> ## Documentation index
> Fetch the complete documentation index at: https://developer.rhombus.com/llms.txt
> Use it to discover all available pages before exploring further.

# Get alert monitoring threat cases

> Get alert monitoring threat cases

```http
POST https://api2.rhombussystems.com/api/event/getAlertMonitoringThreatCases
```

EU organizations send the same request to `https://api2.eu.rhombussystems.com`.

## Authentication and parameters

- `x-auth-apikey` (header, required): Your Rhombus API key. Must be accompanied by the `x-auth-scheme` header set to `api-token` (or `partner-api-token` for partner endpoints).
- `Authorization` (header): instead of an API key, an OAuth access token (`Bearer <token>`) with the `read` scope.
- `x-auth-scheme` (header, string, default: `api-token`): Authentication scheme identifier. Use `api-token` or `partner-api-token` with the `x-auth-apikey` header, `api` or `partner-api` with `x-auth-apikey` plus a client certificate, `api-oauth-token` or `partner-api-oauth-token` with `x-auth-access-token`, and `federated-token` with `x-auth-ft`. A request with `Authorization: Bearer <token>` and no `x-auth-scheme` is treated as OAuth, and `federated-token` may also be sent as the `x-auth-scheme` and `x-auth-ft` query parameters. One of: `api-token`, `api`, `api-oauth-token`, `federated-token`, `partner-api-token`, `partner-api`, `partner-api-oauth-token`.
- `x-auth-org` (header, string<RUUID>): Client organization UUID (22-character RUUID), for partner credentials only. With it the call runs in that client organization with the partner support authority's role. Without it a partner credential runs as the partner organization, which outside the partner endpoints is deprecated (responses carry `Deprecation` and `Sunset: Tue, 05 Jan 2027 00:00:00 GMT`). A malformed value returns 400 `INVALID_AUTH_ORG`; a client organization the partner cannot access returns 403 `PARTNER_CLIENT_ACCESS_DENIED`.

## Request body

Content type: `application/json`. Request object for retrieving alert monitoring threat cases with filtering and pagination options.

- `afterTimestampMs` (integer<int64> | null): Filter for threat cases after this timestamp
- `beforeTimestampMs` (integer<int64> | null): Filter for threat cases before this timestamp
- `deviceFilter` (array<string<RUUID> | null> | null): List of device UUIDs to filter by
- `lastEvaluatedKey` (string | null)
- `lastTimestampMs` (integer<int64> | null): Last timestamp for pagination
- `lastUuid` (string<RUUID> | null): base 64 (url-safe) uuid string
- `locationFilter` (array<string<RUUID> | null> | null): List of location UUIDs to filter by
- `maxPageSize` (integer<int32> | null)
- `maxResults` (integer<int32> | null): Maximum number of results to return
- `mostRecent` (boolean | null): Whether to return only the most recent threat cases
- `statusFilter` (array<string> | null): List of threat case statuses to filter by

## Response 200

OK. Content type: `application/json`

- `error` (boolean | null)
- `errorCode` (string | null): Stable, machine-readable code for the failure (one of the ApiErrorCode catalog) when error is true. Branch on this, not on errorMsg.
- `errorMsg` (string | null)
- `lastEvaluatedKey` (string | null)
- `threatCases` (array<object> | null): List of threat cases matching the request criteria
- `warningMsg` (string | null)

## Errors

Also 400, 401, 403, 429, 500, 503 with the standard error body (`errorCode`, `errorMsg`): https://developer.rhombus.com/errors

