> For the complete documentation index, see [llms.txt](https://docs.vcheckglobal.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.vcheckglobal.com/api-reference/monitoring/monitoring-alert-actions.md).
# Monitoring Alert Actions
Update alert risk/status/comments, escalate alerts, view activity logs, and look up valid risk levels and statuses.
## List Risk Levels
> Returns all available risk levels that can be assigned to a monitoring alert.\
> \
> \### Response fields\
> \
> \| Field | Type | Description |\
> \|-------|------|-------------|\
> \| \`id\` | integer | Risk level identifier |\
> \| \`name\` | string | Risk level name (e.g. \`High\`, \`Medium\`, \`Low\`) |
```json
{"openapi":"3.1.0","info":{"title":"Vcheck Global API","version":"5.4.0"},"tags":[{"name":"Monitoring Alert Actions","description":"Update alert risk/status/comments, escalate alerts, view activity logs, and look up valid risk levels and statuses."}],"servers":[{"url":"https://api-platform.vcheckglobal.net/v2","description":"Vcheck platform (sandbox host issued first; production host after sign-off)"}],"security":[{"bearerAuth":[]}],"components":{"securitySchemes":{"bearerAuth":{"type":"http","scheme":"bearer","bearerFormat":"JWT","description":"Obtain a token via POST https://api-platform.vcheckglobal.net/v2/oauth2/token.\nInclude in all subsequent requests as `Authorization: Bearer `.\nTokens expire after 3,600 seconds - cache and reuse; request a new one only when close to expiry.\n"}}},"paths":{"/monitoring/alerts/risk-levels":{"get":{"tags":["Monitoring Alert Actions"],"operationId":"getAlertRiskLevels","summary":"List Risk Levels","description":"Returns all available risk levels that can be assigned to a monitoring alert.\n\n### Response fields\n\n| Field | Type | Description |\n|-------|------|-------------|\n| `id` | integer | Risk level identifier |\n| `name` | string | Risk level name (e.g. `High`, `Medium`, `Low`) |\n","responses":{"200":{"description":"Risk levels retrieved successfully.","content":{"application/json":{"schema":{"type":"object","properties":{"results":{"type":"array","items":{"type":"object","properties":{"id":{"description":"Risk level identifier.","type":"integer"},"name":{"description":"Risk level name.","type":"string"}}}}}}}}},"403":{"description":"Forbidden - missing or invalid Client-ID credentials, insufficient scope, endpoint disabled via feature flag, or authenticated client has no linked account. Verify the scopes assigned to your credentials.","content":{"application/json":{"schema":{"type":"object","properties":{"detail":{"description":"Authorization or access error message.","type":"string","default":"This endpoint is currently disabled."}}}}}},"500":{"description":"Internal server error - an unexpected error occurred. Please try again later or contact support if the issue persists.","content":{"application/json":{"schema":{"type":"object","properties":{"detail":{"description":"Internal server error message.","type":"string","default":"An unexpected error occurred while processing the request."}}}}}}}}}}}
```
## List Alert Statuses
> Returns all available statuses that can be assigned to a monitoring alert.\
> \
> \### Response fields\
> \
> \| Field | Type | Description |\
> \|-------|------|-------------|\
> \| \`id\` | integer | Status identifier |\
> \| \`name\` | string | Status name (e.g. \`New\`, \`In Review\`) |
```json
{"openapi":"3.1.0","info":{"title":"Vcheck Global API","version":"5.4.0"},"tags":[{"name":"Monitoring Alert Actions","description":"Update alert risk/status/comments, escalate alerts, view activity logs, and look up valid risk levels and statuses."}],"servers":[{"url":"https://api-platform.vcheckglobal.net/v2","description":"Vcheck platform (sandbox host issued first; production host after sign-off)"}],"security":[{"bearerAuth":[]}],"components":{"securitySchemes":{"bearerAuth":{"type":"http","scheme":"bearer","bearerFormat":"JWT","description":"Obtain a token via POST https://api-platform.vcheckglobal.net/v2/oauth2/token.\nInclude in all subsequent requests as `Authorization: Bearer `.\nTokens expire after 3,600 seconds - cache and reuse; request a new one only when close to expiry.\n"}}},"paths":{"/monitoring/alerts/statuses":{"get":{"tags":["Monitoring Alert Actions"],"operationId":"getAlertStatuses","summary":"List Alert Statuses","description":"Returns all available statuses that can be assigned to a monitoring alert.