Get an alarm occurrence

The stable ID that the source system assigns to the occurrence. Together with event_id, it is the deduplication key for events.

The DUET reference for the occurrence. Pass it as after to break ties when you resume a replay.

The source system and site that sent the alarm.

The ID of the organization that owns the project.

The ID of the project that the alarm belongs to.

The site that the alarm came from.

The name of the alarm rule that fired.

The version of the alarm rule that fired.

The type of the rule that fired, for example threshold, stale, bitmask, or enum. Treat it as an open set: new values can appear.

The severity set on the alarm rule, passed through unchanged. The current values are critical, high, medium, low, and info. Treat it as an open set.

The occurrence's place in the operator queue: open, claimed, shelved, or resolved. This set is fixed. Recovery of the source condition is recorded in cleared_at, not in status.

How the occurrence ends. auto ends it when the source condition recovers. manual ends it when an operator resolves it. require_both needs recovery and an operator's resolution. For an auto occurrence, status keeps its last queue value (open or claimed) after recovery, so treat an auto occurrence with cleared_at set as inactive.

The operator's resolution note. Null until the occurrence is resolved.

When the alarm was raised.

The timestamp of the sample that raised the alarm.

When the occurrence last changed in the source system. If you hold more than one snapshot of an occurrence, keep the one with the latest updated_at.

When DUET last stored the occurrence. updated_since compares against this value.

When the source condition recovered. Null while the condition is still active. For manual and require_both occurrences, a recovered occurrence stays open until an operator resolves it. For auto occurrences, recovery ends the occurrence.

The value that raised the alarm.

The most recent value of the tag.

The value furthest past the rule's limit while the condition was active.

When peak_value occurred.

The value when the condition recovered. Null until recovery.

The signal tag that the alarm is on. Always present. While device_id is null, group alarms on source_tag and site.

The measure that the tag reports, for example frequency.

The description configured on the alarm rule.

The names of what fired: one label per bit set for a bitmask rule, the code's label for an enum rule, and for an alarm point the label from its device model's point list (or, when no list names the point, its identifier). Empty when nothing was decoded.

For an alarm point, the source system's identifier for the point, for example Error-3521. It doesn't change when the label is edited, so use it to group or filter alarm points. Null for other alarms.

The class of the alarm, for example fire, comms, or pcs. Treat it as an open set. Null when no class is configured.

Whether the alarm is flagged as relevant to NERC compliance, on the alarm point or the rule.

The ID of the DUET device that the tag maps to. Null until the tag is mapped to a device.

The name of the DUET device. Null until the tag is mapped to a device.

The type of the DUET device. Null until the tag is mapped to a device.

The ID of the DUET device's parent device. Null until the tag is mapped to a device.

The concrete limits of the rule when it fired, for example {"op":">","threshold":45}. The keys depend on kind. This field never holds a raw expression.

The lifecycle events, oldest first. List responses and webhooks hold only the newest 50 events.

The total number of events on the timeline.

Whether events holds only the newest events. To read the full timeline, call GET /platform/v1/alarms/{occurrence_id}.