> For the complete documentation index, see [llms.txt](https://docs.spike.sh/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.spike.sh/spike-api-docs/alert-rules.md).
# Alert Rules
Create, read, update and archive automation (alert) rules.
## Fetch all alert rules
> Get a list of all alert rules configured for a team. Returns both enabled and disabled rules.\
> \
> Each rule contains:\
> \- \`name\`: Rule name\
> \- \`conditions\`: Array of condition groups (OR logic between groups, AND logic within a group)\
> \- \`actions\`: Array of actions to execute when conditions match\
> \- \`enabled\`: Whether the rule is currently active
```json
{"openapi":"3.1.0","info":{"title":"Spike API","version":"1.0.0"},"tags":[{"name":"Alert Rules","description":"Create, read, update and archive automation (alert) rules."}],"servers":[{"url":"https://api.spike.sh","description":"API server"}],"security":[{"ApiKeyAuth":[],"TeamIdHeader":[]}],"components":{"securitySchemes":{"ApiKeyAuth":{"type":"apiKey","in":"header","name":"x-api-key","description":"Your organisation's API key. Create one in the Spike dashboard under Settings > API. Sent on every request as the `x-api-key` header."}},"schemas":{"Error":{"type":"object","properties":{"message":{"type":"string","description":"Error message describing the problem"},"error":{"type":"string","description":"Error type or code"},"success":{"type":"boolean","description":"Present on the endpoints whose handlers include it (for example the API-key filter and the public on-call routes). Always `false` on an error."},"valid_api":{"type":"boolean","description":"Present on `401`s produced by the session/API-key filter. `false` means the supplied `x-api-key` was not recognised."},"statusCode":{"type":"number","description":"Echo of the HTTP status, present on a few permission errors."}}}}},"paths":{"/automation/rules":{"get":{"operationId":"getAutomationRules","summary":"Fetch all alert rules","description":"Get a list of all alert rules configured for a team. Returns both enabled and disabled rules.\n\nEach rule contains:\n- `name`: Rule name\n- `conditions`: Array of condition groups (OR logic between groups, AND logic within a group)\n- `actions`: Array of actions to execute when conditions match\n- `enabled`: Whether the rule is currently active\n","tags":["Alert Rules"],"responses":{"200":{"description":"Successful response","content":{"application/json":{"schema":{"type":"object","properties":{"alertConfigs":{"type":"array","items":{"type":"object","properties":{"_id":{"type":"string"},"name":{"type":"string"},"enable":{"type":"boolean"},"teams":{"type":"array","items":{"type":"string"}},"org":{"type":"string"},"createdAt":{"type":"string","format":"date-time"}}}},"featureFlag":{"type":"boolean"}}}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"parameters":[{"name":"x-api-key","in":"header","required":true,"schema":{"type":"string"},"description":"Your API key. Find it in your Spike dashboard under Settings > API."},{"name":"x-team-id","in":"header","required":true,"schema":{"type":"string"},"description":"The team's `_id` — a 24-character hex ObjectId, NOT the short `uid` slug. Read it from `GET /teams/get-all-teams`."}]}}}}
```
## Get alert rule details
> Get full details of a specific alert rule by its ID, including all conditions and actions.
