> ## Documentation Index
> Fetch the complete documentation index at: https://docs.calseta.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Update Alert



## OpenAPI

````yaml PATCH /v1/alerts/{alert_uuid}
openapi: 3.1.0
info:
  title: Calseta
  description: SOC data platform for security agent consumption
  version: dev
servers: []
security: []
paths:
  /v1/alerts/{alert_uuid}:
    patch:
      tags:
        - alerts
      summary: Patch Alert
      operationId: patch_alert_v1_alerts__alert_uuid__patch
      parameters:
        - name: alert_uuid
          in: path
          required: true
          schema:
            type: string
            format: uuid
            title: Alert Uuid
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AlertPatch'
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DataResponse_AlertResponse_'
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
components:
  schemas:
    AlertPatch:
      properties:
        status:
          anyOf:
            - $ref: '#/components/schemas/AlertStatus'
            - type: 'null'
        severity:
          anyOf:
            - $ref: '#/components/schemas/AlertSeverity'
            - type: 'null'
        close_classification:
          anyOf:
            - $ref: '#/components/schemas/AlertCloseClassification'
            - type: 'null'
        tags:
          anyOf:
            - items:
                type: string
              type: array
            - type: 'null'
          title: Tags
        malice_override:
          anyOf:
            - $ref: '#/components/schemas/MaliceLevel'
            - type: 'null'
        reset_malice_override:
          type: boolean
          title: Reset Malice Override
          default: false
      type: object
      title: AlertPatch
      description: |-
        Patch request for updating an alert — PATCH /v1/alerts/{uuid}.
        All fields optional. If status=Closed, close_classification is required.
    DataResponse_AlertResponse_:
      properties:
        data:
          $ref: '#/components/schemas/AlertResponse'
        meta:
          additionalProperties: true
          type: object
          title: Meta
      type: object
      required:
        - data
      title: DataResponse[AlertResponse]
    HTTPValidationError:
      properties:
        detail:
          items:
            $ref: '#/components/schemas/ValidationError'
          type: array
          title: Detail
      type: object
      title: HTTPValidationError
    AlertStatus:
      type: string
      enum:
        - Open
        - Triaging
        - Escalated
        - Closed
      title: AlertStatus
      description: >-
        Alert investigation lifecycle status. Stored as TEXT with Pydantic
        validation.

        Do NOT use a Postgres ENUM type — TEXT with app-level validation is
        easier to migrate.


        Transition flow:
            Open → Triaging / Escalated → Closed
    AlertSeverity:
      type: string
      enum:
        - Pending
        - Informational
        - Low
        - Medium
        - High
        - Critical
      title: AlertSeverity
      description: >-
        Alert severity levels. Stored as TEXT with Pydantic validation.

        Source plugins are responsible for mapping source-specific severity
        values to this enum.
    AlertCloseClassification:
      type: string
      enum:
        - True Positive - Suspicious Activity
        - Benign Positive - Suspicious but Expected
        - False Positive - Incorrect Detection Logic
        - False Positive - Inaccurate Data
        - Undetermined
        - Duplicate
        - Not Applicable
      title: AlertCloseClassification
      description: >-
        Required when status transitions to Closed. Used for FP rate metrics and
        detection quality.

        Any value starting with 'False Positive' counts toward the
        false_positive_rate metric.
    MaliceLevel:
      type: string
      enum:
        - Pending
        - Benign
        - Suspicious
        - Malicious
      title: MaliceLevel
      description: Indicator malice verdict — shared validation enum.
