Get warned before tickets breach their SLA

from datetime import datetime, timedelta, timezone
from clickruntime import on_trigger, http, credentials, notify, state, report_fetched

ZD = "https://yourcompany.zendesk.com/api/v2"
AGENT_EMAIL = "you@yourcompany.com"

def zd(method, path, **kw):
    r = http.request(method, f"{ZD}{path}", auth=(f"{AGENT_EMAIL}/token", credentials.secret("ZENDESK_API_TOKEN")), **kw)
    r.raise_for_status()
    return r.json() if r.content else None

@on_trigger
def run(event):
    soon = datetime.now(timezone.utc) + timedelta(minutes=30)
    alerted = set(state.get("alerted") or [])
    tickets = zd("GET", "/search.json", params={"query": "type:ticket status<solved", "include": "tickets(slas)", "per_page": 100})["results"]
    risky = []
    for t in tickets:
        for p in (t.get("slas") or {}).get("policy_metrics", []):
            at = p.get("breach_at")
            if at and p.get("stage") == "active" and datetime.fromisoformat(at.replace("Z", "+00:00")) <= soon and t["id"] not in alerted:
                risky.append((t, p))
                break
    report_fetched(len(risky))
    if not risky:
        return {"at_risk": 0}
    for t, p in risky:
        notify.slack(f"SLA ({p['metric']}) breaches at {p['breach_at'][11:16]}Z: #{t['id']} {t['subject']}\n"
                     f"https://yourcompany.zendesk.com/agent/tickets/{t['id']}", channel="#support")
        alerted.add(t["id"])
    state.set("alerted", list(alerted)[-1000:])
    return {"at_risk": len(risky)}