```json
{"openapi":"3.1.0","info":{"title":"Spike API","version":"1.0.0"},"tags":[{"name":"Alert Rules","description":"Create, read, update and archive automation (alert) rules."}],"servers":[{"url":"https://api.spike.sh","description":"API server"}],"security":[{"ApiKeyAuth":[],"TeamIdHeader":[]}],"components":{"securitySchemes":{"ApiKeyAuth":{"type":"apiKey","in":"header","name":"x-api-key","description":"Your organisation's API key. Create one in the Spike dashboard under Settings > API. Sent on every request as the `x-api-key` header."}},"schemas":{"Error":{"type":"object","properties":{"message":{"type":"string","description":"Error message describing the problem"},"error":{"type":"string","description":"Error type or code"},"success":{"type":"boolean","description":"Present on the endpoints whose handlers include it (for example the API-key filter and the public on-call routes). Always `false` on an error."},"valid_api":{"type":"boolean","description":"Present on `401`s produced by the session/API-key filter. `false` means the supplied `x-api-key` was not recognised."},"statusCode":{"type":"number","description":"Echo of the HTTP status, present on a few permission errors."}}}}},"paths":{"/automation/rules/{ruleId}":{"get":{"operationId":"getAutomationRulesByRuleId","summary":"Get alert rule details","description":"Get full details of a specific alert rule by its ID, including all conditions and actions.","tags":["Alert Rules"],"parameters":[{"name":"x-api-key","in":"header","required":true,"schema":{"type":"string"},"description":"Your API key. Find it in your Spike dashboard under Settings > API."},{"name":"x-team-id","in":"header","required":true,"schema":{"type":"string"},"description":"The team's `_id` — a 24-character hex ObjectId, NOT the short `uid` slug. Read it from `GET /teams/get-all-teams`."},{"name":"ruleId","in":"path","required":true,"schema":{"type":"string"},"description":"ruleId parameter"}],"responses":{"200":{"description":"Successful response","content":{"application/json":{"schema":{"type":"object","properties":{"alertConfig":{"type":"object"},"featureFlag":{"type":"boolean"},"isPinned":{"type":"boolean"}}}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"Not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}}}}
```
## Create an alert rule
> Create a new alert rule for a team. An alert rule automatically executes actions when incoming incidents match the specified conditions.\
> \
> \*\*Request Body:\*\*\
> \- \`name\` (required): A descriptive name for the rule.\
> \- \`conditions\` (required): A 2D array of condition objects. The outer array represents \*\*OR\*\* groups — if any group matches, the rule triggers. Each inner array contains conditions combined with \*\*AND\*\* logic — all must match.\
> \- \`actions\` (required): An array of action objects to execute when conditions are met.\
> \
> \---\
> \
> \*\*Condition Types:\*\*\
> \
> \| \`conditionType\` | Description | Additional Fields |\
> \|---|---|---|\
> \| \`allIncidents\` | Matches every incident (wildcard) | — |\
> \| \`incidentMessage\` | Match on the incident title/message | \`comparator\`, \`text\` |\
> \| \`incidentDetails\` | Match on a specific key in the incident metadata | \`comparator\`, \`text\`, \`keypair\` |\
> \| \`incidentOccurrence\` | Match when total occurrences exceed a threshold | \`occurrences\` |\
> \| \`incidentOccurrenceTimeframe\` | Match when occurrences exceed a threshold within a time window | \`occurrences\`, \`timeframe\` (in minutes) |\
> \| \`priority\` | Match on incident priority | \`priority\` (one of \`p1\`, \`p2\`, \`p3\`, \`p4\`, \`p5\`) |\
> \| \`severity\` | Match on incident severity | \`severity\` (one of \`sev1\`, \`sev2\`, \`sev3\`) |\
> \| \`regexMatch\` | Match incident message against a regex pattern | \`regex\` |\
> \| \`incidentTiming\` | Match based on time of day the incident occurred | \`start\` (HH:mm), \`end\` (HH:mm), \`timezone\` (optional, e.g., \`America/New\_York\`) |\
> \| \`incidentDayOfWeek\` | Match based on day of the week | \`days\` (array of day numbers: 0=Sunday, 6=Saturday), \`timezone\` (optional) |\
> \
> \*\*Comparators\*\* (for \`incidentMessage\` and \`incidentDetails\`):\
> \`contains\`, \`doesNotContain\`, \`equals\`, \`doesNotEqual\`, \`startsWith\`, \`endsWith\`, \`greaterThan\`, \`lessThan\`, \`greaterThanOrEqual\`, \`lessThanOrEqual\`, \`regexMatch\`\
> \
> \> \*\*Note:\*\* \`greaterThan\`, \`lessThan\`, \`greaterThanOrEqual\`, \`lessThanOrEqual\` are only available for \`incidentDetails\`.\
> \
> \---\
> \
> \*\*Action Types:\*\*\
> \
> \| \`actionType\` | Description | Additional Fields |\
> \|---|---|---|\
> \| \`reassignIncident\` | Reassign the incident to a specific user | \`user\` (user ID) |\
> \| \`suppressIncident\` | Suppress the incident (do not create) | — |\
> \| \`acknowledgeIncident\` | Auto-acknowledge the incident | \`sendAlert\` (\`\\"true\\"\` or \`\\"false\\"\`) |\
> \| \`resolveIncident\` | Auto-resolve the incident | \`sendAlert\` (\`\\"true\\"\` or \`\\"false\\"\`) |\
> \| \`changeEscalation\` | Override the escalation policy | \`escalation\` (escalation policy ID) |\
> \| \`priority\` | Set incident priority | \`priority\` (one of \`p1\`, \`p2\`, \`p3\`, \`p4\`, \`p5\`) |\
> \| \`severity\` | Set incident severity | \`severity\` (one of \`sev1\`, \`sev2\`, \`sev3\`) |\
> \| \`outboundWebhook\` | Trigger an outbound webhook | \`outboundWebhook\` (webhook ID) |\
> \| \`executePlaybook\` | Execute a playbook | \`playbook\` (playbook ID) |\
> \| \`timerResolve\` | Auto-resolve after a timer | timer config |\
> \
> \---\
> \
> \*\*Example:\*\* The sample body creates a rule that matches all incidents whose message starts with \\"test\\" AND whose metadata key \\"test\\" has a value greater than 8, then reassigns the incident to a specific user.
