Create alert escalation policy

A predefined action to be taken when an alert is not acknowledged.

Leave Feedback

URL

POST https://{api-url}/api/v2/tenants/{tenantId}/escalations

Sample URLs

https://{api-url}/api/v2/tenants/client_9/escalations

Parameters

N/A indicates that the value is not applicable.

FieldSub-FieldsData TypeDescription
nameN/AStringValue: N/A

Description: Escalation policy name.
descriptionN/AStringValue: N/A

Description: (Optional) Escalation policy description.
resourcesID or TypeStringResource values:
  • Resource ID
  • Resource type:
    • DEVICE
    • DEVICEGROUP
    • SERVICEGROUP
    • LOCATION
    • CLIENT


Description: Resources on which the policy would be applied.
  • Resource ID
  • Resource type Example: DEVICE. Use the following APIs to fetch the resource types:
    • Search Devices or Get Minimal Details of Resources API to fetch the list of devices or resources in a client.
    • Get Child Device Groups and Get Root Level Device Groups to fetch the list of device groups.
    • Get Service Groups to fetch the list of service groups.
    • Search Sites to fetch the list of sites.
    • Search Clients to fetch the list of clients. Only partner users have permission to fetch the details of client.
filterCriteriamatchingTypeStringValues: ALL, ANY

Description: (Optional) Define alert conditions for the policy. Only the filtered alerts are escalated. All the alerts on the resource will match this policy if NO condition is defined. Match ANY or ALL of the filter rules.
filterCriteriakey ruleStringValues:
  • Alert: Description
  • Alert: Event Type
  • Alert: Healed Time
  • Alert: Metric
  • Alert: No of Occurrence
  • Alert: Source
  • Alert: State
  • Alert: Subject
  • Alert: Type
  • Alert: Update Time
  • Resource: Aws Account Id
  • Resource: Aws Instance Name
  • Resource: Instance Id
  • Resource: Resource IP
  • Resource: Resource Name
  • Resource: Resource Type


Description: Unique attribute to filter the alert. Use Get Alert Types API to fetch the list of alert types.
  • Alert: Occurrence
  • Frequency: Escalate alerts which trigger repeatedly despite Acknowledge/Suppress actions.

The following are the fields for alert occurrence frequency:

  • occurrences:
    • Datatype: Integer
    • Description: Rate at which an alert triggers repeatedly over a particular duration. Example: 5
  • frequency:
    • Data Type: Integer
    • Description: Duration in which alert triggers repeatedly. Example: 2
  • frequencyType:
    • Data Type: String
    • Description: Provide the type of duration.Supported values: hours, days, weeks. Example: days

Consider a scenario where a user wants to escalate alerts which trigger repeatedly for 5 times in 2 days. For this scenario, the values are:
"occurrences": 5, "frequency": 2, "frequencyType": "days"

filterCriteriaoperator ruleStringValues: Contains, Not Contains, Equals, Not Equals, Starts with, Ends with, Regex, Is

Description: Operating values to filter the resource types. Operators Is and Is Not are applicable only for "key": "Resource: Resource Type"
filterCriteriavalue ruleStringValue: N/A

Description: Unique information of alert. Example: Critical.
Example for filter rules: key: Alert: Subject, operator: Contains, value: Critical, this implies that filter the alerts that contain the subject critical.
escalationTypeN/AStringValues:
  • MANUAL
  • AUTOMATIC_UNTIL_ACKNOWLEDGED_CLOSED_SUPPRESSED_TICKETED
  • AUTOMATIC_UNTIL_ACKNOWLEDGED_CLOSED_SUPPRESSED
Description: Escalation rules are actions to be taken when an alert is not acknowledged within the desired time. Both manual and automatic escalation types are supported.

Parameters for manual escalationType

The following tables provides detailed parameters for an escalationType of MANUAL.

Manual Escalation Type
FieldSub-FieldsData TypeDescription
escalationsrecipients ID (or) nameStringValue: N/A

Description: Users to contact directly. User ID or name.
escalationstypeStringValues:
  • USERS
  • USER GROUPS
  • ROSTERS
  • USERGROUP_DL


Description: User type.
Tips for retrieving user types for the escalation:
  • Search users to retrieve a list of users.
  • Search user groups to retrieve a list of user groups.
  • Retrieve the user group distributed list and use the user group IDs which have a distributed list of email addresses.

