Alerting V2
Alerting V2 is an ES|QL-first alerting API for managing rules, alert actions, and action policies. Use these endpoints to create and manage detection rules, act on alerts, and control when and how notifications are delivered. These APIs are experimental.
-
List action policies
Stack
Experimental
9.5+
- GET /api/alerting/v2/action_policies
-
Create an action policy
Stack
Experimental
9.5+
- POST /api/alerting/v2/action_policies
-
Delete action policies in bulk by ID
Stack
Experimental
9.5+
- POST /api/alerting/v2/action_policies/_bulk_delete
-
Disable action policies in bulk by ID
Stack
Experimental
9.5+
- POST /api/alerting/v2/action_policies/_bulk_disable
-
Enable action policies in bulk by ID
Stack
Experimental
9.5+
- POST /api/alerting/v2/action_policies/_bulk_enable
-
Snooze action policies in bulk by ID
Stack
Experimental
9.5+
- POST /api/alerting/v2/action_policies/_bulk_snooze
-
Cancel snooze for action policies in bulk by ID
Stack
Experimental
9.5+
- POST /api/alerting/v2/action_policies/_bulk_unsnooze
-
Rotate API keys for action policies in bulk by ID
Stack
Experimental
9.5+
- POST /api/alerting/v2/action_policies/_bulk_update_api_key
-
Get an action policy
Stack
Experimental
9.5+
- GET /api/alerting/v2/action_policies/{id}
-
Create or replace an action policy
Stack
Experimental
9.5+
- PUT /api/alerting/v2/action_policies/{id}
-
Partially update an action policy.
Stack
Experimental
9.5+
- PATCH /api/alerting/v2/action_policies/{id}
-
Delete an action policy
Stack
Experimental
9.5+
- DELETE /api/alerting/v2/action_policies/{id}
-
Disable an action policy
Stack
Experimental
9.5+
- POST /api/alerting/v2/action_policies/{id}/_disable
-
Enable an action policy
Stack
Experimental
9.5+
- POST /api/alerting/v2/action_policies/{id}/_enable
-
Snooze an action policy
Stack
Experimental
9.5+
- POST /api/alerting/v2/action_policies/{id}/_snooze
-
Unsnooze an action policy
Stack
Experimental
9.5+
- POST /api/alerting/v2/action_policies/{id}/_unsnooze
-
Update an action policy API key
Stack
Experimental
9.5+
- POST /api/alerting/v2/action_policies/{id}/_update_api_key
-
Bulk acknowledge alert episodes
Stack
Experimental
9.5+
- POST /api/alerting/v2/episodes/_bulk_ack
-
Bulk activate alert episodes
Stack
Experimental
9.5+
- POST /api/alerting/v2/episodes/_bulk_activate
-
Bulk assign alert episodes
Stack
Experimental
9.5+
- POST /api/alerting/v2/episodes/_bulk_assign
-
Bulk deactivate alert episodes
Stack
Experimental
9.5+
- POST /api/alerting/v2/episodes/_bulk_deactivate
-
Bulk tag alert episodes
Stack
Experimental
9.5+
- POST /api/alerting/v2/episodes/_bulk_tag
-
Bulk unacknowledge alert episodes
Stack
Experimental
9.5+
- POST /api/alerting/v2/episodes/_bulk_unack
-
Acknowledge an alert episode
Stack
Experimental
9.5+
- POST /api/alerting/v2/episodes/{episode_id}/_ack
-
Activate an alert episode
Stack
Experimental
9.5+
- POST /api/alerting/v2/episodes/{episode_id}/_activate
-
Assign an alert episode to a user
Stack
Experimental
9.5+
- POST /api/alerting/v2/episodes/{episode_id}/_assign
-
Deactivate an alert episode
Stack
Experimental
9.5+
- POST /api/alerting/v2/episodes/{episode_id}/_deactivate
-
Tag an alert episode
Stack
Experimental
9.5+
- POST /api/alerting/v2/episodes/{episode_id}/_tag
-
Unacknowledge an alert episode
Stack
Experimental
9.5+
- POST /api/alerting/v2/episodes/{episode_id}/_unack
-
List action policy executions
Stack
Experimental
9.5+
- GET /api/alerting/v2/execution_history/action_policies
-
List rule executions
Stack
Experimental
9.5+
- GET /api/alerting/v2/execution_history/rules
-
List rules
Stack
Experimental
9.5+
- GET /api/alerting/v2/rules
-
Create a rule
Stack
Experimental
9.5+
- POST /api/alerting/v2/rules
-
Create rules in bulk
Stack
Experimental
9.5+
- POST /api/alerting/v2/rules/_bulk_create
-
Delete rules in bulk by ID
Stack
Experimental
9.5+
- POST /api/alerting/v2/rules/_bulk_delete
-
Disable rules in bulk by ID
Stack
Experimental
9.5+
- POST /api/alerting/v2/rules/_bulk_disable
-
Enable rules in bulk by ID
Stack
Experimental
9.5+
- POST /api/alerting/v2/rules/_bulk_enable
-
Get rules in bulk
Stack
Experimental
9.5+
- POST /api/alerting/v2/rules/_bulk_get
-
Update the API key of rules in bulk by ID
Stack
Experimental
9.5+
- POST /api/alerting/v2/rules/_bulk_update_api_key
-
Delete rules matching a query (dry-run by default)
Stack
Experimental
9.5+
- POST /api/alerting/v2/rules/_delete_by_query
-
Disable rules matching a query (dry-run by default)
Stack
Experimental
9.5+
- POST /api/alerting/v2/rules/_disable_by_query
-
Enable rules matching a query (dry-run by default)
Stack
Experimental
9.5+
- POST /api/alerting/v2/rules/_enable_by_query
-
Update the API key of rules matching a query (dry-run by default)
Stack
Experimental
9.5+
- POST /api/alerting/v2/rules/_update_api_key_by_query
-
Get a rule
Stack
Experimental
9.5+
- GET /api/alerting/v2/rules/{id}
-
Create or replace a rule
Stack
Experimental
9.5+
- PUT /api/alerting/v2/rules/{id}
-
Update a rule
Stack
Experimental
9.5+
- PATCH /api/alerting/v2/rules/{id}
-
Delete a rule
Stack
Experimental
9.5+
- DELETE /api/alerting/v2/rules/{id}
-
Disable a rule
Stack
Experimental
9.5+
- POST /api/alerting/v2/rules/{id}/_disable
-
Enable a rule
Stack
Experimental
9.5+
- POST /api/alerting/v2/rules/{id}/_enable
-
Run a rule now
Stack
Experimental
9.5+
- POST /api/alerting/v2/rules/{id}/_run
-
Bulk snooze alert episode series
Stack
Experimental
9.5+
- POST /api/alerting/v2/series/_bulk_snooze
-
Bulk unsnooze alert episode series
Stack
Experimental
9.5+
- POST /api/alerting/v2/series/_bulk_unsnooze
-
Snooze an alert episode series
Stack
Experimental
9.5+
- POST /api/alerting/v2/series/{group_hash}/_snooze
-
Unsnooze an alert episode series
Stack
Experimental
9.5+
- POST /api/alerting/v2/series/{group_hash}/_unsnooze