List action policy executions
https://{kibana_url}
- GET /api/alerting/v2/execution_history/action_policies
Get a paginated list of dispatcher summary events for action policies in the current space.
[Required authorization] Route required privileges: read_alerting-v2-execution-history.
Query Parameters
-
pageinteger · min: 1 · max: 10000 Page number (1-indexed). Defaults to 1.
-
per_pageinteger · min: 0 · max: 100 Number of events per page. Defaults to 20. Pass 0 for a count-only read.
-
start_datestring · pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$ Inclusive ISO datetime lower bound on the event timestamp; overrides the default 24-hour window. Independent of episode_ids — e.g. set it to an episode’s start time to scope results to that episode’s lifetime.
-
episode_idsstring · min: 1 · max: 50 Episode filter. Narrows events to those referencing at least one of the provided episode ids.
-
searchstring · min: 1 · max: 256 Free-text search. Matches policy name, rule name, policy/rule ID (case-insensitive).
-
rule_idsstring · min: 1 · max: 50 Explicit rule filter. Narrows events to those referencing at least one of the provided rule ids. Also unions with the search filter if both are provided.
-
outcome· min: 1 · max: 3 Outcome filter. When omitted matches all outcomes. Pass one or more of "dispatched", "throttled", "dispatch_failed" to narrow.
-
Values:
dispatchedthrottleddispatch_failed
Responses
Returns a paginated list of execution history events.
-
itemsobjectrequired -
action_group_countnumberrequired -
dispatched_atstringrequired -
episode_countnumberrequired -
episodesobject · max: 50 -
Episode ids referenced by this event, bounded to MAX_EMBEDDED_EPISODES_PER_ITEM. Use
episode_countfor the true total. -
idstringrequired -
failure_reason -
Values:
missing_api_keyworkflow_not_foundworkflow_disabledschedule_error -
outcome -
Values:
dispatchedthrottleddispatch_failed -
rulesobject · max: 20required -
Rules referenced by this event, bounded to MAX_EMBEDDED_RULES_PER_ITEM. When a search or rule filter narrows the match, this array is intersected with the matched subset server-side. Use
total_rule_countfor the full count. -
total_rule_countnumberrequired -
Total number of rules referenced by this event after search / rule-filter narrowing. May exceed
rules.lengthwhen the embedded array is truncated to the cap. -
pageinteger · min: 1 · max: 9007199254740991required -
per_pageinteger · min: 0 · max: 9007199254740991required -
search_matchesobjectrequired nullable -
Per-type match counts for the active search, plus the cap used as filter. Null when no search was provided. When policies > cap or rules > cap the result is truncated.
-
total_eventsinteger · min: 0 · max: 9007199254740991required
Indicates an invalid schema or parameters.
-
codestringrequired -
Stable error code you can branch on, for example
INVALID_SCHEDULEorRULE_ALREADY_EXISTS. -
detailsmap string to object -
Optional extra information about the error, for example field validation issues or the
rule_idwhen that ID already exists. -
errorstringrequired -
A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.
-
messagestringrequired -
A readable explanation of the error. The wording can change without notice. Do not parse this field.
Indicates the request was not authenticated.
-
codestringrequired -
Stable error code you can branch on, for example
INVALID_SCHEDULEorRULE_ALREADY_EXISTS. -
detailsmap string to object -
Optional extra information about the error, for example field validation issues or the
rule_idwhen that ID already exists. -
errorstringrequired -
A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.
-
messagestringrequired -
A readable explanation of the error. The wording can change without notice. Do not parse this field.
Indicates the user does not have the required privileges to perform the request.
-
codestringrequired -
Stable error code you can branch on, for example
INVALID_SCHEDULEorRULE_ALREADY_EXISTS. -
detailsmap string to object -
Optional extra information about the error, for example field validation issues or the
rule_idwhen that ID already exists. -
errorstringrequired -
A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.
-
messagestringrequired -
A readable explanation of the error. The wording can change without notice. Do not parse this field.
Indicates an unexpected server-side error.
-
codestringrequired -
Stable error code you can branch on, for example
INVALID_SCHEDULEorRULE_ALREADY_EXISTS. -
detailsmap string to object -
Optional extra information about the error, for example field validation issues or the
rule_idwhen that ID already exists. -
errorstringrequired -
A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.
-
messagestringrequired -
A readable explanation of the error. The wording can change without notice. Do not parse this field.
Indicates the alerting engine is disabled by the alerting:v2:enabled advanced setting.
-
codestringrequired -
Stable error code you can branch on, for example
INVALID_SCHEDULEorRULE_ALREADY_EXISTS. -
detailsmap string to object -
Optional extra information about the error, for example field validation issues or the
rule_idwhen that ID already exists. -
errorstringrequired -
A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.
-
messagestringrequired -
A readable explanation of the error. The wording can change without notice. Do not parse this field.