    AlertResponse:
      properties:
        uuid:
          type: string
          format: uuid
          title: Uuid
        title:
          type: string
          title: Title
        description:
          anyOf:
            - type: string
            - type: 'null'
          title: Description
        severity:
          $ref: '#/components/schemas/AlertSeverity'
        status:
          $ref: '#/components/schemas/AlertStatus'
        enrichment_status:
          $ref: '#/components/schemas/app__schemas__alert__EnrichmentStatus'
        source_name:
          type: string
          title: Source Name
        occurred_at:
          type: string
          format: date-time
          title: Occurred At
        ingested_at:
          type: string
          format: date-time
          title: Ingested At
        enriched_at:
          anyOf:
            - type: string
              format: date-time
            - type: 'null'
          title: Enriched At
        is_enriched:
          type: boolean
          title: Is Enriched
        fingerprint:
          anyOf:
            - type: string
            - type: 'null'
          title: Fingerprint
        duplicate_count:
          type: integer
          title: Duplicate Count
          default: 0
        last_seen_at:
          anyOf:
            - type: string
              format: date-time
            - type: 'null'
          title: Last Seen At
        close_classification:
          anyOf:
            - $ref: '#/components/schemas/AlertCloseClassification'
            - type: 'null'
        acknowledged_at:
          anyOf:
            - type: string
              format: date-time
            - type: 'null'
          title: Acknowledged At
        triaged_at:
          anyOf:
            - type: string
              format: date-time
            - type: 'null'
          title: Triaged At
        closed_at:
          anyOf:
            - type: string
              format: date-time
            - type: 'null'
          title: Closed At
        tags:
          items:
            type: string
          type: array
          title: Tags
        detection_rule_id:
          anyOf:
            - type: integer
            - type: 'null'
          title: Detection Rule Id
        raw_payload:
          anyOf:
            - additionalProperties: true
              type: object
            - type: 'null'
          title: Raw Payload
        malice:
          anyOf:
            - type: string
            - type: 'null'
          title: Malice
        malice_override:
          anyOf:
            - type: string
            - type: 'null'
          title: Malice Override
        malice_override_source:
          anyOf:
            - type: string
            - type: 'null'
          title: Malice Override Source
        malice_override_at:
          anyOf:
            - type: string
              format: date-time
            - type: 'null'
          title: Malice Override At
        indicators:
          items:
            $ref: '#/components/schemas/EnrichedIndicator'
          type: array
          title: Indicators
        detection_rule:
          anyOf:
            - $ref: '#/components/schemas/DetectionRuleResponse'
            - type: 'null'
        context_documents:
          items:
            $ref: '#/components/schemas/ContextDocumentResponse'
          type: array
          title: Context Documents
        agent_findings:
          anyOf:
            - items:
                additionalProperties: true
                type: object
              type: array
            - type: 'null'
          title: Agent Findings
        created_at:
          type: string
          format: date-time
          title: Created At
        updated_at:
          type: string
          format: date-time
          title: Updated At
      type: object
      required:
        - uuid
        - title
        - severity
        - status
        - enrichment_status
        - source_name
        - occurred_at
        - ingested_at
        - enriched_at
        - is_enriched
        - fingerprint
        - close_classification
        - acknowledged_at
        - triaged_at
        - closed_at
        - tags
        - detection_rule_id
        - created_at
        - updated_at
      title: AlertResponse
      description: Full alert response — returned by GET /v1/alerts/{uuid}.
    ValidationError:
      properties:
        loc:
          items:
            anyOf:
              - type: string
              - type: integer
          type: array
          title: Location
        msg:
          type: string
          title: Message
        type:
          type: string
          title: Error Type
        input:
          title: Input
        ctx:
          type: object
          title: Context
      type: object
      required:
        - loc
        - msg
        - type
      title: ValidationError
    app__schemas__alert__EnrichmentStatus:
      type: string
      enum:
        - Pending
        - Enriched
        - Failed
      title: EnrichmentStatus
      description: |-
        System-managed enrichment pipeline status. Stored as TEXT.
        Set automatically by the enrichment pipeline — not user-editable.

        Transition flow:
            Pending → Enriched | Failed
    EnrichedIndicator:
      properties:
        uuid:
          type: string
          title: Uuid
        type:
          $ref: '#/components/schemas/IndicatorType'
        value:
          type: string
          title: Value
        first_seen:
          type: string
          format: date-time
          title: First Seen
        last_seen:
          type: string
          format: date-time
          title: Last Seen
        is_enriched:
          type: boolean
          title: Is Enriched
        malice:
          type: string
          title: Malice
        malice_source:
          anyOf:
            - type: string
            - type: 'null'
          title: Malice Source
        malice_overridden_at:
          anyOf:
            - type: string
              format: date-time
            - type: 'null'
          title: Malice Overridden At
        enrichment_results:
          anyOf:
            - additionalProperties: true
              type: object
            - type: 'null'
          title: Enrichment Results
        created_at:
          type: string
          format: date-time
          title: Created At
        updated_at:
          type: string
          format: date-time
          title: Updated At
      type: object
      required:
        - uuid
        - type
        - value
        - first_seen
        - last_seen
        - is_enriched
        - malice
        - created_at
        - updated_at
      title: EnrichedIndicator
      description: |-
        Full indicator as returned to API callers and MCP clients.
        Includes enrichment results and alert association metadata.
    DetectionRuleResponse:
      properties:
        uuid:
          type: string
          format: uuid
          title: Uuid
        name:
          type: string
          title: Name
        source_rule_id:
          anyOf:
            - type: string
            - type: 'null'
          title: Source Rule Id
        source_name:
          anyOf:
            - type: string
            - type: 'null'
          title: Source Name
        severity:
          anyOf:
            - type: string
            - type: 'null'
          title: Severity
        is_active:
          type: boolean
          title: Is Active
        mitre_tactics:
          items:
            type: string
          type: array
          title: Mitre Tactics
        mitre_techniques:
          items:
            type: string
          type: array
          title: Mitre Techniques
        mitre_subtechniques:
          items:
            type: string
          type: array
          title: Mitre Subtechniques
        data_sources:
          items:
            type: string
          type: array
          title: Data Sources
        run_frequency:
          anyOf:
            - type: string
            - type: 'null'
          title: Run Frequency
        created_by:
          anyOf:
            - type: string
            - type: 'null'
          title: Created By
        documentation:
          anyOf:
            - type: string
            - type: 'null'
          title: Documentation
        created_at:
          type: string
          format: date-time
          title: Created At
        updated_at:
          type: string
          format: date-time
          title: Updated At
      type: object
      required:
        - uuid
        - name
        - source_rule_id
        - source_name
        - severity
        - is_active
        - mitre_tactics
        - mitre_techniques
        - mitre_subtechniques
        - data_sources
        - run_frequency
        - created_by
        - documentation
        - created_at
        - updated_at
      title: DetectionRuleResponse
    ContextDocumentResponse:
      properties:
        uuid:
          type: string
          format: uuid
          title: Uuid
        title:
          type: string
          title: Title
        document_type:
          type: string
          title: Document Type
        is_global:
          type: boolean
          title: Is Global
        description:
          anyOf:
            - type: string
            - type: 'null'
          title: Description
        tags:
          items:
            type: string
          type: array
          title: Tags
        version:
          type: integer
          title: Version
        created_at:
          type: string
          format: date-time
          title: Created At
        updated_at:
          type: string
          format: date-time
          title: Updated At
        content:
          type: string
          title: Content
        targeting_rules:
          anyOf:
            - additionalProperties: true
              type: object
            - type: 'null'
          title: Targeting Rules
      type: object
      required:
        - uuid
        - title
        - document_type
        - is_global
        - description
        - tags
        - version
        - created_at
        - updated_at
        - content
        - targeting_rules
      title: ContextDocumentResponse
      description: Full response — includes content and targeting_rules.
    IndicatorType:
      type: string
      enum:
        - ip
        - domain
        - hash_md5
        - hash_sha1
        - hash_sha256
        - url
        - email
        - account
      title: IndicatorType
      description: Supported indicator-of-compromise (IOC) types.

````