---
type: api
title: Disable a rule
description: Disable a rule by identifier.<br/><br/>[Required authorization] Route required privileges: manage_alerting-v2-rules.
url: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/v0/operation/operation-post-alerting-v2-rules-id-disable
resource: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/v0/operation/operation-post-alerting-v2-rules-id-disable
products:
  - Kibana
---

# Disable a rule

Availability: 9.5+

- Server: `https://{kibana_url}`

## Paths

- `POST` `/api/alerting/v2/rules/{id}/_disable`

- [Api key auth](/elastic/docs-builder/docs/4371/api/doc/kibana/v0/authentication#apikeyauth)
- [Basic auth](/elastic/docs-builder/docs/4371/api/doc/kibana/v0/authentication#basicauth)

#### Path Parameters

- `id` (string · min: 1 · max: 150)
  The identifier for the rule.

## Description

Disable a rule by identifier.<br/><br/>[Required authorization] Route required privileges: manage_alerting-v2-rules.

## Responses

#### `200`

Returns the disabled rule.

`application/json`

- `artifacts` ([] object · max: 100)
  Optional objects attached to the rule, such as a runbook or a dashboard. Each item has `id`, `type`, and `data`. The shape of `data` depends on `type`. For example, a `runbook` uses `content` and a `dashboard` uses `dashboard_id`. Known types are validated against that shape. Unknown types are stored when `id`, `type`, and `data` are present.
  - `data` (map string to object)
    Structured artifact data.
  - `id` (string · min: 1 · max: 256)
    Artifact identifier.
  - `type` (string · min: 1 · max: 128)
    Artifact type.
- `created_at` (string)
  ISO timestamp when the rule was created.
- `created_by` (string) — nullable
  User who created the rule.
- `enabled` (boolean)
  Whether the rule is enabled.
- `grouping` ({})
  Grouping configuration.
  - `fields` ([] string · max: 16)
    Fields to group alerts by, e.g. ["host.name", "service.name"]. Should match ES|QL GROUP BY fields.
- `id` (string)
  Unique rule identifier.
- `kind` (enum)
  Whether the rule creates alerts (`alert`) or only stores matching events (`signal`).
  Values: `alert`, `signal`
- `metadata` ({})
  - `builder_type` (string · max: 64)
    Identifies the rule builder that authored this rule (e.g. "threshold"). Absent for rules authored directly in ES|QL.
  - `description` (string · max: 1024)
    Human-readable description of the rule.
  - `name` (string · min: 1 · max: 256)
    Rule name (must be unique within the space).
  - `owner` (string · max: 256)
    Owner of the rule.
  - `tags` ([] string · min: 1 · max: 20)
    Tags for categorization, e.g. ["production", "infra"].
  - `version` (integer · min: 1 · max: 9007199254740991)
    Monotonically increasing integer number representing a rule configuration version, incremented on every change. Used on generated rule events as `rule.version`.
- `no_data_strategy` (enum)
  How the rule behaves when it finds no data for a group. If you omit this field or set it to `none`, those runs are ignored. If you set `last_known_status` or `recover`, a standalone query (`query.format: standalone`) must include `query.no_data`. A composed query (`query.format: composed`) uses `query.base` to detect whether data is present. The `emit` value is not accepted when creating or updating rules.
  Values: `last_known_status`, `emit`, `recover`, `none`
- `query` (union)
  Detection query configuration.
  - **Kibana_HTTP_APIs_alerting_composed_rule_query** (`format: composed`)
    Composed query: a shared base with appendable breach and recovery segments.
    - `base` (string · min: 1 · max: 10000)
      Base ES|QL query. Time filters are applied automatically via the lookback window.
    - `breach` (object)
      Breach detection configuration. Omit to treat every base row as a breach.
      - `segment` (string · min: 1 · max: 10000)
        A clause appended to the end of the rule's ES|QL query. Required in breach blocks.
    - `format` (enum)
      Values: `composed`
    - `recovery` (object)
      Recovery query segment. Required when recovery_strategy is "query".
      - `segment` (string · min: 1 · max: 10000)
        Appendable ES|QL segment for recovery detection.
  - **Kibana_HTTP_APIs_alerting_standalone_rule_query** (`format: standalone`)
    Standalone queries: independent full queries for breach, recovery, and no_data.
    - `breach` (object)
      Breach detection configuration (required).
      - `query` (string · min: 1 · max: 10000)
        Full ES|QL query for breach detection (required).
    - `format` (enum)
      Values: `standalone`
    - `no_data` (object)
      No-data detection query. Required when no_data_strategy is not "none".
      - `query` (string · min: 1 · max: 10000)
        Full ES|QL query that detects presence of data.
    - `recovery` (object)
      Recovery query. Required when recovery_strategy is "query".
      - `query` (string · min: 1 · max: 10000)
        Full ES|QL query for recovery detection.
- `recovery_strategy` (enum)
  The condition that marks an alert recovered. If omitted or set to `none`, recovery is disabled: the alert stays `active` even after the breach query stops returning matches, and `state_transition.recovering_count` / `recovering_timeframe` are not allowed. Set to `no_breach` to recover when the breach query stops returning matches. Set to `query` only when you also provide `query.recovery`.
  Values: `no_breach`, `query`, `none`
- `schedule` ({})
  Execution schedule configuration.
  - `every` (string · max: 32)
    Execution interval, e.g. 1m, 5m, 1h.
  - `lookback` (string · max: 32)
    Lookback window for the query, e.g. 5m, 1h. Can also be expressed in ES|QL.
- `state_transition` (object) — nullable
  Consecutive-match or time requirements before an alert becomes `active` or `inactive`. Applies only when `kind` is `alert`.
  - `pending_count` (integer · min: 0 · max: 1000)
    Number of consecutive matches required before the alert becomes `active`.
  - `pending_operator` (enum)
    The operator that combines `pending_count` and `pending_timeframe`. `AND` requires both. `OR` requires either.
    Values: `AND`, `OR`
  - `pending_timeframe` (string · max: 32)
    Time window used with `pending_count`, for example `5m` or `15m`.
  - `recovering_count` (integer · min: 0 · max: 1000)
    Number of consecutive recoveries required before the alert becomes `inactive`.
  - `recovering_operator` (enum)
    The operator that combines `recovering_count` and `recovering_timeframe`. `AND` requires both. `OR` requires either.
    Values: `AND`, `OR`
  - `recovering_timeframe` (string · max: 32)
    Time window used with `recovering_count`, for example `5m` or `15m`.
- `time_field` (string · min: 1 · max: 128 · default: @timestamp)
  Document field used as the event time when applying the lookback window. Defaults to `@timestamp`.
- `updated_at` (string)
  ISO timestamp when the rule was last updated.
- `updated_by` (string) — nullable
  User who last updated the rule.
- `version` (string)
  The saved object version token of the rule, used for optimistic concurrency control.
#### `400`

