Stay organized with collections
Save and categorize content based on your preferences.
See Query filters for reference
on filter syntax, and review the filter examples below.
Fields supported by alerts.list
Filter fields
alertId
Should be used to filter alerts based on alert id.
Corresponding value should be of type: string.
type
Should be used to filter alerts based on alert type.
Corresponding value should be of type: string. Possible values
for this filter are listed in the Alert.type field description.
source
Should be used to filter alerts based on alert source.
Corresponding value should be of type: string. Possible values
for this filter are listed in the Alert.type field description.
createTime
Should be used to filter alerts based on alert creation time.
Corresponding value should be of type: string (Timestamp
format);
more specifically, an RFC 3339 date-time
string, for example, "2018-01-01T00:00:00Z"
startTime
Should be used to filter alerts based on alert start time.
Corresponding value should be of type: string (Timestamp
format);
more specifically, an RFC 3339 date-time
string, for example, "2018-01-01T00:00:00Z"
endTime
Should be used to filter alerts based on alert end time.
Corresponding value should be of type: string (Timestamp
format);
more specifically, an RFC 3339 date-time
string, for example, "2018-01-01T00:00:00Z"
List query examples
To query for all alerts created on or after April 5, 2018: createTime >= "2018-04-05T00:00:00Z"
To query for all alerts from the source "Gmail phishing": source:"Gmail phishing"
To query for all alerts that started in 2017: startTime >= "2017-01-01T00:00:00Z&" AND startTime < "2018-01-01T00:00:00Z"
To query for all user-reported phishing alerts from the source "Gmail phishing": type:"User reported phishing" source:"Gmail phishing"
Fields supported by alerts.feedback.list
Filter fields
alertId
Should be used to filter alert feedback based on alert id.
Corresponding value should be of type: string.
Can be used to list feedback for selected alerts in one call when the '-' wildcard is used
in request's alertId.
feedbackId
Should be used to filter alert feedback based on feedback id.
Corresponding value should be of type: string.
Feedback list query examples
To query feedback of alerts with ids alertId01 or alertId02: alertId = alertId01 OR alertId = alertId02
To query feedback of an alert alertId01 with feedback id feedbackId01: alertId = alertId01 AND feedbackId = feedbackId01
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Missing the information I need","missingTheInformationINeed","thumb-down"],["Too complicated / too many steps","tooComplicatedTooManySteps","thumb-down"],["Out of date","outOfDate","thumb-down"],["Samples / code issue","samplesCodeIssue","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-08-28 UTC."],[],[],null,["# Supported query filter fields\n\nSee [Query filters](/workspace/admin/alertcenter/guides/query-filters) for reference\non filter syntax, and review the filter examples below.\n\nFields supported by `alerts.list`\n---------------------------------\n\n| Filter fields ||\n|--------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|\n| `alertId` | Should be used to filter alerts based on alert id. Corresponding value should be of type: `string`. |\n| `type` | Should be used to filter alerts based on alert type. Corresponding value should be of type: `string`. Possible values for this filter are listed in the [`Alert.type` field description](/workspace/admin/alertcenter/reference/rest/v1beta1/alerts#alert-types). |\n| `source` | Should be used to filter alerts based on alert source. Corresponding value should be of type: `string`. Possible values for this filter are listed in the [`Alert.type` field description](/workspace/admin/alertcenter/reference/rest/v1beta1/alerts#alert-types). |\n| `createTime` | Should be used to filter alerts based on alert creation time. Corresponding value should be of type: `string (`[Timestamp](/protocol-buffers/docs/reference/google.protobuf#google.protobuf.Timestamp)` format)`; more specifically, an [RFC 3339](https://tools.ietf.org/html/rfc3339) date-time string, for example, `\"2018-01-01T00:00:00Z\"` |\n| `startTime` | Should be used to filter alerts based on alert start time. Corresponding value should be of type: `string (`[Timestamp](/protocol-buffers/docs/reference/google.protobuf#google.protobuf.Timestamp)` format)`; more specifically, an [RFC 3339](https://tools.ietf.org/html/rfc3339) date-time string, for example, `\"2018-01-01T00:00:00Z\"` |\n| `endTime` | Should be used to filter alerts based on alert end time. Corresponding value should be of type: `string (`[Timestamp](/protocol-buffers/docs/reference/google.protobuf#google.protobuf.Timestamp)` format)`; more specifically, an [RFC 3339](https://tools.ietf.org/html/rfc3339) date-time string, for example, `\"2018-01-01T00:00:00Z\"` |\n\n### List query examples\n\n- To query for all alerts created on or after April 5, 2018: \n `createTime \u003e= \"2018-04-05T00:00:00Z\"`\n- To query for all alerts from the source \"Gmail phishing\": \n `source:\"Gmail phishing\"`\n- To query for all alerts that started in 2017: \n `startTime \u003e= \"2017-01-01T00:00:00Z&\" AND startTime \u003c \"2018-01-01T00:00:00Z\"`\n- To query for all user-reported phishing alerts from the source \"Gmail phishing\": \n `type:\"User reported phishing\" source:\"Gmail phishing\"`\n\nFields supported by `alerts.feedback.list`\n------------------------------------------\n\n| Filter fields ||\n|--------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|\n| `alertId` | Should be used to filter alert feedback based on alert id. Corresponding value should be of type: `string`. Can be used to list feedback for selected alerts in one call when the '-' wildcard is used in request's `alertId`. |\n| `feedbackId` | Should be used to filter alert feedback based on feedback id. Corresponding value should be of type: `string`. |\n\n### Feedback list query examples\n\n- To query feedback of alerts with ids `alertId01` or `alertId02`: \n `alertId = alertId01 OR alertId = alertId02`\n- To query feedback of an alert `alertId01` with feedback id `feedbackId01`: \n `alertId = alertId01 AND feedbackId = feedbackId01`"]]
