Alerting V2

Alerting V2 is an ES|QL-first alerting API for managing rules, alert actions, and action policies. Use these endpoints to create and manage detection rules, act on alerts, and control when and how notifications are delivered. These APIs are experimental.

List action policies Stack Planned
- GET /api/alerting/v2/action_policies
Create an action policy Stack Planned
- POST /api/alerting/v2/action_policies
Delete action policies in bulk by ID Stack Planned
- POST /api/alerting/v2/action_policies/_bulk_delete
Disable action policies in bulk by ID Stack Planned
- POST /api/alerting/v2/action_policies/_bulk_disable
Enable action policies in bulk by ID Stack Planned
- POST /api/alerting/v2/action_policies/_bulk_enable
Snooze action policies in bulk by ID Stack Planned
- POST /api/alerting/v2/action_policies/_bulk_snooze
Cancel snooze for action policies in bulk by ID Stack Planned
- POST /api/alerting/v2/action_policies/_bulk_unsnooze
Rotate API keys for action policies in bulk by ID Stack Planned
- POST /api/alerting/v2/action_policies/_bulk_update_api_key
Get an action policy Stack Planned
- GET /api/alerting/v2/action_policies/{id}
Create or replace an action policy Stack Planned
- PUT /api/alerting/v2/action_policies/{id}
Partially update an action policy. Stack Planned
- PATCH /api/alerting/v2/action_policies/{id}
Delete an action policy Stack Planned
- DELETE /api/alerting/v2/action_policies/{id}
Disable an action policy Stack Planned
- POST /api/alerting/v2/action_policies/{id}/_disable
Enable an action policy Stack Planned
- POST /api/alerting/v2/action_policies/{id}/_enable
Snooze an action policy Stack Planned
- POST /api/alerting/v2/action_policies/{id}/_snooze
Unsnooze an action policy Stack Planned
- POST /api/alerting/v2/action_policies/{id}/_unsnooze
Update an action policy API key Stack Planned
- POST /api/alerting/v2/action_policies/{id}/_update_api_key
Bulk acknowledge alerts Stack Planned
- POST /api/alerting/v2/alerts/_bulk_ack
Bulk activate alerts Stack Planned
- POST /api/alerting/v2/alerts/_bulk_activate
Bulk assign alerts Stack Planned
- POST /api/alerting/v2/alerts/_bulk_assign
Bulk deactivate alerts Stack Planned
- POST /api/alerting/v2/alerts/_bulk_deactivate
Bulk tag alerts Stack Planned
- POST /api/alerting/v2/alerts/_bulk_tag
Bulk unacknowledge alerts Stack Planned
- POST /api/alerting/v2/alerts/_bulk_unack
Acknowledge an alert Stack Planned
- POST /api/alerting/v2/alerts/{id}/_ack
Activate an alert Stack Planned
- POST /api/alerting/v2/alerts/{id}/_activate
Assign an alert to a user Stack Planned
- POST /api/alerting/v2/alerts/{id}/_assign
Deactivate an alert Stack Planned
- POST /api/alerting/v2/alerts/{id}/_deactivate
Tag an alert Stack Planned
- POST /api/alerting/v2/alerts/{id}/_tag
Unacknowledge an alert Stack Planned
- POST /api/alerting/v2/alerts/{id}/_unack
List action policy executions Stack Planned
- GET /api/alerting/v2/execution_history/action_policies
List rule executions Stack Planned
- GET /api/alerting/v2/execution_history/rules
List rules Stack Planned
- GET /api/alerting/v2/rules
Create a rule Stack Planned
- POST /api/alerting/v2/rules
Create rules in bulk Stack Planned
- POST /api/alerting/v2/rules/_bulk_create
Delete rules in bulk by ID Stack Planned
- POST /api/alerting/v2/rules/_bulk_delete
Disable rules in bulk by ID Stack Planned
- POST /api/alerting/v2/rules/_bulk_disable
Enable rules in bulk by ID Stack Planned
- POST /api/alerting/v2/rules/_bulk_enable
Get rules in bulk Stack Planned
- POST /api/alerting/v2/rules/_bulk_get
Update the API key of rules in bulk by ID Stack Planned
- POST /api/alerting/v2/rules/_bulk_update_api_key
Delete rules matching a query (dry-run by default) Stack Planned
- POST /api/alerting/v2/rules/_delete_by_query
Disable rules matching a query (dry-run by default) Stack Planned
- POST /api/alerting/v2/rules/_disable_by_query
Enable rules matching a query (dry-run by default) Stack Planned
- POST /api/alerting/v2/rules/_enable_by_query
Update the API key of rules matching a query (dry-run by default) Stack Planned
- POST /api/alerting/v2/rules/_update_api_key_by_query
Get a rule Stack Planned
- GET /api/alerting/v2/rules/{id}
Create or replace a rule Stack Planned
- PUT /api/alerting/v2/rules/{id}
Update a rule Stack Planned
- PATCH /api/alerting/v2/rules/{id}
Delete a rule Stack Planned
- DELETE /api/alerting/v2/rules/{id}
Disable a rule Stack Planned
- POST /api/alerting/v2/rules/{id}/_disable
Enable a rule Stack Planned
- POST /api/alerting/v2/rules/{id}/_enable
Run a rule now Stack Planned
- POST /api/alerting/v2/rules/{id}/_run