## OpenAPI

````yaml
openapi: 3.0.1
info:
  title: Rhombus API
  version: "1.0"
servers:
  - description: Production Server
    url: https://api2.rhombussystems.com
security:
  - ApiKeyAuth: []
paths:
  /api/event/getAlertMonitoringThreatCases:
    post:
      description: Get alert monitoring threat cases
      operationId: getAlertMonitoringThreatCases
      parameters:
        - description: "Authentication scheme identifier. Use `api-token` or `partner-api-token` with the `x-auth-apikey` header, `api` or `partner-api` with `x-auth-apikey` plus a client certificate, `api-oauth-token` or `partner-api-oauth-token` with `x-auth-access-token`, and `federated-token` with `x-auth-ft`. A request with `Authorization: Bearer <token>` and no `x-auth-scheme` is treated as OAuth, and `federated-token` may also be sent as the `x-auth-scheme` and `x-auth-ft` query parameters."
          example: api-token
          in: header
          name: x-auth-scheme
          required: false
          schema:
            default: api-token
            enum:
              - api-token
              - api
              - api-oauth-token
              - federated-token
              - partner-api-token
              - partner-api
              - partner-api-oauth-token
            type: string
        - description: "Client organization UUID (22-character RUUID), for partner credentials only. With it the call runs in that client organization with the partner support authority's role. Without it a partner credential runs as the partner organization, which outside the partner endpoints is deprecated (responses carry `Deprecation` and `Sunset: Tue, 05 Jan 2027 00:00:00 GMT`). A malformed value returns 400 `INVALID_AUTH_ORG`; a client organization the partner cannot access returns 403 `PARTNER_CLIENT_ACCESS_DENIED`."
          in: header
          name: x-auth-org
          required: false
          schema:
            format: RUUID
            maxLength: 22
            minLength: 22
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/Event_GetAlertMonitoringThreatCasesWSRequest"
      responses:
        "200":
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Event_GetAlertMonitoringThreatCasesWSResponse"
          description: OK
        "400":
          $ref: "#/components/responses/BadRequest"
        "401":
          $ref: "#/components/responses/Unauthorized"
        "403":
          $ref: "#/components/responses/Forbidden"
        "429":
          $ref: "#/components/responses/TooManyRequests"
        "500":
          $ref: "#/components/responses/InternalServerError"
        "503":
          $ref: "#/components/responses/ServiceUnavailable"
      security:
        - ApiKeyAuth: []
        - oauth2:
            - read
      summary: Get alert monitoring threat cases
      tags:
        - Event Webservice
components:
  schemas:
    Event_GetAlertMonitoringThreatCasesWSRequest:
      description: Request object for retrieving alert monitoring threat cases with filtering and pagination options.
      properties:
        afterTimestampMs:
          description: Filter for threat cases after this timestamp
          example: 1640995200000
          format: int64
          nullable: true
          type: integer
        beforeTimestampMs:
          description: Filter for threat cases before this timestamp
          example: 1641081600000
          format: int64
          nullable: true
          type: integer
        deviceFilter:
          description: List of device UUIDs to filter by
          items:
            description: base 64 (url-safe) uuid string
            example: AAAAAAAAAAAAAAAAAAAAAA
            format: RUUID
            nullable: true
            type: string
          nullable: true
          type: array
        lastEvaluatedKey:
          nullable: true
          type: string
        lastTimestampMs:
          description: Last timestamp for pagination
          example: 1640995200000
          format: int64
          nullable: true
          type: integer
        lastUuid:
          description: base 64 (url-safe) uuid string
          example: AAAAAAAAAAAAAAAAAAAAAA
          format: RUUID
          nullable: true
          type: string
        locationFilter:
          description: List of location UUIDs to filter by
          items:
            description: base 64 (url-safe) uuid string
            example: AAAAAAAAAAAAAAAAAAAAAA
            format: RUUID
            nullable: true
            type: string
          nullable: true
          type: array
        maxPageSize:
          format: int32
          nullable: true
          type: integer
        maxResults:
          description: Maximum number of results to return
          example: 100
          format: int32
          nullable: true
          type: integer
        mostRecent:
          description: Whether to return only the most recent threat cases
          example: true
          nullable: true
          type: boolean
        statusFilter:
          description: List of threat case statuses to filter by
          items:
            $ref: "#/components/schemas/ThreatCaseStatusEnum"
          nullable: true
          type: array
      type: object
    ThreatCaseStatusEnum:
      enum:
        - INITIATED
        - REQUESTED
        - FOLLOW_ON
        - ESCALATED
        - PSAP_CONTACTED
        - VERIFIED
        - DISMISSED
        - CANCELLED
        - UNVERIFIABLE
        - TIMEOUT
        - ERROR
        - CLOSED
      type: string
    Event_GetAlertMonitoringThreatCasesWSResponse:
      description: Response object containing alert monitoring threat cases with pagination information.
      properties:
        error:
          nullable: true
          type: boolean
        errorCode:
          description: Stable, machine-readable code for the failure (one of the ApiErrorCode catalog) when error is true. Branch on this, not on errorMsg.
          nullable: true
          type: string
        errorMsg:
          nullable: true
          type: string
        lastEvaluatedKey:
          nullable: true
          type: string
        threatCases:
          description: List of threat cases matching the request criteria
          items:
            $ref: "#/components/schemas/AlertMonitoringThreatCaseType"
          nullable: true
          type: array
        warningMsg:
          nullable: true
          type: string
      type: object
    AlertMonitoringThreatCaseType:
      description: List of threat cases matching the request criteria
      properties:
        alertGroupingKeys:
          additionalProperties:
            nullable: true
            type: string
          nullable: true
          type: object
        alertGroupingStrategy:
          $ref: "#/components/schemas/AlertGroupingStrategyEnum"
        associatedDeviceUuids:
          additionalProperties:
            format: int64
            nullable: true
            type: integer
          nullable: true
          type: object
        createdAtMillis:
          format: int64
          nullable: true
          type: integer
        deleted:
          nullable: true
          type: boolean
        deviceUuid:
          description: base 64 (url-safe) uuid string
          example: AAAAAAAAAAAAAAAAAAAAAA
          format: RUUID
          nullable: true
          type: string
        locationName:
          nullable: true
          type: string
        locationUuid:
          description: base 64 (url-safe) uuid string
          example: AAAAAAAAAAAAAAAAAAAAAA
          format: RUUID
          nullable: true
          type: string
        noonlightAlarmId:
          nullable: true
          type: string
        noonlightVerificationId:
          nullable: true
          type: string
        orgUuid:
          description: base 64 (url-safe) uuid string
          example: AAAAAAAAAAAAAAAAAAAAAA
          format: RUUID
          nullable: true
          type: string
        policyAlertComponentCompositeUuids:
          items:
            description: base 64 (url-safe) uuid string
            example: AAAAAAAAAAAAAAAAAAAAAA
            format: RUUID
            nullable: true
            type: string
          nullable: true
          type: array
          uniqueItems: true
        policyAlertDeviceUuids:
          items:
            description: base 64 (url-safe) uuid string
            example: AAAAAAAAAAAAAAAAAAAAAA
            format: RUUID
            nullable: true
            type: string
          nullable: true
          type: array
          uniqueItems: true
        policyAlertUuid:
          description: base 64 (url-safe) uuid string
          example: AAAAAAAAAAAAAAAAAAAAAA
          format: RUUID
          nullable: true
          type: string
        policyAlertUuids:
          items:
            description: base 64 (url-safe) uuid string
            example: AAAAAAAAAAAAAAAAAAAAAA
            format: RUUID
            nullable: true
            type: string
          nullable: true
          type: array
          uniqueItems: true
        promptTheme:
          $ref: "#/components/schemas/NoonlightPromptThemeEnum"
        promptTitle:
          nullable: true
          type: string
        sharedClipGroupUuid:
          description: base 64 (url-safe) uuid string
          example: AAAAAAAAAAAAAAAAAAAAAA
          format: RUUID
          nullable: true
          type: string
        sirenSettings:
          $ref: "#/components/schemas/AMSirenSettingsType"
        status:
          $ref: "#/components/schemas/ThreatCaseStatusEnum"
        subLocationsHierarchyKey:
          description: |
            A sequence of one or more base 64 (url-safe) uuid substrings.
            These substrings are separated by dots (.).
          example: AAAAAAAAAAAAAAAAAAAAAA.AAAAAAAAAAAAAAAAAAAAAA.AAAAAAAAAAAAAAAAAAAAAA
          format: SubLocationsHierarchyKey
          nullable: true
          pattern: ^([A-Za-z0-9\-_]{22})([.][A-Za-z0-9\-_]{22})*$
          type: string
        submissionTimestampMs:
          format: int64
          nullable: true
          type: integer
        submitDelayExpireTimestampMs:
          format: int64
          nullable: true
          type: integer
        timelineEventList:
          items:
            $ref: "#/components/schemas/ThreatCaseTimelineEventType"
          nullable: true
          type: array
        uuid:
          description: base 64 (url-safe) uuid string
          example: AAAAAAAAAAAAAAAAAAAAAA
          format: RUUID
          nullable: true
          type: string
        verificationHistory:
          $ref: "#/components/schemas/VerificationHistory"
        verificationMode:
          $ref: "#/components/schemas/ThreatCaseVerificationModeEnum"
      type: object
    AlertGroupingStrategyEnum:
      enum:
        - ALARM_RULES
        - POLICY
        - CUSTOM_EVENTS
        - DOORBELL
        - MULTIPURPOSE_BUTTON
      type: string
    NoonlightPromptThemeEnum:
      enum:
        - THREAT
        - HUMAN
      type: string
    AMSirenSettingsType:
      properties:
        audioGateways:
          description: UUIDs of audio gateways used to play this siren.
          items:
            description: base 64 (url-safe) uuid string
            example: AAAAAAAAAAAAAAAAAAAAAA
            format: RUUID
            nullable: true