\n\n### Response fields\n\n| Field | Type | Description |\n|-------|------|-------------|\n| `id` | integer | Status identifier |\n| `name` | string | Status name (e.g. `New`, `In Review`) |\n","responses":{"200":{"description":"Alert statuses retrieved successfully.","content":{"application/json":{"schema":{"type":"object","properties":{"results":{"type":"array","items":{"type":"object","properties":{"id":{"description":"Status identifier.","type":"integer"},"name":{"description":"Status name.","type":"string"}}}}}}}}},"403":{"description":"Forbidden - missing or invalid Client-ID credentials, insufficient scope, endpoint disabled via feature flag, or authenticated client has no linked account. Verify the scopes assigned to your credentials.","content":{"application/json":{"schema":{"type":"object","properties":{"detail":{"description":"Authorization or access error message.","type":"string","default":"This endpoint is currently disabled."}}}}}},"500":{"description":"Internal server error - an unexpected error occurred. Please try again later or contact support if the issue persists.","content":{"application/json":{"schema":{"type":"object","properties":{"detail":{"description":"Internal server error message.","type":"string","default":"An unexpected error occurred while processing the request."}}}}}}}}}}}
```
## Update Alert
> Updates one or more fields on a monitoring alert: \`risk\`, \`status\`, and/or \`comments\`.\
> \
> \*\*Cross-account protection:\*\* The alert must belong to the account behind the caller's Client-ID. The account is resolved server-side from the OAuth2 client credentials — it is never taken from the request body or URL.\
> \
> \### Request body\
> \
> At least one of the following fields is required:\
> \
> \| Field | Type | Description |\
> \|-------|------|-------------|\
> \| \`risk\` | integer or string | Risk level id or name (case-insensitive). Use \`GET /v2/monitoring/alerts/risk-levels/\` for valid values. |\
> \| \`status\` | integer or string | Status id or name (case-insensitive). Use \`GET /v2/monitoring/alerts/statuses/\` for valid values. |\
> \| \`comments\` | string | Alert comments text. |\
> \
> \### Response fields\
> \
> \| Field | Type | Description |\
> \|-------|------|-------------|\
> \| \`alert\_id\` | integer | Alert identifier |\
> \| \`risk\` | object | \`{id, name}\` of the current risk level |\
> \| \`status\` | object | \`{id, name}\` of the current status |\
> \| \`comments\` | string / null | Current comments |\
> \| \`archived\` | boolean | Whether the alert is archived |\
> \| \`is\_escalated\` | boolean | Whether the alert is escalated |\
> \| \`vcheck\_reviewed\_date\` | string (ISO 8601) / null | Review date |\
> \| \`updated\_on\` | string (ISO 8601) | Last update timestamp |\
> \
> \*\*History tracking:\*\* Changes to \`risk\`, \`status\`, and \`comments\` are automatically recorded in the alert's activity log.\
> \
> \### Example Request\
> \
> \`\`\`json\
> {\
> "risk": "Medium",\
> "status": "In Review",\
> "comments": "Under investigation"\
> }\
> \`\`\`
````json
{"openapi":"3.1.0","info":{"title":"Vcheck Global API","version":"5.4.0"},"tags":[{"name":"Monitoring Alert Actions","description":"Update alert risk/status/comments, escalate alerts, view activity logs, and look up valid risk levels and statuses."}],"servers":[{"url":"https://api-platform.vcheckglobal.net/v2","description":"Vcheck platform (sandbox host issued first; production host after sign-off)"}],"security":[{"bearerAuth":[]}],"components":{"securitySchemes":{"bearerAuth":{"type":"http","scheme":"bearer","bearerFormat":"JWT","description":"Obtain a token via POST https://api-platform.vcheckglobal.net/v2/oauth2/token.\nInclude in all subsequent requests as `Authorization: Bearer `.\nTokens expire after 3,600 seconds - cache and reuse; request a new one only when close to expiry.\n"}}},"paths":{"/monitoring/alerts/{alert_id}/update":{"patch":{"tags":["Monitoring Alert Actions"],"operationId":"updateMonitoringAlert","summary":"Update Alert","description":"Updates one or more fields on a monitoring alert: `risk`, `status`, and/or `comments`.\n\n**Cross-account protection:** The alert must belong to the account behind the caller's Client-ID. The account is resolved server-side from the OAuth2 client credentials — it is never taken from the request body or URL.