Stay organized with collections
Save and categorize content based on your preferences.
See Query filters for reference
on filter syntax, and review the filter examples below.
Fields supported by alerts.list
Filter fields
alertId
Should be used to filter alerts based on alert id.
Corresponding value should be of type: string.
type
Should be used to filter alerts based on alert type.
Corresponding value should be of type: string. Possible values
for this filter are listed in the Alert.type field description.
source
Should be used to filter alerts based on alert source.
Corresponding value should be of type: string. Possible values
for this filter are listed in the Alert.type field description.
createTime
Should be used to filter alerts based on alert creation time.
Corresponding value should be of type: string (Timestamp
format);
more specifically, an RFC 3339 date-time
string, for example, "2018-01-01T00:00:00Z"
startTime
Should be used to filter alerts based on alert start time.
Corresponding value should be of type: string (Timestamp
format);
more specifically, an RFC 3339 date-time
string, for example, "2018-01-01T00:00:00Z"
endTime
Should be used to filter alerts based on alert end time.
Corresponding value should be of type: string (Timestamp
format);
more specifically, an RFC 3339 date-time
string, for example, "2018-01-01T00:00:00Z"
List query examples
To query for all alerts created on or after April 5, 2018: createTime >= "2018-04-05T00:00:00Z"
To query for all alerts from the source "Gmail phishing": source:"Gmail phishing"
To query for all alerts that started in 2017: startTime >= "2017-01-01T00:00:00Z&" AND startTime < "2018-01-01T00:00:00Z"
To query for all user-reported phishing alerts from the source "Gmail phishing": type:"User reported phishing" source:"Gmail phishing"
Fields supported by alerts.feedback.list
Filter fields
alertId
Should be used to filter alert feedback based on alert id.
Corresponding value should be of type: string.
Can be used to list feedback for selected alerts in one call when the '-' wildcard is used
in request's alertId.
feedbackId
Should be used to filter alert feedback based on feedback id.
Corresponding value should be of type: string.
Feedback list query examples
To query feedback of alerts with ids alertId01 or alertId02: alertId = alertId01 OR alertId = alertId02
To query feedback of an alert alertId01 with feedback id feedbackId01: alertId = alertId01 AND feedbackId = feedbackId01
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Missing the information I need","missingTheInformationINeed","thumb-down"],["Too complicated / too many steps","tooComplicatedTooManySteps","thumb-down"],["Out of date","outOfDate","thumb-down"],["Samples / code issue","samplesCodeIssue","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2024-12-19 UTC."],[[["`alerts.list` allows filtering by alert properties such as ID, type, source, and creation, start, and end times using specific syntax and data types."],["`alerts.feedback.list` enables filtering feedback by alert ID and feedback ID, supporting queries for multiple alerts or specific feedback entries."],["Refer to the provided [Query filters](/admin-sdk/alertcenter/guides/query-filters) documentation for detailed filter syntax and usage instructions."],["Several practical filter examples are included to demonstrate how to construct queries for various scenarios, such as retrieving alerts based on time ranges or specific criteria."]]],[]]
