> ## Documentation Index
> Fetch the complete documentation index at: https://docs.calseta.com/llms.txt
> Use this file to discover all available pages before exploring further.

# List Alert Indicators

> Return all indicators linked to an alert.

Each indicator includes enrichment results keyed by provider with the raw
response excluded — only the extracted sub-object, success flag, and
enriched_at timestamp are returned.



## OpenAPI

````yaml GET /v1/alerts/{alert_uuid}/indicators
openapi: 3.1.0
info:
  title: Calseta
  description: SOC data platform for security agent consumption
  version: dev
servers: []
security: []
paths:
  /v1/alerts/{alert_uuid}/indicators:
    get:
      tags:
        - alerts
      summary: List Alert Indicators
      description: >-
        Return all indicators linked to an alert.


        Each indicator includes enrichment results keyed by provider with the
        raw

        response excluded — only the extracted sub-object, success flag, and

        enriched_at timestamp are returned.
      operationId: list_alert_indicators_v1_alerts__alert_uuid__indicators_get
      parameters:
        - name: alert_uuid
          in: path
          required: true
          schema:
            type: string
            format: uuid
            title: Alert Uuid
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DataResponse_list_IndicatorResponse__'
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
components:
  schemas:
    DataResponse_list_IndicatorResponse__:
      properties:
        data:
          items:
            $ref: '#/components/schemas/IndicatorResponse'
          type: array
          title: Data
        meta:
          additionalProperties: true
          type: object
          title: Meta
      type: object
      required:
        - data
      title: DataResponse[list[IndicatorResponse]]
    HTTPValidationError:
      properties:
        detail:
          items:
            $ref: '#/components/schemas/ValidationError'
          type: array
          title: Detail
      type: object
      title: HTTPValidationError
    IndicatorResponse:
      properties:
        uuid:
          type: string
          title: Uuid
        type:
          $ref: '#/components/schemas/IndicatorType'
        value:
          type: string
          title: Value
        malice:
          type: string
          title: Malice
        malice_source:
          anyOf:
            - type: string
            - type: 'null'
          title: Malice Source
        malice_overridden_at:
          anyOf:
            - type: string
              format: date-time
            - type: 'null'
          title: Malice Overridden At
        first_seen:
          type: string
          format: date-time
          title: First Seen
        last_seen:
          type: string
          format: date-time
          title: Last Seen
        is_enriched:
          type: boolean
          title: Is Enriched
        enrichment_results:
          anyOf:
            - additionalProperties: true
              type: object
            - type: 'null'
          title: Enrichment Results
        created_at:
          type: string
          format: date-time
          title: Created At
        updated_at:
          type: string
          format: date-time
          title: Updated At
      type: object
      required:
        - uuid
        - type
        - value
        - malice
        - first_seen
        - last_seen
        - is_enriched
        - created_at
        - updated_at
      title: IndicatorResponse
      description: Indicator as returned by GET /v1/alerts/{uuid}/indicators.
    ValidationError:
      properties:
        loc:
          items:
            anyOf:
              - type: string
              - type: integer
          type: array
          title: Location
        msg:
          type: string
          title: Message
        type:
          type: string
          title: Error Type
        input:
          title: Input
        ctx:
          type: object
          title: Context
      type: object
      required:
        - loc
        - msg
        - type
      title: ValidationError
    IndicatorType:
      type: string
      enum:
        - ip
        - domain
        - hash_md5
        - hash_sha1
        - hash_sha256
        - url
        - email
        - account
      title: IndicatorType
      description: Supported indicator-of-compromise (IOC) types.

````