> ## Documentation Index
> Fetch the complete documentation index at: https://docs.orq.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# List alert trigger events

> Returns the evaluation events recorded while a trigger was open, newest first. Each event carries the observed value and, when available, exemplar traces that contributed to the breach.



## OpenAPI

````yaml get /v2/alerts/{alert_id}/triggers/{trigger_id}/events
openapi: 3.1.0
info:
  title: orq.ai API
  version: '2.0'
  description: orq.ai API documentation
servers:
  - url: https://api.orq.ai
security:
  - ApiKey: []
tags:
  - description: List models available through the AI Router.
    name: Models
  - name: Guardrail Rules
  - name: Policies
  - name: Routing Rules
  - name: Activities
    description: Activity timeline entries for comments and entity versions.
  - name: Alerts
    description: >-
      Alerts evaluate a Reporting API metric on a fixed interval and fire
      notifications through notifiers when the value breaches a threshold. Each
      breach opens a trigger that tracks the incident until the value recovers.
  - name: API keys
    description: >-
      API keys authenticate programmatic access to the workspace. The unified
      key model exposes opaque tokens, per-domain access grants, and budget /
      rate-limit constraints (see ADR 0001 and ADR 0002).
  - name: Budgets
    description: >-
      Budgets govern spend, token usage, and request rate across six scopes:
      workspace, project, identity, api-key, provider, and model. A budget is
      hierarchical and defense-in-depth — every applicable budget is a hard
      gate, and the most restrictive one wins per dimension (see ADR 0007).
  - name: Documentation
    description: >-
      Search the orq.ai documentation. Proxies the workspace's query to the
      hosted docs search index.
  - name: FeaturePreviews
    description: >-
      Internal: list and toggle per-user feature previews (beta features users
      can opt into).
  - name: Files
    description: File upload and retrieval operations.
  - name: Finder
    description: >-
      Finder entities back the studio navigation tree, project switcher, and
      cross-project resource references.
  - name: Identities
    description: >-
      Identities represent end users from your system for usage and engagement
      tracking.
  - name: Management keys
    description: >-
      Management keys are workspace-scoped credentials that authenticate
      programmatic access to workspace administration surfaces (API keys,
      budgets). Unlike project-scoped API keys, a management key always operates
      at the workspace level.
  - name: MCP Gateway
    description: >-
      Manage upstream MCP servers and client-facing MCP gateways. Create server
      connections, discover tools, assemble gateways, and review call logs.
  - name: Model Sharing
    description: >-
      Model sharing controls which projects a workspace model is available to.
      Workspace admins configure a model's Sharing (all projects / selected
      projects); the config ships inline on the models list response, so there
      is no separate read endpoint.
  - name: Notifiers
    description: Notifier destinations used to send delivery and workflow notifications.
  - name: People
    description: >-
      People are workspace members and invited users. Manage roles, groups, and
      invitations for your team.
  - name: Projects
    description: Projects organize resources within a workspace
  - name: Skills
    description: >-
      Skills are modular instructions you can use to codify processes and
      conventions
  - name: Smart Routers
    description: >-
      Smart Routers distribute an ordered pool of eligible language models
      across V2 routing bands.
  - name: Webhooks
    description: >-
      Create and manage webhooks that deliver workspace events to external HTTPS
      endpoints.
  - name: Workspace Settings
    description: >-
      Workspace-level settings managed with a workspace credential. A workspace
      is the tenant, so these settings are a singleton — there is nothing to
      create or delete, only read and update.
  - name: Responses
  - description: >-
      Run agents on a cadence — cron, interval, or one-off. Minimum firing
      interval is 1 hour.
    name: Agent Schedules
  - name: Embeddings
  - name: Logs
    description: >-
      OpenTelemetry log query API. Search, filter, aggregate, and facet log
      records ingested via OTLP.
  - name: Reporting
    description: >-
      GenAI reporting API over canonical analytics rollups. Accepts a metric
      name, time range, grain, group-by, and filters; returns a typed time
      series and optional totals.
  - name: Traces
    description: >-
      Query and inspect ingested trace data: search trace summaries, aggregate
      metrics, and read individual traces and their spans.
externalDocs:
  url: https://docs.orq.ai
  description: orq.ai Documentation
paths:
  /v2/alerts/{alert_id}/triggers/{trigger_id}/events:
    get:
      tags:
        - Alerts
      summary: List alert trigger events
      description: >-
        Returns the evaluation events recorded while a trigger was open, newest
        first. Each event carries the observed value and, when available,
        exemplar traces that contributed to the breach.
      operationId: AlertListTriggerEvents
      parameters:
        - name: alert_id
          in: path
          description: Alert the trigger belongs to.
          required: true
          schema:
            type: string
        - name: trigger_id
          in: path
          description: Trigger whose events to list.
          required: true
          schema:
            type: string
        - name: limit
          in: query
          description: Page size, 1-200. Unset uses the server default (25).
          schema:
            type: integer
            format: int32
        - name: starting_after
          in: query
          description: |-
            Cursor for forward pagination. Set to the `event_id` of the last
             item from the previous page.
          schema:
            type: string
        - name: ending_before
          in: query
          description: |-
            Cursor for backward pagination. Set to the `event_id` of the first
             item from the previous page.
          schema:
            type: string
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ListAlertTriggerEventsResponse'
components:
  schemas:
    ListAlertTriggerEventsResponse:
      required:
        - object
        - data
        - has_more
      type: object
      properties:
        object:
          type: string
          description: Object discriminator for list responses; always `list`.
        data:
          type: array
          items:
            $ref: '#/components/schemas/AlertTriggerEvent'
          description: Page of events, ordered newest first.
        has_more:
          type: boolean
          description: |-
            Whether more events are available in the selected pagination
             direction.
    AlertTriggerEvent:
      required:
        - event_id
        - trigger_id
        - alert_id
        - at
        - value
      type: object
      properties:
        event_id:
          type: string
          description: Unique event identifier, for example `alertevent_01H...`.
        trigger_id:
          type: string
          description: Trigger the event was recorded on.
        alert_id:
          type: string
          description: Alert the event belongs to.
        at:
          type: string
          description: Time of the evaluation tick.
          format: date-time
        value:
          type: number
          description: Observed metric value at the tick.
          format: double
        evidence:
          type: array
          items:
            $ref: '#/components/schemas/AlertEvidence'
          description: Exemplar traces that contributed to the breach, worst first.
    AlertEvidence:
      required:
        - trace_id
        - span_id
        - start_time
        - value
      type: object
      properties:
        trace_id:
          type: string
          description: Trace the exemplar span belongs to.
        span_id:
          type: string
          description: Exemplar span ID.
        start_time:
          type: string
          description: Start time of the exemplar span.
          format: date-time
        value:
          type: number
          description: Metric contribution of the exemplar (e.g. cost or duration).
          format: double
  securitySchemes:
    ApiKey:
      type: http
      scheme: bearer
      bearerFormat: JWT

````