Indicates the request failed schema validation.

`application/json`

- `code` (string)
  Stable error code you can branch on, for example `INVALID_SCHEDULE` or `RULE_ALREADY_EXISTS`.
- `details` (map string to object)
  Optional extra information about the error, for example field validation issues or the `rule_id` when that ID already exists.
- `error` (string)
  A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.
- `message` (string)
  A readable explanation of the error. The wording can change without notice. Do not parse this field.
#### `401`

Indicates the request was not authenticated.

`application/json`

- `code` (string)
  Stable error code you can branch on, for example `INVALID_SCHEDULE` or `RULE_ALREADY_EXISTS`.
- `details` (map string to object)
  Optional extra information about the error, for example field validation issues or the `rule_id` when that ID already exists.
- `error` (string)
  A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.
- `message` (string)
  A readable explanation of the error. The wording can change without notice. Do not parse this field.
#### `403`

Indicates the user does not have the required privileges to perform the request.

`application/json`

- `code` (string)
  Stable error code you can branch on, for example `INVALID_SCHEDULE` or `RULE_ALREADY_EXISTS`.
- `details` (map string to object)
  Optional extra information about the error, for example field validation issues or the `rule_id` when that ID already exists.
- `error` (string)
  A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.
- `message` (string)
  A readable explanation of the error. The wording can change without notice. Do not parse this field.
#### `404`

Indicates a rule with the given ID does not exist.

`application/json`

- `code` (string)
  Stable error code you can branch on, for example `INVALID_SCHEDULE` or `RULE_ALREADY_EXISTS`.
- `details` (map string to object)
  Optional extra information about the error, for example field validation issues or the `rule_id` when that ID already exists.
- `error` (string)
  A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.
- `message` (string)
  A readable explanation of the error. The wording can change without notice. Do not parse this field.
#### `409`

Indicates the rule was concurrently updated by another caller.