Parameters for automatic escalationType

The following tables provides detailed parameters for the following escalationType:

  • AUTOMATIC_UNTIL_ACKNOWLEDGED_CLOSED_SUPPRESSED_TICKETED
  • AUTOMATIC_UNTIL_ACKNOWLEDGED_CLOSED_SUPPRESSED
Automatic Escalation Type
FieldSub-FieldsData TypeDescription
escalationswaitMinsIntegerValues:
  • 0 to 30 mins, 45 mins
  • 1 to 6 hours, 12 hours
  • 1 day, 3 days, 5 days, 7 days, 10 days


Description: Configure the time interval to escalate an alert after it is generated. Escalate after the alert has elapsed the set time.
Convert hours and days to minutes and provide the minutes time format.
Example: For 6 hours provide the value as 360 minutes.
escalationsactionStringValues: NOTIFICATION or INCIDENT

Description: Escalation action to be taken. Escalate as Notification implies to send periodic notifications to users until the alert is acknowledged. Escalate as Incident implies to automatically create an incident from the alert and assign it to the desired user or team.
escalationsaction: NOTIFICATIONrecipients ID or nameStringValue: N/A

Description: Recipients ID or name who would receive the alert notifications.
escalationsaction: NOTIFICATIONrecipient typeStringValue: Recipient types:
  • USER
  • USER GROUPS
  • ROSTERS
  • USERGROUP_DL


Description: Recipient types who would receive the alert notifications. For example: USER.
Tips for retrieving recipient types:
  • Search users to retrieve a list of users.
  • Search user groups to retrieve a list of user groups.
  • Search rosters to retrieve a list of rosters.
  • Obtain user groups which have distributed list of email addresses and provide the user group IDs that have distributed list of email addresses.
escalationsaction: NOTIFICATIONpriorityStringValues:
  • Very Low
  • Low
  • Normal
  • High
  • Urgent


Description: Priority of the notification.
escalationsaction: NOTIFICATIONrepeatFrequencyIntegerValues: repeatFrequency is represented in minutes format.
  • 5 mins
  • 10 mins
  • 15 mins
  • 30 mins
  • 60 mins
  • 120 mins
  • 180 mins
  • 240 mins
  • 360 mins
  • 480 mins
  • 720 mins
  • 1440 mins


Description: The time interval in which user receives repeated notifications. When a repeat frequency is not provided, the default repeatFrequency is 15 mins.
escalationsaction: NOTIFICATIONnotifyLimitCountIntegerValues: 1 through 10
Description: Number of repeated notifications a user has to receive within a certain time interval.

For example, if repeatFrequency: 15 and notifyLimitCount: 5, it indicates that user receives notifications every 15 minutes and stops receiving after 5 notifications.

Note: When a notification limit count is not provided, the default notifyLimitCount is 2.
escalationsaction: NOTIFICATIONalertStateTransitionFromStringValues: CRITICAL, WARNING

Description: Escalate alerts as notification on a change in alert state.

For example, escalate alerts as notification when alert state changes from Warning to Critical. The notification is a one-time notification sent at the time of the state transition.
escalationsaction: INCIDENT (create new incident)incident: Assignee groupstringValues: uniqueId or name

Description: An incident is automatically created from the alert and assigned to the desired user or team. Escalate the incident to a user group responsible for working on the incident.

Note: The escalation ends when an incident is created from the alert. After that, adding further level of escalation is not possible.
escalationsaction: INCIDENT (create new incident)incident: AssignStringValues: Id or name

Description: An incident is automatically created from the alert and assigned to the desired user or team. Escalate incident to a user.

Note: The escalation ends when an incident is created from the alert. After that, adding further level of escalation is not possible.
escalationsaction: INCIDENT (create new incident)incident: CustomFieldsStringValues: Id, name, or value

Description: An incident is automatically created from the alert and assigned to the desired user or team. User customized fields. Additional information of incident is added by creating custom fields.

Note: The escalation ends when an incident is created from the alert. After that, adding further level of escalation is not possible.

To obtain custom forms associated with an incident, retrieve incident custom fields.
escalationsaction: INCIDENT (create new incident)incident: businessImpactStringValues: uniqueId

Description: An incident is automatically created from the alert and assigned to the desired user or team. The severity of an incident on the business.

Note: The escalation ends when an incident is created from the alert. After that, adding further level of escalation is not possible.

To retrieve a list of defined business impacts, get business impacts information.
escalationsaction: INCIDENT (create new incident)incident: urgencyStringValues: uniqueId

Description: An incident is automatically created from the alert and assigned to the desired user or team. Urgency to prioritize and work on the incident.

Note: The escalation ends when an incident is created from the alert. After that, adding further level of escalation is not possible.

To retrieve a list of defined urgencies, retrieve urgencies.
escalationsaction: INCIDENT (create new incident)incident: PriorityStringValues: Low, Normal, High, Urgent, Very Low

Description: An incident is automatically created from the alert and assigned to the desired user or team. Priority of the incident. This can be defined with respect to business impact and urgency.

Note: The escalation ends when an incident is created from the alert. After that, adding further level of escalation is not possible.
escalationsaction: INCIDENT (create new incident)incident: CC: to EmailStringValues: N/A

Description: An incident is automatically created from the alert and assigned to the desired user or team. User receives the incident notifications via email.

Note: The escalation ends when an incident is created from the alert. After that, adding further level of escalation is not possible.
escalationsaction: INCIDENT (update incident)updateIncident: noneStringValues: True/False

Description: Configure how to update an existing incident of an escalated alert. Either none or withAlertState is required. Update incident with respect to alert state. The latest description is appended on the alert. No change to the status of the incident is made based on escalated alert's state.

Note: If an open incident (other than closed) is available for the alert, the incident gets updated instead of creating a new incident.
escalationsaction: INCIDENT (update incident)updateIncident: withAlertStateStringValues: True/False

Description: Configure how to update an existing incident of an escalated alert. Either none or withAlertState is required. The incident gets updated every time the escalated alert repeats with a state change.

Note: If an open incident (other than closed) is available for the alert, the incident gets updated instead of creating a new incident.
escalationsaction: INCIDENT (update incident)priorityRules: keyStringValues: Value for key is currentState.code.

Description: Update incident priority based on unique attribute of the alert. Example: Alert State.
escalationsaction: INCIDENT (update incident)priorityRules: operatorStringValues: Supported value for operator -Is.

Description: Operating values to filter the incident. Example: Is.
escalationsaction: INCIDENT (update incident)priorityRules: valueStringValues: Supported priority values are warning and critical.

Description: Status of incident. Example: Critical
escalationsaction: INCIDENT (update incident)priorityRules: businessImpactStringValues: Unique Id of business impact.

Description: Severity of an incident on the business.

Note: To retrieve a list of defined business impacts, use the get business impacts API.
escalationsaction: INCIDENT (update incident)priorityRules: urgencyStringValues: Urgency to prioritize the incident

Description: Urgency to prioritize and work on the incident.

Note: To retrieve a list of defined urgencies, use the get urgencies API.
escalationsaction: INCIDENT (update incident)priorityRules: priorityStringValues: Low, Normal, High, Urgent, Very Low.

Description: Priority of the incident. This can be defined with respect to business impact and urgency.
escalationsaction: INCIDENT (update incident)notifyIncident: whenAlertStateChangedStringValues: N/A

Description: (Required) Notify users when incident is updated due to change in alert state.

Sample 1: AUTOMATIC_UNTIL_ACKNOWLEDGED_CLOSED_SUPPRESSED_TICKETED

This sample code creates an escalation alert policy with an escalationType of AUTOMATIC_UNTIL_ACKNOWLEDGED_CLOSED_SUPPRESSED_TICKETED.

