Why do I get zero results when trying to retrieve alert events via Panther's GraphQL API?
Last updated: November 25, 2025
QUESTION
Why does my GraphQL query show zero results for a specific alert_id?
ANSWER
The GraphQL query endpoint runs a data lake query against the Snowflake backend. If you're running a query via an automated workflow in an alert destination, it might be running before the data is actually loaded into the data lake.
For workflows like these, we recommend using the /alerts/{id}/events REST API endpoint that does not have the same delay.