\n\n### Request body\n\nAt least one of the following fields is required:\n\n| Field | Type | Description |\n|-------|------|-------------|\n| `risk` | integer or string | Risk level id or name (case-insensitive). Use `GET /v2/monitoring/alerts/risk-levels/` for valid values. |\n| `status` | integer or string | Status id or name (case-insensitive). Use `GET /v2/monitoring/alerts/statuses/` for valid values. |\n| `comments` | string | Alert comments text. |\n\n### Response fields\n\n| Field | Type | Description |\n|-------|------|-------------|\n| `alert_id` | integer | Alert identifier |\n| `risk` | object | `{id, name}` of the current risk level |\n| `status` | object | `{id, name}` of the current status |\n| `comments` | string / null | Current comments |\n| `archived` | boolean | Whether the alert is archived |\n| `is_escalated` | boolean | Whether the alert is escalated |\n| `vcheck_reviewed_date` | string (ISO 8601) / null | Review date |\n| `updated_on` | string (ISO 8601) | Last update timestamp |\n\n**History tracking:** Changes to `risk`, `status`, and `comments` are automatically recorded in the alert's activity log.\n\n### Example Request\n\n```json\n{\n \"risk\": \"Medium\",\n \"status\": \"In Review\",\n \"comments\": \"Under investigation\"\n}\n```\n","parameters":[{"name":"alert_id","in":"path","required":true,"description":"Unique monitoring alert identifier.","schema":{"type":"integer"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"risk":{"description":"Risk level - pass the id (integer) or name (string, case-insensitive).","type":"string"},"status":{"description":"Alert status - pass the id (integer) or name (string, case-insensitive).","type":"string"},"comments":{"description":"Alert comments text.","type":"string"}}}}}},"responses":{"200":{"description":"Alert updated successfully.","content":{"application/json":{"schema":{"type":"object","properties":{"alert_id":{"description":"Unique alert identifier.","type":"integer"},"risk":{"type":"object","properties":{"id":{"type":"integer"},"name":{"type":"string"}}},"status":{"type":"object","properties":{"id":{"type":"integer"},"name":{"type":"string"}}},"comments":{"type":["string","null"]},"archived":{"type":"boolean"},"is_escalated":{"type":"boolean"},"vcheck_reviewed_date":{"type":["string","null"],"format":"date-time"},"updated_on":{"type":"string","format":"date-time"}}}}}},"400":{"description":"Bad request - validation error.","content":{"application/json":{"schema":{"type":"object","properties":{"detail":{"description":"Validation error message.","type":"string"}}}}}},"403":{"description":"Forbidden - missing or invalid Client-ID credentials, insufficient scope, endpoint disabled via feature flag, or authenticated client has no linked account. Verify the scopes assigned to your credentials.","content":{"application/json":{"schema":{"type":"object","properties":{"detail":{"description":"Authorization or access error message.","type":"string","default":"This endpoint is currently disabled."}}}}}},"404":{"description":"Not found - alert does not exist or does not belong to the authenticated account.","content":{"application/json":{"schema":{"type":"object","properties":{"detail":{"description":"Resource not found message.","type":"string","default":"Alert not found."}}}}}},"500":{"description":"Internal server error - an unexpected error occurred. Please try again later or contact support if the issue persists.","content":{"application/json":{"schema":{"type":"object","properties":{"detail":{"description":"Internal server error message.","type":"string","default":"An unexpected error occurred while processing the request."}}}}}}}}}}}
````
## Escalate Alert
> Creates a Salesforce escalation case for the specified monitoring alert and marks the alert as escalated.\
> \
> \*\*Idempotent:\*\* Only one escalation request is allowed per alert. If the alert has already been escalated, the endpoint returns \`204 No Content\` with an empty body — no duplicate Salesforce case is created.\
> \
> \*\*Cross-account protection:\*\* The alert must belong to the account behind the caller's Client-ID.\
> \
> \### Request body\
> \
> \| Field | Type | Required | Description |\
> \|-------|------|----------|-------------|\
> \| \`escalation\_details\` | string | Yes | Details or reason for the escalation |\
> \
> \### Response fields (201 Created)\
> \
> \| Field | Type | Description |\
> \|-------|------|-------------|\
> \| \`alert\_id\` | integer | Alert identifier |\
> \| \`message\` | string | Confirmation message |\
> \| \`detail\` | string | Additional information about next steps |\
> \
> \### Response (204 No Content)\
> \
> Empty body — the alert was already escalated. No action taken.\
> \
> \### Example Request\
> \
> \`\`\`json\
> {\
> "escalation\_details": "Subject has new criminal charges that require immediate review."\
> }\
> \`\`\`\
> \
> \### Example Response (subsequent calls)\
> \
> HTTP 204 No Content — empty response body.
