---
type: api
title: Get rule details
description: **Spaces method and path for this operation:**
url: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/operation/operation-get-alerting-rule-id
resource: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/operation/operation-get-alerting-rule-id
products:
  - Kibana
---

# Get rule details

- Server: `https://{kibana_url}`

## Paths

- `GET` `/api/alerting/rule/{id}`
- `GET` `/s/{space_id}/api/alerting/rule/{id}`

- [Api key auth](/elastic/docs-builder/docs/4371/api/doc/kibana/authentication#apikeyauth)
- [Basic auth](/elastic/docs-builder/docs/4371/api/doc/kibana/authentication#basicauth)

#### Path Parameters

- `id` (string)
  The identifier for the rule.

## Description

Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

## Responses

#### `200`

Indicates a successful call.

`application/json`

- `actions` ([] object)
  - `alerts_filter` (object)
    Defines a period that limits whether the action runs.
    - `query` ({})
      - `dsl` (string)
        A filter written in Elasticsearch Query Domain Specific Language (DSL).
      - `filters` ([] object)
        A filter written in Elasticsearch Query Domain Specific Language (DSL) as defined in the `kbn-es-query` package.
        - `$state` (object)
          - `store` (enum)
            A filter that can be applied to a specific application context or applied globally.
            Values: `appState`, `globalState`
        - `meta` (map string to object)
        - `query` (map string to object)
      - `kql` (string)
        A filter written in Kibana Query Language (KQL).
    - `timeframe` (object)
      - `days` ([] enum)
        Defines the days of the week that the action can run, represented as an array of numbers. For example, `1` represents Monday. An empty array is equivalent to specifying all the days of the week.
        Values: `1`, `2`, `3`, `4`, `5`, `6`, `7`
      - `hours` (object)
        - `end` (string)
          The end of the time frame, in 24-hour notation (`hh:mm`).
        - `start` (string)
          The start of the time frame, in 24-hour notation (`hh:mm`).
      - `timezone` (string)
        The ISO time zone for the `hours` values. Values such as `UTC` and `UTC+1` also work but lack built-in support for daylight savings time and are not recommended.
  - `connector_type_id` (string)
    The type of connector. This property appears in responses but cannot be set in requests.
  - `frequency` (object)
    - `notify_when` (enum)
      Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values.
      Values: `onActionGroupChange`, `onActiveAlert`, `onThrottleInterval`
    - `summary` (boolean)
      Indicates whether the action is a summary.
    - `throttle` (string · default: null) — nullable
      The throttle interval defines how frequently rule actions are triggered. It is specified in seconds, minutes, hours, or days and only applies when 'notify_when' is set to 'onThrottleInterval'. You cannot set the throttle interval at both the rule and action level. The recommended approach is to set it for each action individually. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.
  - `group` (string)
    The group name, which affects when the action runs (for example, when the threshold is met or when the alert is recovered). Each rule type has a list of valid action group names. If you don't need to group actions, set to `default`.
  - `id` (string)
    The identifier for the connector saved object.
  - `params` (map string to object)
    The parameters for the action, which are sent to the connector. The `params` are handled as Mustache templates and passed a default set of context.
  - `use_alert_data_for_template` (boolean)
    Indicates whether to use alert data as a template.
  - `uuid` (string)
    A universally unique identifier (UUID) for the action.
- `alert_delay` (object)
  Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
  - `active` (number)
    The number of consecutive runs that must meet the rule conditions.
- `api_key_created_by_user` (boolean) — nullable
  Indicates whether the API key that is associated with the rule was created by the user.
- `api_key_owner` (string · default: null) — nullable
  The owner of the API key that is associated with the rule and used to run background tasks.
- `artifacts` (object)
  - `dashboards` ([] object)
    - `id` (string)
  - `investigation_guide` (object)
    - `blob` (string)
      User-created content that describes alert causes and remediation.
- `consumer` (string)
  The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`.
- `created_at` (string)
  The date and time that the rule was created.
- `created_by` (string · default: null) — nullable
  The identifier for the user that created the rule.
- `enabled` (boolean)
  Indicates whether you want the rule to run on an interval basis after it is created.
- `execution_status` (object)
  - `error` (object)
    - `message` (string)
      Error message.
    - `reason` (enum)
      Reason for error.
      Values: `read`, `decrypt`, `execute`, `unknown`, `license`, `timeout`, `disabled`, `validate`
  - `last_duration` (number)
    Duration of last rule execution.
  - `last_execution_date` (string)
    The date and time of the last rule execution.
  - `status` (enum)
    Status of rule execution.
    Values: `ok`, `active`, `error`, `warning`, `pending`, `unknown`
  - `warning` (object)
    - `message` (string)
      Warning message.
    - `reason` (enum)
      Reason for warning.
      Values: `maxExecutableActions`, `maxAlerts`, `maxQueuedActions`, `ruleExecution`
- `flapping` ({})
  - `enabled` (boolean)
    Determines whether the rule can enter the flapping state. By default, rules can enter the flapping state.
  - `look_back_window` (number · min: 2 · max: 20)
    The minimum number of runs in which the threshold must be met.
  - `status_change_threshold` (number · min: 2 · max: 20)
    The minimum number of times an alert must switch states within the defined look back window time.
- `id` (string)
  The identifier for the rule.
- `last_run` (object) — nullable
  - `alerts_count` (object)
    - `active` (number) — nullable
      Number of active alerts during last run.
    - `ignored` (number) — nullable
      Number of ignored alerts during last run.
    - `new` (number) — nullable
      Number of new alerts during last run.
    - `recovered` (number) — nullable
      Number of recovered alerts during last run.
  - `outcome` (enum)
    Outcome of the last rule run. Value can be succeeded, warning, or failed.
    Values: `succeeded`, `warning`, `failed`
  - `outcome_msg` ([] string) — nullable
  - `outcome_order` (number)
    Order of the outcome.
  - `warning` (enum) — nullable
    Warning of last rule execution.
    Values: `read`, `decrypt`, `execute`, `unknown`, `license`, `timeout`, `disabled`, `validate`, `maxExecutableActions`, `maxAlerts`, `maxQueuedActions`, `ruleExecution`, `null`
- `mapped_params` (map string to object)
- `mute_all` (boolean)
  Indicates whether all alerts are muted.
- `muted_alert_ids` ([] string)
- `name` (string)
   The name of the rule.
- `next_run` (string) — nullable
  Date and time of the next rule run.
- `notify_when` (enum) — nullable
  Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values.
  Values: `onActionGroupChange`, `onActiveAlert`, `onThrottleInterval`, `null`
- `params` (map string to object)
  The parameters for the rule.
- `revision` (number)
  The rule revision number.
- `rule_type_id` (string)
  The rule type identifier.
- `running` (boolean) — nullable
  Indicates whether the rule is running.
- `schedule` (object)
  - `interval` (string)
    The interval is specified in seconds, minutes, hours, or days.
- `scheduled_task_id` (string)
  Identifier of the scheduled task.
- `tags` ([] string)
- `throttle` (string) — nullable — deprecated
  Deprecated in 8.13.0. Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.
- `updated_at` (string)
  The date and time of the latest updates to the rule.
- `updated_by` (string · default: null) — nullable
  The identifier for the user who was the last to update the rule.
#### `400`

