# List Monitoring alarms

> Source: https://truto.one/docs/api-reference/unified-cloud-infrastructure-api/monitoringalarms/list/

`GET /unified/cloud-infrastructure/monitoring_alarms`

Resource: **MonitoringAlarms** · API: **Unified Cloud Infrastructure API**

## Supported integrations

Amazon Web Services

## Query parameters

- **`integrated_account_id`** _(string, required)_
  The ID of the integrated account to use for the request.
- **`truto_response_format`** _(string)_
  The format of the response. - `unified` returns the response with unified mappings applied. - `raw` returns the unprocessed, raw response from the remote API. - `normalized` applies the unified mappings and returns the data in a normalized format. - `stream` returns the response as a stream, which is ideal for transmitting large datasets, files, or binary data. Using streaming mode helps to efficiently handle large payloads or real-time data flows without requiring the entire data to be buffered in memory. - `debug` returns the final unified result alongside raw remote fetch information. The response is an envelope containing `result` (identical to unified mode output) and `debug` (with `requestUrl`, `requestOptions`, `data`, `responseHeaders`, and for list operations: `nextCursor`, `isLooping`, `isEmptyResult`, `resultCount`). When the upstream body exceeds 1 MiB, `data` is replaced by `{ truto_truncated: true, truto_max_bytes, truto_excerpt }`. `debug` is `null` for static responses or when `truto_skip_api_call=true`. Defaults to `unified`.
  Allowed: `unified`, `raw`, `normalized`, `stream`, `debug`
- **`truto_key_by`** _(string)_
  By default the `result` attribute is an array of objects. This parameter allows you to specify a field in each `result` objects to use as key, which transforms the `result` array into an object with the array items keyed by the field. This is useful for when you want to use the result as a lookup table.
- **`truto_ignore_limit`** _(boolean)_
  Ignores the `limit` query parameter.
- **`truto_ignore_remote_data`** _(boolean)_
  Excludes the `remote_data` attribute from the response.
- **`truto_exclude_fields`** _(array<string>)_
  Array of fields to exclude from the response.
- **`remote_query`** _(object)_
  Query parameters to pass to the underlying API without any transformations. Refer [this guide](https://truto.one/docs/api-reference/overview/querying#remote-query-parameters) to see how to structure the query parameters.
- **`region`** _(string)_
  AWS region to read. CloudWatch is regional; one call reads one region.
- **`alarm_type`** _(string)_
  Which alarms to read: 'metric' (default) or 'composite'. AWS returns them from separate calls; call both for full coverage.
  Allowed: `composite`, `metric`
- **`fields`** _(array<string>)_
  Opt-in reads. Naming notifies_confirmed_subscriber or actions also reads each distinct SNS topic of the page once (sns:GetTopicAttributes, at most 25 per page) to fill has_confirmed_subscriber. Accepts fields[]=a&fields[]=b or a comma-separated string.

