---
type: api
title: Get a paginated set of alerts
description: **Spaces method and path for this operation:**
url: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/v8/operation/operation-legacyfindalerts
resource: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/v8/operation/operation-legacyfindalerts
products:
  - Kibana
---

# Get a paginated set of alerts

deprecated

- Server: `https://{kibana_url}`

## Paths

- `GET` `/api/alerts/alerts/_find`
- `GET` `/s/{space_id}/api/alerts/alerts/_find`

- [Api key auth](/elastic/docs-builder/docs/4371/api/doc/kibana/v8/authentication#apikeyauth)
- [Basic auth](/elastic/docs-builder/docs/4371/api/doc/kibana/v8/authentication#basicauth)

## Description

Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

Deprecated in 7.13.0. Use the find rules API instead. NOTE: Alert `params` are stored as a flattened field type and analyzed as keywords. As alerts change in Kibana, the results on each page of the response also change. Use the find API for traditional paginated results, but avoid using it to export large amounts of data.

## Query String Parameters

- `default_search_operator` (string · default: OR)
  The default operator to use for the `simple_query_string`.
- `fields` ([] string)
  The fields to return in the `attributes` key of the response.
- `filter` (string)
  A KQL string that you filter with an attribute from your saved object. It should look like `savedObjectType.attributes.title: "myTitle"`. However, if you used a direct attribute of a saved object, such as `updatedAt`, you must define your filter, for example, `savedObjectType.updatedAt > 2018-12-22`.
- `has_reference` (object)
  Filters the rules that have a relation with the reference objects with a specific type and identifier.
- `page` (integer · default: 1)
  The page number to return.
- `per_page` (integer · default: 20)
  The number of alerts to return per page.
- `search` (string)
  An Elasticsearch `simple_query_string` query that filters the alerts in the response.
- `search_fields` (union string | [] string)
  The fields to perform the `simple_query_string` parsed query against.
  One of: `string` or `string[]`
- `sort_field` (string)
  Determines which field is used to sort the results. The field must exist in the `attributes` key of the response.
- `sort_order` (enum  · default: desc)
  Determines the sort order.
  Values: `asc`, `desc`

## Responses

#### `200`

Indicates a successful call.

`application/json`

- `data` ([] object)
  - `actions` ([] object)
  - `alertTypeId` (string)
  - `apiKeyOwner` (string) — nullable
  - `createdAt` (string)
    The date and time that the alert was created.
  - `createdBy` (string)
    The identifier for the user that created the alert.
  - `enabled` (boolean)
    Indicates whether the alert is currently enabled.
  - `executionStatus` (object)
    - `lastExecutionDate` (string)
    - `status` (string)
  - `id` (string)
    The identifier for the alert.
  - `muteAll` (boolean)
  - `mutedInstanceIds` ([] string) — nullable
  - `name` (string)
    The name of the alert.
  - `notifyWhen` (string)
  - `params` (object)
  - `schedule` (object)
    - `interval` (string)
  - `scheduledTaskId` (string)
  - `tags` ([] string)
  - `throttle` (string) — nullable
  - `updatedAt` (string)
  - `updatedBy` (string) — nullable
    The identifier for the user that updated this alert most recently.
- `page` (integer)
- `perPage` (integer)
- `total` (integer)
#### `401`

Authorization information is missing or invalid.

`application/json`

- `error` (enum)
  Values: `Unauthorized`
- `message` (string)
- `statusCode` (enum)
  Values: `401`
## Code Examples

#### Console

```console
GET /api/alerts/alerts/_find
```

#### curl

```curl
curl -X GET "https://{kibana_url}/api/alerts/alerts/_find"
```