Alerts - Change State

  • Reference
Service:
Monitor
API Version:
2019-03-01

Change the state of an alert. If scope is a deleted resource then please use scope as parent resource of the delete resource. For example if my alert id is '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroup}/providers/Microsoft.Compute/virtualMachines/vm1/providers/Microsoft.AlertsManagement/alerts/{alertId}' and 'vm1' is deleted then if you want to change state of this particular alert then use parent resource of scope. So in this example change state call will look like this: '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroup}/providers/Microsoft.AlertsManagement/alerts/{alertId}'.

POST https://management.azure.com/{scope}/providers/Microsoft.AlertsManagement/alerts/{alertId}/changestate?api-version=2018-05-05&newState={newState}

URI Parameters

Name In Required Type Description
alertId
 path True
  • string

Unique ID of an alert instance.
scope
 path True
  • string

scope here is resourceId for which alert is created.
api-version
 query True

API version.
newState
 query True

New state of the alert.

Request Body

Name Type Description
comments
  • string

Responses

Name Type Description
200 OK

OK. Alert state updated.
Other Status Codes

Error response describing why the operation failed.

Examples

Resolve

Sample Request

POST https://management.azure.com/subscriptions/3b540246-808d-4331-99aa-917b808a9166/resourcegroups/servicedeskresourcegroup/providers/microsoft.insights/components/servicedeskappinsight/providers/Microsoft.AlertsManagement/alerts/66114d64-d9d9-478b-95c9-b789d6502100/changestate?api-version=2018-05-05&newState=Acknowledged

Sample Response

Status code:
200 
{
  "properties": {
    "essentials": {
      "severity": "Sev3",
      "signalType": "Log",
      "alertState": "Acknowledged",
      "monitorCondition": "Fired",
      "monitorService": "Application Insights",
      "targetResource": "/subscriptions/3b540246-808d-4331-99aa-917b808a9166/resourcegroups/servicedeskresourcegroup/providers/microsoft.insights/components/servicedeskappinsight",
      "targetResourceName": "servicedeskappinsight",
      "targetResourceGroup": "servicedeskresourcegroup",
      "targetResourceType": "components",
      "sourceCreatedId": "6cd6b2ce-8c54-468f-aff0-9d12aebb7e49",
      "smartGroupId": "23d6b2ce-8c54-468f-aff0-sd32aebb7e56",
      "smartGroupingReason": "Occurred frequently with other alerts",
      "alertRule": "https://servisdfsdfappinsight.portal.mms.microsoft.com/#Workspace/overview/settings/details/Edit Alert Rule/details/index?savedSearchId=&scheduleId=",
      "startDateTime": "2018-09-13T15:51:02Z",
      "lastModifiedDateTime": "2018-09-13T15:51:02Z",
      "lastModifiedUserName": "System",
      "monitorConditionResolvedDateTime": "2018-09-13T15:51:02Z",
      "actionStatus": {
        "isSuppressed": false
      },
      "description": "description of the alert"
    },
    "egressConfig": {},
    "context": {}
  },
  "id": "/subscriptions/3b540246-808d-4331-99aa-917b808a9166/resourcegroups/servicedeskresourcegroup/providers/microsoft.insights/components/servicedeskappinsight/providers/Microsoft.AlertsManagement/alerts/66114d64-d9d9-478b-95c9-b789d6502100",
  "type": "Microsoft.AlertsManagement/alerts",
  "name": "cpu alert"
}

Definitions

actionStatus

Action status
alert

An alert created in alert management service.
alertProperties

Alert property bag
AlertsManagementErrorResponse

An error response from the service.
AlertState

Alert object state, which can be modified by the user.
api-version

API version.
comments

Change alert state reason
errorResponseBody

Details of error response.
essentials

This object contains consistent fields across different monitor services.
MonitorCondition

Can be 'Fired' or 'Resolved', which represents whether the underlying conditions have crossed the defined alert rule thresholds.
MonitorService

Monitor service on which the rule(monitor) is set.
Severity

Severity of alert Sev0 being highest and Sev4 being lowest.
SignalType

The type of signal the alert is based on, which could be metrics, logs or activity logs.

actionStatus

Action status

Name Type Description
isSuppressed
  • boolean

Value indicating whether alert is suppressed.

alert

An alert created in alert management service.