````json
{"openapi":"3.1.0","info":{"title":"Vcheck Global API","version":"5.4.0"},"tags":[{"name":"Monitoring Alert Actions","description":"Update alert risk/status/comments, escalate alerts, view activity logs, and look up valid risk levels and statuses."}],"servers":[{"url":"https://api-platform.vcheckglobal.net/v2","description":"Vcheck platform (sandbox host issued first; production host after sign-off)"}],"security":[{"bearerAuth":[]}],"components":{"securitySchemes":{"bearerAuth":{"type":"http","scheme":"bearer","bearerFormat":"JWT","description":"Obtain a token via POST https://api-platform.vcheckglobal.net/v2/oauth2/token.\nInclude in all subsequent requests as `Authorization: Bearer `.\nTokens expire after 3,600 seconds - cache and reuse; request a new one only when close to expiry.\n"}}},"paths":{"/monitoring/alerts/{alert_id}/escalate":{"post":{"tags":["Monitoring Alert Actions"],"operationId":"escalateMonitoringAlert","summary":"Escalate Alert","description":"Creates a Salesforce escalation case for the specified monitoring alert and marks the alert as escalated.\n\n**Idempotent:** Only one escalation request is allowed per alert. If the alert has already been escalated, the endpoint returns `204 No Content` with an empty body — no duplicate Salesforce case is created.\n\n**Cross-account protection:** The alert must belong to the account behind the caller's Client-ID.\n\n### Request body\n\n| Field | Type | Required | Description |\n|-------|------|----------|-------------|\n| `escalation_details` | string | Yes | Details or reason for the escalation |\n\n### Response fields (201 Created)\n\n| Field | Type | Description |\n|-------|------|-------------|\n| `alert_id` | integer | Alert identifier |\n| `message` | string | Confirmation message |\n| `detail` | string | Additional information about next steps |\n\n### Response (204 No Content)\n\nEmpty body — the alert was already escalated. No action taken.\n\n### Example Request\n\n```json\n{\n \"escalation_details\": \"Subject has new criminal charges that require immediate review.\"\n}\n```\n\n### Example Response (subsequent calls)\n\nHTTP 204 No Content — empty response body.\n","parameters":[{"name":"alert_id","in":"path","required":true,"description":"Unique monitoring alert identifier.","schema":{"type":"integer"}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"required":["escalation_details"],"type":"object","properties":{"escalation_details":{"description":"Details or reason for escalation.","type":"string"}}}}}},"responses":{"201":{"description":"Escalation request submitted successfully.","content":{"application/json":{"schema":{"type":"object","properties":{"alert_id":{"type":"integer"},"message":{"type":"string"},"detail":{"type":"string"}}}}}},"204":{"description":"No content - alert has already been escalated. No duplicate escalation is created."},"400":{"description":"Bad request - validation error.","content":{"application/json":{"schema":{"type":"object","properties":{"detail":{"description":"Validation error message.","type":"string"}}}}}},"403":{"description":"Forbidden - missing or invalid Client-ID credentials, insufficient scope, endpoint disabled via feature flag, or authenticated client has no linked account. Verify the scopes assigned to your credentials.","content":{"application/json":{"schema":{"type":"object","properties":{"detail":{"description":"Authorization or access error message.","type":"string","default":"This endpoint is currently disabled."}}}}}},"404":{"description":"Not found - alert does not exist or does not belong to the authenticated account.","content":{"application/json":{"schema":{"type":"object","properties":{"detail":{"description":"Resource not found message.","type":"string","default":"Alert not found."}}}}}},"500":{"description":"Internal server error - an unexpected error occurred. Please try again later or contact support if the issue persists.","content":{"application/json":{"schema":{"type":"object","properties":{"detail":{"description":"Internal server error message.","type":"string","default":"An unexpected error occurred while processing the request."}}}}}}}}}}}
````
## Alert Activity Log
> Returns the change history for a monitoring alert. Each entry records which field changed, its old and new values, and who made the change.\
> \
> \*\*Cross-account protection:\*\* The alert must belong to the account behind the caller's Client-ID.\
> \
> For \`risk\_id\` and \`status\_id\` fields, the \`field\_value\` and \`old\_value\` are resolved to \`{id, name}\` objects. For other fields (e.g. \`comments\`), they are plain text.\
> \
> \### Response fields (per entry)\
> \
> \| Field | Type | Description |\
> \|-------|------|-------------|\
> \| \`id\` | integer | History entry identifier |\
> \| \`alert\_id\` | string | Alert identifier |\
> \| \`field\_name\` | string | Name of the changed field |\
> \| \`field\_value\` | object or string | New value |\
> \| \`old\_value\` | object or string / null | Previous value |\
