Snooze an action policy
https://{kibana_url}
- POST /api/alerting/v2/action_policies/{id}/_snooze
Snooze an action policy until a specified time.
[Required authorization] Route required privileges: manage_alerting-v2-action-policies.
Path Parameters
-
idstring · min: 1 · max: 150required -
The ID of the action policy. Copy it from the response when you create a policy, fetch one policy, or fetch the policy list.
Request
-
snoozed_untilstring · pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$required -
The ISO datetime until which the action policy should be snoozed.
Responses
Returns the snoozed action policy.
-
authobjectrequired -
Authentication and ownership information.
-
created_by_userbooleanrequired -
Whether this policy was created by a user (vs system-generated).
-
ownerstringrequired -
The owner of the action policy.
-
created_atstringrequired -
The ISO datetime when the action policy was created.
-
created_bystringrequired nullable -
The user ID who created the action policy.
-
descriptionstringrequired -
A description of the action policy.
-
destinations -
The list of destinations.
-
enabledbooleanrequired -
Whether the action policy is enabled.
-
group_bystringrequired nullable -
The fields used to group alerts, or null for no grouping.
-
grouping_modeobjectrequired -
The grouping mode for alert notifications.
-
Values:
per_episodeallper_field -
idstringrequired -
The unique identifier for the action policy.
-
matcherobjectrequired nullable -
Selects the alerts this policy applies to. Set
tagsto match alerts from rules with those tags. Setexpressionto a KQL query, which will be evaluated against each alert.
If you set bothtagsandexpression, an alert must match the tags and the expression for the policy to apply. Whenmatcherisnull, or when bothtagsandexpressionare empty, the policy applies to all alerts. -
expressionstring · max: 4096nullable -
A KQL query that's evaluated against each alert. Supported fields are:
episode_id,episode_status,group_hash,last_event_timestamp,severity, and your rule's query output columns underdata.*(for example,data.host.name). Referencing other fields won't work. Omitmatcher.expressionor set it tonullto match ontagsalone. -
Rule tags this policy should match. The policy applies to alerts from any rule that has at least one of these tags. Omit
matcher.tagsor set it tonullto match onmatcher.expressionalone. -
namestringrequired -
The name of the action policy.
-
snoozed_untilstringrequired nullable -
The ISO datetime until which the policy is snoozed, or null if not snoozed.
-
throttleobjectrequired nullable -
The throttle configuration for notifications.
-
updated_atstringrequired -
The ISO datetime when the action policy was last updated.
-
updated_bystringrequired nullable -
The user ID who last updated the action policy.
-
versionstring -
The version, used for optimistic concurrency control.
Indicates an invalid schema or parameters.
-
codestringrequired -
Stable error code you can branch on, for example
INVALID_SCHEDULEorRULE_ALREADY_EXISTS. -
detailsmap string to object -
Optional extra information about the error, for example field validation issues or the
rule_idwhen that ID already exists. -
errorstringrequired -
A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.
-
messagestringrequired -
A readable explanation of the error. The wording can change without notice. Do not parse this field.
Indicates the request was not authenticated.
-
codestringrequired -
Stable error code you can branch on, for example
INVALID_SCHEDULEorRULE_ALREADY_EXISTS. -
detailsmap string to object -
Optional extra information about the error, for example field validation issues or the
rule_idwhen that ID already exists. -
errorstringrequired -
A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.
-
messagestringrequired -
A readable explanation of the error. The wording can change without notice. Do not parse this field.
Indicates the user does not have the required privileges to perform the request.
-
codestringrequired -
Stable error code you can branch on, for example
INVALID_SCHEDULEorRULE_ALREADY_EXISTS. -
detailsmap string to object -
Optional extra information about the error, for example field validation issues or the
rule_idwhen that ID already exists. -
errorstringrequired -
A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.
-
messagestringrequired -
A readable explanation of the error. The wording can change without notice. Do not parse this field.
Indicates an action policy with the given ID does not exist.
-
codestringrequired -
Stable error code you can branch on, for example
INVALID_SCHEDULEorRULE_ALREADY_EXISTS. -
detailsmap string to object -
Optional extra information about the error, for example field validation issues or the
rule_idwhen that ID already exists. -
errorstringrequired -
A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.
-
messagestringrequired -
A readable explanation of the error. The wording can change without notice. Do not parse this field.
Indicates the action policy was concurrently updated by another caller.
-
codestringrequired -
Stable error code you can branch on, for example
INVALID_SCHEDULEorRULE_ALREADY_EXISTS. -
detailsmap string to object -
Optional extra information about the error, for example field validation issues or the
rule_idwhen that ID already exists. -
errorstringrequired -
A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.
-
messagestringrequired -
A readable explanation of the error. The wording can change without notice. Do not parse this field.
Indicates an unexpected server-side error.
-
codestringrequired -
Stable error code you can branch on, for example
INVALID_SCHEDULEorRULE_ALREADY_EXISTS. -
detailsmap string to object -
Optional extra information about the error, for example field validation issues or the
rule_idwhen that ID already exists. -
errorstringrequired -
A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.
-
messagestringrequired -
A readable explanation of the error. The wording can change without notice. Do not parse this field.
Indicates the alerting engine is disabled by the alerting:v2:enabled advanced setting.
-
codestringrequired -
Stable error code you can branch on, for example
INVALID_SCHEDULEorRULE_ALREADY_EXISTS. -
detailsmap string to object -
Optional extra information about the error, for example field validation issues or the
rule_idwhen that ID already exists. -
errorstringrequired -
A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.
-
messagestringrequired -
A readable explanation of the error. The wording can change without notice. Do not parse this field.