Name Type Description
id
  • string

Azure resource Id
name
  • string

Azure resource name
properties

Alert property bag
type
  • string

Azure resource type

alertProperties

Alert property bag

Name Type Description
context
  • object

Information specific to the monitor service that gives more contextual details about the alert.
egressConfig
  • object

Config which would be used for displaying the data in portal.
essentials

This object contains consistent fields across different monitor services.

AlertsManagementErrorResponse

An error response from the service.

Name Type Description
error

Details of error response.

AlertState

Alert object state, which can be modified by the user.

Name Type Description
Acknowledged
  • string
Closed
  • string
New
  • string

api-version

API version.

Name Type Description
2018-05-05
  • string

comments

Change alert state reason

Name Type Description
comments
  • string

errorResponseBody

Details of error response.

Name Type Description
code
  • string

Error code, intended to be consumed programmatically.
details

A list of additional details about the error.
message
  • string

Description of the error, intended for display in user interface.
target
  • string

Target of the particular error, for example name of the property.

essentials

This object contains consistent fields across different monitor services.

Name Type Description
actionStatus

Action status
alertRule
  • string

Rule(monitor) which fired alert instance. Depending on the monitor service, this would be ARM id or name of the rule.
alertState

Alert object state, which can be modified by the user.
description
  • string

Alert description.
lastModifiedDateTime
  • string

Last modification time(ISO-8601 format) of alert instance.
lastModifiedUserName
  • string

User who last modified the alert, in case of monitor service updates user would be 'system', otherwise name of the user.
monitorCondition

Can be 'Fired' or 'Resolved', which represents whether the underlying conditions have crossed the defined alert rule thresholds.
monitorConditionResolvedDateTime
  • string

Resolved time(ISO-8601 format) of alert instance. This will be updated when monitor service resolves the alert instance because the rule condition is no longer met.
monitorService

Monitor service on which the rule(monitor) is set.
severity

Severity of alert Sev0 being highest and Sev4 being lowest.
signalType

The type of signal the alert is based on, which could be metrics, logs or activity logs.
smartGroupId
  • string

Unique Id of the smart group
smartGroupingReason
  • string

Verbose reason describing the reason why this alert instance is added to a smart group
sourceCreatedId
  • string

Unique Id created by monitor service for each alert instance. This could be used to track the issue at the monitor service, in case of Nagios, Zabbix, SCOM etc.
startDateTime
  • string

Creation time(ISO-8601 format) of alert instance.
targetResource
  • string

Target ARM resource, on which alert got created.
targetResourceGroup
  • string

Resource group of target ARM resource, on which alert got created.
targetResourceName
  • string

Name of the target ARM resource name, on which alert got created.
targetResourceType
  • string

Resource type of target ARM resource, on which alert got created.

MonitorCondition

Can be 'Fired' or 'Resolved', which represents whether the underlying conditions have crossed the defined alert rule thresholds.

Name Type Description
Fired
  • string
Resolved
  • string

MonitorService

Monitor service on which the rule(monitor) is set.

Name Type Description
ActivityLog Administrative
  • string
ActivityLog Autoscale
  • string
ActivityLog Policy
  • string
ActivityLog Recommendation
  • string
ActivityLog Security
  • string
Application Insights
  • string
Log Analytics
  • string
Nagios
  • string
Platform
  • string
Resource Health
  • string
SCOM
  • string
ServiceHealth
  • string
SmartDetector
  • string
VM Insights
  • string
Zabbix
  • string

Severity

Severity of alert Sev0 being highest and Sev4 being lowest.

Name Type Description
Sev0
  • string
Sev1
  • string
Sev2
  • string
Sev3
  • string
Sev4
  • string

SignalType

The type of signal the alert is based on, which could be metrics, logs or activity logs.

Name Type Description
Log
  • string
Metric
  • string
Unknown
  • string