alert_resolved

alert_resolved closes the incident opened by alert_triggered.

When it fires#

On a scheduled check (every frequency_minutes) or a manual Check, when:

• The rule's state is triggered, and
• The measured value no longer breaches the threshold.

The rule goes back to ok and this event is sent once. A rule that was never triggered never sends alert_resolved.

Which settings enable it#

Same as alert_triggered: the rule's webhook_url, else the workspace webhook URL. No event filter. Workspace timeout, else 10 s. Up to 3 retries.

Payload#

{
  "event": "alert_resolved",
  "alert": {
    "alert_id": "alert_3a9e5c1f7b2d4e8a0c6f1b93",
    "name": "Success rate below 70%",
    "metric": "call_success_rate",
    "threshold_type": "absolute",
    "comparator": "<",
    "threshold": 70,
    "window_minutes": 60,
    "frequency_minutes": 5,
    "agent_ids": ["agent_5b0e2c7d9a1f4e3b8c6d2a10"],
    "emails": ["ops@bondidental.com.au"],
    "webhook_url": "https://example.com/hooks/alerts",
    "enabled": true,
    "state": "ok",
    "last_value": 81.25,
    "last_checked_timestamp": 1760686800000,
    "created_timestamp": 1760510400000,
    "value": 81.25,
    "message": "Success rate below 70%: back within threshold (call_success_rate is 81.25)",
    "timestamp": 1760686800390
  }
}

Fields#

The fields match alert_triggered, with:

The rule's email recipients get [Tried] Alert resolved: <rule name>. Needs keys

How to respond#

Reply 2xx. The body is ignored. To match a resolve with its trigger, key on alert.alert_id: a rule has at most one open incident at a time.