Filter that response alerts must match. Specified in CEL format. Note that filter expressions must be URL encoded.

Supported filter fields:

• id (string): unique alert identifier
• level (string): one of Critical, Error, Warning, Informational, NoData, None
• status (string): one of Active, Ended, Retracted
• monitor.id (int): ID of the monitor that generated the alert
• monitor.label (string): display label of the monitor (supports .contains(), .startsWith(), .endsWith())
• muted (bool): whether the alert is muted (true / false)
• context.<key> (string): context value by key, where <key> is a GroupBy column name from the monitor definition. Use dot notation to access context fields. Supports .contains(), .startsWith(), .endsWith().

A comma-separated list of field expressions to sort by. Prefix a field with - for descending order (default is ascending). Default sort is by start time, descending.

Start of the time range to query. Alerts that overlap this range are returned (i.e., alerts whose end time is after startTime, or that are still active). Defaults to 24 hours ago if not provided.

End of the time range to query. Alerts whose start time is before endTime are returned. Defaults to current time if not provided.

A single timestamp to query alerts that were active at that moment. Returns alerts where start <= activeAt and (end >= activeAt or the alert is still active). Mutually exclusive with startTime and endTime — if both are provided, returns 400.