Security alerts API: GET /agent_logs-Alibaba Cloud Model Studio(Model Studio)-阿里云帮助中心

Query the security alert list with cursor-based pagination. Supports filters such as risk level, handling status, and asset type.

Prerequisites

Configure the endpoint and authentication first. See API overview and authentication.

Endpoint

GET /agent_logs

Query the security alert list with cursor-based pagination. Supports filters such as risk level, handling status, and asset type.

Request parameters

Parameter	Required	Type	Description
`current_page`	No	integer	Current page number, default 1
`page_size`	No	integer	Page size, default 20
`risk_level`	No	string	Risk level filter: `high` / `medium` / `low`
`status`	No	string	Handling status filter
`status_list`	No	array	Handling status batch filter (multiple values)
`risk_name`	No	string	Risk name filter
`app_name`	No	string	Application name filter
`asset_type`	No	string	Asset type filter: `agent` / `tool` / `skill` / `knowledge_base` / `memory` / `channel`
`vendor`	No	string	Vendor filter
`order_by`	No	string	Sort field, default `check_time`
`order`	No	string	Sort direction: `asc` / `desc`, default `desc`
`lang`	No	string	Language: `zh` / `en`

Request example

curl -X GET "$BASE_URL/agent_logs?current_page=1&page_size=20&risk_level=high&order_by=check_time&order=desc&lang=zh" \
  -H "Authorization: Bearer $BAILIAN_API_KEY"

BASE_URL is https://{workspace_id}.cn-beijing.maas.aliyuncs.com/api/v1/agentstudio/security, and BAILIAN_API_KEY is your Alibaba Cloud Bailian API Key.

Response body

Field	Type	Description
`stats`	object	Statistics: `total` count, and `high` / `medium` / `low` grouped by level
`data`	array	Alert list, item fields in the table below
`next_page`	integer	Cursor page number, `null` on the last page

List item fields:

Field	Type	Description
`alert_id`	string	Alert ID, numeric, used for detail queries
`risk_level`	string	Risk level: `high` / `medium` / `low`
`risk_name`	string	Risk name
`risk_desc`	string	Risk description
`asset_type`	string	Asset type
`asset_name`	string	Asset name
`app_id`	string	Application ID
`app_name`	string	Application name
`agent_name`	string	Agent name
`status`	string	Handling status: `unhandled` / `handling` / `intercepted`, etc.
`source`	string	Source: `aiguard` / `Agent-Runtime-Guard` / `cspm`, etc.
`check_time`	string	Check time, millisecond timestamp string
`handle_time`	string	Handling time, millisecond timestamp string

Response example

{
  "success": true,
  "data": {
    "stats": {"total": 15, "high": 3, "medium": 7, "low": 5},
    "data": [
      {
        "alert_id": "4289016",
        "risk_level": "high",
        "risk_name": "Prompt Injection Attack",
        "risk_desc": "Prompt leakage, request intercepted",
        "asset_type": "agent",
        "asset_name": "demo_agent",
        "app_id": "app-1001",
        "app_name": "demo_application",
        "agent_name": "demo_agent",
        "status": "intercepted",
        "source": "Agent-Runtime-Guard",
        "check_time": "1788365324000",
        "handle_time": null
      }
    ],
    "next_page": null
  }
}