Alert Rules

Create, read, update and archive automation (alert) rules.

Fetch all alert rules

get

Get a list of all alert rules configured for a team. Returns both enabled and disabled rules.

Each rule contains:

name: Rule name
conditions: Array of condition groups (OR logic between groups, AND logic within a group)
actions: Array of actions to execute when conditions match
enabled: Whether the rule is currently active

Authorizations

x-api-keystringRequired

Your organisation's API key. Create one in the Spike dashboard under Settings > API. Sent on every request as the x-api-key header.

x-team-idstringRequired

The target team's _id — a 24-character hex ObjectId such as 5f2b1c4d9e8a7b6c5d4e3f21. This is NOT the short uid slug (e.g. eng) shown in dashboard URLs; passing the uid will not resolve a team. Read the _id from GET /teams/get-all-teams or GET /teams/get-my-teams.

REQUIRED for: GET /on-calls (API-key callers get 400 without it), POST /on-calls, and every team-scoped read that declares it — the /incidents/* and /services/* listings, /escalations, /automation/rules and the integration endpoints.

OPTIONAL for: the incident action endpoints (acknowledge, resolve, escalate, unacknowledge), which derive the organisation from the API key itself; PUT /on-calls/{oncallId} and the on-call layer endpoints, which fall back to the organisation's default team; and org-wide reads such as GET /orgs/info and GET /users, which ignore it.

When supplied it must name a team inside the API key's organisation. A team from another organisation is rejected with 403.

Header parameters

x-api-keystringRequired

Your API key. Find it in your Spike dashboard under Settings > API.

x-team-idstringRequired

The team's _id — a 24-character hex ObjectId, NOT the short uid slug. Read it from GET /teams/get-all-teams.

Example: 5f2b1c4d9e8a7b6c5d4e3f21

Responses

200

Successful response

application/json

featureFlagbooleanOptional

401

Unauthorized

application/json

get/automation/rules

GET /automation/rules HTTP/1.1
Host: api.spike.sh
x-api-key: text
x-team-id: text
Accept: */*

{
  "alertConfigs": [
    {
      "_id": "67d1e2f3a4b5c60718293a4b",
      "name": "Reassign noisy CPU alerts",
      "enable": true,
      "teams": [
        "5f2b1c4d9e8a7b6c5d4e3f21"
      ],
      "org": "5f72e289b17d1656e0115098",
      "createdAt": "2026-03-13T09:41:00.000Z"
    }
  ],
  "featureFlag": true
}

Get alert rule details

get

Get full details of a specific alert rule by its ID, including all conditions and actions.

Authorizations

x-api-keystringRequired

Your organisation's API key. Create one in the Spike dashboard under Settings > API. Sent on every request as the x-api-key header.

x-team-idstringRequired

When supplied it must name a team inside the API key's organisation. A team from another organisation is rejected with 403.

Path parameters

ruleIdstringRequired

ruleId parameter

Header parameters

x-api-keystringRequired

Your API key. Find it in your Spike dashboard under Settings > API.

x-team-idstringRequired

The team's _id — a 24-character hex ObjectId, NOT the short uid slug. Read it from GET /teams/get-all-teams.

Example: 5f2b1c4d9e8a7b6c5d4e3f21

Responses

200

Successful response

application/json

alertConfigobjectOptional

featureFlagbooleanOptional

isPinnedbooleanOptional

401

Unauthorized

application/json

404

Not found

application/json

get/automation/rules/{ruleId}

GET /automation/rules/{ruleId} HTTP/1.1
Host: api.spike.sh
x-api-key: text
x-team-id: text
Accept: */*

{
  "alertConfig": {
    "_id": "67d1e2f3a4b5c60718293a4b",
    "name": "Reassign noisy CPU alerts",
    "enable": true,
    "teams": [
      "5f2b1c4d9e8a7b6c5d4e3f21"
    ],
    "org": "5f72e289b17d1656e0115098",
    "createdAt": "2026-03-13T09:41:00.000Z"
  },
  "featureFlag": true,
  "isPinned": false
}

Create an alert rule

post

Create a new alert rule for a team. An alert rule automatically executes actions when incoming incidents match the specified conditions.

