searchOrgAlarms
Search alarms across the organization with filters for site, alarm group, severity, type, acknowledgement state, acknowledgement admin, and time range.
Preferred authentication method for automation and integrations. Send the API token in the HTTP Authorization header.
Format:
Authorization: Token {apitoken}
Notes:
- An API token generated for a specific admin has the same privileges as that admin
- An API token is automatically removed if it is not used for more than 90 days
- SSO admins cannot generate admin API tokens. Use organization API tokens when scoped Org/Site privileges are needed.
In: header
Path Parameters
uuidQuery Parameters
Filter results by site identifier. Accepts multiple comma-separated values.
Alarm group used to filter alarm results. enum: certificate_expiry, infrastructure, marvis, security. The marvis group is used to retrieve AI-driven network issue detections. Known Marvis alarm types include: bad_cable, bad_wan_uplink, dns_failure, arp_failure, auth_failure, dhcp_failure, missing_vlan, negotiation_mismatch, port_flap. Results include resolution status (status, resolved_time) and affected entity details. Accepts multiple comma-separated values.
Alarm severity used to filter results. enum: critical, info, warn. Accepts multiple comma-separated values.
Filter alarms by alarm type. Accepts multiple values separated by comma. Use List Alarm Definitions to get the list of possible alarm types
Name of the admins who have acked the alarms; accepts multiple values separated by comma
Filter alarm results by whether the alarm has been acknowledged
Lower bound of the time range, as an epoch timestamp in seconds or a relative value such as -1d or -1w
Upper bound of the time range, as an epoch timestamp in seconds or a relative value such as -1d, -2h, or now
Time range duration for the query, using relative units such as 10m, 7d, or 2w
"1d"Maximum number of results to return per page
0 <= value100On which field the list should be sorted, -prefix represents DESC order
"timestamp"Pagination cursor for retrieving subsequent pages of results. This value is automatically populated by Mist in the next URL from the previous response and should not be manually constructed.
Response Body
curl -X GET "https://example.com/api/v1/orgs/000000ab-00ab-00ab-00ab-0000000000ab/alarms/search?group=security%2Cinfrastructure&severity=warn%2Ccritical"{ "component": "string", "end": 1711035686, "limit": 10, "next": "/api/v1/orgs/b3b9f5e6-67b1-4112-9b4c-6824c565eaeb/alarms/search?end=1711035686&limit=10&search_after=%5B1711031354000%2C+%2256bfa7af-b2db-43ee-a4c8-9b820bbba0e1%22%5D&start=1710949286", "page": 1, "results": [ { "ack_admin_id": "456b7016-a916-a4b1-78dd-72b947c152b7", "ack_admin_name": "Joe", "acked": true, "acked_time": 1711031352, "aps": [ "ffeeddccbbaa", "ffeeddccbbab" ], "bssids": [ "Corp SSID" ], "count": 2, "gateways": [ "ffeeddccbbaa", "ffeeddccbbab" ], "group": "security", "hostnames": [ "MC_DavidL", "MCM_AP_33_Nishant" ], "id": "53f10664-3ce8-4c27-b382-0ef66432349f", "last_seen": 1711031774, "note": "string", "org_id": "a97c1b22-a4e9-411e-9bfd-d8695a0f9e61", "resolved_time": 0, "severity": "critical", "site_id": "441a1214-6928-442a-8e92-e1d34b8ec6a6", "ssids": [ "string" ], "status": "open", "switches": [ "ffeeddccbbaa", "ffeeddccbbab" ], "timestamp": 0.1, "type": "rogue_client" } ], "start": 1710949286, "total": 232}