---
type: api
title: Create an alert
description: **Spaces method and path for this operation:**
url: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/v8/operation/operation-legacycreatealert
resource: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/v8/operation/operation-legacycreatealert
products:
  - Kibana
---

# Create an alert

deprecated

- Server: `https://{kibana_url}`

## Paths

- `POST` `/api/alerts/alert/{alertId}`
- `POST` `/s/{space_id}/api/alerts/alert/{alertId}`

- [Api key auth](/elastic/docs-builder/docs/4371/api/doc/kibana/v8/authentication#apikeyauth)
- [Basic auth](/elastic/docs-builder/docs/4371/api/doc/kibana/v8/authentication#basicauth)

#### Path Parameters

- `alertId` (string)
  An UUID v1 or v4 identifier for the alert. If this parameter is omitted, the identifier is randomly generated.

## Description

Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

Deprecated in 7.13.0. Use the create rule API instead.

## Request Body

`application/json`

- `actions` ([] object) — optional
  - `actionTypeId` (string) — required
    The identifier for the action type.
  - `group` (string) — required
    Grouping actions is recommended for escalations for different types of alert instances. If you don't need this functionality, set it to `default`.
  - `id` (string) — required
    The ID of the action saved object.
  - `params` (object) — required
    The map to the `params` that the action type will receive. `params` are handled as Mustache templates and passed a default set of context.
- `alertTypeId` (string) — required
  The ID of the alert type that you want to call when the alert is scheduled to run.
- `consumer` (string) — required
  The name of the application that owns the alert. This name has to match the Kibana feature name, as that dictates the required role-based access control privileges.
- `enabled` (boolean) — optional
  Indicates if you want to run the alert on an interval basis after it is created.
- `name` (string) — required
  A name to reference and search.
- `notifyWhen` (enum) — required
  The condition for throttling the notification.
  Values: `onActionGroupChange`, `onActiveAlert`, `onThrottleInterval`
- `params` (object) — required
  The parameters to pass to the alert type executor `params` value. This will also validate against the alert type params validator, if defined.
- `schedule` (object) — required
  The schedule specifying when this alert should be run. A schedule is structured such that the key specifies the format you wish to use and its value specifies the schedule.
  - `interval` (string) — optional
    The interval format specifies the interval in seconds, minutes, hours or days at which the alert should run.
- `tags` ([] string) — optional
  A list of keywords to reference and search.
- `throttle` (string) — optional
  How often this alert should fire the same actions. This will prevent the alert from sending out the same notification over and over. For example, if an alert with a schedule of 1 minute stays in a triggered state for 90 minutes, setting a throttle of `10m` or `1h` will prevent it from sending 90 notifications during this period.

## Responses

#### `200`

Indicates a successful call.

`application/json`

- `actions` ([] object)
- `alertTypeId` (string)
- `apiKeyOwner` (string) — nullable
- `createdAt` (string)
  The date and time that the alert was created.
- `createdBy` (string)
  The identifier for the user that created the alert.
- `enabled` (boolean)
  Indicates whether the alert is currently enabled.
- `executionStatus` (object)
  - `lastExecutionDate` (string)
  - `status` (string)
- `id` (string)
  The identifier for the alert.
- `muteAll` (boolean)
- `mutedInstanceIds` ([] string) — nullable
- `name` (string)
  The name of the alert.
- `notifyWhen` (string)
- `params` (object)
- `schedule` (object)
  - `interval` (string)
- `scheduledTaskId` (string)
- `tags` ([] string)
- `throttle` (string) — nullable
- `updatedAt` (string)
- `updatedBy` (string) — nullable
  The identifier for the user that updated this alert most recently.
#### `401`

Authorization information is missing or invalid.

`application/json`

- `error` (enum)
  Values: `Unauthorized`
- `message` (string)
- `statusCode` (enum)
  Values: `401`
## Code Examples

#### Console

```console
POST /api/alerts/alert/{alertId}
```

#### curl

```curl
curl -X POST "https://{kibana_url}/api/alerts/alert/{alertId}" \
  -H "kbn-xsrf: true"
```