Tell Salience what is by design, once
Site context lets you say \"this is expected, and here is why\" about a pattern on your site. Matching alerts are still recorded but no longer sent, the AI triage reads your note, and everything covered stays on one list you can check. In the app, the API, MCP and the CLI.
Some things that look alarming are how your site is meant to work. Subscription links carry a one-time token in the URL. A health path answers 503 on purpose. You have decided to let a particular bot through. Until now the only answers were to snooze the incident for a week at most, or acknowledge it and see it again the next morning with the same 4 out of 5 from the AI triage.
Site context is a permanent answer. On any incident, choose This is expected. The form starts from the incident itself: its alert kind and the paths, bots and IP addresses in its evidence. Adjust them, write why it is expected, and save. The incident moves to Covered by context at once, and the next alert that matches is recorded but not sent.
A few rules keep it from hiding real problems:
- A note on its own silences nothing. It is shown to your team and given to the AI triage, which rates an alert lower when your note explains it and says which note it relied on.
- An alert is covered only when every path, bot or IP it names is listed. One expected path among several unexpected ones does not hide the alert.
- Covering every alert of a kind is allowed, but not by accident. For exposed secrets and hacking probes you are asked to confirm first.
- Nothing is deleted. Covered alerts keep their evidence and are listed under Covered by context on the Alerts page, each with the note that covers it. The dashboard shows them as one quiet count.
Entries do not expire. You can give one a review date, which is a reminder and nothing more. Alerts → Settings → Site context lists every entry with who added it and how many alerts it has covered; edit, disable or remove them there, and the incidents come back if you do. Recommendations leave out what you have listed, so an IP you have said is yours is not recommended for blocking. The weekly report adds one line when there is something to say: "4 alerts were covered by your site context this week; nothing was sent."
Site context is in the public API as /public/v1/websites/{id}/context (read with any key, write with a read & write key; typed in the OpenAPI description), in MCP as list_site_context, add_site_context and remove_site_context, and in the CLI as salience context list|add|remove. See Site context help.