---
type: api
title: Get rules in bulk
description: [Required authorization] Route required privileges: read_alerting-v2-rules.
url: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/v0/operation/operation-post-alerting-v2-rules-bulk-get
resource: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/v0/operation/operation-post-alerting-v2-rules-bulk-get
products:
  - Kibana
---

# Get rules in bulk

Availability: 9.5+

- Server: `https://{kibana_url}`

## Paths

- `POST` `/api/alerting/v2/rules/_bulk_get`

- [Api key auth](/elastic/docs-builder/docs/4371/api/doc/kibana/v0/authentication#apikeyauth)
- [Basic auth](/elastic/docs-builder/docs/4371/api/doc/kibana/v0/authentication#basicauth)

## Description

[Required authorization] Route required privileges: read_alerting-v2-rules.

## Request Body

`application/json`

- `ids` ([] string · min: 1 · max: 100) — required
  Explicit list of IDs to operate on.

## Responses

#### `200`

Returns the requested rules.

`application/json`

- `rules` ([] object)
  The requested rules, in the same order as the requested ids.
  - `artifacts` ([] object · max: 100)
    Optional objects attached to the rule, such as a runbook or a dashboard. Each item has `id`, `type`, and `data`. The shape of `data` depends on `type`. For example, a `runbook` uses `content` and a `dashboard` uses `dashboard_id`. Known types are validated against that shape. Unknown types are stored when `id`, `type`, and `data` are present.
    - `data` (map string to object)
      Structured artifact data.
    - `id` (string · min: 1 · max: 256)
      Artifact identifier.
    - `type` (string · min: 1 · max: 128)
      Artifact type.
  - `created_at` (string)
    ISO timestamp when the rule was created.
  - `created_by` (string) — nullable
    User who created the rule.
  - `enabled` (boolean)
    Whether the rule is enabled.
  - `grouping` ({})
    Grouping configuration.
    - `fields` ([] string · max: 16)
      Fields to group alerts by, e.g. ["host.name", "service.name"]. Should match ES|QL GROUP BY fields.
  - `id` (string)
    Unique rule identifier.
  - `kind` (enum)
    Whether the rule creates alerts (`alert`) or only stores matching events (`signal`).
    Values: `alert`, `signal`
  - `metadata` ({})
    - `builder_type` (string · max: 64)
      Identifies the rule builder that authored this rule (e.g. "threshold"). Absent for rules authored directly in ES|QL.
    - `description` (string · max: 1024)
      Human-readable description of the rule.
    - `name` (string · min: 1 · max: 256)
      Rule name (must be unique within the space).
    - `owner` (string · max: 256)
      Owner of the rule.
    - `tags` ([] string · min: 1 · max: 20)
      Tags for categorization, e.g. ["production", "infra"].
    - `version` (integer · min: 1 · max: 9007199254740991)
      Monotonically increasing integer number representing a rule configuration version, incremented on every change. Used on generated rule events as `rule.version`.
  - `no_data_strategy` (enum)
    How the rule behaves when it finds no data for a group. If you omit this field or set it to `none`, those runs are ignored. If you set `last_known_status` or `recover`, a standalone query (`query.format: standalone`) must include `query.no_data`. A composed query (`query.format: composed`) uses `query.base` to detect whether data is present. The `emit` value is not accepted when creating or updating rules.
    Values: `last_known_status`, `emit`, `recover`, `none`
  - `query` (union)
    Detection query configuration.
    - **Kibana_HTTP_APIs_alerting_composed_rule_query** (`format: composed`)
      Composed query: a shared base with appendable breach and recovery segments.
      - `base` (string · min: 1 · max: 10000)
        Base ES|QL query. Time filters are applied automatically via the lookback window.
      - `breach` (object)
        Breach detection configuration. Omit to treat every base row as a breach.
        - `segment` (string · min: 1 · max: 10000)
          A clause appended to the end of the rule's ES|QL query. Required in breach blocks.
      - `format` (enum)
        Values: `composed`
      - `recovery` (object)
        Recovery query segment. Required when recovery_strategy is "query".
        - `segment` (string · min: 1 · max: 10000)
          Appendable ES|QL segment for recovery detection.
    - **Kibana_HTTP_APIs_alerting_standalone_rule_query** (`format: standalone`)
      Standalone queries: independent full queries for breach, recovery, and no_data.
      - `breach` (object)
        Breach detection configuration (required).
        - `query` (string · min: 1 · max: 10000)
          Full ES|QL query for breach detection (required).
      - `format` (enum)
        Values: `standalone`
      - `no_data` (object)
        No-data detection query. Required when no_data_strategy is not "none".
        - `query` (string · min: 1 · max: 10000)
          Full ES|QL query that detects presence of data.
      - `recovery` (object)
        Recovery query. Required when recovery_strategy is "query".
        - `query` (string · min: 1 · max: 10000)
          Full ES|QL query for recovery detection.
  - `recovery_strategy` (enum)
    The condition that marks an alert recovered. If omitted or set to `none`, recovery is disabled: the alert stays `active` even after the breach query stops returning matches, and `state_transition.recovering_count` / `recovering_timeframe` are not allowed. Set to `no_breach` to recover when the breach query stops returning matches. Set to `query` only when you also provide `query.recovery`.
    Values: `no_breach`, `query`, `none`
  - `schedule` ({})
    Execution schedule configuration.
    - `every` (string · max: 32)
      Execution interval, e.g. 1m, 5m, 1h.
    - `lookback` (string · max: 32)
      Lookback window for the query, e.g. 5m, 1h. Can also be expressed in ES|QL.
  - `state_transition` (object) — nullable
    Consecutive-match or time requirements before an alert becomes `active` or `inactive`. Applies only when `kind` is `alert`.
    - `pending_count` (integer · min: 0 · max: 1000)
      Number of consecutive matches required before the alert becomes `active`.
    - `pending_operator` (enum)
      The operator that combines `pending_count` and `pending_timeframe`. `AND` requires both. `OR` requires either.
      Values: `AND`, `OR`
    - `pending_timeframe` (string · max: 32)
      Time window used with `pending_count`, for example `5m` or `15m`.
    - `recovering_count` (integer · min: 0 · max: 1000)
      Number of consecutive recoveries required before the alert becomes `inactive`.
    - `recovering_operator` (enum)
      The operator that combines `recovering_count` and `recovering_timeframe`. `AND` requires both. `OR` requires either.
      Values: `AND`, `OR`
    - `recovering_timeframe` (string · max: 32)
      Time window used with `recovering_count`, for example `5m` or `15m`.
  - `time_field` (string · min: 1 · max: 128 · default: @timestamp)
    Document field used as the event time when applying the lookback window. Defaults to `@timestamp`.
  - `updated_at` (string)
    ISO timestamp when the rule was last updated.
  - `updated_by` (string) — nullable
    User who last updated the rule.
  - `version` (string)
    The saved object version token of the rule, used for optimistic concurrency control.
#### `400`

