CentralCSP
APIAlerts

Get an alert

Returns one alert with what it found, each finding linked to its evidence in the dashboard, and its delivery to each channel of the rule. A delivery's eventId names the alert it carried. Alerts are kept 90 days: an id from before that answers 410 alert_event_expired, and any other id this website has no alert for answers 404 alert_event_not_found.

Requires the viewer role on the website and the alerting plan feature.

GET
/v1/workspaces/{workspaceId}/websites/{websiteId}/alerts/events/{eventId}

Authorization

headerAuthorizationBearer <JWT>

An OpenID Connect access token from signing in to CentralCSP, acting as the signed-in user.

Path Parameters

workspaceId*string

The workspace's id.

websiteId*string

The website's id.

eventId*string

The alert's id, the eventId of its deliveries.

Response Body

One alert with its findings and its delivery to each channel.

application/json
  1. response
id*string

The alert's id.

ruleId*|

The rule that fired. null when the rule has since been deleted.

ruleName*|

The rule's name at the time, kept after the rule is deleted.

eventType*AlertEventType

What to notify about.

  • csp-violation:new-type: a new CSP directive and blocked origin pair appears in the reports.
  • csp-hash:new-script-origin: a script loads from a new origin.
  • network-error:new-failing-origin: a new origin starts failing network requests.
  • coop:new-violation, coep:new-violation: a new COOP or COEP violation type appears.
  • permissions-policy:new-violation: a new Permissions Policy violation appears.
  • deprecation:new-api: a deprecated API is reported for the first time.
  • intervention:new-type: a browser intervention is reported for the first time.
  • connection-allowlist:new-blocked-origin: a new blocked connection origin appears.
  • compliance:new-script: a script never seen before runs on a payment page and no reviewer or inventory rule has justified it yet.
  • compliance:script-changed: a payment-page script serves different content and no reviewer or inventory rule has justified the new content yet.
  • csp-violation:spike, integrity-violation:spike, network-error:spike, crash:spike: an hour's report count reaches at least 50 and 3 times the hourly average of the previous 24 hours. Both thresholds are adjustable with config.
  • sbom:new-cve: a technology on the website gains a known vulnerability at or above the rule's minimum severity.
  • sbom:version-status: a technology is detected with, or moves to, one of the rule's statuses.
  • sbom:new-technology: the website starts loading a technology, or a version of one, it did not load before.
Value in"csp-violation:new-type""csp-violation:spike""csp-hash:new-script-origin""integrity-violation:spike""compliance:new-script""compliance:script-changed""network-error:new-failing-origin""network-error:spike""crash:spike""coop:new-violation""coep:new-violation""permissions-policy:new-violation""deprecation:new-api""intervention:new-type""connection-allowlist:new-blocked-origin""sbom:new-cve""sbom:version-status""sbom:new-technology"
status*AlertEventStatus

pending is still collecting findings until the rule's cooldown lets it go out, dispatched was handed to the rule's channels.

Value in"pending""dispatched"
findingsCount*|

How many findings the alert holds in total, including any left out of findings.

windowStart*string

Start of the period the findings were collected over.

Formatdate-time
windowEnd*string

End of that period.

Formatdate-time
createdAt*string

When the first finding was collected.

Formatdate-time
dispatchedAt*|

When it went out to the channels, null while pending.

findings*array<||||||||||||||>

What the rule found, in the shape the webhook posts them, with the words the alert used: 10 findings at most, each alert holding its own. findingsCount is larger only when a burst went past what one sweep sends, and counts the rest too.

deliveries*array<>

The alert's delivery to each channel of the rule, newest first. Empty while it is pending.

Example Request
curl -X GET 'https://api.centralcsp.com/v1/workspaces/01936b7a-6f2e-7c31-9a4d-2f8e1c5b7d90/websites/01936b7a-6f2e-7c31-9a4d-2f8e1c5b7d90/alerts/events/01936b7a-6f2e-7c31-9a4d-2f8e1c5b7d90'
Example Response
{  "id": "string",  "ruleId": "string",  "ruleName": "New third-party script",  "eventType": "csp-violation:new-type",  "status": "pending",  "findingsCount": 3,  "windowStart": "2019-08-24T14:15:22Z",  "windowEnd": "2019-08-24T14:15:22Z",  "createdAt": "2019-08-24T14:15:22Z",  "dispatchedAt": "2019-08-24T14:15:22Z",  "findings": [    {      "kind": "csp-violation:new-type",      "key": "string",      "effectiveDirective": "script-src-elem",      "blockedUrlOrigin": "https://cdn.example.net",      "disposition": "enforce",      "blockedCount": 12,      "reportedCount": 0,      "firstPage": "https://shop.example.com/checkout",      "exampleBlockedUrl": "https://cdn.example.net/widget.js",      "firstSeen": "2026-09-14T08:49:32.000Z",      "count": 12,      "url": "https://app.centralcsp.com/0198e0d4-0000-7000-8000-000000000001/websites/0198e0d4-2a1b-7c3d-8e4f-5a6b7c8d9e0f/reports/csp-hash/scripts?key=eyJzdWJyZXNvdXJjZU9yaWdpbiI6Imh0dHBzOi8vY2RuLmV4YW1wbGUubmV0In0&range=30d",      "label": "https://cdn.example.net",      "facts": [        "script-src-elem",        "Mode: 4 blocked",        "Reports: 4"      ]    }  ],  "deliveries": [    {      "id": "string",      "eventId": "string",      "ruleId": "string",      "ruleName": "New third-party script",      "eventType": "csp-hash:new-script-origin",      "channelId": "string",      "channelType": "slack",      "channelName": "string",      "status": "pending",      "attempts": 0,      "responseStatus": 0,      "error": "string",      "createdAt": "2019-08-24T14:15:22Z",      "completedAt": "2019-08-24T14:15:22Z"    }  ]}

List alerts GET

Lists the alerts this website's rules raised, newest first. A pending alert is still collecting findings until its rule's cooldown lets it go out.

List API keys GET

Lists the workspace's API keys with who created each one, when it expires, and when it was last used. The secret itself is never returned.