```json
{"openapi":"3.1.0","info":{"title":"Spike API","version":"1.0.0"},"tags":[{"name":"Alert Rules","description":"Create, read, update and archive automation (alert) rules."}],"servers":[{"url":"https://api.spike.sh","description":"API server"}],"security":[{"ApiKeyAuth":[],"TeamIdHeader":[]}],"components":{"securitySchemes":{"ApiKeyAuth":{"type":"apiKey","in":"header","name":"x-api-key","description":"Your organisation's API key. Create one in the Spike dashboard under Settings > API. Sent on every request as the `x-api-key` header."}},"schemas":{"Error":{"type":"object","properties":{"message":{"type":"string","description":"Error message describing the problem"},"error":{"type":"string","description":"Error type or code"},"success":{"type":"boolean","description":"Present on the endpoints whose handlers include it (for example the API-key filter and the public on-call routes). Always `false` on an error."},"valid_api":{"type":"boolean","description":"Present on `401`s produced by the session/API-key filter. `false` means the supplied `x-api-key` was not recognised."},"statusCode":{"type":"number","description":"Echo of the HTTP status, present on a few permission errors."}}}}},"paths":{"/automation/rules/create":{"post":{"operationId":"postAutomationRulesCreate","summary":"Create an alert rule","description":"Create a new alert rule for a team. An alert rule automatically executes actions when incoming incidents match the specified conditions.\n\n**Request Body:**\n- `name` (required): A descriptive name for the rule.\n- `conditions` (required): A 2D array of condition objects. The outer array represents **OR** groups — if any group matches, the rule triggers. Each inner array contains conditions combined with **AND** logic — all must match.\n- `actions` (required): An array of action objects to execute when conditions are met.\n\n---\n\n**Condition Types:**\n\n| `conditionType` | Description | Additional Fields |\n|---|---|---|\n| `allIncidents` | Matches every incident (wildcard) | — |\n| `incidentMessage` | Match on the incident title/message | `comparator`, `text` |\n| `incidentDetails` | Match on a specific key in the incident metadata | `comparator`, `text`, `keypair` |\n| `incidentOccurrence` | Match when total occurrences exceed a threshold | `occurrences` |\n| `incidentOccurrenceTimeframe` | Match when occurrences exceed a threshold within a time window | `occurrences`, `timeframe` (in minutes) |\n| `priority` | Match on incident priority | `priority` (one of `p1`, `p2`, `p3`, `p4`, `p5`) |\n| `severity` | Match on incident severity | `severity` (one of `sev1`, `sev2`, `sev3`) |\n| `regexMatch` | Match incident message against a regex pattern | `regex` |\n| `incidentTiming` | Match based on time of day the incident occurred | `start` (HH:mm), `end` (HH:mm), `timezone` (optional, e.g., `America/New_York`) |\n| `incidentDayOfWeek` | Match based on day of the week | `days` (array of day numbers: 0=Sunday, 6=Saturday), `timezone` (optional) |\n\n**Comparators** (for `incidentMessage` and `incidentDetails`):\n`contains`, `doesNotContain`, `equals`, `doesNotEqual`, `startsWith`, `endsWith`, `greaterThan`, `lessThan`, `greaterThanOrEqual`, `lessThanOrEqual`, `regexMatch`\n\n> **Note:** `greaterThan`, `lessThan`, `greaterThanOrEqual`, `lessThanOrEqual` are only available for `incidentDetails`.