Sample 1 request

{
	"name": "Create escalate alert policy API",
	"description": "Test description",
	"resources": [{
			"id": "bf3a10a2-92f1-4610-b3f4-174ed83db7b9",
			"type": "RESOURCE"
		},
		{
			"id": "DGP-0b165e70-7152-49f1-bfe3-ebe77409d5f2",
			"type": "DEVICEGROUP"
		},
		{
			"id": "SGP-11f1a6a8-acc8-411f-86c1-b693dd8e9817",
			"type": "SERVICEGROUP"
		},
		{
			"id": "7_AWS",
			"type": "LOCATION"
		},
		{
			"id": "client_7",
			"type": "CLIENT"
		}
	],
	"filterCriteria": {
		"matchingType": "ANY",
		"rules": [{
			"key": "Alert  : Description",
			"operator": "CONTAINS",
			"value": "critical"
		}, {
			"key": "Alert : Occurrence Frequency",
			"operator": "GREATERTHANOREQUALTO",
			"value": {
				"occurrences": "5",
				"frequency": "2",
				"frequencyType": "hours"
			}
		}, {
			"key": "Resource : Resource Type",
			"operator": "MATCH",
			"value": "DEVICE"
            	}]
	},
	"escalationType": "AUTOMATIC_UNTIL_ACKNOWLEDGED_CLOSED_SUPPRESSED_TICKETED",
	"escalations": [{
			"waitMins": 5,
			"priority": "Low",
			"repeatFrequency": 5,
			"notifyLimitCount": 2,
			"action": "NOTIFICATION",
			"recipients": [{
					"id": "USR0000000028",
					"name": "AP_User",
					"type": "USER"
				},
				{
					"id": "USRGRP-9498fc95-67b7-3477-953f-1ec70bf0c61d",
					"name": "Cloud group",
					"type": "USERGROUP"
				},
				{
					"id": "ES-de9bfd9f-d8ee-430f-4bc0-e6e4645cdb47",
					"name": "Cloud roster",
					"type": "ROSTER"
				},
				{
					"id": "USRGRP-9498fc95-67b7-3477-953f-1ec70bf0c61d",
					"name": "Ops group",
					"type": "USERGROUP_DL"
				}
			]
		},
		{
			"waitMins": 5,
			"action": "INCIDENT",
			"updateIncident": {
				"none": "true",
				"withAlertState": "true",
				"priorityRules": [{
					"key": "currentState.code",
					"operator": "Is",
					"value": "Warning",
					"businessImpact": {
						"uniqueId": "SIMPACT-e8853b21-ebc5-dd1d-d9a3-7a7b121a5e0f"
					},
					"urgency": {
						"uniqueId": "SURG-09358506-4af1-4d35-b902-cd3b14a00c10"
					},
					"priority": "High"
				}]
			},
			"notifyIncident": "whenAlertStateChanged",
			"incident": {
				"priority": "Very Low",
				"assigneeGroup": {
					"uniqueId": "USRGRP-4189ae2e-bcf5-f686-26d0-8b6eabd91558",
					"name": "Test Group"
				},
				"assignedUser": {
					"id": "USR0000000030",
					"loginName": "OpsAdmin"
				},
				"businessImpact": {
					"uniqueId": "SIMPACT-e8853b21-ebc5-dd1d-d9a3-7a7b121a5e0f"
				},
				"urgency": {
					"uniqueId": "SURG-09358506-4af1-4d35-b902-cd3b14a00c10"
				},
				"customFields": [{
						"id": "UDF0000000002",
						"name": "test_cutom_2",
						"value": "2"
					},
					{
						"id": "UDF0000000004",
						"name": "esc_custom_field_4",
						"value": "request custom field - text"
					}
				],
				"cc": "tester1@opsramp.com",
				"toEmail": "tester2@opsramp.com"
			}
		}
	]
}

