> ## Documentation Index > Fetch the complete documentation index at: https://docs.leen.dev/llms.txt > Use this file to discover all available pages before exploring further. # List Alerts > Retrieve cloud security posture alerts from the connected CSPM tool, normalised across vendors. ## OpenAPI ````yaml get /cspm/alerts openapi: 3.1.0 info: title: Leen Security API version: 0.0.1 servers: - description: Production API (US) url: https://api.leen.dev/v1 - description: Production API (EU) url: https://api.eu-c1.leen.dev/v1 - description: Production API (APAC) url: https://api.ap-se2.leen.dev/v1 security: [] paths: /cspm/alerts: get: tags: - cspm summary: List Alerts description: >- Retrieve cloud security posture alerts from the connected CSPM tool, normalised across vendors. operationId: get_cspm_alerts parameters: - description: >- Enable cursor based pagination instead of default offset-based pagination in: query name: enableCursor required: false schema: default: false description: >- Enable cursor based pagination instead of default offset-based pagination title: Enablecursor type: boolean - description: >- Only records whose `updated_at` is at or after this time. Leen bumps `updated_at` whenever any field on a record changes, so this is the filter for an incremental sync: it returns records that are new and records that changed, and nothing that has stood still. Example: `2021-01-01T00:00:00+00:00`. in: query name: updatedSince required: false schema: anyOf: - format: date-time type: string - type: 'null' description: >- Only records whose `updated_at` is at or after this time. Leen bumps `updated_at` whenever any field on a record changes, so this is the filter for an incremental sync: it returns records that are new and records that changed, and nothing that has stood still. Example: `2021-01-01T00:00:00+00:00`. examples: - '2021-01-01T00:00:00+00:00' title: Updatedsince - description: >- How many records to return per page. The walk is the same either way; a larger page means fewer round trips and more memory per response. in: query name: limit required: false schema: default: 100 description: >- How many records to return per page. The walk is the same either way; a larger page means fewer round trips and more memory per response. maximum: 500 minimum: 1 title: Limit type: integer - description: >- Where to start, counted in records. Offset paging is stable only while the underlying data is; prefer the cursor for anything long-running. in: query name: offset required: false schema: default: 0 description: >- Where to start, counted in records. Offset paging is stable only while the underlying data is; prefer the cursor for anything long-running. minimum: 0 title: Offset type: integer - description: >- Skip counting the total. Counting is the expensive half of a large query, so set this when you are walking every page anyway and never read `total`. `total` comes back null. in: query name: excludeTotal required: false schema: default: false description: >- Skip counting the total. Counting is the expensive half of a large query, so set this when you are walking every page anyway and never read `total`. `total` comes back null. title: Excludetotal type: boolean - description: >- Opaque position of the next page, taken from the previous response. Ignore its contents; it encodes where the walk had reached. in: query name: cursor required: false schema: anyOf: - type: string - type: 'null' description: >- Opaque position of the next page, taken from the previous response. Ignore its contents; it encodes where the walk had reached. title: Cursor responses: '200': content: application/json: schema: anyOf: - $ref: >- #/components/schemas/OffsetPaginatedResponse_CSPMAlertRespModel_ - $ref: >- #/components/schemas/KeySetPaginatedResponse_CSPMAlertRespModel_ title: Response Get Cspm Alerts description: Successful Response '422': content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' description: Unprocessable Content security: - API-Key: [] Connection-ID: [] components: schemas: OffsetPaginatedResponse_CSPMAlertRespModel_: properties: count: description: Number of items return in the response title: Count type: integer items: description: The records on this page. items: $ref: '#/components/schemas/CSPMAlertRespModel' title: Items type: array total: anyOf: - type: integer - type: 'null' description: Total number of items that can be returned title: Total required: - count - items title: OffsetPaginatedResponse[CSPMAlertRespModel] type: object KeySetPaginatedResponse_CSPMAlertRespModel_: properties: items: description: The records on this page. items: $ref: '#/components/schemas/CSPMAlertRespModel' title: Items type: array next_cursor: anyOf: - type: string - type: 'null' description: >- Opaque position of the next page. Pass it back as `cursor` to continue; null when this is the last page. title: Next Cursor previous_cursor: anyOf: - type: string - type: 'null' description: >- Opaque position of the previous page, for walking backwards. Null on the first page. title: Previous Cursor required: - items title: KeySetPaginatedResponse[CSPMAlertRespModel] type: object ErrorResponse: properties: code: description: Error code title: Code type: string detail: description: List of error dictionaries items: additionalProperties: true type: object title: Detail type: array message: description: Error message title: Message type: string type: description: Type of error title: Type type: string required: - type - code - message - detail title: ErrorResponse type: object CSPMAlertRespModel: properties: description: description: Full alert description, as the tool states it. title: Description type: string id: description: Leen's identifier for this alert. format: uuid title: Id type: string severity: description: >- Severity, normalised across tools so it can be compared and filtered. For the tool's own wording see `vendor_severity`. title: Severity type: string status: description: >- Status, normalised across tools. For the tool's own wording see `vendor_status`. title: Status type: string title: description: Alert title, as the tool states it. title: Title type: string vendor_data: anyOf: - additionalProperties: true type: object - type: 'null' description: Vendor specific pass through data, values can vary based on vendor title: Vendor Data vendor_id: description: The tool's own identifier for the alert. title: Vendor Id type: string vendor_severity: description: >- Severity exactly as the tool words it. Not comparable across tools -- one vendor's confidence level is another's numeric score -- but it is what their console shows. title: Vendor Severity type: string vendor_status: description: Status exactly as the tool words it. title: Vendor Status type: string required: - id - vendor_id - title - description - severity - vendor_severity - status - vendor_status title: CSPMAlert type: object securitySchemes: API-Key: in: header name: X-API-KEY type: apiKey Connection-ID: in: header name: X-CONNECTION-ID type: apiKey ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.