`, … |
message | string | Human-readable explanation. Safe to show an operator. |
requestId | string | Present on 5xx: quote it to support. |