KQL filter string to match target resources. At most 10000 matching resources are processed per request. Cannot be empty; to target every resource use match_all: true.
forceboolean · default: false
When true, executes the operation. When false (default), returns a dry-run preview with match_count and a sample of matching resource IDs so the client can verify before committing.
match_allenum
When true, targets every resource. Requires an explicit opt-in. Omitted by default.
Values:true
searchstring · min length: 1 · max length: 256
Free-text search string matched against the resource-defined searchable fields. Cannot be empty; to target every resource use match_all: true.
Total number of resources matching the query. A dry run never fails on size, but if this exceeds 10000, re-sending the same query with force: true is rejected with BULK_QUERY_MATCH_LIMIT_EXCEEDED; narrow the query before executing.
samplestring[] · max items: 100required
Sample of matching resource IDs (up to 100) for spot-checking before executing.
Number of resources the operation successfully touched.
errorsobject[]required
Errors encountered during the operation.
errorobjectrequired
codestringrequired
Stable error code you can branch on, for example INVALID_SCHEDULE or RULE_ALREADY_EXISTS.
detailsmapstring to object
Optional structured context whose keys depend on code. Identifier keys such as rule_id, action_policy_id and group_hash are stable, permanent public identifiers. On a 400 request-validation error, details.source (params, query, or body) names the failing part and is the only guaranteed key. The sibling details.errors may change. Do not branch on it.
messagestringrequired
A readable explanation of the error. The wording can change without notice. Do not parse this field.
idstringrequired
The identifier of the resource that failed.
Indicates an invalid schema or parameters.
application/json
codestringrequired
Stable error code you can branch on, for example INVALID_SCHEDULE or RULE_ALREADY_EXISTS.
detailsmapstring to object
Optional structured context whose keys depend on code. Identifier keys such as rule_id, action_policy_id and group_hash are stable, permanent public identifiers. On a 400 request-validation error, details.source (params, query, or body) names the failing part and is the only guaranteed key. The sibling details.errors may change. Do not branch on it.
errorstringrequired
A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.
messagestringrequired
A readable explanation of the error. The wording can change without notice. Do not parse this field.
Indicates the request was not authenticated.
application/json
codestringrequired
Stable error code you can branch on, for example INVALID_SCHEDULE or RULE_ALREADY_EXISTS.
detailsmapstring to object
Optional structured context whose keys depend on code. Identifier keys such as rule_id, action_policy_id and group_hash are stable, permanent public identifiers. On a 400 request-validation error, details.source (params, query, or body) names the failing part and is the only guaranteed key. The sibling details.errors may change. Do not branch on it.
errorstringrequired
A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.
messagestringrequired
A readable explanation of the error. The wording can change without notice. Do not parse this field.
Indicates the user does not have the required privileges to perform the request.
application/json
codestringrequired
Stable error code you can branch on, for example INVALID_SCHEDULE or RULE_ALREADY_EXISTS.
detailsmapstring to object
Optional structured context whose keys depend on code. Identifier keys such as rule_id, action_policy_id and group_hash are stable, permanent public identifiers. On a 400 request-validation error, details.source (params, query, or body) names the failing part and is the only guaranteed key. The sibling details.errors may change. Do not branch on it.
errorstringrequired
A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.
messagestringrequired
A readable explanation of the error. The wording can change without notice. Do not parse this field.
Indicates an unexpected server-side error.
application/json
codestringrequired
Stable error code you can branch on, for example INVALID_SCHEDULE or RULE_ALREADY_EXISTS.
detailsmapstring to object
Optional structured context whose keys depend on code. Identifier keys such as rule_id, action_policy_id and group_hash are stable, permanent public identifiers. On a 400 request-validation error, details.source (params, query, or body) names the failing part and is the only guaranteed key. The sibling details.errors may change. Do not branch on it.
errorstringrequired
A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.
messagestringrequired
A readable explanation of the error. The wording can change without notice. Do not parse this field.
Indicates the alerting engine is disabled by the alerting:v2:enabled advanced setting.
application/json
codestringrequired
Stable error code you can branch on, for example INVALID_SCHEDULE or RULE_ALREADY_EXISTS.
detailsmapstring to object
Optional structured context whose keys depend on code. Identifier keys such as rule_id, action_policy_id and group_hash are stable, permanent public identifiers. On a 400 request-validation error, details.source (params, query, or body) names the failing part and is the only guaranteed key. The sibling details.errors may change. Do not branch on it.
errorstringrequired
A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.
messagestringrequired
A readable explanation of the error. The wording can change without notice. Do not parse this field.