Request Body:

name (required): A descriptive name for the rule.
conditions (required): A 2D array of condition objects. The outer array represents OR groups — if any group matches, the rule triggers. Each inner array contains conditions combined with AND logic — all must match.
actions (required): An array of action objects to execute when conditions are met.

Condition Types:

conditionType

Description

Additional Fields

allIncidents

Matches every incident (wildcard)

—

incidentMessage

Match on the incident title/message

comparator, text

incidentDetails

Match on a specific key in the incident metadata

comparator, text, keypair

incidentOccurrence

Match when total occurrences exceed a threshold

occurrences

incidentOccurrenceTimeframe

Match when occurrences exceed a threshold within a time window

occurrences, timeframe (in minutes)

priority

Match on incident priority

priority (one of p1, p2, p3, p4, p5)

severity

Match on incident severity

severity (one of sev1, sev2, sev3)

regexMatch

Match incident message against a regex pattern

regex

incidentTiming

Match based on time of day the incident occurred

start (HH:mm), end (HH:mm), timezone (optional, e.g., America/New_York)

incidentDayOfWeek

Match based on day of the week

days (array of day numbers: 0=Sunday, 6=Saturday), timezone (optional)

Comparators (for incidentMessage and incidentDetails): contains, doesNotContain, equals, doesNotEqual, startsWith, endsWith, greaterThan, lessThan, greaterThanOrEqual, lessThanOrEqual, regexMatch

Note: greaterThan, lessThan, greaterThanOrEqual, lessThanOrEqual are only available for incidentDetails.

Action Types:

actionType

Description

Additional Fields

reassignIncident

Reassign the incident to a specific user

user (user ID)

suppressIncident

Suppress the incident (do not create)

—

acknowledgeIncident

Auto-acknowledge the incident

sendAlert (\"true\" or \"false\")

resolveIncident

Auto-resolve the incident

sendAlert (\"true\" or \"false\")

changeEscalation

Override the escalation policy

escalation (escalation policy ID)

priority

Set incident priority

priority (one of p1, p2, p3, p4, p5)

severity

Set incident severity

severity (one of sev1, sev2, sev3)

outboundWebhook

Trigger an outbound webhook

outboundWebhook (webhook ID)

executePlaybook

Execute a playbook

playbook (playbook ID)

timerResolve

Auto-resolve after a timer

timer config

Example: The sample body creates a rule that matches all incidents whose message starts with "test" AND whose metadata key "test" has a value greater than 8, then reassigns the incident to a specific user.

Authorizations

x-api-keystringRequired

Your organisation's API key. Create one in the Spike dashboard under Settings > API. Sent on every request as the x-api-key header.

x-team-idstringRequired

When supplied it must name a team inside the API key's organisation. A team from another organisation is rejected with 403.

Header parameters

x-api-keystringRequired

Your API key. Find it in your Spike dashboard under Settings > API.

x-team-idstringRequired

The team's _id — a 24-character hex ObjectId, NOT the short uid slug. Read it from GET /teams/get-all-teams.

Example: 5f2b1c4d9e8a7b6c5d4e3f21

Body

namestringOptional

Responses

200

Successful response

application/json

alertConfigobjectOptional

featureFlagbooleanOptional

400

Bad request

application/json

401

Unauthorized

application/json

post/automation/rules/create

POST /automation/rules/create HTTP/1.1
Host: api.spike.sh
x-api-key: text
x-team-id: text
Content-Type: application/json
Accept: */*
Content-Length: 358

{
  "name": "Auto-reassign test incidents",
  "conditions": [
    [
      {
        "conditionType": "incidentMessage",
        "comparator": "startsWith",
        "text": "test"
      },
      {
        "conditionType": "incidentDetails",
        "text": "8",
        "comparator": "greaterThan",
        "keypair": "metric_value"
      }
    ],
    [
      {
        "conditionType": "priority",
        "priority": "p1"
      }
    ]
  ],
  "actions": [
    {
      "actionType": "reassignIncident",
      "user": "6a3c2d5e0f9b8c7d6e5f4a32"
    }
  ]
}

{
  "alertConfig": {
    "_id": "67d1e2f3a4b5c60718293a4b",
    "name": "Reassign noisy CPU alerts",
    "enable": true,
    "teams": [
      "5f2b1c4d9e8a7b6c5d4e3f21"
    ],
    "org": "5f72e289b17d1656e0115098",
    "createdAt": "2026-03-13T09:41:00.000Z"
  },
  "featureFlag": true
}

Update an alert rule

put

Update an existing alert rule by its ID. You must send the complete rule — partial updates are not supported. The existing rule will be fully replaced with the provided data.

