See [Query filters](https://developers.google.com/workspace/admin/alertcenter/guides/query-filters) for
reference on filter syntax, and review the following filter examples.

## Fields supported by `alerts.list`

| Filter fields ||
|---|---|
| `alertId` | Filters alerts by alert ID. Value must be a `string`. |
| `type` | Filters alerts by alert type. Value must be a `string`. For possible values, see the [`Alert.type` field description](https://developers.google.com/workspace/admin/alertcenter/reference/rest/v1beta1/alerts#alert-types). |
| `source` | Filters alerts by alert source. Value must be a `string`. For possible values, see the [`Alert.type` field description](https://developers.google.com/workspace/admin/alertcenter/reference/rest/v1beta1/alerts#alert-types). |
| `createTime` | Filters alerts by alert creation time. Value must be a `string` in `https://developers.google.com/protocol-buffers/docs/reference/google.protobuf#google.protobuf.Timestamp` format. Use an [RFC 3339](https://tools.ietf.org/html/rfc3339) date-time string (for example, `"2018-01-01T00:00:00Z"`). |
| `startTime` | Filters alerts by alert start time. Value must be a `string` in `https://developers.google.com/protocol-buffers/docs/reference/google.protobuf#google.protobuf.Timestamp` format. Use an [RFC 3339](https://tools.ietf.org/html/rfc3339) date-time string (for example, `"2018-01-01T00:00:00Z"`). |
| `endTime` | Filters alerts by alert end time. Value must be a `string` in `https://developers.google.com/protocol-buffers/docs/reference/google.protobuf#google.protobuf.Timestamp` format. Use an [RFC 3339](https://tools.ietf.org/html/rfc3339) date-time string (for example, `"2018-01-01T00:00:00Z"`). |

### List query examples

- To query for all alerts created on or after April 5, 2018:

  `createTime >= "2018-04-05T00:00:00Z"`
- To query for all alerts from the source "Gmail phishing":

  `source:"Gmail phishing"`
- To query for all alerts that started in 2017:

  `startTime >= "2017-01-01T00:00:00Z" AND startTime < "2018-01-01T00:00:00Z"`
- To query for all user-reported phishing alerts from the source "Gmail
  phishing":

  `type:"User reported phishing" source:"Gmail phishing"`

## Fields supported by `alerts.feedback.list`

| Filter fields ||
|---|---|
| `alertId` | Filters alert feedback by alert ID. Value must be a `string`. |
| `feedbackId` | Filters alert feedback by feedback ID. Value must be a `string`. |

### Feedback list query examples

- To query feedback for alerts with IDs `alertId01` or `alertId02`:

  `alertId = alertId01 OR alertId = alertId02`
- To query feedback for an alert `alertId01` with feedback ID
  `feedbackId01`:

  `alertId = alertId01 AND feedbackId = feedbackId01`