Alerting V2
Alerting V2 is an ES|QL-first alerting API for managing rules, alert actions, and action policies. Use these endpoints to create and manage detection rules, act on alerts, and control when and how notifications are delivered. These APIs are experimental.
50 endpoints
-
List action policies
- GET /api/alerting/v2/action_policies
-
Create an action policy
- POST /api/alerting/v2/action_policies
-
Delete action policies in bulk by ID
- POST /api/alerting/v2/action_policies/_bulk_delete
-
Disable action policies in bulk by ID
- POST /api/alerting/v2/action_policies/_bulk_disable
-
Enable action policies in bulk by ID
- POST /api/alerting/v2/action_policies/_bulk_enable
-
Snooze action policies in bulk by ID
- POST /api/alerting/v2/action_policies/_bulk_snooze
-
Cancel snooze for action policies in bulk by ID
- POST /api/alerting/v2/action_policies/_bulk_unsnooze
-
Rotate API keys for action policies in bulk by ID
- POST /api/alerting/v2/action_policies/_bulk_update_api_key
-
Delete an action policy
- DELETE /api/alerting/v2/action_policies/{id}
-
Get an action policy
- GET /api/alerting/v2/action_policies/{id}
-
Partially update an action policy.
- PATCH /api/alerting/v2/action_policies/{id}
-
Create or replace an action policy
- PUT /api/alerting/v2/action_policies/{id}
-
Disable an action policy
- POST /api/alerting/v2/action_policies/{id}/_disable
-
Enable an action policy
- POST /api/alerting/v2/action_policies/{id}/_enable
-
Snooze an action policy
- POST /api/alerting/v2/action_policies/{id}/_snooze
-
Unsnooze an action policy
- POST /api/alerting/v2/action_policies/{id}/_unsnooze
-
Update an action policy API key
- POST /api/alerting/v2/action_policies/{id}/_update_api_key
-
Bulk acknowledge alert episodes
- POST /api/alerting/v2/alerts/_bulk_ack
-
Bulk activate alert episodes
- POST /api/alerting/v2/alerts/_bulk_activate
-
Bulk assign alert episodes
- POST /api/alerting/v2/alerts/_bulk_assign
-
Bulk deactivate alert episodes
- POST /api/alerting/v2/alerts/_bulk_deactivate
-
Bulk tag alert episodes
- POST /api/alerting/v2/alerts/_bulk_tag
-
Bulk unacknowledge alert episodes
- POST /api/alerting/v2/alerts/_bulk_unack
-
Acknowledge an alert episode
- POST /api/alerting/v2/alerts/{id}/_ack
-
Activate an alert episode
- POST /api/alerting/v2/alerts/{id}/_activate
-
Assign an alert episode to a user
- POST /api/alerting/v2/alerts/{id}/_assign
-
Deactivate an alert episode
- POST /api/alerting/v2/alerts/{id}/_deactivate
-
Tag an alert episode
- POST /api/alerting/v2/alerts/{id}/_tag
-
Unacknowledge an alert episode
- POST /api/alerting/v2/alerts/{id}/_unack
-
List action policy executions
- GET /api/alerting/v2/execution_history/action_policies
-
List rule executions
- GET /api/alerting/v2/execution_history/rules
-
List rules
- GET /api/alerting/v2/rules
-
Create a rule
- POST /api/alerting/v2/rules
-
Create rules in bulk
- POST /api/alerting/v2/rules/_bulk_create
-
Delete rules in bulk by ID
- POST /api/alerting/v2/rules/_bulk_delete
-
Disable rules in bulk by ID
- POST /api/alerting/v2/rules/_bulk_disable
-
Enable rules in bulk by ID
- POST /api/alerting/v2/rules/_bulk_enable
-
Get rules in bulk
- POST /api/alerting/v2/rules/_bulk_get
-
Update the API key of rules in bulk by ID
- POST /api/alerting/v2/rules/_bulk_update_api_key
-
Delete rules matching a query (dry-run by default)
- POST /api/alerting/v2/rules/_delete_by_query
-
Disable rules matching a query (dry-run by default)
- POST /api/alerting/v2/rules/_disable_by_query
-
Enable rules matching a query (dry-run by default)
- POST /api/alerting/v2/rules/_enable_by_query
-
Update the API key of rules matching a query (dry-run by default)
- POST /api/alerting/v2/rules/_update_api_key_by_query
-
Delete a rule
- DELETE /api/alerting/v2/rules/{id}
-
Get a rule
- GET /api/alerting/v2/rules/{id}
-
Update a rule
- PATCH /api/alerting/v2/rules/{id}
-
Create or replace a rule
- PUT /api/alerting/v2/rules/{id}
-
Disable a rule
- POST /api/alerting/v2/rules/{id}/_disable
-
Enable a rule
- POST /api/alerting/v2/rules/{id}/_enable
-
Run a rule now
- POST /api/alerting/v2/rules/{id}/_run