Request Body:

name (required): Updated rule name.
conditions (required): Full 2D array of condition groups (same format as Create).
actions (required): Full array of action objects (same format as Create).

See Create an alert rule for all available conditionType, comparator, and actionType values.

Authorizations

x-api-keystringRequired

Your organisation's API key. Create one in the Spike dashboard under Settings > API. Sent on every request as the x-api-key header.

x-team-idstringRequired

When supplied it must name a team inside the API key's organisation. A team from another organisation is rejected with 403.

Path parameters

ruleIdstringRequired

ruleId parameter

Header parameters

x-api-keystringRequired

Your API key. Find it in your Spike dashboard under Settings > API.

x-team-idstringRequired

The team's _id — a 24-character hex ObjectId, NOT the short uid slug. Read it from GET /teams/get-all-teams.

Example: 5f2b1c4d9e8a7b6c5d4e3f21

Body

namestringOptional

Responses

200

The updated rule document.

application/json

objectOptional

400

Bad request

application/json

401

Unauthorized

application/json

404

Not found

application/json

put/automation/rules/{ruleId}/update

PUT /automation/rules/{ruleId}/update HTTP/1.1
Host: api.spike.sh
x-api-key: text
x-team-id: text
Content-Type: application/json
Accept: */*
Content-Length: 356

{
  "name": "Updated auto-reassign rule",
  "conditions": [
    [
      {
        "conditionType": "incidentMessage",
        "comparator": "startsWith",
        "text": "test"
      },
      {
        "conditionType": "incidentDetails",
        "text": "8",
        "comparator": "greaterThan",
        "keypair": "metric_value"
      }
    ],
    [
      {
        "conditionType": "priority",
        "priority": "p1"
      }
    ]
  ],
  "actions": [
    {
      "actionType": "reassignIncident",
      "user": "6a3c2d5e0f9b8c7d6e5f4a32"
    }
  ]
}

{
  "_id": "67d1e2f3a4b5c60718293a4b",
  "name": "Reassign noisy CPU alerts (v2)",
  "enable": true,
  "teams": [
    "5f2b1c4d9e8a7b6c5d4e3f21"
  ],
  "org": "5f72e289b17d1656e0115098",
  "createdAt": "2026-03-13T09:41:00.000Z"
}

Archive an alert rule

delete

Archive (soft-delete) an alert rule by its ID. Archived rules will no longer evaluate against incoming incidents.

Pass the alert rule _id as a path parameter. No request body is required.

Authorizations

x-api-keystringRequired

Your organisation's API key. Create one in the Spike dashboard under Settings > API. Sent on every request as the x-api-key header.

x-team-idstringRequired

When supplied it must name a team inside the API key's organisation. A team from another organisation is rejected with 403.

Path parameters

ruleIdstringRequired

ruleId parameter

Header parameters

x-api-keystringRequired

Your API key. Find it in your Spike dashboard under Settings > API.

x-team-idstringRequired

The team's _id — a 24-character hex ObjectId, NOT the short uid slug. Read it from GET /teams/get-all-teams.

Example: 5f2b1c4d9e8a7b6c5d4e3f21

Responses

200

Successful response

application/json

archivebooleanOptional

401

Unauthorized

application/json

404

Not found

application/json

delete/automation/rules/{ruleId}/archive

DELETE /automation/rules/{ruleId}/archive HTTP/1.1
Host: api.spike.sh
x-api-key: text
x-team-id: text
Accept: */*

{
  "archive": true
}

PreviousEscalations

NextServices

Last updated 2 months ago