Skip to content

Create v2



POST /api/v1/alert_policy/add_v2

Overview

Create an alert strategy. v2 supports synchronously updating associated monitors/intelligent monitors/intelligent inspections/SLOs, and security checks.

Body Request Parameters

Parameter Name Type Required Description
name string Y Alert strategy name
Allow Empty: False
desc string Description
Allow Empty: False
Allow Empty String: True
Max Length: 256
openPermissionSet boolean Enable custom permission configuration (default false: not enabled). After enabling, the operational permissions of this rule are based on permissionSet.
Allow Empty: False
permissionSet array Operational permission configuration, can be configured with (roles (except owner), member UUIDs, team UUIDs)
Example: ['wsAdmin', 'acnt_xxxx', 'group_yyyy']
Allow Empty: False
checkerUUIDs array Monitor/Intelligent Monitor/Intelligent Inspection/SLO UUIDs (newly added in the 2024-12-11 iteration)
Example: ['rule_xxx', 'monitor_xxx']
Allow Empty: False
securityRuleUUIDs array Security Check (CSPM, SIEM, ABA) UUIDs
Example: ['srul_xxx', 'srul_xxx', 'srul_xxx']
Allow Empty: False
ruleTimezone str Y Alert strategy timezone
Example: Asia/Shanghai
Allow Empty: False
alertOpt json Alert settings
Allow Empty: False
alertOpt.aggType string Alert aggregation type. If not passed, the old version logic is used. (Newly added in the 2024-12-25 iteration)
Allow Empty: True
Optional values: ['byFields', 'byCluster', 'byAI', 'byCustom']
alertOpt.ignoreOK boolean Advanced configuration: normal level only generates events, does not send notifications (whether to ignore OK notifications). (Newly added field in 2025-10-22)
Allow Empty: False
alertOpt.alertType string Alert strategy notification type, level (status)/member (member), default is level.
Allow Empty: False
Optional values: ['status', 'member']
alertOpt.alertTarget array Trigger actions. Note the trigger time, parameter handling.
Example: [{'name': 'Notification Configuration1', 'targets': [{'to': ['acnt_xxxx32'], 'status': 'critical', 'tags': {'pod_name': ['coredns-7769b554cf-w95fk']}, 'upgradeTargets': [{'to': ['acnt_xxxx32'], 'duration': 600}, {'to': ['group_xxxx32'], 'duration': 6000}]}], 'crontabDuration': 600, 'crontab': '0 9 * * 0,1,2,3,4'}, {'name': 'Notification Configuration2', 'targets': [{'status': 'error', 'to': ['group_xxxx32'], 'upgradeTargets': [{'to': ['acnt_xxxx32'], 'duration': 600}, {'to': ['group_xxxx32'], 'duration': 6000}]}], 'customDateUUIDs': ['ndate_xxxx32'], 'customStartTime': '09:30:10', 'crontabDuration': 600}]
Allow Empty: False
alertOpt.silentTimeout integer Repeat alert configuration
Allow Empty: False
alertOpt.silentTimeoutByStatusEnable boolean Whether to enable repeat alerts by level. Default is false, using silentTimeout configuration.
Allow Empty: False
alertOpt.silentTimeoutByStatus array Repeat alerts by level, minimum alert interval configuration by level.
Allow Empty: False
alertOpt.aggInterval integer Y Alert aggregation interval, in seconds. 0 means no aggregation.
Allow Empty: False
$minValue: 0
$maxValue: 1800
alertOpt.aggFields array Aggregation field list. An empty list [] means "Aggregation rule: all". df_monitor_checker_id: Monitor/Intelligent Inspection/SLO, df_dimension_tags: Detection dimension, df_label: Label, CLUSTER: Intelligent aggregation.
Example: ['CLUSTER']
Allow Empty: False
alertOpt.aggLabels array Label value list when aggregating by label. Only takes effect if df_label is specified in aggFields.
Allow Empty: False
alertOpt.aggClusterFields array Field list for intelligent aggregation. Only takes effect if CLUSTER is specified in aggFields. Optional values: "df_title": Title, "df_message": Content.
Example: ['df_title']
Allow Empty: False
alertOpt.aggSendFirst boolean Whether the first alert is sent directly when aggregating. (Newly added parameter in the 2025-09-03 iteration)
Allow Empty: False

Supplementary Parameter Description


Data Description.

