trigger_get
Read-only
Retrieve Zabbix triggers with filters for hosts, host groups, severity, status, and problem state; control returned fields, sorting, and counts to inspect alert conditions.
Instructions
Retrieve triggers. Triggers define conditions (expressions) that evaluate item values and determine when a problem exists. Each trigger references one or more items via an expression like 'last(/host/key) > 90'. Triggers have severity levels (0-5) and generate events when their state changes. The expression comes in the form the update tool takes, functions written out and user macros kept ('avg(/host/key,10m)>{$MAX}'; Zabbix 5.4 and later, before that Zabbix's own expansion). extra_params expandExpression: true asks Zabbix for its own expansion instead, with every user macro replaced by its current value: for reading, never for sending back (the trigger would lose its macros); false returns the stored form with function IDs.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Maximum number of results to return. | |
| active | No | Only return enabled triggers that belong to enabled hosts. | |
| filter | No | Return only results whose properties exactly match the given values (a single value or a list of values per key). Example: {"status": 0} or {"status": [0, 1]}. Keys: correlation_mode, correlation_tag, description, error, event_name (6.0+), expression, flags, lastchange, manual_close, opdata, priority, recovery_expression, recovery_mode, state, status, templateid, triggerid, type, url, url_name (6.4+), uuid (6.0+), value. Text properties cannot be filtered; use 'search' for them. | |
| output | No | Properties of the trigger object to return. Pass 'extend' for all, 'count' for the number of matches only, or a list of property names. Default when omitted: triggerid, description, priority, status, value. Properties: comments, correlation_mode, correlation_tag, description, error, event_name (6.0+), expression, flags, lastchange, manual_close, opdata, priority, recovery_expression, recovery_mode, state, status, templateid, triggerid, type, url, url_name (6.4+), uuid (6.0+), value. | |
| search | No | Return results whose string properties contain the given pattern (case-insensitive; '*' is a wildcard when searchWildcardsEnabled is true). Example: {"name": "web"}. Keys: comments, correlation_tag, description, error, event_name (6.0+), expression, opdata, recovery_expression, url, url_name (6.4+), uuid (6.0+). | |
| server | No | Target Zabbix server. Available: default. Defaults to 'default' if omitted. | |
| hostids | No | Return only triggers that belong to the given hosts. | |
| groupids | No | Return only triggers that belong to hosts in the given host groups. | |
| raw_json | No | Strips the security disclaimer preamble from the response so it is pure JSON. Default: false. Requires the bearer token to have 'allow_raw_json' explicitly enabled by an operator in the admin portal - tokens without that policy receive a PolicyError instead. WARNING: setting true bypasses the prompt-injection mitigation marker that wraps untrusted Zabbix data (host names, item descriptions, problem text). LLM clients (Claude, GPT, Cursor, ...) should leave this false; only programmatic non-LLM consumers (Python scripts, n8n workflows that json.loads the result) should set true. | |
| monitored | No | Only return enabled triggers that belong to enabled hosts and contain only enabled items. | |
| only_true | No | Only return triggers that are currently in a problem (PROBLEM) state. | |
| sortfield | No | Sort by one or more of: triggerid, description, status, priority, lastchange, hostname (a list for several; pair with 'sortorder'). No other property is sortable. | |
| sortorder | No | Sort order: 'ASC' (ascending) or 'DESC' (descending). | |
| triggerids | No | Return only triggers with the given IDs. | |
| countOutput | No | Return the count of matching results instead of the actual data. | |
| searchByAny | No | If true, return results matching ANY search field (OR). Default is ALL fields (AND). | |
| templateids | No | Return only triggers that belong to the given templates. | |
| extra_params | No | Other native trigger.get parameters, merged into the request as-is. Parameters: dependent, evaltype, expandComment, expandDescription, expandExpression, functions, group, groupCount, host, inherited, inheritedTags (8.0+), itemids, lastChangeSince, lastChangeTill, limitSelects, maintenance, maintenanceids (8.0+), skipDependent, tags, templated, withAcknowledgedEvents, withLastEventUnacknowledged, withUnacknowledgedEvents. Switches (true turns one on, false is the same as leaving it out): expandComment, expandDescription, expandExpression, groupCount, skipDependent, withAcknowledgedEvents, withLastEventUnacknowledged, withUnacknowledgedEvents. groupCount goes with output='count': the count is then split by the ID filters the method groups by (hostids, groupids ...), one row per ID with 'rowscount'; a single row without such a filter. Sub-object selects (value 'extend', 'count' or a list of property names): selectDependencies, selectDiscoveryData (7.4+), selectDiscoveryRule, selectFunctions, selectGroups (removed in 7.2), selectHostGroups (6.2+), selectHosts, selectInheritedTags (8.0+), selectItems, selectLastEvent, selectTags, selectTemplateGroups (6.2+), selectTriggerDiscovery (deprecated in 7.4, use selectDiscoveryData). Any other key is refused here, because Zabbix would silently ignore it. For a parameter you are sure exists on your release but is not listed, use zabbix_raw_api_call. | |
| min_severity | No | Minimum trigger severity to return (0-5: NOT_CLASSIFIED, INFORMATION, WARNING, AVERAGE, HIGH, DISASTER) | |
| searchWildcardsEnabled | No | If true, enable * and ? wildcards in search patterns. | |
| with_unacknowledged_events | No | Only return triggers that have unacknowledged problem events. |