Create an alert rule.

trigger_kind picks how the rule is evaluated — metric_threshold, custom_sql, evaluation_score, eval_compound or per_event — and trigger_spec is the free-form JSON that kind expects.

The scheduling fields work together: the dispatcher evaluates the rule every eval_interval_secs (default 300, must be between 30 and 86400) and only opens an issue once min_breaches of the last eval_window evaluations breached (both default to 1, and min_breaches may not exceed eval_window). Every entry in channels needs a kind of email, slack, webhook or dashboard; omitting channels creates a rule that opens issues but notifies nobody.

Returns the new alert’s id and created_at. When the request came through the dashboard, created_by records the human; a direct API call records the API key’s id instead.