1. alertOpt Parameter Description

Parameter Name type Required Description
name string Required Rule name
desc string Description
type string Required Checker type
ruleTimezone string Required Alert strategy timezone (newly added parameter in the 2024-01-31 iteration)
alertOpt Dict Required Alert settings
alertOpt.silentTimeout integer Minimum alert interval. How long the same alert will not be sent again (i.e., alert silence duration). Unit: seconds. 0/null means send only once (i.e., infinite interval).
alertOpt.silentTimeoutByStatusEnable boolean Whether to enable repeat alerts by level configuration.
alertOpt.silentTimeoutByStatus array Minimum alert interval by level, unit: seconds. Use security_ prefix for security check levels.
alertOpt.aggInterval integer Alert aggregation interval, unit: seconds. 0 means no aggregation. Range [0,1800].
alertOpt.aggFields array Aggregation field list. An empty list [] means "Aggregation rule: all". df_monitor_checker_id: Monitor/Intelligent Inspection/SLO, df_dimension_tags: Detection dimension, df_label: Label, CLUSTER: Intelligent aggregation, or when aggType=byCustom it represents custom aggregation fields.
alertOpt.aggLabels array Label value list when aggregating by label. Only takes effect if df_label is specified in aggFields.
alertOpt.aggClusterFields array Field list for intelligent aggregation. Only takes effect if CLUSTER is specified in aggFields. Optional values: "df_title": Title, "df_message": Content.
alertOpt.aggSendFirst boolean Whether the first alert is sent directly when aggregating. (Newly added parameter in the 2025-09-03 iteration)
alertOpt.aggType string Default not passed: old version logic. byFields: Rule aggregation, byCluster: Intelligent aggregation, byAI: AI aggregation, byCustom: Rule aggregation - custom. (Newly added field in the 2024-12-25 iteration)
alertOpt.alertTarget Array[Dict] Alert actions
alertOpt.alertType string Alert strategy notification type, level (status)/member (member). Default is level. (Newly added in the 2024-11-06 iteration)
alertOpt.ignoreOK boolean Advanced configuration: normal level only generates events, does not send notifications (whether to ignore OK notifications). (Newly added field in 2025-10-22)
openPermissionSet boolean Whether to enable custom permission configuration. Default is false. (Newly added in the 2024-11-06 iteration)
permissionSet array Operational permission configuration. (Newly added in the 2024-11-06 iteration)
checkerUUIDs array Associated monitor/intelligent monitor/intelligent inspection/SLO UUIDs. (Newly added in the 2024-12-11 iteration)
securityRuleUUIDs array Associated security check (CSPM, SIEM, ABA) UUIDs. (Newly added in the 2025-05-14 iteration)

1.1 alertOpt.aggType Parameter Description 2024-12-25
Alert aggregation types:
 null: No aggregation
 byFields: Rule aggregation
 byCluster: Intelligent aggregation
 byAI: AI aggregation


Since the old data structure does not have the aggType field and instead determines the aggregation type based on the aggFields content, the following compatibility handling will be performed after adding the aggType field:
When aggType is specified, aggregation is performed according to the method specified by aggType.
When aggType is not specified or aggType is None (following the old logic):
If aggFields contains "CLUSTER", aggregation is performed using the intelligent aggregation method.
If aggFields does not contain "CLUSTER", aggregation is performed using the rule aggregation method.

Derived rules: Specifying aggInterval=0 or aggInterval=null still means "no aggregation".
When aggType="byCluster" is specified, it is no longer necessary to pass "CLUSTER" in aggFields (whether passed or not has no effect).
When aggType="byFields" is specified but aggFields contains "CLUSTER", "CLUSTER" will be ignored (i.e., aggType has higher priority).
When aggType="byCustom" is specified, aggregation is performed according to the custom fields in aggFields.


2. When the alert strategy is of level type, alertOpt.alertTarget Parameter Description

key Type Required Description
name string Configuration name
targets Array[dict] Required Notification target configuration (Note the position of this field when the alert strategy is of level/member type)
crontab String When selecting a recurring time period, the start Crontab (Crontab syntax)
crontabDuration integer When selecting a recurring time period, the duration from the start of the Crontab (in seconds)
customDateUUIDs Array[String] When selecting a custom time period, the UUID list of custom notification dates. Example: ['ndate_xxxx32', 'ndate_xxxx32']. Refer to (Monitoring - Alert Strategies - Custom Notification Dates API) for custom notification dates.
customStartTime String When selecting a custom time period, the daily start time, format: HH🇲🇲ss
customDuration integer When selecting a custom time period, the duration from the customStartTime (in seconds)