Indicates an invalid schema or parameters.

`application/json`

- `code` (string)
  Stable error code you can branch on, for example `INVALID_SCHEDULE` or `RULE_ALREADY_EXISTS`.
- `details` (map string to object)
  Optional extra information about the error, for example field validation issues or the `rule_id` when that ID already exists.
- `error` (string)
  A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.
- `message` (string)
  A readable explanation of the error. The wording can change without notice. Do not parse this field.
#### `401`

Indicates the request was not authenticated.

`application/json`

- `code` (string)
  Stable error code you can branch on, for example `INVALID_SCHEDULE` or `RULE_ALREADY_EXISTS`.
- `details` (map string to object)
  Optional extra information about the error, for example field validation issues or the `rule_id` when that ID already exists.
- `error` (string)
  A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.
- `message` (string)
  A readable explanation of the error. The wording can change without notice. Do not parse this field.
#### `403`

Indicates the user does not have the required privileges to perform the request.

`application/json`

- `code` (string)
  Stable error code you can branch on, for example `INVALID_SCHEDULE` or `RULE_ALREADY_EXISTS`.
- `details` (map string to object)
  Optional extra information about the error, for example field validation issues or the `rule_id` when that ID already exists.
- `error` (string)
  A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.
- `message` (string)
  A readable explanation of the error. The wording can change without notice. Do not parse this field.
#### `404`

One or more rule ids could not be found.

`application/json`

- `code` (string)
  Stable error code you can branch on, for example `INVALID_SCHEDULE` or `RULE_ALREADY_EXISTS`.
- `details` (map string to object)
  Optional extra information about the error, for example field validation issues or the `rule_id` when that ID already exists.
- `error` (string)
  A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.
- `message` (string)
  A readable explanation of the error. The wording can change without notice. Do not parse this field.
#### `500`

Indicates an unexpected server-side error.

`application/json`

- `code` (string)
  Stable error code you can branch on, for example `INVALID_SCHEDULE` or `RULE_ALREADY_EXISTS`.
- `details` (map string to object)
  Optional extra information about the error, for example field validation issues or the `rule_id` when that ID already exists.
- `error` (string)
  A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.
- `message` (string)
  A readable explanation of the error. The wording can change without notice. Do not parse this field.
#### `503`

Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.

`application/json`

- `code` (string)
  Stable error code you can branch on, for example `INVALID_SCHEDULE` or `RULE_ALREADY_EXISTS`.
- `details` (map string to object)
  Optional extra information about the error, for example field validation issues or the `rule_id` when that ID already exists.
- `error` (string)
  A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.
- `message` (string)
  A readable explanation of the error. The wording can change without notice. Do not parse this field.
## Code Examples

#### Console

```console
POST /api/alerting/v2/rules/_bulk_get
{
  "ids": [
    "rule-1",
    "rule-2"
  ]
}
```

#### curl

```curl
curl -X POST "https://{kibana_url}/api/alerting/v2/rules/_bulk_get" \
  -H "kbn-xsrf: true" \
  -H "Content-Type: application/json" \
  -d '{
  "ids": [
    "rule-1",
    "rule-2"
  ]
}'
```

## Response Examples

#### Returned the requested rules

```json
{
  "rules": [
    {
      "created_at": "2026-01-15T12:00:00.000Z",
      "created_by": "elastic",
      "enabled": true,
      "grouping": {
        "fields": [
          "host.name"
        ]
      },
      "id": "rule-1",
      "kind": "alert",
      "metadata": {
        "description": "Alerts when average CPU usage exceeds a threshold.",
        "name": "Host CPU high",
        "tags": [
          "production",
          "infra"
        ],
        "version": 1
      },
      "query": {
        "breach": {
          "query": "FROM metrics-* | WHERE host.cpu.usage \u003E 0.9 | STATS avg_cpu = AVG(host.cpu.usage) BY host.name"
        },
        "format": "standalone"
      },
      "recovery_strategy": "no_breach",
      "schedule": {
        "every": "1m",
        "lookback": "5m"
      },
      "state_transition": {
        "pending_count": 1,
        "recovering_count": 1
      },
      "time_field": "@timestamp",
      "updated_at": "2026-01-15T12:00:00.000Z",
      "updated_by": "elastic",
      "version": "WzAsMV0="
    }
  ]
}
```

#### Request body is missing required rule ids

```json
{
  "code": "BAD_REQUEST",
  "details": {
    "errors": {
      "ids": [
        "Required"
      ]
    }
  },
  "error": "Bad Request",
  "message": "ids: Required"
}
```

#### Request was not authenticated

```json
{
  "code": "UNAUTHORIZED",
  "error": "Unauthorized",
  "message": "Authentication required to access this API."
}
```

#### Caller lacks required privileges

```json
{
  "code": "FORBIDDEN",
  "error": "Forbidden",
  "message": "The current user does not have the required privileges for this request."
}
```

#### One or more requested rule ids could not be found

```json
{
  "code": "NOT_FOUND",
  "error": "Not Found",
  "message": "Saved object [alerting_rule/rule-1] not found"
}
```

#### Unexpected server-side error

```json
{
  "code": "INTERNAL_SERVER_ERROR",
  "error": "Internal Server Error",
  "message": "An unexpected error occurred."
}
```

#### Alerting V2 is disabled

```json
{
  "code": "ALERTING_DISABLED",
  "error": "Service Unavailable",
  "message": "Alerting is disabled."
}
```