## Response body

- **`result`** _(array<object>)_
  List of Monitoring alarms
  - **`id`** _(string, required)_
    Truto's stable unified identifier for this object. Opaque; use provider_id to address the object in the provider's own console or API.
  - **`provider_id`** _(string)_
    The provider's own identifier, passed through verbatim — a full ARN, resource id, or self-link. Never truncated, prefixed, or normalized.
  - **`provider`** _(string)_
    Which cloud this object was read from.
    Allowed: `aws`, `azure`, `gcp`
  - **`account`** _(string)_
    The account, subscription or project this object belongs to.
  - **`region`** _(string)_
    Where the object is located. 'global' denotes genuinely global resources (e.g. IAM, GCP VPC networks) rather than a guessed region. A substituted region (when none is derivable) is flagged in unreadable_fields.
  - **`native_type`** _(string)_
    The provider's own type string, unmodified — for example 'AWS::S3::Bucket', 'aws_iam_role', 'Microsoft.Sql/servers'. Used for display and drill-down.
  - **`tags`** _(object)_
    Key-value pairs exactly as the customer set them: no case folding, key/value normalization, or merging of separate provider concepts. An empty object means no tags; tags that could not be read appear in unreadable_fields instead.
  - **`collected_at`** _(string)_
    When Truto actually read this object from the provider, in UTC ISO 8601 with the offset present — not the request time, and not a provider timestamp.
  - **`updated_at`** _(string)_
    When the object was last modified at the provider, in UTC ISO 8601. Null when the provider does not record one - see unreadable_fields.
  - **`created_at`** _(string)_
    When the object was created at the provider, in UTC ISO 8601. Null when the provider does not record one - see unreadable_fields.
  - **`unreadable_fields`** _(array<object>)_
    Fields on this object that could not be read, and why. An empty array means everything was read. Use this to tell a real value from a missing one.
    - **`field`** _(string)_
      The property on this resource that could not be read.
    - **`reason`** _(string)_
      Why the field could not be read. available_on_get: Not read on list to keep the list fast; call GET for this resource's id to get it.
      Allowed: `not_supported_by_provider`, `not_configured`, `permission_denied`, `not_collected`, `collection_error`, `partially_collected`, `available_on_get`
    - **`detail`** _(string)_
      Explanation of the reason, where one adds anything.
  - **`remote_data`** _(object)_
    Raw data returned from the remote API call.
  - **`name`** _(string)_
    The alarm's name, verbatim.
  - **`alarm_type`** _(string)_
    metric: watches one metric or a metric expression. composite: combines other alarms through a rule. The list reads one type per call (alarm_type query parameter). The provider's own value is in remote_data.
    Allowed: `metric`, `composite`
  - **`description`** _(string)_
    The alarm's description, verbatim.
  - **`state`** _(string)_
    Current alarm state. The provider's own value is in remote_data.
    Allowed: `ok`, `alarm`, `insufficient_data`, `unknown`
  - **`state_reason`** _(string)_
    Why the alarm is in its state, as the provider words it.
  - **`state_updated_at`** _(string)_
    When the state last changed.
  - **`actions_enabled`** _(boolean)_
    Whether the alarm runs its actions. False means it changes state silently.
  - **`metrics`** _(array<object>)_
    What a metric alarm watches: one entry for a single-metric alarm, or every metric and expression of a metric-math alarm. Empty for a composite alarm.
    - **`id`** _(string)_
      The entry's id inside a metric-math alarm. Null for a single-metric alarm.
    - **`expression`** _(string)_
      A metric-math expression. Null for a plain metric.
    - **`namespace`** _(string)_
      Metric namespace, verbatim (AWS/EC2, or a log metric filter's namespace).
    - **`name`** _(string)_
      Metric name, verbatim.
    - **`dimensions`** _(object)_
      Dimension name to value, exactly as set.
    - **`statistic`** _(string)_
      Statistic or percentile, verbatim (Average, Sum, p99 ...).
    - **`period_seconds`** _(integer)_
      Aggregation period in seconds.
    - **`returns_data`** _(boolean)_
      Whether this entry is the value the alarm evaluates.
  - **`comparison_operator`** _(string)_
    How the value is compared, normalised. outside_band, below_band and above_band compare against an anomaly-detection band instead of a threshold. Null for a composite alarm. The provider's own value is in remote_data.
    Allowed: `greater_than_or_equal`, `greater_than`, `less_than`, `less_than_or_equal`, `outside_band`, `below_band`, `above_band`, `unknown`
  - **`threshold`** _(number)_
    The threshold. Null for a composite alarm, or a band alarm that compares against another metric.
  - **`evaluation_periods`** _(integer)_
    How many periods are evaluated.
  - **`datapoints_to_alarm`** _(integer)_
    How many breaching periods within evaluation_periods make the alarm fire.
  - **`period_seconds`** _(integer)_
    Evaluation period of a single-metric alarm.
  - **`treat_missing_data`** _(string)_
    What missing data points count as. missing: the alarm looks further back for enough points; ignore: the current state is kept. Null for a composite alarm. The provider's own value is in remote_data.
    Allowed: `missing`, `not_breaching`, `breaching`, `ignore`, `unknown`
  - **`rule`** _(string)_
    A composite alarm's rule expression, verbatim. Null for a metric alarm.
  - **`actions`** _(array<object>)_
    What the alarm does on each state change.
    - **`on_state`** _(string)_
      The state change that triggers this action. The provider's own value is in remote_data.
      Allowed: `alarm`, `ok`, `insufficient_data`
    - **`target_id`** _(string)_
      The action target, verbatim (an ARN on AWS).
    - **`target_type`** _(string)_
      What kind of target it is. notification_topic: a pub/sub topic (SNS); scaling_policy: an autoscaling policy; instance_action: stop, terminate, reboot or recover a machine; incident_management: an OpsItem or incident; function: a serverless function. The provider's own value is in remote_data.
      Allowed: `notification_topic`, `scaling_policy`, `instance_action`, `incident_management`, `function`, `other`
    - **`notification_topic`** _(object)_
      The topic, when target_type is notification_topic.
      - **`id`** _(string)_
        The target's `id`.
    - **`has_confirmed_subscriber`** _(boolean)_
      For a notification topic: whether it has at least one confirmed subscription. Null for other targets, and for a topic that was not read: one in another account, or a read that failed (for an ALARM-state topic the notifies_confirmed_subscriber entry in unreadable_fields says which). Read on GET, or on the list with fields[]=notifies_confirmed_subscriber.
  - **`notifies_confirmed_subscriber`** _(boolean)_
    Whether the alarm, when it fires, reaches at least one person or system: actions are enabled and at least one ALARM-state action is a notification topic with a confirmed subscription. False when actions are disabled or no ALARM-state action is a topic. Null when a topic could not be read. Read on GET, or on the list with fields[]=notifies_confirmed_subscriber.
- **`next_cursor`** _(string)_
  The cursor to use for the next page of results. Pass this value as `next_cursor` in the query parameter in the next request to get the next page of results.
- **`debug`** _(object)_
  Present only when `truto_response_format=debug`. Contains raw fetch details: `requestUrl`, `requestOptions`, `data`, `responseHeaders`, `nextCursor`, `isLooping`, `isEmptyResult`, `resultCount`. `data` is the parsed upstream body; when its JSON form exceeds 1 MiB it is replaced by `{ truto_truncated: true, truto_max_bytes, truto_excerpt }`, where `truto_excerpt` is the leading bytes of that body. The same applies to a string `requestOptions.body`. `null` for static responses or when `truto_skip_api_call=true`.
  - **`requestUrl`** _(string)_
  - **`requestOptions`** _(object)_
  - **`data`** _(unknown)_
  - **`responseHeaders`** _(object)_
  - **`nextCursor`** _(string)_
  - **`isLooping`** _(boolean)_
  - **`isEmptyResult`** _(boolean)_
  - **`resultCount`** _(number)_

