API reference

API reference: Monitoring

Snowtrol monitoring API: incidents (correlated timelines), per-resource metrics, alert rules, on-demand evaluation, and the per-employee activity view.

The monitoring/alerts engine. Reads are open to members (a never-connected org gets { empty: true }); rule creation and evaluation need mutate_infra.

GET/api/monitoring/incidentsSession

Correlated incident timelines: firing/resolved alerts plus change events, newest first — reading the same metric series the alert evaluation uses.

Example response

json

{ "incidents": [ { "id": "…", "title": "…", "events": [ … ] } ], "alerts": [ … ] }

Errors

Status	When
`401`	Not signed in.

GET/api/monitoring/metricsSession

Per-resource metric series (?nativeId= required): cpu, memory, network_in/out, latency_p99, error_rate. Real polled samples from a configured per-resource metrics endpoint win; otherwise the deterministic series (mock) or an honest empty.

Errors

Status	When
`400`	Missing nativeId.
`404`	Unknown/cross-org native id.

GET/api/monitoring/alert-rulesSession (create: mutate_infra)

List alert rules (default rules are seeded on first connect). POST creates one (mutate_infra).

POST/api/monitoring/evaluatemutate_infra

Evaluate all rules now (also fired by the connect-kick): opens firing alerts (deduplicated per rule+resource) and auto-resolves recovered ones. Audited monitoring.alert_fired/alert_resolved.

GET/api/monitoring/activitySession (others' activity: manage_users_sso)

Per-employee activity view over the audit trail: your own always; another member's (?userId=) requires manage_users_sso; cross-org 404.