List your alert destinations
/v1/me/alert-destinations in the Alert Destinations API.
Your destinations, primary first.
kindisemailortelegram(push_deviceis reserved for the mobile apps).targetis your email address foremail, or the linked chat's id fortelegram.classeslists the alert classes routed here, isnullfor every class, or is[]for none (the destination is kept but receives nothing).is_primarymarks the destination of your linked Telegram chat. It is derived from the link, never set through this API.
Until you write a destination, you are on the default: every class goes to your linked Telegram chat when there is one, and email carries what nothing else does. The list is empty while the default applies, and the grid in the app shows the default as every cell ticked on the chat. Linking Telegram writes the default down as rows, so from then on the rows lead.
Critical classes always reach your email. Security notices, an open Sev1 or Sev2 incident and an exhausted AI budget are sent to your email whatever the destinations say, because they arrive when the chat you would otherwise read them on may be the thing that failed. Routing them to Telegram adds a message there; it never removes the email.
Requires ability
The token must hold this ability, or the call is refused with 403.
MCP tool
Runs the same action from an agent, behind the same ability.
Authorization
bearerToken A personal access token minted in the app under Account Settings, then API Tokens, sent as Authorization: Bearer zg_live_…. The token carries the abilities each endpoint lists under Requires ability and is frozen to one team, and optionally to one project, at mint time.
In: header
Responses
200OKapplication/json
Array of AlertDestinationResource
401UnauthorizedAUTHENTICATION_REQUIREDapplication/json
The request carries no bearer token, or one that is revoked, malformed, or minted for another environment (a zg_test_ token on production).
403ForbiddenTOKEN_MISSING_ABILITYapplication/json
The token is valid but does not carry the ability this endpoint requires; error.context.required_ability names the one to grant. An endpoint that also checks who registered a row answers FORBIDDEN with the same status, and says so in its own description.
429Too many requestsRATE_LIMITEDapplication/json
The token has spent its 300 requests a minute or 10,000 an hour; Retry-After says when the next one is accepted.
How is this guide?
Last updated on