List action policies

Base URL: https://{kibana_url}

GET /api/alerting/v2/action_policies
GET /s/{space_id}/api/alerting/v2/action_policies

Auth

Get a paginated list of action policies with optional filtering and sorting.

Required privileges

Privileges read_alerting-v2-action-policies

Path parameters

space_id string optional: An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.

Query parameters

page integer · min: 1 · max: 10000: The page number to return. Defaults to 1.
per_page integer · min: 1 · max: 100: The number of action policies to return per page. Defaults to 20.
filter string · min length: 1 · max length: 4096: A KQL filter to apply to the action policies. Supported fields: id, name, description, enabled. Cannot be empty. Omit it to list every action policy.
search string · min length: 1 · max length: 256: A text string to search across action policy fields.
sort_field enum: The field to sort action policies by.; Values: name created_at updated_at
sort_order enum: The sort direction.; Values: asc desc

Responses

Returns a paginated list of action policies.

application/json

items object[] required: The list of action policies.
page number required: The current page number.
per_page number required: The number of action policies per page.
total number required: The number of action policies matching the query. This count is an estimate: results above 10,000 may be reported as 10,000.

Indicates an invalid schema or parameters.

application/json

Indicates the request was not authenticated.

application/json

Indicates the user does not have the required privileges to perform the request.

application/json

Indicates an unexpected server-side error.

application/json

Indicates the alerting engine is disabled by the alerting:v2:enabled advanced setting.

application/json

View as Markdown

Base URL: https://{kibana_url}

Examples

Request Console 1 / 2 languages

Console Kibana Dev Tools

GET kbn:/api/alerting/v2/action_policies

Generated from the API spec

curl Shell

curl -X GET "${KIBANA_URL}/api/alerting/v2/action_policies" \
  -H "Authorization: ApiKey ${API_KEY}"

Generated from the API spec

Response

{
  "items": [
    {
      "created_at": "2026-01-15T12:00:00.000Z",
      "created_by": {
        "profile_uid": "u_elastic_0"
      },
      "description": "Sends notifications for alerts generated by rules with the production tag.",
      "destinations": [
        {
          "id": "workflow-1",
          "type": "workflow"
        }
      ],
      "enabled": true,
      "grouping": {
        "mode": "per_alert"
      },
      "id": "action-policy-1",
      "matcher": {
        "tags": [
          "production"
        ]
      },
      "name": "Notify on production alerts",
      "throttle": {
        "strategy": "on_status_change"
      },
      "updated_at": "2026-01-15T12:00:00.000Z",
      "updated_by": {
        "profile_uid": "u_elastic_0"
      }
    }
  ],
  "page": 1,
  "per_page": 20,
  "total": 1
}

{
  "code": "BAD_REQUEST",
  "details": {
    "errors": {
      "errors": [],
      "properties": {
        "page": {
          "errors": [
            "Too small: expected number to be \u003E=1"
          ]
        }
      }
    }
  },
  "error": "Bad Request",
  "message": "page: Too small: expected number to be \u003E=1"
}

{
  "code": "UNAUTHORIZED",
  "error": "Unauthorized",
  "message": "Authentication required to access this API."
}

{
  "code": "FORBIDDEN",
  "error": "Forbidden",
  "message": "The current user does not have the required privileges for this request."
}

{
  "code": "INTERNAL_SERVER_ERROR",
  "error": "Internal Server Error",
  "message": "An unexpected error occurred."
}

{
  "code": "ALERTING_DISABLED",
  "error": "Service Unavailable",
  "message": "Alerting is disabled."
}