Returns active, historical, or all alarms for the appliances specified in the request body.

Response: Each alarm object includes severity, description, recommendedAction, source, type, timestamps, acknowledgement status, and more. See the ApplianceAlarmItem schema for full details.

Filtering: Use query parameters to filter by status (view), severity level, and time range (from/to). Results can be sorted by severity (orderBySeverity) and capped with maxAlarms.

Severity values: Response values are uppercase (WARNING, MINOR, MAJOR, CRITICAL), while the severity query parameter accepts lowercase (warning, minor, major, critical).

Correlation fields: The fields sourceIp, destinationIp, peerId, hierarchy, isRoot, instanceId, sourceLabel, destinationLabel, and saCount are always present in every alarm object, but only contain meaningful (non-default) values for correlation-engine alarm types: tunnel down, interface down, nexthop down, and IPSLA link down alarms. For all other alarm types, these fields contain default values (empty string for strings, false for booleans, 0 for numbers).

Obtaining nePk values: Appliance IDs (nePks) can be retrieved from GET /appliance. Each appliance object contains an id field in the format {number}.NE (e.g., 10.NE, 2094.NE).

Note on hostName: The hostName field is populated from the appliance's configured hostname. In rare cases during alarm creation, if the appliance is not in cache, it may be empty. Resolve via GET /appliance if needed.