CreateAggregateAlert is an input datatype for creating an aggregate alert. It's used by the createAggregateAlert() mutation field.

Table: CreateAggregateAlert

ParameterTypeRequiredDefaultStabilityDescription
Some arguments may be required, as indicated in the Required column. For return datatypes, this indicates that you must specify which fields you want returned in the results.
Table last updated: Feb 10, 2026
actionIdsOrNames[string]yes Long-TermList of unique identifiers or names for actions to fire on query result. Actions in packages can be referred to as packagescope/packagename:actionname. The default value is an empty list of actions.
descriptionstring  Long-TermDescription of the aggregate alert.
enabledbooleanyestrueLong-TermFlag indicating whether the aggregate alert is enabled.
labels[string]yes[ ]Long-TermLabels attached to the aggregate alert. The default value is an empty list of labels.
namestringyes Long-TermName of the aggregate alert.
queryOwnershipTypeQueryOwnershipTypeyes Long-TermOwnership of the query run by this aggregate alert. If value is User, ownership will be based on the runAsUserId field. See QueryOwnershipType.
queryStringstringyes Long-TermThe LogScale query to execute.
queryTimestampTypeQueryTimestampTypeyes Long-TermTimestamp type to use for a query. See QueryTimestampType.
runAsUserIdstring  Long-TermThe aggregate alert will run with the permissions of the user corresponding to this id if the queryOwnershipType field is set to User. If the queryOwnershipType is set to Organization, whilst runAsUserId is set, this will result in an error. If not specified, the aggregate alert will run with the permissions of the calling user. It requires the ChangeTriggersToRunAsOtherUsers permission to set this field to a user id different from the calling user.
searchIntervalSecondslongyes Long-TermSearch interval in seconds. Valid values: 1-80 minutes in seconds divisible by 60 (60, 120, ..., 4800 seconds); 82-180 minutes in seconds divisible by 120 (4920, 5040, ..., 10800 seconds); and 4-24 hours in seconds divisible by 3600 (14400, 18000, ..., 86400 seconds).
throttleFieldstring  DeprecatedThe field on which to throttle. This can be set only if throttleTimeSeconds is set. Aggregate alerts now support multiple throttle fields. This field will be removed at the earliest in version 1.279. Use instead the throttleFields field.
throttleFields[string]  Long-TermThe fields on which to throttle. This can be set only if throttleTimeSeconds is set. Ten throttle fields can be added at most.
throttleTimeSecondslongyes Long-TermThrottle time in seconds.
triggerModeTriggerMode  Long-TermTrigger mode used for triggering the alert. See TriggerMode.
viewNameRepoOrViewNameyes Long-TermName of the view of the aggregate alert. RepoOrViewName is a scalar.