## Code examples

### Truto CLI

```bash
truto unified cloud-infrastructure monitoringalarms \
  -a '<integrated_account_id>' \
  -o json
```

### Truto TS SDK

```typescript
import Truto from '@truto/truto-ts-sdk';

const truto = new Truto({
  token: '<your_api_token>',
});

const result = await truto.unifiedApi.list(
  'cloud-infrastructure',
  'monitoringalarms',
  { integrated_account_id: '<integrated_account_id>' }
);

console.log(result);
```

### Truto Python SDK

```python
import asyncio
from truto_python_sdk import TrutoApi

truto_api = TrutoApi(token="<your_api_token>")

async def main():
    async for item in truto_api.unified_api.list(
        "cloud-infrastructure",
        "monitoringalarms",
        {"integrated_account_id": "<integrated_account_id>"}
    ):
        print(item)

asyncio.run(main())
```

### curl

```bash
curl -X GET 'https://api.truto.one/unified/cloud-infrastructure/monitoring_alarms?integrated_account_id=<integrated_account_id>' \
  -H 'Authorization: Bearer <your_api_token>' \
  -H 'Content-Type: application/json'
```

### JavaScript

```javascript
const integratedAccountId = '<integrated_account_id>';

const response = await fetch(`https://api.truto.one/unified/cloud-infrastructure/monitoring_alarms?integrated_account_id=${integratedAccountId}`, {
  method: 'GET',
  headers: {
    'Authorization': 'Bearer <your_api_token>',
    'Content-Type': 'application/json',
  },
});

const data = await response.json();
console.log(data);
```

### Python

```python
import requests

url = "https://api.truto.one/unified/cloud-infrastructure/monitoring_alarms"
headers = {
    "Authorization": "Bearer <your_api_token>",
    "Content-Type": "application/json",
}
params = {
    "integrated_account_id": "<integrated_account_id>"
}

response = requests.get(url, headers=headers, params=params)
print(response.json())
```