Due to the lack of response from SmartThings with respect to new Capability requests, I understand why you chose “Alarm” to tag this Device, but in my opinion, it is not the right choice (there is a very long extensive discussion about this in the “New Capabilities” Category, BTW).
Capability Alarm is meant for Devices that sound alarms (i.e., either via a siren and/or strobe) – i.e., it is an activated device (an actuator).
The Attributes of Alarm do not make sense for Tamper messages:
A device of Capability Alarm must be able to respond to the 4 Alarm commands (
off(), strobe(), siren(), both()).
Detecting tampering is a passive device (a sensor), and only has one Command, as you noted, “reset()” (although reset probably should be done only physically at the device, because if it was tampered with, it needs to be physically inspected!!!).
My recommendation?
If you don’t just want to use generic Capability Sensor, then any binary sensor device is applicable, such as Capability Smoke Detector, Capability Contact Sensor, or Capability Motion Sensor. The latter is “self-resetting”, in theory, when “motion (tampering) stops”, the former is easily extended with your “reset()” command.
I hope my explanation of why Alarm is a bad fit makes sense, but it’s just an opinion and open to discussion.
Even SmartThings engineer proposed the new Capability Tamper Alert too, sigh: