Skip to main content
An alert records that a risk rule is currently breaching. Every rule that fires opens exactly one alert, regardless of the rule’s outcome. Alerts have two states: ongoing and resolved.

​
How alerts open

The engine evaluates active rules against each new metric reading for the source they watch. When a reading crosses a rule, that rule’s alert opens as ongoing, captures the observed value and threshold at that moment, and emits the portfolio_wallet.risk.alert.triggered webhook. Rules also back-evaluate on creation: if a source is already breaching when you create or re-enable a rule, the alert opens right away rather than waiting for the next reading. An open alert stays ongoing across subsequent breaching readings. It is not re-raised on every reading.

​
How alerts resolve

Recovery is automatic. When a later reading no longer crosses the rule (the metric has moved back to the safe side of the threshold), the engine resolves the alert: it sets the status to resolved with a resolution_source of auto, and emits the portfolio_wallet.risk.alert.resolved webhook. What changes on resolution:
  • Allocation blocks lift. A prevent_additional_allocation rule stops blocking the source once its alert resolves.
  • Pending actions are rejected. Any action still waiting on the alert is rejected.
  • History is kept. The resolved alert remains queryable as a record of what happened.
Alerts can also resolve as a side effect of deleting a rule, which resolves the rule’s ongoing alert before removing the rule.

​
Query alerts

curl -X GET "$BASE_URL/v2/wallets/risk/alerts?status=ongoing" \
  -H "Authorization: Bearer $API_TOKEN"
Filter by status (ongoing or resolved) and scope to one or more wallets. Each alert includes the rule it came from, the metric, the observed value and threshold that triggered it, a human-readable explanation, and timestamps.
Pausing a rule does not resolve its existing alert. The alert stays ongoing but becomes inert, with nothing enforcing it while the rule is paused. To clear it, let the metric recover or delete the rule.

​
Monitoring

Subscribe to the alert webhooks and use them as your primary trigger:
  • portfolio_wallet.risk.alert.triggered
  • portfolio_wallet.risk.alert.resolved
See Webhooks for registration and signature verification. Because delivery is best-effort, back the webhooks with periodic GET /v2/wallets/risk/alerts?status=ongoing polling.

​
Next steps