> ## Documentation Index
> Fetch the complete documentation index at: https://syteca.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# List Alerts

> Syteca Data Connector REST API endpoint returning alert events with full details — alert name, user, Client, triggering activity, and a deep-link into the Session Viewer. Paginated.

Returns alert events that have occurred when alerts were triggered — with full details for each event including what activity caused the trigger and a deep-link into the Session Viewer to review the recording. **Paginated** with up to 1000 events per request.

```http theme={"system"}
GET https://<hostname>/ekranapi/alerts
```

## Authentication

<ParamField header="ApiKey" type="string" required>
  Your Active API Key from the Management Tool.
</ParamField>

## Query parameters

<ParamField query="start" type="string">
  Alert events that occurred **after this time** are included.

  Accepted formats: `2021-04-01`, `2021-04-01T12:00`, `2021-04-01T12:00:00`.
</ParamField>

<ParamField query="end" type="string">
  Alert events that occurred **before this time** are included.
</ParamField>

<ParamField query="alertCount" type="int" default="1000">
  Number of alert events to return per request.

  Default: `1000`. Maximum: `1000`.
</ParamField>

<ParamField query="afterActivityId" type="int">
  Cursor for pagination — the ID after which to start returning records. Use the `afterActivityId` from a previous response to fetch the next batch.
</ParamField>

<Warning>
  Requesting more than 1000 alert events (`alertCount > 1000`) returns **HTTP 400 Bad Request**.
</Warning>

<Note>
  If both `start` and `end` are omitted, all alert events in the database are returned (subject to pagination).
</Note>

## Response (200 OK)

<ResponseField name="afterActivityId" type="int">
  The ID of the first alert event in the batch. Use this value as the `afterActivityId` parameter in the next request to fetch the following 1000 events.
</ResponseField>

<ResponseField name="alerts" type="array">
  Array of alert event objects:

  <Expandable title="Alert event">
    <ResponseField name="alertId" type="int">
      The ID of the alert (i.e. the alert rule that was triggered).
    </ResponseField>

    <ResponseField name="activityId" type="int">
      The ID of the alert event itself (i.e. the specific occurrence when the alert was triggered).
    </ResponseField>

    <ResponseField name="date" type="date">
      When the alert was triggered.
    </ResponseField>

    <ResponseField name="alertName" type="string">
      The name of the alert.
    </ResponseField>

    <ResponseField name="alertDescription" type="string">
      The alert description (typically describes the condition that triggers it).
    </ResponseField>

    <ResponseField name="userName" type="string">
      The user name of the user that triggered the alert.
    </ResponseField>

    <ResponseField name="clientName" type="string">
      The name of the Client computer where the alert was triggered.
    </ResponseField>

    <ResponseField name="what" type="string">
      What user activity caused the alert to fire — e.g. keystroke text, URL, window title, application name.
    </ResponseField>

    <ResponseField name="playerLink" type="string">
      A direct link to open the session in the Session Viewer **at the moment the alert was triggered**. Format: `https://<management-tool-host>/EkranSystem/Player?id=<sessionId>&startSlideId=<activityId>&play=false&mode=0`.
    </ResponseField>
  </Expandable>
</ResponseField>

<Warning>
  The `playerLink` field contains a legacy URL with `/EkranSystem/Player?...` — this is the literal current Session Viewer URL preserved verbatim in the API response. Use it exactly as returned by the API.
</Warning>

## Example

<RequestExample>
  ```bash cURL theme={"system"}
  curl -X GET "https://<hostname>/ekranapi/alerts?start=2022-09-01&end=2022-09-30&alertCount=1000" \
    -H "ApiKey: xJ)tsCNcpj)l+]}(@_|lt!t………"
  ```
</RequestExample>

<ResponseExample>
  ```json 200 OK theme={"system"}
  {
    "afterActivityId": 20223,
    "alerts": [
      {
        "alertId": 88,
        "activityId": 29,
        "date": "2022-09-05T12:33:32.548",
        "alertName": "application alert",
        "alertDescription": "check application equal cmd",
        "userName": "WINDEV2106EVAL\\User",
        "clientName": "WinDev2106Eval",
        "what": "Command Prompt - cmd.exe - cmd",
        "playerLink": "https://localhost/EkranSystem/Player?id=5&startSlideId=29&play=false&mode=0"
      },
      {
        "alertId": 91,
        "activityId": 20223,
        "date": "2022-09-19T16:11:24.356",
        "alertName": "username alert",
        "alertDescription": "check username equal WINDEV2106EVAL\\User",
        "userName": "WINDEV2106EVAL\\User",
        "clientName": "WinDev2106Eval",
        "what": "explorer.exe",
        "playerLink": "https://localhost/EkranSystem/Player?id=1013&startSlideId=20223&play=false&mode=0"
      }
    ]
  }
  ```
</ResponseExample>

<Tip>
  **Pagination loop**: call the endpoint with `alertCount=1000` and no `afterActivityId`. From the response, take `afterActivityId` and pass it as the parameter in the next call. Continue until the response contains fewer than 1000 alerts — that's the last page.
</Tip>

## Errors

See [Status codes](/docs/api/data-connector/api-reference#status-codes). Common errors:

* **400 Bad Request** — invalid time format, or `alertCount > 1000`.
* **403 Forbidden** — Data Connector not registered.

## Related

<CardGroup cols={2}>
  <Card title="Alerts (Management Tool)" icon="bell" href="/docs/session-monitoring/alerts">
    The Alerts UI for the rules that produce these events.
  </Card>

  <Card title="Alert events tab" icon="bell-dot" href="/docs/session-monitoring/alerts-events">
    The Management Tool's view of the same alert events.
  </Card>

  <Card title="List sessions with productivity" icon="bar-chart-3" href="/docs/api/data-connector/endpoints/post-sessions">
    Sessions during which alerts fired.
  </Card>

  <Card title="API reference" icon="square-code" href="/docs/api/data-connector/api-reference">
    Base URL, authentication, status codes.
  </Card>
</CardGroup>