This is how I have been able to access these things via REST.
The first thing you need to make sure is you have the "Add to Triggered Alerts" Alert Action that you want to be see these in the GUI or REST. By default, Splunk will run alerts you configure, but won't necessarily "track" them unless you explicitly tell it to. It looks like this in the GUI:
Once you add that Alert Action and some alerts fire, you'll see the triggered events in the GUI and via this REST endpoint:
/alerts/fired_alerts/
Once you're getting your list of triggered alerts, then you can find the sid value within the data returned and then use the other REST endpints to fetch stuff for the actual search that was ran. Here's a screenshot of a bit of the output from the above rest endpoint on my test environment:
Also - note that the Expire setting for the alert will control how long Splunk keeps those results around for those sids:
