> ## Documentation Index > Fetch the complete documentation index at: https://docs.cotool.ai/llms.txt > Use this file to discover all available pages before exploring further. # Get alert triage routes > Return the ordered routes that choose which agent triages a new alert, with the organization default for alerts no route matches and the agent for Hunt Alerts, which skip both. ## OpenAPI ````yaml https://app.cotool.ai/api/docs/openapi.json get /api/alert-triage-routes openapi: 3.1.0 info: title: Cotool API version: 1.0.0 description: >- The Cotool REST API. Authenticate with an API key from `/settings/api-keys` sent as `Authorization: Bearer `. Authentication, error formats, pagination, and common integration recipes are documented in the [API overview](https://docs.cotool.ai/api-reference/introduction). Endpoints marked **Deprecated** keep working; each one's description names its replacement. servers: - url: https://app.cotool.ai description: Production server security: - ApiKeyAuth: [] tags: - name: Agents description: Create, update, run, and version agents. - name: Agent Runs description: Inspect agent runs, submit feedback, and read evaluation metrics. - name: Agent Triggers description: Webhook, schedule, and integration triggers that start agent runs. - name: Agents as Code description: Validate agents and skills defined as YAML in a Git repository. - name: Skills description: Reusable instructions and tool grants attached to agents. - name: Chat description: Chat sessions and their transcripts. - name: Alerts description: Alert triage, routing, and escalation notifications. - name: Output Destinations description: Webhook, Slack, Jira, and Linear destinations for agent output. - name: Detections description: Detection agents, detection hits, and the Cotool detection library. - name: Hunt description: Autonomous hunt threats, gaps, and settings. - name: Intel description: Threat-intelligence feed items, indicators, and sources. - name: Threat Model description: The organization threat model and its version history. - name: MITRE Coverage description: MITRE ATT&CK coverage across detections. - name: Tools description: Connected tool integrations and captured tool output. - name: CLIs description: Connected CLI integrations. - name: Artifacts description: Files and reports produced by agent runs. - name: Audit Logs description: Organization audit log export and event catalog. - name: Users description: Users, memberships, and the current session. - name: Roles description: Role-based permissions. - name: Organizations description: Organization-level metrics. paths: /api/alert-triage-routes: get: tags: - Alerts summary: Get alert triage routes description: >- Return the ordered routes that choose which agent triages a new alert, with the organization default for alerts no route matches and the agent for Hunt Alerts, which skip both. responses: '200': description: Successful response content: application/json: schema: type: object properties: routes: type: array items: type: object properties: id: type: string format: uuid description: Route ID name: type: string minLength: 1 maxLength: 120 description: >- Name shown in settings and wherever the route is credited enabled: type: boolean description: Disabled routes are skipped conditions: type: array items: oneOf: - type: object properties: type: type: string const: codeDetection codeDetectionIds: type: array items: type: string format: uuid minItems: 1 required: - type - codeDetectionIds description: Alerts from any of these code detections - type: object properties: type: type: string const: agent agentIds: type: array items: type: string format: uuid minItems: 1 required: - type - agentIds description: >- Alerts from any of these agents: alerts an agent created with the create-alert tool, and alerts a legacy detection agent raised. Alerts created by triggers do not match - type: object properties: type: type: string const: logTable tables: type: array items: type: object properties: source: type: string minLength: 1 description: >- Log ingest source id, e.g. okta or azure_event_hub stream: type: string minLength: 1 description: >- Declared stream of one of the source's tables, e.g. entra_logs; omitted means every table of the source required: - source minItems: 1 required: - type - tables description: >- Alerts from code detections that query any of these Cotool Logs tables minItems: 1 maxItems: 10 description: Conditions that must all match action: type: string enum: - triage - leave_unassigned description: >- triage starts the route agent on matching alerts; leave_unassigned leaves them open for a person responseAgentId: type: - string - 'null' format: uuid description: >- Agent that triages matching alerts when action is triage; null for leave_unassigned responseAgentName: type: - string - 'null' description: >- Name of the route agent, or null when it was deleted or can no longer triage alerts; such a route is skipped required: - id - name - enabled - conditions - action - responseAgentId - responseAgentName description: Routes in the order they are checked defaultSettings: type: object properties: organizationId: type: string format: uuid description: Organization that owns these alert routing defaults defaultResponseAgentId: type: - string - 'null' format: uuid description: Default agent for alerts without an explicit route defaultResponseAgentName: type: - string - 'null' description: Display name for the configured default alert agent createdAt: type: string description: ISO timestamp when the organization row was created updatedAt: type: string description: >- ISO timestamp when the routing default was last updated required: - organizationId - defaultResponseAgentId - defaultResponseAgentName - createdAt - updatedAt description: Organization default agent for alerts no route matches huntAlertRouting: type: object properties: responseAgentId: type: - string - 'null' format: uuid description: >- Response agent that triages new Hunt Alerts, or null to leave them unassigned responseAgentName: type: - string - 'null' description: Display name for the Hunt Alert response agent required: - responseAgentId - responseAgentName description: >- Agent that triages new Hunt Alerts, which skip the routes and the default responseAgents: type: array items: type: object properties: id: type: string format: uuid description: Response agent identifier name: type: string minLength: 1 description: Response agent display name required: - id - name description: Agents a route can send alerts to logTableOptions: type: array items: type: object properties: source: type: string description: Log ingest source id sourceDisplayName: type: string description: Source name, e.g. Azure Event Hub toolId: type: string description: Integration the source belongs to, for its logo stream: type: - string - 'null' description: >- Declared stream of the table, for sources with several tables streamLabel: type: - string - 'null' description: Stream name, e.g. Entra ID diagnostic logs required: - source - sourceDisplayName - toolId - stream - streamLabel description: Cotool Logs tables a logTable condition can name required: - routes - defaultSettings - huntAlertRouting - responseAgents - logTableOptions '400': description: Bad request — input validation failed or the request was malformed content: application/json: schema: $ref: '#/components/schemas/ValidationError' '401': description: Unauthorized — missing or invalid API key / session content: application/json: schema: $ref: '#/components/schemas/Error' '403': description: Forbidden — the authenticated user lacks the required permissions content: application/json: schema: $ref: '#/components/schemas/PermissionError' '500': description: Internal server error content: application/json: schema: $ref: '#/components/schemas/Error' x-codeSamples: - lang: shell label: cURL source: |- curl -X GET "https://app.cotool.ai/api/alert-triage-routes" \ -H "Authorization: Bearer YOUR_API_KEY" \ -H "Content-Type: application/json" components: schemas: ValidationError: type: object properties: error: type: string description: Error message describing what went wrong issues: type: array description: >- Detailed validation issues, present when request or response schema validation fails items: type: object additionalProperties: true required: - error Error: type: object properties: error: type: string description: Error message describing what went wrong required: - error PermissionError: type: object properties: error: type: string description: Error message describing what went wrong missingPerms: type: array description: Permissions the authenticated user is missing for this operation items: type: string required: - error securitySchemes: ApiKeyAuth: type: http scheme: bearer bearerFormat: API Key description: >- API Key authentication for programmatic access. Include your API key in the Authorization header as: `Bearer your_api_key_here` ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.