alerts_history
Authoritative 'what fired and when' stream — wraps the alert_history table (one row per incident, both legacy and modern) and alert_outlet_log (per-dispatch ledger keyed by history_id).
Default mode: lists incidents newest-first. Each row is one incident with opened_at / last_event_at / resolved_at framing the lifecycle, plus aggregated outlet_types[], dispatch_count, and failed_count. status is computed from resolved_at: 'open' if null, 'resolved' otherwise.
Drill-down mode: pass incident_id (the alert_history.id, NOT alert_id) to switch the call to /api/alert-history/{id}/log and return the per-outlet dispatch ledger for that one incident. Use this for 'did the email actually go' / 'what did the webhook payload look like' / 'which outlets failed' follow-ups.
Filters (default mode, all client-side, AND-combined): status (open|resolved|all, default all), severity (int or array — scheme is 1-5, lower=worse), device_id, source (legacy|modern|all), hours (1-168, default 24, applied against last_event_at), search (substring on alert_label/subject).
Important caps: the upstream endpoint returns at most 500 rows ordered by last_event_at DESC. We can't reach older rows than that. meta.upstream_cap reports this so the LLM can warn the user when results may be truncated. severity_label is added server-side so the LLM doesn't memorize the scale.
Pagination is over the post-filter result. Tag-scope is enforced by Laravel — tag-restricted users see only incidents for devices in their slug set.
Permission: alerts. Examples: alerts_history({status: 'open', severity: [1,2], hours: 1}) alerts_history({device_id: 42, hours: 24}) alerts_history({incident_id: 9182}) // dispatch ledger
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| page | No | 1-indexed page number (default 1). | |
| hours | No | Lookback window applied against last_event_at (default 24). | |
| search | No | Case-insensitive substring on alert_label / subject. | |
| source | No | Filter by source axis. Default 'all'. | |
| status | No | Filter by lifecycle state. Default 'all'. | |
| end_time | No | ISO-8601 UTC; pairs with start_time. | |
| per_page | No | Rows per page (default 50, max 200). | |
| severity | No | Severity int or array of ints (1-5, lower=worse). | |
| device_id | No | Restrict to one device id. | |
| start_time | No | ISO-8601 UTC; pairs with end_time. | |
| incident_id | No | If set, switches to per-incident dispatch-ledger mode (returns alert_outlet_log rows). This is alert_history.id, NOT alert_id. |