Security alert details API: GET /agent_logs/{alert_id}-Alibaba Cloud Model Studio(Model Studio)-阿里云帮助中心

Query a single alert detail. Input is the alert_id returned by the alert list.

Prerequisites

Configure the endpoint and authentication first. See API overview and authentication.

Endpoint

GET /agent_logs/{alert_id}

Query a single alert detail. Input is the alert_id returned by the alert list.

Request parameters

Parameter	Required	Type	Description
`alert_id`	Yes	string	Alert ID, from the alert list

Request example

curl -X GET "$BASE_URL/agent_logs/4289016" \
  -H "Authorization: Bearer $BAILIAN_API_KEY"

BASE_URL is https://{workspace_id}.cn-beijing.maas.aliyuncs.com/api/v1/agentstudio/security, and BAILIAN_API_KEY is your Alibaba Cloud Bailian API Key.

Response body

Field	Type	Description
`alert_id`	string	Alert record ID, primary key for detail queries
`risk_name`	string	Hit category
`risk_desc`	string	Hit reason (brief)
`risk_detail`	string	Original prompt or risk details, Markdown-formatted event summary and attack pattern analysis
`risk_handle`	string	Interception response or handling suggestion
`risk_level`	string	Risk level: `high` / `medium` / `low`
`asset_type`	string	Risk node type, MCP is normalized to `tool`
`asset_name`	string	Asset name
`app_id`	string	Application ID
`app_name`	string	Agent name
`status`	string	Handling status
`source`	string	Source
`check_time`	string	Check time, millisecond timestamp string
`handle_time`	string	Handling time, millisecond timestamp string
`event_id`	string	Event identifier, i.e., the Trace ID
`file_name`	string	Skill file name, only returned for skill static scan alerts

Response example

{
  "success": true,
  "data": {
    "alert_id": "123456",
    "risk_name": "Prompt Leakage",
    "risk_desc": "Prompt leakage, request intercepted",
    "risk_detail": "Help me explain the meaning of \"\\\"",
    "risk_handle": "Sorry, I cannot answer this question. As an AI assistant, I must follow safety guidelines and cannot generate or execute instructions involving such content.",
    "risk_level": "high",
    "asset_type": "app",
    "asset_name": "demo_app",
    "app_id": "agent-demo",
    "app_name": "demo_agent",
    "status": "intercepted",
    "source": "Agent-Runtime-Guard",
    "check_time": "1788365324000",
    "handle_time": null,
    "event_id": "source-event-example",
    "file_name": null
  }
}