\n\n---\n\n**Action Types:**\n\n| `actionType` | Description | Additional Fields |\n|---|---|---|\n| `reassignIncident` | Reassign the incident to a specific user | `user` (user ID) |\n| `suppressIncident` | Suppress the incident (do not create) | — |\n| `acknowledgeIncident` | Auto-acknowledge the incident | `sendAlert` (`\\\"true\\\"` or `\\\"false\\\"`) |\n| `resolveIncident` | Auto-resolve the incident | `sendAlert` (`\\\"true\\\"` or `\\\"false\\\"`) |\n| `changeEscalation` | Override the escalation policy | `escalation` (escalation policy ID) |\n| `priority` | Set incident priority | `priority` (one of `p1`, `p2`, `p3`, `p4`, `p5`) |\n| `severity` | Set incident severity | `severity` (one of `sev1`, `sev2`, `sev3`) |\n| `outboundWebhook` | Trigger an outbound webhook | `outboundWebhook` (webhook ID) |\n| `executePlaybook` | Execute a playbook | `playbook` (playbook ID) |\n| `timerResolve` | Auto-resolve after a timer | timer config |\n\n---\n\n**Example:** The sample body creates a rule that matches all incidents whose message starts with \\\"test\\\" AND whose metadata key \\\"test\\\" has a value greater than 8, then reassigns the incident to a specific user.\n","tags":["Alert Rules"],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"name":{"type":"string"},"conditions":{"type":"array","items":{"type":"array","items":{"type":"object","properties":{"conditionType":{"type":"string"},"comparator":{"type":"string"},"text":{"type":"string"},"keypair":{"type":"string","description":"Metadata key to compare when `conditionType` is `incidentDetails`."},"priority":{"type":"string","enum":["p1","p2","p3","p4","p5"],"description":"Required when `conditionType` is `priority`."}}}}},"actions":{"type":"array","items":{"type":"object","properties":{"actionType":{"type":"string"},"user":{"type":"string"}}}}}}}}},"responses":{"200":{"description":"Successful response","content":{"application/json":{"schema":{"type":"object","properties":{"alertConfig":{"type":"object"},"featureFlag":{"type":"boolean"}}}}}},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}},"parameters":[{"name":"x-api-key","in":"header","required":true,"schema":{"type":"string"},"description":"Your API key. Find it in your Spike dashboard under Settings > API."},{"name":"x-team-id","in":"header","required":true,"schema":{"type":"string"},"description":"The team's `_id` — a 24-character hex ObjectId, NOT the short `uid` slug. Read it from `GET /teams/get-all-teams`."}]}}}}
```
## Update an alert rule
> Update an existing alert rule by its ID. You must send the \*\*complete rule\*\* — partial updates are not supported. The existing rule will be fully replaced with the provided data.\
> \
> \*\*Request Body:\*\*\
> \- \`name\` (required): Updated rule name.\
> \- \`conditions\` (required): Full 2D array of condition groups (same format as Create).\
> \- \`actions\` (required): Full array of action objects (same format as Create).\
> \
> See \*Create an alert rule\* for all available \`conditionType\`, \`comparator\`, and \`actionType\` values.
