> ## Documentation Index > Fetch the complete documentation index at: https://docs.promptguard.co/llms.txt > Use this file to discover all available pages before exploring further. # Export Alerts > The Organization's alerts, oldest first: every threat that was blocked, or found at the alert confidence -- exactly the events a webhook delivery is sent for. ## OpenAPI ````yaml /api-reference/openapi-developer.json get /api/v1/alerts openapi: 3.1.0 info: title: PromptGuard Developer API description: >- Public API for developers to integrate PromptGuard security into their applications version: 1.0.0 servers: - url: https://api.promptguard.co description: Production security: - ApiKeyAuth: [] paths: /api/v1/alerts: get: tags: - SIEM export summary: Export Alerts description: >- The Organization's alerts, oldest first: every threat that was blocked, or found at the alert confidence -- exactly the events a webhook delivery is sent for. operationId: export_alerts_api_v1_alerts_get parameters: - name: since in: query required: false schema: anyOf: - type: string format: date-time - type: 'null' description: 'Read events from this time (ISO 8601). Default: 24 hours ago.' title: Since description: 'Read events from this time (ISO 8601). Default: 24 hours ago.' - name: until in: query required: false schema: anyOf: - type: string format: date-time - type: 'null' description: Read events before this time. title: Until description: Read events before this time. - name: cursor in: query required: false schema: anyOf: - type: string - type: 'null' description: '`next_cursor` from the previous page; replaces `since`.' title: Cursor description: '`next_cursor` from the previous page; replaces `since`.' - name: limit in: query required: false schema: type: integer maximum: 1000 minimum: 1 description: Events per page. default: 100 title: Limit description: Events per page. - name: x-api-key in: header required: false schema: anyOf: - type: string - type: 'null' title: X-Api-Key responses: '200': description: Successful Response content: application/json: schema: $ref: '#/components/schemas/ExportPage' '422': description: Validation Error content: application/json: schema: $ref: '#/components/schemas/HTTPValidationError' components: schemas: ExportPage: properties: organization_id: type: string title: Organization Id organization_name: anyOf: - type: string - type: 'null' title: Organization Name events: items: $ref: '#/components/schemas/SiemEventRecord' type: array title: Events next_cursor: anyOf: - type: string - type: 'null' title: Next Cursor description: >- Where this page ended. Pass it back as `cursor` to read on; it is returned even when the page is short, so a poller always has its place. Null only when there was no position to report. has_more: type: boolean title: Has More description: Whether another page is ready now. type: object required: - organization_id - organization_name - events - next_cursor - has_more title: ExportPage description: One page of an Organization's events, oldest first. HTTPValidationError: properties: detail: items: $ref: '#/components/schemas/ValidationError' type: array title: Detail type: object title: HTTPValidationError SiemEventRecord: properties: schema_version: type: string title: Schema Version event: type: string title: Event description: '`threat_detected` or `scan_completed`.' event_id: type: string title: Event Id timestamp: type: string title: Timestamp description: When the event happened, ISO 8601 with offset. organization_id: anyOf: - type: string - type: 'null' title: Organization Id organization_name: anyOf: - type: string - type: 'null' title: Organization Name project_id: anyOf: - type: string - type: 'null' title: Project Id project: anyOf: - type: string - type: 'null' title: Project description: The project's name. device_id: anyOf: - type: string - type: 'null' title: Device Id description: Null for a key no Device holds. device_hostname: anyOf: - type: string - type: 'null' title: Device Hostname attribution_label_unverified: anyOf: - type: string - type: 'null' title: Attribution Label Unverified description: >- Free text naming who is believed to be behind the Device. Never validated; read `identity_verified` before treating it as a person. identity_verified: anyOf: - type: boolean - type: 'null' title: Identity Verified description: >- True when a Member signed in to bind the Device; false when only the label stands behind it; null when the event predates the record. threat_type: anyOf: - type: string - type: 'null' title: Threat Type decision: type: string title: Decision confidence: anyOf: - type: number - type: 'null' title: Confidence reason: anyOf: - type: string - type: 'null' title: Reason direction: anyOf: - type: string - type: 'null' title: Direction surface: anyOf: - type: string - type: 'null' title: Surface segment: anyOf: - type: string - type: 'null' title: Segment description: >- On a Shadow AI Device's event, the part of the request the finding came from: `current_turn`, `earlier_turn`, `instructions` or `tool_definition`. Null for any other caller's. dashboard_url: type: string title: Dashboard Url description: Opens this event in its Organization. text: type: string title: Text threshold: anyOf: - additionalProperties: true type: object - type: 'null' title: Threshold type: object required: - schema_version - event - event_id - timestamp - organization_id - organization_name - project_id - project - device_id - device_hostname - attribution_label_unverified - identity_verified - threat_type - decision - confidence - reason - direction - surface - dashboard_url - text title: SiemEventRecord description: One security event, in the SIEM event contract (schema_version 1). ValidationError: properties: loc: items: anyOf: - type: string - type: integer type: array title: Location msg: type: string title: Message type: type: string title: Error Type input: title: Input ctx: type: object title: Context type: object required: - loc - msg - type title: ValidationError securitySchemes: ApiKeyAuth: type: apiKey in: header name: X-API-Key description: >- PromptGuard API key for developer endpoints. Keys start with pg_live_ and are created in the dashboard. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.