Sample 1 response

{
	"id": "POLICY-e29f63f3-951a-4b41-a2a9-94835f6e9a42",
	"name": "Create escalate alert policy API",
	"description": "Test description",
	"policyType": "ESCALATION_POLICY",
	"clientMatchingType": "ALL",
	"createdDate": "2017-05-15T10:35:51+0000",
	"updatedDate": "2017-05-15T10:35:51+0000",
	"active": true,
	"enabledMode": "ON",
	"scope": {
		"id": 7,
		"uniqueId": "client_7",
		"name": "Netenrich  Client",
		"activated": true
	},
	"createdBy": {
		"loginName": "ops_admin_user",
		"firstName": "Ops Admin",
		"email": "tester1@opsramp.com"
	},
	"updatedBy": {
		"loginName": "ops_admin_user",
		"firstName": "Ops Admin",
		"email": "tester1@opsramp.com"
	},
	"resources": [{
			"id": "bf3a10a2-92f1-4610-b3f4-174ed83db7b9",
			"name": "LPT00001",
			"type": "RESOURCE"
		},
		{
			"id": "7_AWS",
			"name": "AWS",
			"type": "LOCATION"
		},
		{
			"id": "DGP-0b165e70-7152-49f1-bfe3-ebe77409d5f2",
			"name": "Test Group",
			"type": "DEVICEGROUP"
		},
		{
			"id": "SGP-11f1a6a8-acc8-411f-86c1-b693dd8e9817",
			"name": "Test SG",
			"type": "SERVICEGROUP"
		},
		{
			"id": "client_6",
			"name": "Ops Client",
			"type": "CLIENT"
		}
	],
	"filterCriteria": {
		"matchingType": "ALL",
		"rules": [{
			"key": "Alert  : Description",
			"operator": "CONTAINS",
			"value": "critical"
		}, {
			"key": "Alert : Occurrence Frequency",
			"operator": "GREATERTHANOREQUALTO",
			"value": {
				"occurrences": "5",
				"frequency": "2",
				"frequencyType": "hours"
			}
		},{
			"key": "Resource : Resource Type",
			"operator": "MATCH",
			"value": "DEVICE"
		}]
	},
	"escalationType": "AUTOMATIC_UNTIL_ACKNOWLEDGED_CLOSED_SUPPRESSED_TICKETED",
	"escalations": [{
			"waitMins": 5,
			"priority": "Low",
			"repeatFrequency": 5,
			"notifyLimitCount": 2,
			"action": "NOTIFICATION",
			"recipients": [{
					"id": "USR0000000028",
					"name": "AP_User",
					"type": "USER"
				},
				{
					"id": "USRGRP-9498fc95-67b7-3477-953f-1ec70bf0c61d",
					"name": "Cloud group",
					"type": "USERGROUP"
				},
				{
					"id": "ES-de9bfd9f-d8ee-430f-4bc0-e6e4645cdb47",
					"name": "Cloud roster",
					"type": "ROSTER"
				},
				{
					"id": "USRGRP-9498fc95-67b7-3477-953f-1ec70bf0c61d",
					"name": "Ops group",
					"type": "USERGROUP_DL"
				}
			]
		},
		{
			"waitMins": 5,
			"updateIncident": {
				"none": true,
				"priorityRules": [{
					"key": "currentState.code",
					"operator": "Is",
					"value": "Warning",
					"businessImpact": {
						"uniqueId": "SIMPACT-e8853b21-ebc5-dd1d-d9a3-7a7b121a5e0f",
						"name": "Test Ops impact",
						"description": "Test"
					},
					"urgency": {
						"uniqueId": "SURG-09358506-4af1-4d35-b902-cd3b14a00c10",
						"name": "Test Ops urgency",
						"description": "Test"
					},
					"priority": "High"
				}]
			},
			"incident": {
				"status": "New",
				"priority": "Low",
				"assignedUser": {
					"id": "USR0000000030",
					"loginName": "OpsAdmin",
					"lastName": "User",
					"firstName": "Ops",
					"email": "opsuser@opsramp.com", "phoneNumber": "", "mobileNumber": "9876543210" }, "assigneeGroup": { "id": 1, "name": "Test Group", "description": "", "uniqueId": "USRGRP-4189ae2e-bcf5-f686-26d0-8b6eabd91558" }, "businessImpact": { "uniqueId": "SIMPACT-e8853b21-ebc5-dd1d-d9a3-7a7b121a5e0f", "name": "Impact 2", "description": "Impact level 2" }, "urgency": { "uniqueId": "SURG-09358506-4af1-4d35-b902-cd3b14a00c10", "name": "Urgency 1", "description": "Urgency level 1" }, "customFields": [{ "id": "UDF0000000002", "classCode": "INCIDENT", "displayLabel": "Test Cutom", "name": "test_cutom_2", "fieldType": "TYPE_TEXT", "mandatory": false, "editable": true, "description": "", "value": "2", "defaultValue": "", "customField": true }, { "id": "UDF0000000004", "classCode": "INCIDENT", "displayLabel": "Esc custom field", "name": "esc_custom_field_4", "fieldType": "TYPE_TEXT", "mandatory": false, "editable": true, "description": "", "value": "request custom field - text", "defaultValue": "", "customField": true } ], "cc": "tester1@opsramp.com", "toEmail": "tester2@opsramp.com" }, "action": "INCIDENT", "notifyIncident": "whenAlertStateChanged" } ] }

Sample 2: AUTOMATIC_UNTIL_ACKNOWLEDGED_CLOSED_SUPPRESSED

This sample code creates an escalation alert policy with an escalationType of AUTOMATIC_UNTIL_ACKNOWLEDGED_CLOSED_SUPPRESSED.