> \| \`date\_created\` | string (ISO 8601) | When the change was recorded |\
> \| \`user\` | object / null | \`{id, name, email}\` of the user who made the change |
```json
{"openapi":"3.1.0","info":{"title":"Vcheck Global API","version":"5.4.0"},"tags":[{"name":"Monitoring Alert Actions","description":"Update alert risk/status/comments, escalate alerts, view activity logs, and look up valid risk levels and statuses."}],"servers":[{"url":"https://api-platform.vcheckglobal.net/v2","description":"Vcheck platform (sandbox host issued first; production host after sign-off)"}],"security":[{"bearerAuth":[]}],"components":{"securitySchemes":{"bearerAuth":{"type":"http","scheme":"bearer","bearerFormat":"JWT","description":"Obtain a token via POST https://api-platform.vcheckglobal.net/v2/oauth2/token.\nInclude in all subsequent requests as `Authorization: Bearer `.\nTokens expire after 3,600 seconds - cache and reuse; request a new one only when close to expiry.\n"}}},"paths":{"/monitoring/alerts/{alert_id}/activity-log":{"get":{"tags":["Monitoring Alert Actions"],"operationId":"getAlertActivityLog","summary":"Alert Activity Log","description":"Returns the change history for a monitoring alert. Each entry records which field changed, its old and new values, and who made the change.\n\n**Cross-account protection:** The alert must belong to the account behind the caller's Client-ID.\n\nFor `risk_id` and `status_id` fields, the `field_value` and `old_value` are resolved to `{id, name}` objects. For other fields (e.g. `comments`), they are plain text.\n\n### Response fields (per entry)\n\n| Field | Type | Description |\n|-------|------|-------------|\n| `id` | integer | History entry identifier |\n| `alert_id` | string | Alert identifier |\n| `field_name` | string | Name of the changed field |\n| `field_value` | object or string | New value |\n| `old_value` | object or string / null | Previous value |\n| `date_created` | string (ISO 8601) | When the change was recorded |\n| `user` | object / null | `{id, name, email}` of the user who made the change |\n","parameters":[{"name":"alert_id","in":"path","required":true,"description":"Unique monitoring alert identifier.","schema":{"type":"integer"}},{"name":"page","in":"query","required":false,"description":"Page number to retrieve (1-indexed, default: 1). Each page returns up to 50 records.","schema":{"type":"integer"}}],"responses":{"200":{"description":"Activity log retrieved successfully.","content":{"application/json":{"schema":{"type":"object","properties":{"count":{"description":"Total number of records across all pages.","type":"integer"},"next":{"description":"Full URL to the next page. null on the last page.","type":["string","null"]},"previous":{"description":"Full URL to the previous page. null on the first page.","type":["string","null"]},"results":{"description":"Array of records for the current page (max 50).","type":"array","items":{"type":"object","properties":{"change_id":{"description":"Change history entry identifier.","type":"integer"},"alert_id":{"description":"Alert identifier.","type":"string"},"field_name":{"description":"Field that changed.","type":"string"},"field_value":{"description":"New value - object with id/name for risk_id/status_id, plain text for others.","type":"string"},"old_value":{"description":"Previous value - object with id/name for risk_id/status_id, plain text for others.","type":"string"},"date_created":{"description":"When the change was recorded (ISO 8601).","type":"string","format":"date-time"},"user":{"description":"User who made the change.","type":["object","null"],"properties":{"id":{"type":"integer"},"name":{"type":"string"},"email":{"type":"string"}}}}}}}}}}},"403":{"description":"Forbidden - missing or invalid Client-ID credentials, insufficient scope, endpoint disabled via feature flag, or authenticated client has no linked account. Verify the scopes assigned to your credentials.","content":{"application/json":{"schema":{"type":"object","properties":{"detail":{"description":"Authorization or access error message.","type":"string","default":"This endpoint is currently disabled."}}}}}},"404":{"description":"Not found - alert does not exist or does not belong to the authenticated account.","content":{"application/json":{"schema":{"type":"object","properties":{"detail":{"description":"Resource not found message.","type":"string","default":"Alert not found."}}}}}},"500":{"description":"Internal server error - an unexpected error occurred. Please try again later or contact support if the issue persists.","content":{"application/json":{"schema":{"type":"object","properties":{"detail":{"description":"Internal server error message.","type":"string","default":"An unexpected error occurred while processing the request."}}}}}}}}}}}
```
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://docs.vcheckglobal.com/api-reference/monitoring/monitoring-alert-actions.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.