> ## Documentation Index > Fetch the complete documentation index at: https://docs.superlog.sh/llms.txt > Use this file to discover all available pages before exploring further. # Preview an alert rule > Reads the current window of a draft rule without saving it, and returns each group's value and whether it is past the threshold, those past it first. Use it to choose a threshold. ## OpenAPI ````yaml /api-reference/openapi.json post /alerts/preview openapi: 3.1.0 info: description: >- Manage a Superlog workspace's automations, runs, tag mode, model access, and secrets, read its telemetry, build dashboards and alerts over it, run synthetic checks, and export them to Terraform. Every request acts as the member who created the API key. title: Superlog management API version: 1.0.0 servers: - url: https://superlog.sh/api/v1 security: - bearerAuth: [] tags: - description: Connected integrations and the IDs automations and tag mode use. name: Integrations - description: The workspace and its members. name: Workspace - description: Keys that authenticate the management API and MCP server. name: API keys - description: Create and change automations. name: Automations - description: Start, follow, and cancel automation runs. name: Runs - description: What Superlog can use and change when someone mentions it in Slack. name: Tag mode - description: Model API keys, subscriptions, and available models. name: Models - description: Credentials agents can use without seeing them. name: Secrets - description: Read the workspace's logs, traces, and metrics. name: Telemetry - description: >- Exceptions in the workspace's telemetry, grouped into issues by fingerprint. name: Errors - description: Create and change dashboards over the workspace's telemetry. name: Dashboards - description: Threshold alerts on the workspace's telemetry that post to Slack. name: Alerts - description: HTTP checks that request a URL on a schedule and post failures to Slack. name: Synthetics - description: Configuration for the superloglabs/superlog Terraform provider. name: Terraform paths: /alerts/preview: post: tags: - Alerts summary: Preview an alert rule description: >- Reads the current window of a draft rule without saving it, and returns each group's value and whether it is past the threshold, those past it first. Use it to choose a threshold. operationId: preview_alert requestBody: content: application/json: schema: type: object properties: aggregation: type: string enum: - count - count_distinct - sum - avg - min - max - p50 - p90 - p95 - p99 description: >- `count` counts matching logs or spans; other aggregations read `field`. Metrics use `sum` or `avg`. comparator: type: string enum: - gt - lt description: >- `gt` fires when the value is above `threshold`, `lt` when it is below. field: anyOf: - type: string maxLength: 200 - type: 'null' description: >- What a log or span aggregation other than `count` reads: `duration`, an attribute key, or an AI usage field such as `ai:cost`. filter: type: object properties: metricKind: type: string enum: - gauge - sum - histogram - exponential_histogram - summary metricUnit: type: string maxLength: 100 minDurationMs: type: number minimum: 0 maximum: 3600000 resourceAttrs: maxItems: 50 type: array items: type: object properties: key: type: string minLength: 1 maxLength: 200 op: type: string enum: - eq - neq - not_contains value: type: string maxLength: 500 required: - key - value service: type: string maxLength: 200 severity: type: string maxLength: 50 spanName: type: string maxLength: 200 statusCode: type: string maxLength: 50 description: >- Narrows the data the alert reads. `resourceAttrs` keys may start with `resource.`, `span.`, `log.`, or `field.`; a bare key is a resource attribute. `service`, `severity`, `spanName`, `statusCode`, and `minDurationMs` match those fields of a log or span. groupBy: anyOf: - type: string maxLength: 200 - type: 'null' description: >- The attribute key to split by when `groupMode` is `per_group`, such as `service.name`. groupMode: description: >- `single` checks one total. `per_group` checks each `groupBy` value and fires for each one separately. Defaults to `single`. type: string enum: - single - per_group metricName: anyOf: - type: string maxLength: 200 - type: 'null' description: The metric to read when `source` is `metric`. source: type: string enum: - logs - traces - metric description: '`logs`, `traces` (spans), or `metric`.' threshold: type: number windowMinutes: description: How many minutes of data each check reads. Defaults to 5. type: integer minimum: 1 maximum: 1440 required: - aggregation - comparator - source - threshold required: true responses: '200': content: application/json: schema: type: object properties: evaluations: type: array items: type: object properties: breaching: type: boolean groupKey: type: string value: type: number required: - breaching - groupKey - value additionalProperties: false description: >- At most 50 groups. Empty when a rule other than a count, distinct count, or sum has no data in the window. required: - evaluations additionalProperties: false description: OK '400': content: application/json: schema: $ref: '#/components/schemas/Error' description: The request is invalid. `issues` lists each invalid field. '401': content: application/json: schema: $ref: '#/components/schemas/Error' description: The API key is missing, revoked, or its creator left the workspace. '404': content: application/json: schema: $ref: '#/components/schemas/Error' description: >- The resource does not exist in this workspace, or the feature it belongs to is not enabled. security: - bearerAuth: [] components: schemas: Error: type: object properties: code: description: A stable machine-readable error code, when there is one. type: string error: type: string description: What went wrong. issues: description: Validation problems, one per invalid field. type: array items: type: object properties: message: type: string path: type: array items: anyOf: - type: string - type: number required: - message - path additionalProperties: false required: - error additionalProperties: false securitySchemes: bearerAuth: description: A workspace API key, created in Superlog under Settings → API keys. scheme: bearer type: http ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.