{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://raw.githubusercontent.com/api-evangelist/cloudflare/main/json-schema/cloudflare-aaa-filters-schema.json",
  "title": "aaa_filters",
  "description": "Optional filters that allow you to be alerted only on a subset of events for that alert type based on some criteria. This is only available for select alert types. See alert type documentation for more details.",
  "x-generated": "2026-10-03",
  "x-method": "derived",
  "x-generator": "derive-json-schema.py",
  "x-source": "openapi/cloudflare-accounts-api-openapi.yml#/components/schemas/aaa_filters",
  "type": "object",
  "properties": {
    "actions": {
      "type": "array",
      "description": "Usage depends on specific alert type",
      "items": {
        "type": "string"
      }
    },
    "affected_asns": {
      "type": "array",
      "description": "Used for configuring radar_notification",
      "items": {
        "type": "string"
      }
    },
    "affected_components": {
      "type": "array",
      "description": "Used for configuring incident_alert. A list of identifiers for each component to monitor.",
      "items": {
        "type": "string"
      }
    },
    "affected_locations": {
      "type": "array",
      "description": "Used for configuring radar_notification",
      "items": {
        "type": "string"
      }
    },
    "airport_code": {
      "type": "array",
      "description": "Used for configuring maintenance_event_notification",
      "items": {
        "type": "string"
      }
    },
    "alert_trigger_preferences": {
      "type": "array",
      "description": "Usage depends on specific alert type",
      "items": {
        "type": "string"
      }
    },
    "alert_trigger_preferences_value": {
      "type": "array",
      "description": "Used for configuring magic_tunnel_health_check_event",
      "items": {
        "type": "string",
        "enum": [
          "99.0",
          "98.0",
          "97.0"
        ],
        "minItems": 1,
        "maxItems": 1
      }
    },
    "enabled": {
      "type": "array",
      "description": "Used for configuring load_balancing_pool_enablement_alert",
      "items": {
        "type": "string",
        "minItems": 1
      }
    },
    "environment": {
      "type": "array",
      "description": "Used for configuring pages_event_alert",
      "items": {
        "type": "string",
        "minItems": 1
      }
    },
    "event": {
      "type": "array",
      "description": "Used for configuring pages_event_alert",
      "items": {
        "type": "string",
        "minItems": 1
      }
    },
    "event_source": {
      "type": "array",
      "description": "Used for configuring load_balancing_health_alert",
      "items": {
        "type": "string"
      }
    },
    "event_type": {
      "type": "array",
      "description": "Usage depends on specific alert type",
      "items": {
        "type": "string"
      }
    },
    "group_by": {
      "type": "array",
      "description": "Usage depends on specific alert type",
      "items": {
        "type": "string"
      }
    },
    "health_check_id": {
      "type": "array",
      "description": "Used for configuring health_check_status_notification",
      "items": {
        "type": "string"
      }
    },
    "incident_impact": {
      "type": "array",
      "description": "Used for configuring incident_alert",
      "items": {
        "type": "string",
        "enum": [
          "INCIDENT_IMPACT_NONE",
          "INCIDENT_IMPACT_MINOR",
          "INCIDENT_IMPACT_MAJOR",
          "INCIDENT_IMPACT_CRITICAL"
        ]
      }
    },
    "input_id": {
      "type": "array",
      "description": "Used for configuring stream_live_notifications",
      "items": {
        "type": "string"
      }
    },
    "limit": {
      "type": "array",
      "description": "Used for configuring billing_usage_alert",
      "items": {
        "type": "string",
        "minItems": 1
      }
    },
    "logo_tag": {
      "type": "array",
      "description": "Used for configuring logo_match_alert",
      "items": {
        "type": "string"
      }
    },
    "megabits_per_second": {
      "type": "array",
      "description": "Used for configuring advanced_ddos_attack_l4_alert",
      "items": {
        "type": "string"
      }
    },
    "new_health": {
      "type": "array",
      "description": "Used for configuring load_balancing_health_alert",
      "items": {
        "type": "string"
      }
    },
    "new_status": {
      "type": "array",
      "description": "Used for configuring tunnel_health_event",
      "items": {
        "type": "string"
      }
    },
    "packets_per_second": {
      "type": "array",
      "description": "Used for configuring advanced_ddos_attack_l4_alert",
      "items": {
        "type": "string"
      }
    },
    "pool_id": {
      "type": "array",
      "description": "Usage depends on specific alert type",
      "items": {
        "type": "string"
      }
    },
    "product": {
      "type": "array",
      "description": "Used for configuring billing_usage_alert",
      "items": {
        "type": "string",
        "minItems": 1
      }
    },
    "project_id": {
      "type": "array",
      "description": "Used for configuring pages_event_alert",
      "items": {
        "type": "string",
        "minItems": 1
      }
    },
    "protocol": {
      "type": "array",
      "description": "Used for configuring advanced_ddos_attack_l4_alert",
      "items": {
        "type": "string"
      }
    },
    "query_tag": {
      "type": "array",
      "description": "Usage depends on specific alert type",
      "items": {
        "type": "string"
      }
    },
    "requests_per_second": {
      "type": "array",
      "description": "Used for configuring advanced_ddos_attack_l7_alert",
      "items": {
        "type": "string"
      }
    },
    "selectors": {
      "type": "array",
      "description": "Usage depends on specific alert type",
      "items": {
        "type": "string"
      }
    },
    "services": {
      "type": "array",
      "description": "Used for configuring clickhouse_alert_fw_ent_anomaly",
      "items": {
        "type": "string",
        "minItems": 1
      }
    },
    "slo": {
      "type": "array",
      "description": "Usage depends on specific alert type",
      "items": {
        "type": "string"
      }
    },
    "status": {
      "type": "array",
      "description": "Used for configuring health_check_status_notification",
      "items": {
        "type": "string",
        "minItems": 1
      }
    },
    "target_hostname": {
      "type": "array",
      "description": "Used for configuring advanced_ddos_attack_l7_alert",
      "items": {
        "type": "string"
      }
    },
    "target_ip": {
      "type": "array",
      "description": "Used for configuring advanced_ddos_attack_l4_alert",
      "items": {
        "type": "string"
      }
    },
    "target_zone_name": {
      "type": "array",
      "description": "Used for configuring advanced_ddos_attack_l7_alert",
      "items": {
        "type": "string"
      }
    },
    "traffic_exclusions": {
      "type": "array",
      "description": "Used for configuring traffic_anomalies_alert",
      "items": {
        "type": "string",
        "enum": [
          "security_events"
        ],
        "maxItems": 1
      }
    },
    "tunnel_id": {
      "type": "array",
      "description": "Used for configuring tunnel_health_event",
      "items": {
        "type": "string"
      }
    },
    "tunnel_name": {
      "type": "array",
      "description": "Used for configuring magic_tunnel_health_check_event",
      "items": {
        "type": "string",
        "minItems": 1
      }
    },
    "where": {
      "type": "array",
      "description": "Usage depends on specific alert type",
      "items": {
        "type": "string"
      }
    },
    "zones": {
      "type": "array",
      "description": "Usage depends on specific alert type",
      "items": {
        "type": "string"
      }
    }
  }
}