Indicates an invalid schema or parameters.

#### `403`

Indicates that this call is forbidden.

#### `404`

Indicates a rule with the given ID does not exist.

## Code Examples

#### Console

```console
GET /api/alerting/rule/{id}
```

#### curl

```curl
curl -X GET "https://{kibana_url}/api/alerting/rule/{id}"
```

## Response Examples

#### Get an index threshold rule

A response that contains information about an index threshold rule.

```json
{
  "actions": [],
  "api_key_owner": "elastic",
  "consumer": "alerts",
  "created_at": "2022-12-05T23:40:33.132Z",
  "created_by": "elastic",
  "enabled": true,
  "id": "3583a470-74f6-11ed-9801-35303b735aef",
  "mute_all": false,
  "muted_alert_ids": [],
  "name": "my alert",
  "notify_when": "onActionGroupChange",
  "params": {
    "aggField": "sheet.version",
    "aggType": "avg",
    "groupBy": "top",
    "index": [
      "test-index"
    ],
    "termField": "name.keyword",
    "termSize": 6,
    "threshold": [
      1000
    ],
    "thresholdComparator": "\u003E",
    "timeField": "@timestamp",
    "timeWindowSize": 5,
    "timeWindowUnit": "m"
  },
  "revision": 0,
  "rule_type_id": ".index-threshold",
  "schedule": {
    "interval": "1m"
  },
  "tags": [
    "cpu"
  ],
  "throttle": "null",
  "updated_at": "2022-12-05T23:40:33.132Z",
  "updated_by": "elastic"
}
```