Alerting

Get notified when something goes wrong in your fleet.

Event types

Event	Fires when
`device.offline`	A device misses 3 consecutive heartbeats (~45 seconds)
`login.failed`	A failed login attempt for your organization

Create an alert rule

Go to Settings > Alerts in the dashboard
Click + New rule
Select the event type
Choose a sink (webhook or email)
Configure the sink and save

Or via API:

curl -X POST https://app.kvmfleet.io/v1/alerts/rules \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "event_type": "device.offline",
    "sink_type": "webhook",
    "sink_config": {"url": "https://hooks.slack.com/services/T.../B.../xxx"}
  }'

Sinks

Webhook

Sends a POST request with a JSON payload:

{
  "event_type": "device.offline",
  "device_id": "dev_abc123",
  "device_name": "DC1-R3-S7",
  "timestamp": "2026-04-15T14:32:00Z",
  "details": {"last_seen": "2026-04-15T14:31:15Z"}
}

Works with Slack (incoming webhooks), PagerDuty, Opsgenie, or any HTTP endpoint.

Email

Sends a plain-text email to the configured address. Uses the platform's transactional email service.

curl -X POST https://app.kvmfleet.io/v1/alerts/rules \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "event_type": "login.failed",
    "sink_type": "email",
    "sink_config": {"address": "secops@example.com"}
  }'

Alert history

View past alerts in Settings > Alerts > History, or via API:

curl https://app.kvmfleet.io/v1/alerts/history \
  -H "Authorization: Bearer $TOKEN"

Disable a rule

curl -X PATCH https://app.kvmfleet.io/v1/alerts/rules/<rule-id> \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"enabled": false}'