`application/json`

- `code` (string)
  Stable error code you can branch on, for example `INVALID_SCHEDULE` or `RULE_ALREADY_EXISTS`.
- `details` (map string to object)
  Optional extra information about the error, for example field validation issues or the `rule_id` when that ID already exists.
- `error` (string)
  A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.
- `message` (string)
  A readable explanation of the error. The wording can change without notice. Do not parse this field.
#### `500`

Indicates an unexpected server-side error.

`application/json`

- `code` (string)
  Stable error code you can branch on, for example `INVALID_SCHEDULE` or `RULE_ALREADY_EXISTS`.
- `details` (map string to object)
  Optional extra information about the error, for example field validation issues or the `rule_id` when that ID already exists.
- `error` (string)
  A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.
- `message` (string)
  A readable explanation of the error. The wording can change without notice. Do not parse this field.
#### `503`

Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.

`application/json`

- `code` (string)
  Stable error code you can branch on, for example `INVALID_SCHEDULE` or `RULE_ALREADY_EXISTS`.
- `details` (map string to object)
  Optional extra information about the error, for example field validation issues or the `rule_id` when that ID already exists.
- `error` (string)
  A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.
- `message` (string)
  A readable explanation of the error. The wording can change without notice. Do not parse this field.
## Code Examples

#### Console

```console
POST /api/alerting/v2/rules/{id}/_disable
```

#### curl

```curl
curl -X POST "https://{kibana_url}/api/alerting/v2/rules/{id}/_disable" \
  -H "kbn-xsrf: true"
```

## Response Examples

#### Disabled host CPU threshold rule

```json
{
  "created_at": "2026-01-15T12:00:00.000Z",
  "created_by": "elastic",
  "enabled": false,
  "grouping": {
    "fields": [
      "host.name"
    ]
  },
  "id": "rule-1",
  "kind": "alert",
  "metadata": {
    "description": "Alerts when average CPU usage exceeds a threshold.",
    "name": "Host CPU high",
    "tags": [
      "production",
      "infra"
    ],
    "version": 1
  },
  "query": {
    "breach": {
      "query": "FROM metrics-* | WHERE host.cpu.usage \u003E 0.9 | STATS avg_cpu = AVG(host.cpu.usage) BY host.name"
    },
    "format": "standalone"
  },
  "recovery_strategy": "no_breach",
  "schedule": {
    "every": "1m",
    "lookback": "5m"
  },
  "state_transition": {
    "pending_count": 1,
    "recovering_count": 1
  },
  "time_field": "@timestamp",
  "updated_at": "2026-01-15T12:00:00.000Z",
  "updated_by": "elastic",
  "version": "WzAsMV0="
}
```

#### Indicates an invalid schema or parameters.

```json
{
  "code": "BAD_REQUEST",
  "details": {
    "errors": {
      "errors": [],
      "properties": {
        "page": {
          "errors": [
            "Too small: expected number to be \u003E=1"
          ]
        }
      }
    }
  },
  "error": "Bad Request",
  "message": "page: Too small: expected number to be \u003E=1"
}
```

#### Request was not authenticated

```json
{
  "code": "UNAUTHORIZED",
  "error": "Unauthorized",
  "message": "Authentication required to access this API."
}
```

#### Caller lacks required privileges

```json
{
  "code": "FORBIDDEN",
  "error": "Forbidden",
  "message": "The current user does not have the required privileges for this request."
}
```

#### No rule exists for the given ID

```json
{
  "code": "RULE_NOT_FOUND",
  "details": {
    "rule_id": "rule-1"
  },
  "error": "Not Found",
  "message": "Rule with id \u0022rule-1\u0022 not found"
}
```

#### Indicates the rule was concurrently updated by another caller.

```json
{
  "code": "RULE_VERSION_CONFLICT",
  "details": {
    "rule_id": "rule-1"
  },
  "error": "Conflict",
  "message": "Rule with id \u0022rule-1\u0022 has already been updated by another user"
}
```

#### Unexpected server-side error

```json
{
  "code": "INTERNAL_SERVER_ERROR",
  "error": "Internal Server Error",
  "message": "An unexpected error occurred."
}
```

#### Alerting V2 is disabled

```json
{
  "code": "ALERTING_DISABLED",
  "error": "Service Unavailable",
  "message": "Alerting is disabled."
}
```