            type: string
          nullable: true
          type: array
          uniqueItems: true
        clipUuid:
          description: base 64 (url-safe) uuid string
          example: AAAAAAAAAAAAAAAAAAAAAA
          format: RUUID
          nullable: true
          type: string
        durationSeconds:
          description: The duration (in seconds) to loop the clip audio for the siren.
          format: int32
          nullable: true
          type: integer
        playCount:
          description: The number of times to play the clip audio for the siren.
          format: int32
          nullable: true
          type: integer
      required:
        - audioGateways
        - clipUuid
      type: object
    ThreatCaseTimelineEventType:
      properties:
        alertUuid:
          description: base 64 (url-safe) uuid string
          example: AAAAAAAAAAAAAAAAAAAAAA
          format: RUUID
          nullable: true
          type: string
        message:
          nullable: true
          type: string
        noonlightVerificationId:
          nullable: true
          type: string
        reviewerName:
          description: Reviewer name at the time the action was taken. For a shared PIN, this is the PIN name. For a user, including a user acting through their own PIN, this is the user's name. The value is null for actions not taken by a reviewer or for events recorded before the name was stored.
          nullable: true
          type: string
        reviewerPinUuid:
          description: base 64 (url-safe) uuid string
          example: AAAAAAAAAAAAAAAAAAAAAA
          format: RUUID
          nullable: true
          type: string
        reviewerType:
          $ref: "#/components/schemas/ThreatCaseReviewerTypeEnum"
        threatCaseStatus:
          $ref: "#/components/schemas/ThreatCaseStatusEnum"
        timestampSec:
          format: int64
          nullable: true
          type: integer
        type:
          $ref: "#/components/schemas/ThreatCaseTimelineEventTypeEnum"
        userUuid:
          description: base 64 (url-safe) uuid string
          example: AAAAAAAAAAAAAAAAAAAAAA
          format: RUUID
          nullable: true
          type: string
      type: object
    ThreatCaseReviewerTypeEnum:
      description: Type of reviewer who performed an action on a threat case.
      enum:
        - USER
        - SHARED_PIN
        - MONITORING_SERVICE
        - UNKNOWN
      type: string
    ThreatCaseTimelineEventTypeEnum:
      enum:
        - ALERT
        - DELAYED_ALERT
        - USER
        - SERVICE_PROVIDER
        - ERROR
        - PANIC_BUTTON
        - ACCESS_CONTROL_INTEGRATION
        - ALARM_INTEGRATION
        - UNKNOWN
      type: string
    VerificationHistory:
      properties:
        alertIndex:
          format: int32
          nullable: true
          type: integer
        currentVerification:
          $ref: "#/components/schemas/VerificationRecord"
        verificationRecords:
          items:
            $ref: "#/components/schemas/VerificationRecord"
          nullable: true
          type: array
      type: object
    VerificationRecord:
      properties:
        alertUuid:
          description: base 64 (url-safe) uuid string
          example: AAAAAAAAAAAAAAAAAAAAAA
          format: RUUID
          nullable: true
          type: string
        clipVerificationId:
          nullable: true
          type: string
        failedAsClip:
          nullable: true
          type: boolean
        failedAsStream:
          nullable: true
          type: boolean
        initiatedAsClip:
          nullable: true
          type: boolean
        sentAsClip:
          nullable: true
          type: boolean
        sentAsClipAtMs:
          format: int64
          nullable: true
          type: integer
        sentAsWindowedStream:
          nullable: true
          type: boolean
        sentAsWindowedStreamAtMs:
          format: int64
          nullable: true
          type: integer
        streamVerificationId:
          nullable: true
          type: string
        subLocationsHierarchyKey:
          description: |
            A sequence of one or more base 64 (url-safe) uuid substrings.
            These substrings are separated by dots (.).
          example: AAAAAAAAAAAAAAAAAAAAAA.AAAAAAAAAAAAAAAAAAAAAA.AAAAAAAAAAAAAAAAAAAAAA
          format: SubLocationsHierarchyKey
          nullable: true
          pattern: ^([A-Za-z0-9\-_]{22})([.][A-Za-z0-9\-_]{22})*$
          type: string
      type: object
    ThreatCaseVerificationModeEnum:
      enum:
        - EXTERNAL
        - INTERNAL
      type: string
  securitySchemes:
    ApiKeyAuth:
      description: Your Rhombus API key. Must be accompanied by the `x-auth-scheme` header set to `api-token` (or `partner-api-token` for partner endpoints).
      in: header
      name: x-auth-apikey
      type: apiKey
    oauth2:
      description: 'OAuth 2.0 authorization code flow with PKCE (`S256`). Send the access token as `Authorization: Bearer <token>`. Each operation lists the scopes it requires; a token without them is refused 403 with `WWW-Authenticate: Bearer error="insufficient_scope"`.'
      flows:
        authorizationCode:
          authorizationUrl: https://console.rhombus.com/oauth/authorize
          refreshUrl: https://auth-web.rhombussystems.com/oauth/token
          scopes:
            physical: Unlock doors and elevators, lockdown, alarms, speakers and robots
            read: View cameras, footage and settings
            write: Change settings and data
          tokenUrl: https://auth-web.rhombussystems.com/oauth/token
      type: oauth2
````