Alerts

Every alert we raised, whether or not it reached you. The record of record: if a webhook was down, the alert is still here.

List alerts

GET/v1/alertsany key

Newest first, up to 200 at a time; page with before. Each alert carries the sentence the dashboard shows, the structured data a webhook would have carried, and what happened on each channel. unseen counts the alerts raised since the account last opened its alerts page, for a badge.

Query parameters

limitintegerdefault 50: At most 200. 0 asks for the unseen count alone.
beforestring: Alerts raised before this time. The paging cursor: the last row's at.

Response

alertsobject[]: Fields below.
unseeninteger: Raised since the alerts page was last opened.
seen_atstring | null: When that was.

An alert

type is one of the types on the webhooks page and severity is fixed per type. key is what the alert is about (a caller, a pattern, a number, a call) and is what the cooldown is keyed on: one alert per type per key per fifteen minutes. data is the same object a webhook delivers.

delivered has one entry per channel: true it landed, false it was tried and failed, null it was not tried: the channel is off, its floor is above this severity, or the plan does not include it.

RequestShell

BASE=https://api.murusai.com

curl "$BASE/v1/alerts" \
  -H "Authorization: Bearer $MURUSAI_KEY" \
  --get \
  --data-urlencode "limit=1"

RequestNode

const BASE = "https://api.murusai.com";
const KEY = process.env.MURUSAI_KEY;

const url = new URL("/v1/alerts", BASE);
url.search = new URLSearchParams({
  "limit": "1"
});
const res = await fetch(url, {
  headers: {
    Authorization: `Bearer ${KEY}`,
  },
});
const data = await res.json();

RequestPython

import os, requests

BASE = "https://api.murusai.com"
KEY = os.environ["MURUSAI_KEY"]

r = requests.get(
    f"{BASE}/v1/alerts",
    params={
        "limit": "1",
    },
    headers={"Authorization": f"Bearer {KEY}"},
)
data = r.json()

200OKResponseJSON

{
  "seen_at": "2026-09-20T22:00:00.000Z",
  "unseen": 1,
  "alerts": [
    {
      "id": "b1f2…",
      "type": "caller.rotating_numbers",
      "key": "+151255501",
      "at": "2026-09-21T02:14:08.000Z",
      "severity": "critical",
      "text": "5 numbers matching +151255501* hit +14155550100 7x in 15 min. Call ended.",
      "data": {
        "number": "+14155550100",
        "call_id": "CA7f3e2a91c04b",
        "pattern": "+151255501",
        "numbers": 5,
        "count": 7,
        "window_min": 15,
        "hung_up": true
      },
      "delivered": {
        "webhook": true,
        "email": true,
        "sms": null,
        "call": null
      }
    }
  ]
}

Where alerts go

Channels, destinations and severity floors are set in the dashboard under Settings → Alerts, by anyone on the account. The webhook URL alone can also be set through PATCH /v1/account. The rest is described in email, text and voice.

Texts and phone calls go only to numbers the account has proved it holds, with a code, and only on Guard. That is not configurable and is the reason a stolen key cannot start paging a stranger.