Using the API, I cannot tell the difference between reports and alerts. How do I distinguish? A parameter in my request? A property returned in the response?
What values are acceptable for alert_condition? It's blank for all my saved searches. I think this is "Trigger Conditions" where it's set to Custom. I don't have that in any of my alerts.
I'd take a look at your REST results and see which fields in action.* are the safest to work with for you. Unfortunately there isnt a field which states THIS IS AN ALERT. There really should be given the UI has such a clear separation between Alerts and Reports and the architecture behind the scenes stores the config in the same place... but that's another conversation for another time 😀
For email, action.email.subject.alert works. Seems like it's only available for alerts. For other alert actions, nothing I can find that distinguishes them.