3. When the alert strategy is of member type, alertOpt.alertTarget Parameter Description

key Type Required Description
alertTarget[#] dict Element of the alertTarget list
alertTarget[#].name string Configuration name
alertTarget[#].crontab String When selecting a recurring time period, the start Crontab (Crontab syntax)
alertTarget[#].crontabDuration integer When selecting a recurring time period, the duration from the start of the Crontab (in seconds)
alertTarget[#].customDateUUIDs Array[String] When selecting a custom time period, the UUID list of custom notification dates. Example: ['ndate_xxxx32', 'ndate_xxxx32']. Refer to (Monitoring - Alert Strategies - Custom Notification Dates API) for custom notification dates.
alertTarget[#].customStartTime String When selecting a custom time period, the daily start time, format: HH🇲🇲ss
alertTarget[#].customDuration integer When selecting a custom time period, the duration from the customStartTime (in seconds)
alertTarget[#].alertInfo Array[dict] Required Notification-related information configuration for the member-type alert strategy. (Newly added in the 2024-11-27 iteration)

4. When the alert strategy is of member type, alertOpt.alertTarget.alertInfo Parameter Description

key Type Required Description
alertInfo[#] string Element of the alertInfo list
alertInfo[#].name string Configuration name
alertInfo[#].targets Array[dict] Required Notification target configuration (Note the position of this field when the alert strategy is of level/member type)
alertInfo[#].filterString string When alertType is member, this field is used. The raw filter condition string. (Newly added in the 2024-11-27 iteration)
alertInfo[#].memberInfo array When alertType is member, this field is used (team UUIDs, member UUIDs). Example: [group_xxxx, acnt_xxxx]. (Newly added in the 2024-11-27 iteration)

5. Time Configuration Related Notes

If selecting a recurring time period, the crontab and crontabDuration fields are required.
If selecting a custom time period, the customDateUUIDs, customDuration, and customStartTime fields are required.
If selecting other times, the crontab, crontabDuration, customDateUUIDs, customStartTime, and customDuration fields should not be passed.
Note: Each alert strategy will have one notification rule for other times, i.e., the fallback notification target without time configuration.


6. Notification Target Field targets Description
When alertType is status, the targets position is alertOpt.alertTarget.targets.
When alertType is member, the targets position is alertOpt.alertTarget.alertInfo.targets.

targets is a list, with each internal element being a dict. The internal field descriptions are as follows:

key Type Required Description
to Array[String] Required Notification targets/members/teams. Example: [group_xxxx, acnt_xxxx, notify_xxxx]. (When alertType is member, only notification targets and fixed fields email, sms (SaaS version supports SMS) can be selected. Example: [email, notify_xxxx]. (Newly added in the 2024-11-06 iteration)
status Enum Required The event status value that needs to send alerts. Multiple statuses can be separated by commas. All means all. For non-security check types, the status values are: fatal, critical, error, warning, nodata, info. For security check types, the status values are: critical, high, medium, low, info. (Newly added security check enumeration values in the 2025-05-14 iteration)
df_source Enum When the status needs to be a security check status, df_source must be specified as security. Default not passed means non-security check status. (Newly added in the 2025-05-14 iteration)
upgradeTargets Array Upgrade notification for each alert configuration status.
tags dict Filter conditions
filterString dict Raw filter condition string. Can replace tags. filterString has higher priority than tags. (Newly added in the 2024-11-27 iteration)

7. Notification Target Field upgradeTargets Description

  <br/>

When alertType is status, the targets position is alertOpt.alertTarget.targets.upgradeTargets.
When alertType is member, the targets position is alertOpt.alertTarget.alertInfo.targets.upgradeTargets.

7.1 upgradeTargets is a list, with each internal element being a dict. The internal field descriptions are as follows:

key Type Required Description
to Array[String] Required Notification targets/members/teams. Example: [group_xxxx, acnt_xxxx, notify_xxxx]. (When alertType is member, only members and teams can be selected. (Newly added in the 2024-11-06 iteration)
duration integer Duration. The event of this level continuously triggers an upgrade notification after the duration.
toWay Array[String] Used when alertType is member. Only notification targets and fixed fields email, sms (SaaS version supports SMS) can be selected. Example: [email, notify_xxxx]. (Newly added in the 2024-11-06 iteration)

8. Operational Permission Configuration Parameter Description

Parameter Name type Description
openPermissionSet boolean Whether to enable custom permission configuration. Default is false.
permissionSet array Operational permission configuration

8.1 permissionSet, openPermissionSet Field Description (Newly added fields in the 2024-06-26 iteration):

When openPermissionSet is enabled, only the workspace owner and the roles, teams, and members configured in the permissionSet can edit/enable/disable/delete.