```json
{"openapi":"3.1.0","info":{"title":"Spike API","version":"1.0.0"},"tags":[{"name":"Alert Rules","description":"Create, read, update and archive automation (alert) rules."}],"servers":[{"url":"https://api.spike.sh","description":"API server"}],"security":[{"ApiKeyAuth":[],"TeamIdHeader":[]}],"components":{"securitySchemes":{"ApiKeyAuth":{"type":"apiKey","in":"header","name":"x-api-key","description":"Your organisation's API key. Create one in the Spike dashboard under Settings > API. Sent on every request as the `x-api-key` header."}},"schemas":{"Error":{"type":"object","properties":{"message":{"type":"string","description":"Error message describing the problem"},"error":{"type":"string","description":"Error type or code"},"success":{"type":"boolean","description":"Present on the endpoints whose handlers include it (for example the API-key filter and the public on-call routes). Always `false` on an error."},"valid_api":{"type":"boolean","description":"Present on `401`s produced by the session/API-key filter. `false` means the supplied `x-api-key` was not recognised."},"statusCode":{"type":"number","description":"Echo of the HTTP status, present on a few permission errors."}}}}},"paths":{"/automation/rules/{ruleId}/update":{"put":{"operationId":"putAutomationRulesByRuleIdUpdate","summary":"Update an alert rule","description":"Update an existing alert rule by its ID. You must send the **complete rule** — partial updates are not supported. The existing rule will be fully replaced with the provided data.\n\n**Request Body:**\n- `name` (required): Updated rule name.\n- `conditions` (required): Full 2D array of condition groups (same format as Create).\n- `actions` (required): Full array of action objects (same format as Create).\n\nSee *Create an alert rule* for all available `conditionType`, `comparator`, and `actionType` values.\n","tags":["Alert Rules"],"parameters":[{"name":"x-api-key","in":"header","required":true,"schema":{"type":"string"},"description":"Your API key. Find it in your Spike dashboard under Settings > API."},{"name":"x-team-id","in":"header","required":true,"schema":{"type":"string"},"description":"The team's `_id` — a 24-character hex ObjectId, NOT the short `uid` slug. Read it from `GET /teams/get-all-teams`."},{"name":"ruleId","in":"path","required":true,"schema":{"type":"string"},"description":"ruleId parameter"}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"name":{"type":"string"},"conditions":{"type":"array","items":{"type":"array","items":{"type":"object","properties":{"conditionType":{"type":"string"},"comparator":{"type":"string"},"text":{"type":"string"},"keypair":{"type":"string","description":"Metadata key to compare when `conditionType` is `incidentDetails`."},"priority":{"type":"string","enum":["p1","p2","p3","p4","p5"],"description":"Required when `conditionType` is `priority`."}}}}},"actions":{"type":"array","items":{"type":"object","properties":{"actionType":{"type":"string"},"user":{"type":"string"}}}}}}}}},"responses":{"200":{"description":"The updated rule document.","content":{"application/json":{"schema":{"type":"object"}}}},"400":{"description":"Bad request","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"Not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}}}}
```
## Archive an alert rule
> Archive (soft-delete) an alert rule by its ID. Archived rules will no longer evaluate against incoming incidents.\
> \
> Pass the alert rule \`\_id\` as a path parameter. No request body is required.
```json
{"openapi":"3.1.0","info":{"title":"Spike API","version":"1.0.0"},"tags":[{"name":"Alert Rules","description":"Create, read, update and archive automation (alert) rules."}],"servers":[{"url":"https://api.spike.sh","description":"API server"}],"security":[{"ApiKeyAuth":[],"TeamIdHeader":[]}],"components":{"securitySchemes":{"ApiKeyAuth":{"type":"apiKey","in":"header","name":"x-api-key","description":"Your organisation's API key. Create one in the Spike dashboard under Settings > API. Sent on every request as the `x-api-key` header."}},"schemas":{"Error":{"type":"object","properties":{"message":{"type":"string","description":"Error message describing the problem"},"error":{"type":"string","description":"Error type or code"},"success":{"type":"boolean","description":"Present on the endpoints whose handlers include it (for example the API-key filter and the public on-call routes). Always `false` on an error."},"valid_api":{"type":"boolean","description":"Present on `401`s produced by the session/API-key filter. `false` means the supplied `x-api-key` was not recognised."},"statusCode":{"type":"number","description":"Echo of the HTTP status, present on a few permission errors."}}}}},"paths":{"/automation/rules/{ruleId}/archive":{"delete":{"operationId":"deleteAutomationRulesByRuleIdArchive","summary":"Archive an alert rule","description":"Archive (soft-delete) an alert rule by its ID. Archived rules will no longer evaluate against incoming incidents.\n\nPass the alert rule `_id` as a path parameter. No request body is required.\n","tags":["Alert Rules"],"parameters":[{"name":"x-api-key","in":"header","required":true,"schema":{"type":"string"},"description":"Your API key. Find it in your Spike dashboard under Settings > API."},{"name":"x-team-id","in":"header","required":true,"schema":{"type":"string"},"description":"The team's `_id` — a 24-character hex ObjectId, NOT the short `uid` slug. Read it from `GET /teams/get-all-teams`."},{"name":"ruleId","in":"path","required":true,"schema":{"type":"string"},"description":"ruleId parameter"}],"responses":{"200":{"description":"Successful response","content":{"application/json":{"schema":{"type":"object","properties":{"archive":{"type":"boolean"}}}}}},"401":{"description":"Unauthorized","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"404":{"description":"Not found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}}}}
```