Sample 2 request

{
	"name": "Create escalate alert policy API",
	"description": "Test description",
	"resources": [{
			"id": "bf3a10a2-92f1-4610-b3f4-174ed83db7b9",
			"type": "RESOURCE"
		},
		{
			"id": "DGP-0b165e70-7152-49f1-bfe3-ebe77409d5f2",
			"type": "DEVICEGROUP"
		},
		{
			"id": "SGP-11f1a6a8-acc8-411f-86c1-b693dd8e9817",
			"type": "SERVICEGROUP"
		},
		{
			"id": "7_AWS",
			"type": "LOCATION"
		},
		{
			"id": "client_7",
			"type": "CLIENT"
		}
	],
	"filterCriteria": {
		"matchingType": "ANY",
		"rules": [{
			"key": "Alert  : Description",
			"operator": "CONTAINS",
			"value": "critical"
		}, {
			"key": "Alert : Occurrence Frequency",
			"operator": "GREATERTHANOREQUALTO",
			"value": {
				"occurrences": "5",
				"frequency": "2",
				"frequencyType": "hours"
			}
		}, {
			"key": "Resource : Resource Type",
			"operator": "MATCH",
			"value": "DEVICE"
            	}]
	},
	"escalationType": "AUTOMATIC_UNTIL_ACKNOWLEDGED_CLOSED_SUPPRESSED",
	"escalations": [{
			"waitMins": 5,
			"priority": "Low",
			"repeatFrequency": 5,
			"notifyLimitCount": 2,
			"action": "NOTIFICATION",
			"recipients": [{
					"id": "USR0000000028",
					"name": "AP_User",
					"type": "USER"
				},
				{
					"id": "USRGRP-9498fc95-67b7-3477-953f-1ec70bf0c61d",
					"name": "Cloud group",
					"type": "USERGROUP"
				},
				{
					"id": "ES-de9bfd9f-d8ee-430f-4bc0-e6e4645cdb47",
					"name": "Cloud roster",
					"type": "ROSTER"
				},
				{
					"id": "USRGRP-9498fc95-67b7-3477-953f-1ec70bf0c61d",
					"name": "Ops group",
					"type": "USERGROUP_DL"
				}
			]
		},
		{
			"waitMins": 5,
			"action": "INCIDENT",
			"updateIncident": {
				"none": "true",
				"withAlertState": "true",
				"priorityRules": [{
					"key": "currentState.code",
					"operator": "Is",
					"value": "Warning",
					"businessImpact": {
						"uniqueId": "SIMPACT-e8853b21-ebc5-dd1d-d9a3-7a7b121a5e0f"
					},
					"urgency": {
						"uniqueId": "SURG-09358506-4af1-4d35-b902-cd3b14a00c10"
					},
					"priority": "High"
				}]
			},
			"notifyIncident": "whenAlertStateChanged",
			"incident": {
				"priority": "Very Low",
				"assigneeGroup": {
					"uniqueId": "USRGRP-4189ae2e-bcf5-f686-26d0-8b6eabd91558",
					"name": "Test Group"
				},
				"assignedUser": {
					"id": "USR0000000030",
					"loginName": "OpsAdmin"
				},
				"businessImpact": {
					"uniqueId": "SIMPACT-e8853b21-ebc5-dd1d-d9a3-7a7b121a5e0f"
				},
				"urgency": {
					"uniqueId": "SURG-09358506-4af1-4d35-b902-cd3b14a00c10"
				},
				"customFields": [{
						"id": "UDF0000000002",
						"name": "test_cutom_2",
						"value": "2"
					},
					{
						"id": "UDF0000000004",
						"name": "esc_custom_field_4",
						"value": "request custom field - text"
					}
				],
				"cc": "tester1@opsramp.com",
				"toEmail": "tester2@opsramp.com"
			}
		}
	]
}