When openPermissionSet is disabled (default), the delete/enable/disable/edit permissions follow the original interface edit/enable/disable/delete permissions.

The permissionSet field can be configured with role UUIDs (wsAdmin, general, readOnly, role_xxxxx), team UUIDs (group_yyyy), and member UUIDs (acnt_xxx).

Example of the permissionSet field:

  ["wsAdmin", "general", "group_yyyy", "acnt_xxxx"]    


9. alertOpt[#].silentTimeoutByStatus Parameter Description

Parameter Name type Description
silentTimeoutByStatus[#] dict Element of the silentTimeoutByStatus list
silentTimeoutByStatus[#].status boolean For non-security check types, the status values are: fatal, critical, error, warning, nodata, info. For security check types, the status values are: security_critical, security_high, security_medium, security_low, security_info.
silentTimeoutByStatus[#].silentTimeout integer Minimum alert interval. How long the same alert will not be sent again (i.e., alert silence duration). Unit: seconds. 0/null means send only once (i.e., infinite interval).

Example of the silentTimeoutByStatus field:

  [
      {
          "status": "fatal",
          "silentTimeout": 600
      },
      {
          "status": "critical,error",
          "silentTimeout": 900
      },
      {
          "status": "security_high",
          "silentTimeout": 600
      },
  ]


Request Example

curl 'https://openapi.guance.com/api/v1/alert_policy/add' \
-H 'DF-API-KEY: <DF-API-KEY>' \
-H 'Content-Type: application/json;charset=UTF-8' \
--data-raw '{"name":"jj_test","ruleTimezone":"Asia/Shanghai","alertOpt":{"alertTarget":[{"name":"Notification Configuration1","targets":[{"status":"critical","tags":{"pod_name":["coredns-7769b554cf-w95fk"]},"to":["acnt_xxxx32"]}],"crontabDuration":600,"crontab":"0 9 * * 0,1,2,3,4"},{"name":"Notification Configuration2","targets":[{"status":"error","to":["group_xxxx32"]}],"customDateUUIDs":["ndate_xxxx32"],"customStartTime":"09:30:10","customDuration":600},{"targets":[{"status":"warning","to":["notify_xxxx32"]}]}],"silentTimeout":21600,"aggInterval":120,"aggFields":["df_monitor_checker_id"]}}' \
--compressed

Response

{
    "code": 200,
    "content": {
        "alertOpt": {
            "aggFields": [
                "df_monitor_checker_id"
            ],
            "aggInterval": 120,
            "alertTarget": [
                {
                    "crontab": "0 9 * * 0,1,2,3,4",
                    "crontabDuration": 600,
                    "name": "Notification Configuration1",
                    "targets": [
                        {
                            "status": "critical",
                            "tags": {
                                "pod_name": [
                                    "coredns-7769b554cf-w95fk"
                                ]
                            },
                            "to": [
                                "acnt_xxxx32"
                            ]
                        }
                    ]
                },
                {
                    "customDateUUIDs": [
                        "ndate_xxxx32"
                    ],
                    "customDuration": 600,
                    "customStartTime": "09:30:10",
                    "name": "Notification Configuration2",
                    "targets": [
                        {
                            "status": "error",
                            "to": [
                                "group_xxxx32"
                            ]
                        }
                    ]
                },
                {
                    "targets": [
                        {
                            "status": "warning",
                            "to": [
                                "notify_xxxx32"
                            ]
                        }
                    ]
                }
            ],
            "silentTimeout": 21600
        },
        "createAt": 1719373984,
        "creator": "wsak_xxxx32",
        "declaration": {
            "asd": "aa,bb,cc,1,True",
            "asdasd": "dawdawd",
            "business": "aaa",
            "fawf": "afawf",
            "organization": "64fe7b4062f74d0007b46676"
        },
        "deleteAt": -1,
        "id": null,
        "name": "jj_test",
        "ruleTimezone": "Asia/Shanghai",
        "score": 0,
        "status": 0,
        "updateAt": 1719373984,
        "updator": "wsak_xxxx32",
        "uuid": "altpl_xxxx32",
        "workspaceUUID": "wksp_xxxx32"
    },
    "errorCode": "",
    "message": "",
    "success": true,
    "traceId": "TRACE-148B6846-6180-4594-BD26-8A2077F0E911"
} 

Feedback

Is this page helpful? ×