Type to search.

List action policies

Base URL
https://{kibana_url}
  • GET /api/alerting/v2/action_policies
Auth The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats. Availability Experimental since 9.5 This functionality is experimental and is not ready for production usage. Experimental features may change or be removed at any time. Elastic will work to fix any issues, but experimental features are not subject to the support SLA of official GA features. Specific Support terms apply. Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments. This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.

Get a paginated list of action policies with optional filtering and sorting.

Required privileges

Privileges read_alerting-v2-action-policies

Query parameters

page integer · min: 1 · max: 10000

The page number to return. Defaults to 1.

per_page integer · min: 1 · max: 100

The number of action policies to return per page. Defaults to 20.

A text string to search across action policy fields.

enabled enum

Filter by enabled status. Accepts the strings true or false.

Values: true false
sort_field enum

The field to sort action policies by.

Values: name created_at updated_at
sort_order enum

The sort direction.

Values: asc desc

Responses

Returns a paginated list of action policies.

application/json
items object[] required

The list of action policies.

auth object required

Authentication and ownership information.

created_by_user boolean required

Whether this policy was created by a user (vs system-generated).

owner string required

The owner of the action policy.

created_at string required

The ISO datetime when the action policy was created.

created_by string required nullable

The user ID who created the action policy.

description string required

A description of the action policy.

destinations union oneOf[] required

The list of destinations.

One of:
{} type: workflow
id string · min length: 1 · max length: 150 required

The workflow connector identifier.

type enum required

The destination type.

Values: workflow
enabled boolean required

Whether the action policy is enabled.

group_by string[] required nullable

The fields used to group alerts, or null for no grouping.

grouping_mode union anyOf required

The grouping mode for alert notifications.

Values: per_episode all per_field
id string required

The unique identifier for the action policy.

matcher object required nullable

Selects the alerts this policy applies to. Set tags to match alerts from rules with those tags. Set expression to a KQL query, which will be evaluated against each alert.

If you set both tags and expression, an alert must match the tags and the expression for the policy to apply. When matcher is null, or when both tags and expression are empty, the policy applies to all alerts.

expression string · max length: 4096 nullable

A KQL query that's evaluated against each alert. Supported fields are: episode_id, episode_status, group_hash, last_event_timestamp, severity, and your rule's query output columns under data.* (for example, data.host.name). Referencing other fields won't work. Omit matcher.expression or set it to null to match on tags alone.

tags string[] · max items: 50 nullable

Rule tags this policy should match. The policy applies to alerts from any rule that has at least one of these tags. Omit matcher.tags or set it to null to match on matcher.expression alone.

name string required

The name of the action policy.

snoozed_until string required nullable

The ISO datetime until which the policy is snoozed, or null if not snoozed.

throttle object required nullable

The throttle configuration for notifications.

interval string · max length: 32 required nullable

The throttle interval duration (e.g. 5m, 1h), or null when the strategy is intervalless.

strategy enum

The throttle strategy.

Values: on_status_change per_status_interval time_interval every_time
updated_at string required

The ISO datetime when the action policy was last updated.

updated_by string required nullable

The user ID who last updated the action policy.

version string

The version, used for optimistic concurrency control.

page number required

The current page number.

per_page number required

The number of action policies per page.

total number required

The total number of action policies matching the query.