Type to search.

List action policy executions

Base URL
https://{kibana_url}
  • GET /api/alerting/v2/execution_history/action_policies
  • GET /s/{space_id}/api/alerting/v2/execution_history/action_policies
Auth

Get a paginated list of dispatcher summary events for action policies in the current space.

Required privileges

Privileges read_alerting-v2-execution-history

Path parameters

space_id string optional

An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.

Query parameters

page integer · min: 1 · max: 10000 · default: 1 required

Page number (1-indexed). Defaults to 1.

per_page integer · min: 1 · max: 100 · default: 20 required

Number of events per page. Defaults to 20.

from string · format: date-time · max length: 64

Inclusive ISO datetime lower bound on the event timestamp. Defaults to 24 hours before to, or before the request when to is omitted. Independent of alert_ids — e.g. set it to an alert’s start time to scope results to that alert’s lifetime.

to string · format: date-time · max length: 64

Inclusive ISO datetime upper bound on the event timestamp.

alert_ids string[] · min items: 1 · max items: 50

Alert filter. Narrows events to those referencing at least one of the provided alert IDs.

sort_field enum · default: dispatched_at required

Sort field. Defaults to "dispatched_at".

Values: dispatched_at
sort_order enum · default: desc required

Sort direction. Defaults to "desc".

Values: asc desc

Free-text search. Matches policy name, rule name, policy/rule ID (case-insensitive).

rule_ids string[] · min items: 1 · max items: 50

Explicit rule filter. Narrows events to those referencing at least one of the provided rule IDs. Also unions with the search filter if both are provided.

outcomes enum[] · min items: 1 · max items: 3

Outcome filter. When omitted matches all outcomes. Pass one or more of "success", "throttled", "failure" to narrow.

Values: success throttled failure

Responses

Returns a paginated list of execution history events.

application/json
items object[] required
action_group_count number required
alert_count number required
alerts object[] · max items: 50 required

Alert IDs referenced by this event, bounded to 50. Empty when the event references no alerts. Use alert_count for the true total.

id string required
dispatched_at string · format: date-time · max length: 64 required
failure_reason enum
Values: missing_api_key workflow_not_found workflow_disabled schedule_error license_not_supported
outcome enum required
Values: success throttled failure
policy object required
id string required
name string

Omitted when the referenced resource could not be resolved.

rule_count number required

Number of rules referenced by this event after search or rule-filter narrowing. Unlike total on a list response, this is an exact count and it can exceed rules.length when the embedded array is truncated to the cap.

rules object[] · max items: 20 required

Rules referenced by this event, bounded to 20. When a search or rule filter narrows the match, this array is intersected with the matched subset server-side. Use rule_count for the full count.

id string required
name string

Omitted when the referenced resource could not be resolved.

workflows object[] · max items: 100 required
id string required
name string

Omitted when the referenced resource could not be resolved.

page integer · min: 1 · max: 9007199254740991 required
per_page integer · min: 1 · max: 9007199254740991 required
total integer · min: 0 · max: 9007199254740991 required

The number of action policy events matching the query. This count is an estimate: results above 10,000 may be reported as 10,000.