Entity · alarm_rules

Alarm Rule Schema

Schema-ID

alarm_rule

Collection

alarm_rules

Permissions

Lesenalarm_view
Anlegenalarm_rule_manage
Ändernalarm_rule_manage
Löschenalarm_rule_manage

Felder

Alarm Rule Schema

alarm_rules4 Permissions

ADR 0326 — ordered alarm classification rule (woasi parity): filters, severity, alerting windows and an actions list with per-action delay.

namestringerforderlich

1–200 Zeichen

descriptionstringoptional

max 2000 ZeichenDefault: nullnullable

severitystringerforderlich

Display severity the rule assigns to matching alarms (woasi Schweregrad).

Werte

infowarningerror

isActivebooleanoptional

Default: true

pinnedbooleanoptional

Matching alarms cannot be hidden from the board (woasi "fixiert").

Default: false

stopProcessingbooleanoptional

Stop evaluating lower rules after a match (woasi first-match stop).

Default: false

isFallbackbooleanoptional

Auffangregel: skipped in the normal pass, applied only when NO ordinary rule matched and the connection uses alarmUnmatchedPolicy=fallback_rule.

Default: false

sortOrderintegererforderlich

Position in the ordered stack (drag-reorder in the editor).

≥ 0

deviceCategoriesstring[]optional

Empty = all device categories (deviation from woasi, documented in the editor).

Default: []

sourcesobject[]optional

Event origins this rule applies to. Empty = all.

Default: []

providerstringoptional

max 40 ZeichenDefault: nullnullable

connectionIdstringoptional

PatternDefault: nullnullable

matchobjectoptional

Default: {}

checkTypesstring[]optional

Normalized check types (type level, woasi "Checkarten"). Empty = all. AND-combined with terms.

Default: []

severitiesstring[]optional

Canonical severities the EVENT was reported with (ADR 0730). Empty = all. AND-combined with the other filters. Fail-closed: a rule that names severities never matches an event without one.

unique itemsDefault: []

termsobject[]optional

Tri-state search terms: mode or (mind. eines) | required (zwingend, hinreichend) | required_additional (zwingend zusätzlich).

Default: []

valuestringerforderlich

1–500 Zeichen

fieldsoneOfoptional

Fields the term is matched against ('all' or an explicit subset).

modestringoptional

Werte

orrequiredrequired_additional

Default: "or"

matchTypestringoptional

Werte

containsregex

Default: "contains"

caseSensitivebooleanoptional

Default: false

customerScopeobjectoptional

Default: {}

modestringoptional

Werte

allwhitelistblacklist

Default: "all"

entriesobject[]optional

Default: []

partyIdstringoptional

PatternDefault: nullnullable

nameQuerystringoptional

Case-insensitive substring on customerName/siteName (woasi Suchstring).

max 200 ZeichenDefault: nullnullable

exceptionsobject[]optional

Matching terms that SUPPRESS actions (alarm is still created, flagged suppressedByException).

Default: []

valuestringerforderlich

1–500 Zeichen

fieldsoneOfoptional

Fields the term is matched against ('all' or an explicit subset).

scheduleobjectoptional

Alerting windows. Checked at scheduling AND again at execution time; outside = suppress.

Default: {}

modestringoptional

Werte

tenant_hourstenant_plus_windowswindows_onlyalways

Default: "tenant_hours"

windowsobject[]optional

Default: []

daysinteger[]erforderlich

ISO weekdays, 1 = Monday … 7 = Sunday.

min 1 Items

fromstringerforderlich

Pattern

tostringerforderlich

Pattern

useCustomerHoursbooleanoptional

Phase 3 — per-customer business hours. Stored but not yet evaluated.

Default: false

outsideWindowBehaviorstringoptional

What happens to an action whose fire time falls outside the window. 'suppress' (default, legacy) drops it; 'defer' re-schedules it to the next opening. Readers MUST test `=== 'defer'`: this default never reaches the database (AJV mutates a stripped validation copy, not the body).

Werte

suppressdefer

Default: "suppress"

actionsobject[]optional

Default: []

typestringerforderlich

Werte

notify_emailnotify_pushcreate_ticketcreate_taskwebhook_outauto_closereset_ackescalate_priority

delayMinutesintegeroptional

Delay from alarm start (not from evaluation) — woasi staffing pattern.

0 – 10080Default: 0

delayClockModestringoptional

Time base for delayMinutes. 'calendar' (default, legacy) is wall-clock: night and weekend tick along. 'business' consumes only minutes inside the alerting hours, starting the clock at the next opening (waiting time is not credited). Which hours count follows schedule.mode. Readers MUST test `=== 'business'`: this default never reaches the database (AJV mutates a stripped validation copy, not the body), so absent has to stay legacy.

Werte

calendarbusiness

Default: "calendar"

triggerstringoptional

Werte

raiseclearboth

Default: "raise"

ignoreAckStatebooleanoptional

Fire even when the alarm was acknowledged (woasi parity).

Default: false

configobjectoptional

Per-type config (recipients, ticket templates/assignment, webhook url+secret, escalate_priority: intervalMinutes/maxPriority/steps/stopWhenAssigned/addTicketNote, …). Validated per type by the action executor, not here.

Default: {}

originstringoptional

seed = created by the opt-in endpoint to reproduce the fixed ticket policy (idempotency anchor).

Werte

seednull

Default: nullread-onlynullable

seedConnectionIdstringoptional

For origin=seed: the connection whose policy this rule reproduces.

PatternDefault: nullread-onlynullable

Standard-Endpoints

Diese Resource folgt dem generischen CRUD-Vertrag der Plattform. Lesen Sie die Konventionen für Pagination, Idempotenz, Optimistic Locking und Audit. Die wichtigsten Endpoints:

GET /api/v1/alarm_rules — Liste, paginiert + filterbar
GET /api/v1/alarm_rules/<id> — Einzelne Entity
POST /api/v1/alarm_rules — Anlegen
PATCH /api/v1/alarm_rules/<id> — Teil-Update
DELETE /api/v1/alarm_rules/<id> — Soft-Delete
GET /api/v1/alarm_rules/<id>/timeline — Audit + Aktivitäten