List action policy executions

Server: https://{kibana_url}

GET /api/alerting/v2/execution_history/action_policies
GET /s/{space_id}/api/alerting/v2/execution_history/action_policies

Refer to Spaces for more information.

Get a paginated list of dispatcher summary events for action policies in the current space.

[Required authorization] Route required privileges: read_alerting-v2-execution-history.

Query Parameters

page integer · min: 1 · max: 10000 · default: 1 required: Page number (1-indexed). Defaults to 1.
per_page integer · min: 1 · max: 100 · default: 20 required: Number of events per page. Defaults to 20.
from string · pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$: Inclusive ISO datetime lower bound on the event timestamp; overrides the default 24-hour window. Independent of alert_ids — e.g. set it to an alert’s start time to scope results to that alert’s lifetime.
to string · pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$: Inclusive ISO datetime upper bound on the event timestamp.
alert_ids [] string · min: 1 · max: 50: Alert filter. Narrows events to those referencing at least one of the provided alert IDs.
sort_field enum · default: dispatched_at required: Sort field. Defaults to "dispatched_at".; Values: dispatched_at
sort_order enum · default: desc required: Sort direction. Defaults to "desc".; Values: asc desc
search string · min: 1 · max: 256: Free-text search. Matches policy name, rule name, policy/rule ID (case-insensitive).
rule_ids [] string · min: 1 · max: 50: Explicit rule filter. Narrows events to those referencing at least one of the provided rule IDs. Also unions with the search filter if both are provided.
outcomes [] enum · min: 1 · max: 3: Outcome filter. When omitted matches all outcomes. Pass one or more of "success", "throttled", "failure" to narrow.; Values: success throttled failure

Responses

Returns a paginated list of execution history events.

application/json

Indicates an invalid schema or parameters.

application/json

Indicates the request was not authenticated.

application/json

Indicates the user does not have the required privileges to perform the request.

application/json

Indicates an unexpected server-side error.

application/json

Indicates the alerting engine is disabled by the alerting:v2:enabled advanced setting.

application/json

Examples

Request Console 1 / 2 languages

Console Kibana Dev Tools

GET /api/alerting/v2/execution_history/action_policies?page={page}&per_page={per_page}&sort_field={sort_field}&sort_order={sort_order}

curl Shell

curl -X GET "https://{kibana_url}/api/alerting/v2/execution_history/action_policies?page={page}&per_page={per_page}&sort_field={sort_field}&sort_order={sort_order}"

Response

{
  "items": [
    {
      "action_group_count": 1,
      "alert_count": 1,
      "alerts": [
        {
          "id": "episode-1"
        }
      ],
      "dispatched_at": "2026-01-15T12:05:00.000Z",
      "outcome": "success",
      "policy": {
        "id": "action-policy-1",
        "name": "Notify on production alerts"
      },
      "rule_count": 1,
      "rules": [
        {
          "id": "rule-1",
          "name": "Host CPU high"
        }
      ],
      "workflows": [
        {
          "id": "workflow-1",
          "name": "Notify oncall"
        }
      ]
    }
  ],
  "page": 1,
  "per_page": 20,
  "total": 1
}

{
  "code": "BAD_REQUEST",
  "details": {
    "errors": {
      "page": [
        "page * per_page cannot exceed 10000."
      ]
    }
  },
  "error": "Bad Request",
  "message": "page * per_page cannot exceed 10000."
}

{
  "code": "UNAUTHORIZED",
  "error": "Unauthorized",
  "message": "Authentication required to access this API."
}

{
  "code": "FORBIDDEN",
  "error": "Forbidden",
  "message": "The current user does not have the required privileges for this request."
}

{
  "code": "INTERNAL_SERVER_ERROR",
  "error": "Internal Server Error",
  "message": "An unexpected error occurred."
}

{
  "code": "ALERTING_DISABLED",
  "error": "Service Unavailable",
  "message": "Alerting is disabled."
}

Query Parameters { page , per_page , from , to , alert_ids , sort_field , sort_order , search , rule_ids , outcomes , }

Responses

Query Parameters