> ## Documentation Index > Fetch the complete documentation index at: https://docs.superlog.sh/llms.txt > Use this file to discover all available pages before exploring further. # Change an alert > Changes the fields you send and keeps the rest. `filter` replaces the whole filter. Changing what the alert reads or its threshold, or disabling it, ends its open activations without posting a recovery; the next check opens new ones where the value is still past the threshold. ## OpenAPI ````yaml /api-reference/openapi.json patch /alerts/{alertId} openapi: 3.1.0 info: description: >- Manage a Superlog workspace's automations, runs, tag mode, model access, and secrets, read its telemetry, build dashboards and alerts over it, run synthetic checks, and export them to Terraform. Every request acts as the member who created the API key. title: Superlog management API version: 1.0.0 servers: - url: https://superlog.sh/api/v1 security: - bearerAuth: [] tags: - description: Connected integrations and the IDs automations and tag mode use. name: Integrations - description: The workspace and its members. name: Workspace - description: Keys that authenticate the management API and MCP server. name: API keys - description: Create and change automations. name: Automations - description: Start, follow, and cancel automation runs. name: Runs - description: What Superlog can use and change when someone mentions it in Slack. name: Tag mode - description: Model API keys, subscriptions, and available models. name: Models - description: Credentials agents can use without seeing them. name: Secrets - description: Read the workspace's logs, traces, and metrics. name: Telemetry - description: >- Exceptions in the workspace's telemetry, grouped into issues by fingerprint. name: Errors - description: Create and change dashboards over the workspace's telemetry. name: Dashboards - description: Threshold alerts on the workspace's telemetry that post to Slack. name: Alerts - description: HTTP checks that request a URL on a schedule and post failures to Slack. name: Synthetics - description: Configuration for the superloglabs/superlog Terraform provider. name: Terraform paths: /alerts/{alertId}: patch: tags: - Alerts summary: Change an alert description: >- Changes the fields you send and keeps the rest. `filter` replaces the whole filter. Changing what the alert reads or its threshold, or disabling it, ends its open activations without posting a recovery; the next check opens new ones where the value is still past the threshold. operationId: update_alert parameters: - description: Alert ID. in: path name: alertId required: true schema: type: string format: uuid description: Alert ID. requestBody: content: application/json: schema: type: object properties: aggregation: type: string enum: - count - count_distinct - sum - avg - min - max - p50 - p90 - p95 - p99 description: >- `count` counts matching logs or spans; other aggregations read `field`. Metrics use `sum` or `avg`. comparator: type: string enum: - gt - lt description: >- `gt` fires when the value is above `threshold`, `lt` when it is below. field: anyOf: - type: string maxLength: 200 - type: 'null' description: >- What a log or span aggregation other than `count` reads: `duration`, an attribute key, or an AI usage field such as `ai:cost`. filter: type: object properties: metricKind: type: string enum: - gauge - sum - histogram - exponential_histogram - summary metricUnit: type: string maxLength: 100 minDurationMs: type: number minimum: 0 maximum: 3600000 resourceAttrs: maxItems: 50 type: array items: type: object properties: key: type: string minLength: 1 maxLength: 200 op: type: string enum: - eq - neq - not_contains value: type: string maxLength: 500 required: - key - value service: type: string maxLength: 200 severity: type: string maxLength: 50 spanName: type: string maxLength: 200 statusCode: type: string maxLength: 50 description: >- Narrows the data the alert reads. `resourceAttrs` keys may start with `resource.`, `span.`, `log.`, or `field.`; a bare key is a resource attribute. `service`, `severity`, `spanName`, `statusCode`, and `minDurationMs` match those fields of a log or span. groupBy: anyOf: - type: string maxLength: 200 - type: 'null' description: >- The attribute key to split by when `groupMode` is `per_group`, such as `service.name`. groupMode: type: string enum: - single - per_group description: >- `single` checks one total. `per_group` checks each `groupBy` value and fires for each one separately. metricName: anyOf: - type: string maxLength: 200 - type: 'null' description: The metric to read when `source` is `metric`. source: type: string enum: - logs - traces - metric description: '`logs`, `traces` (spans), or `metric`.' threshold: type: number windowMinutes: type: integer minimum: 1 maximum: 1440 description: How many minutes of data each check reads. enabled: type: boolean description: A disabled alert is not checked. evaluationIntervalSeconds: type: integer minimum: 60 maximum: 3600 description: How often the alert is checked. name: type: string