Sample 2 response

{
	"id": "POLICY-e29f63f3-951a-4b41-a2a9-94835f6e9a42",
	"name": "Create escalate alert policy API",
	"description": "Test description",
	"policyType": "ESCALATION_POLICY",
	"clientMatchingType": "ALL",
	"createdDate": "2017-05-15T10:35:51+0000",
	"updatedDate": "2017-05-15T10:35:51+0000",
	"active": true,
	"enabledMode": "ON",
	"scope": {
		"id": 7,
		"uniqueId": "client_7",
		"name": "Netenrich  Client",
		"activated": true
	},
	"createdBy": {
		"loginName": "ops_admin_user",
		"firstName": "Ops Admin",
		"email": "opsuser@opsramp.com" }, 
	"updatedBy": { "loginName": "ops_admin_user", "firstName": "Ops Admin", "email": "opsuser@opsramp.com" }, 
	"resources": [
	    { "id": "bf3a10a2-92f1-4610-b3f4-174ed83db7b9", "name": "LPT00001", "type": "RESOURCE" }, 
	    { "id": "7_AWS", "name": "AWS", "type": "LOCATION" }, 
	    { "id": "DGP-0b165e70-7152-49f1-bfe3-ebe77409d5f2", "name": "Test Group", "type": "DEVICEGROUP" }, 
	    { "id": "SGP-11f1a6a8-acc8-411f-86c1-b693dd8e9817", "name": "Test SG", "type": "SERVICEGROUP" }, 
	    { "id": "client_6", "name": "Ops Client", "type": "CLIENT" } ], 
	"filterCriteria": { "matchingType": "ALL", "rules": [
	    { "key": "Alert : Description", "operator": "CONTAINS", "value": "critical" }, 
	    { "key": "Alert : Occurrence Frequency", "operator": "GREATERTHANOREQUALTO", "value": { "occurrences": "5", "frequency": "2", "frequencyType": "hours" } },
	    { "key": "Resource : Resource Type", "operator": "MATCH", "value": "DEVICE" }] }, 
	"escalationType": "AUTOMATIC_UNTIL_ACKNOWLEDGED_CLOSED_SUPPRESSED", "escalations": [
	    { "waitMins": 5, "priority": "Low", "repeatFrequency": 5, "notifyLimitCount": 2, "action": "NOTIFICATION", "recipients": 
	        [
	            { "id": "USR0000000028", "name": "AP_User", "type": "USER" }, 
	            { "id": "USRGRP-9498fc95-67b7-3477-953f-1ec70bf0c61d", "name": "Cloud group", "type": "USERGROUP" }, 
	            { "id": "ES-de9bfd9f-d8ee-430f-4bc0-e6e4645cdb47", "name": "Cloud roster", "type": "ROSTER" }, 
	            { "id": "USRGRP-9498fc95-67b7-3477-953f-1ec70bf0c61d", "name": "Ops group", "type": "USERGROUP_DL" } ] }, 
	    { "waitMins": 5, "updateIncident": { "none": true, "priorityRules": 
	        [{ "key": "currentState.code", "operator": "Is", "value": "Warning", 
	            "businessImpact": { "uniqueId": "SIMPACT-e8853b21-ebc5-dd1d-d9a3-7a7b121a5e0f", "name": "Test Ops impact", "description": "Test" }, 
	            "urgency": { "uniqueId": "SURG-09358506-4af1-4d35-b902-cd3b14a00c10", "name": "Test Ops urgency", "description": "Test" }, 
	            "priority": "High" }] }, 
	            "incident": { "status": "New", "priority": "Low", 
	                "assignedUser": { "id": "USR0000000030", "loginName": "OpsAdmin", "lastName": "User", "firstName": "Ops", "email": "opsuser@opsramp.com", "phoneNumber": "", "mobileNumber": "9876543210" }, 
	                "assigneeGroup": { "id": 1, "name": "Test Group", "description": "", "uniqueId": "USRGRP-4189ae2e-bcf5-f686-26d0-8b6eabd91558" }, 
	                "businessImpact": { "uniqueId": "SIMPACT-e8853b21-ebc5-dd1d-d9a3-7a7b121a5e0f", "name": "Impact 2", "description": "Impact level 2" }, 
	                "urgency": { "uniqueId": "SURG-09358506-4af1-4d35-b902-cd3b14a00c10", "name": "Urgency 1", "description": "Urgency level 1" }, 
	                "customFields": [{ "id": "UDF0000000002", "classCode": "INCIDENT", "displayLabel": "Test Cutom", "name": "test_cutom_2", "fieldType": "TYPE_TEXT", "mandatory": false, "editable": true, "description": "", "value": "2", "defaultValue": "", "customField": true }, 
	                { "id": "UDF0000000004", "classCode": "INCIDENT", "displayLabel": "Esc custom field", "name": "esc_custom_field_4", "fieldType": "TYPE_TEXT", "mandatory": false, "editable": true, "description": "", "value": "request custom field - text", "defaultValue": "", "customField": true } ], 
	                "cc": "tester1@opsramp.com", "toEmail": "tester2@opsramp.com" }, 
	                "action": "INCIDENT", "notifyIncident": "whenAlertStateChanged" } ] }

Sample 3: MANUAL

This sample code creates an escalation alert policy with an escalationType of MANUAL.

