Version
GET

List your alert destinations

/v1/me/alert-destinations in the Alert Destinations API.

Your destinations, primary first.

  • kind is email or telegram (push_device is reserved for the mobile apps).
  • target is your email address for email, or the linked chat's id for telegram.
  • classes lists the alert classes routed here, is null for every class, or is [] for none (the destination is kept but receives nothing).
  • is_primary marks the destination of your linked Telegram chat. It is derived from the link, never set through this API.

Until you write a destination, you are on the default: every class goes to your linked Telegram chat when there is one, and email carries what nothing else does. The list is empty while the default applies, and the grid in the app shows the default as every cell ticked on the chat. Linking Telegram writes the default down as rows, so from then on the rows lead.

Critical classes always reach your email. Security notices, an open Sev1 or Sev2 incident and an exhausted AI budget are sent to your email whatever the destinations say, because they arrive when the chat you would otherwise read them on may be the thing that failed. Routing them to Telegram adds a message there; it never removes the email.

GET
/v1/me/alert-destinations

Requires ability

The token must hold this ability, or the call is refused with 403.

MCP tool

Runs the same action from an agent, behind the same ability.

Authorization

bearerToken
AuthorizationBearer <token>

A personal access token minted in the app under Account Settings, then API Tokens, sent as Authorization: Bearer zg_live_…. The token carries the abilities each endpoint lists under Requires ability and is frozen to one team, and optionally to one project, at mint time.

In: header

Responses

200OK

Array of AlertDestinationResource

401Unauthorized

The request carries no bearer token, or one that is revoked, malformed, or minted for another environment (a zg_test_ token on production).

403Forbidden

The token is valid but does not carry the ability this endpoint requires; error.context.required_ability names the one to grant. An endpoint that also checks who registered a row answers FORBIDDEN with the same status, and says so in its own description.

429Too many requests

The token has spent its 300 requests a minute or 10,000 an hour; Retry-After says when the next one is accepted.

How is this guide?

Last updated on