The following examples query alerts with getAlerts.

Query Alerts

Each call to getAlerts needs createdTime, updatedTime, or ids. A time range is given as after and before: after is inclusive, before is exclusive, and the two can be at most 65 days apart. The range can be any period in the past. To cover a longer one, split it into consecutive windows.

query GetAlerts($after: DateTime!, $before: DateTime!, $cursor: String) {
  getAlerts(
    createdTime: { after: $after, before: $before }
    first: 100
    after: $cursor
  ) {
    pageInfo {
      endCursor
      hasNextPage
    }
    edges {
      node {
        id
        title
        type
        severity
        status
        createdTime
        updatedTime
      }
    }
  }
}

{
  "after": "2026-09-01T00:00:00Z",
  "before": "2026-10-01T00:00:00Z"
}

To return only alerts that were raised to incidents, filter by severity:

getAlerts(
  createdTime: { after: $after, before: $before }
  filter: { include: { severities: [SEV_1, SEV_2, SEV_3, SEV_4] } }
)

Combining createdTime and updatedTime

When you pass both, an alert must fall inside both ranges. To get alerts that were created or updated in a period, run one query with createdTime and one with updatedTime, then merge the results and remove duplicates by id.

Migrating from getIncidents

getIncidents is deprecated in favor of getAlerts. When moving a query over:

• getIncidents filters startTime and endTime on when an alert was last updated. The equivalent in getAlerts is updatedTime.
• getIncidents doesn't limit the width of its range unless you request totalCount. That needs startTime and endTime passed as GraphQL variables with those names, no more than 65 days apart. getAlerts applies the 65-day limit to every range, so split longer periods into windows.
• Both return all alerts, not only incidents. Filter by severity, as above, to return incidents.