Sample 3 request

{
	"name": "Create escalate alert policy API for NOC",
	"description": "Test description",
	"resources": [{
			"id": "bf3a10a2-92f1-4610-b3f4-174ed83db7b9",
			"type": "RESOURCE"
		},
		{
			"id": "DGP-0b165e70-7152-49f1-bfe3-ebe77409d5f2",
			"type": "DEVICEGROUP"
		},
		{
			"id": "SGP-11f1a6a8-acc8-411f-86c1-b693dd8e9817",
			"type": "SERVICEGROUP"
		},
		{
			"id": "7_AWS",
			"type": "LOCATION"
		},
		{
			"id": "client_7",
			"type": "CLIENT"
		}
	],
	"filterCriteria": {
		"matchingType": "ANY",
		"rules": [{
			"key": "Alert  : Description",
			"operator": "CONTAINS",
			"value": "critical"
		}]
	},
	"escalationType": "MANUAL",
	"escalations": [{
		"recipients": [{
				"id": "ES-de9bfd9f-d8ee-430f-4bc0-e6e4645cdb47",
				"name": "Cloud roster",
				"type": "ROSTER"
			},
			{
				"id": "USR0000000028",
				"name": "AP_User",
				"type": "USER"
			},
			{
				"id": "USRGRP-9498fc95-67b7-3477-953f-1ec70bf0c61d",
				"name": "Cloud group",
				"type": "USERGROUP"
			}
		]
	}]
}

Sample 3 response

{
	"id": "POLICY-a204aea2-f943-46cb-86fa-86197e796f70",
	"name": "Create escalate alert policy API for NOC123",
	"description": "Test description",
	"policyType": "ESCALATION_POLICY",
	"clientMatchingType": "ALL",
	"createdDate": "2017-05-15T11:10:32+0000",
	"updatedDate": "2017-05-15T11:10:32+0000",
	"active": true,
	"enabledMode": "ON",
	"scope": {
		"id": 5,
		"uniqueId": "msp_5",
		"name": "Ops Partner",
		"activated": true
	},
	"createdBy": {
		"loginName": "ops_admin_user",
		"firstName": "Ops Admin",
		"email": "opsuser@opsramp.com" }, 
	"updatedBy": { 
	    "loginName": "ops_admin_user", 
	    "firstName": "Ops Admin", 
	    "email": "opsuser@opsramp.com" }, 
	    "resources": [
	        { 
	        "id": "bf3a10a2-92f1-4610-b3f4-174ed83db7b9", 
	        "name": "LPT00001", 
	        "type": "RESOURCE" }, 
	        { 
	        "id": "7_AWS", 
	        "name": "AWS", 
	        "type": "LOCATION" }, 
	        { 
	        "id": "DGP-0b165e70-7152-49f1-bfe3-ebe77409d5f2", 
	        "name": "Test Group", 
	        "type": "DEVICEGROUP" }, 
	        { 
	        "id": "SGP-11f1a6a8-acc8-411f-86c1-b693dd8e9817", 
	        "name": "Test SG", 
	        "type": "SERVICEGROUP" }, 
	        { 
	        "id": "client_6", 
	        "name": "Ops Client", 
	        "type": "CLIENT" } ], 
	"filterCriteria": { 
	    "matchingType": "ALL", 
	    "rules": [
	        { 
	        "key": "Alert : Description", 
	        "operator": "CONTAINS", 
	        "value": "critical" }] }, 
	"escalationType": "MANUAL", "escalations": [
	    { 
	    "action": "NOTIFICATION", 
	    "recipients": [
	        { 
	        "id": "USR0000000019", 
	        "name": "mani_partner", 
	        "type": "USER" }, 
	        { 
	        "id": "USRGRP-9498fc95-67b7-3477-953f-1ec70bf0c61d", 
	        "name": "Cloud group", 
	        "type": "USERGROUP" }, 
	        { 
	        "id": "ES-d16473ee-29de-1cf2-4983-86307733e34c", 
	        "name": "Test roster", 
	        "type": "ROSTER" } ] 
	}] 
}