minLength: 1 maxLength: 200 slack: anyOf: - type: object properties: channelId: type: string minLength: 1 maxLength: 64 description: >- The Slack channel ID: the `externalId` of a `slack_channel` resource. integrationAccountId: type: string format: uuid description: >- The ID of the Slack integration the channel belongs to. required: - channelId - integrationAccountId - type: 'null' description: >- Where firing and recovery messages are posted. Without a channel the alert only records its activations. required: false responses: '200': content: application/json: schema: type: object properties: alert: type: object properties: aggregation: type: string enum: - count - count_distinct - sum - avg - min - max - p50 - p90 - p95 - p99 description: >- `count` counts matching logs or spans; other aggregations read `field`. Metrics use `sum` or `avg`. comparator: type: string enum: - gt - lt description: >- `gt` fires when the value is above `threshold`, `lt` when it is below. field: anyOf: - type: string maxLength: 200 - type: 'null' description: >- What a log or span aggregation other than `count` reads: `duration`, an attribute key, or an AI usage field such as `ai:cost`. filter: type: object properties: metricKind: type: string enum: - gauge - sum - histogram - exponential_histogram - summary metricUnit: type: string maxLength: 100 minDurationMs: type: number minimum: 0 maximum: 3600000 resourceAttrs: maxItems: 50 type: array items: type: object properties: key: type: string minLength: 1 maxLength: 200 op: type: string enum: - eq - neq - not_contains value: type: string maxLength: 500 required: - key - value additionalProperties: false service: type: string maxLength: 200 severity: type: string maxLength: 50 spanName: type: string maxLength: 200 statusCode: type: string maxLength: 50 additionalProperties: false description: >- Narrows the data the alert reads. `resourceAttrs` keys may start with `resource.`, `span.`, `log.`, or `field.`; a bare key is a resource attribute. `service`, `severity`, `spanName`, `statusCode`, and `minDurationMs` match those fields of a log or span. groupBy: anyOf: - type: string maxLength: 200 - type: 'null' description: >- The attribute key to split by when `groupMode` is `per_group`, such as `service.name`. groupMode: type: string enum: - single - per_group description: >- `single` checks one total. `per_group` checks each `groupBy` value and fires for each one separately. metricName: anyOf: - type: string maxLength: 200 - type: 'null' description: The metric to read when `source` is `metric`. source: type: string enum: - logs - traces - metric description: '`logs`, `traces` (spans), or `metric`.' threshold: type: number windowMinutes: type: integer minimum: 1 maximum: 1440 description: How many minutes of data each check reads. createdAt: type: string enabled: type: boolean evaluationIntervalSeconds: type: integer id: type: string format: uuid description: Alert ID. lastError: anyOf: - type: string - type: 'null' description: Why the last check failed, if it did. lastEvaluatedAt: anyOf: - type: string - type: 'null' name: type: string slack: anyOf: - type: object properties: channelId: type: string integrationAccountId: type: string required: - channelId - integrationAccountId additionalProperties: false - type: 'null' updatedAt: type: string url: type: string format: uri description: The alert in Superlog. required: - aggregation - comparator - field - filter - groupBy - groupMode - metricName - source - threshold - windowMinutes - createdAt - enabled - evaluationIntervalSeconds - id - lastError - lastEvaluatedAt - name - slack - updatedAt - url additionalProperties: false required: - alert additionalProperties: false description: OK '400': content: application/json: schema: $ref: '#/components/schemas/Error' description: The request is invalid. `issues` lists each invalid field. '401': content: application/json: schema: $ref: '#/components/schemas/Error' description: The API key is missing, revoked, or its creator left the workspace. '404': content: application/json: schema: $ref: '#/components/schemas/Error' description: >- The resource does not exist in this workspace, or the feature it belongs to is not enabled. '409': content: application/json: schema: $ref: '#/components/schemas/Error' description: >- The request conflicts with the current state, such as a name already in use. security: - bearerAuth: [] components: schemas: Error: type: object properties: code: description: A stable machine-readable error code, when there is one. type: string error: type: string description: What went wrong. issues: description: Validation problems, one per invalid field. type: array items: type: object properties: message: type: string path: type: array items: anyOf: - type: string - type: number required: - message - path additionalProperties: false required: - error additionalProperties: false securitySchemes: bearerAuth: description: A workspace API key, created in Superlog under Settings → API keys. scheme: bearer type: http ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.