Who rated this post

Hi CBarichello,

You are on the right path. You are missing a filter that would inform the API as to how far back to query for alerts. Here I am querying for resolved alerts from the last 3 hours via v2 POST:

# Get a 10 minute token
token=$(curl -X POST https://api2.prismacloud.io/login -H 'Content-Type: application/json' -d '{"username":"'$PRISMA_ACCESS_KEY_ID'","password":"'$PRISMA_SECRET_KEY'"}' | jq -r '.token')
# Body of the POST
body='{"detailed":"true","timeRange":{"type":"relative","value":{"amount":3,"unit":"hour"}},"filters":[{"name":"alert.status","operator":"=","value":"resolved"}]}'

curl -L -X POST 'https://api2.prismacloud.io/v2/alert?detailed=true' -H 'Content-Type: application/json; charset=UTF-8' -H 'Accept: */*' -H 'x-redlock-auth: '$token --data-raw "$body"

# Same thing via v2 GET
curl -L -X GET 'https://api2.prismacloud.io/v2/alert?timeType=relative&timeAmount=3&timeUnit=hour&detailed=true&alert.status=resolved' -H 'Accept: */*' -H 'x-redlock-auth: '$token