---
type: api
title: Export detection rules
description: **Spaces method and path for this operation:**
url: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/v9/operation/operation-exportrules
resource: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/v9/operation/operation-exportrules
products:
  - Kibana
---

# Export detection rules

- Server: `https://{kibana_url}`

## Paths

- `POST` `/api/detection_engine/rules/_export`
- `POST` `/s/{space_id}/api/detection_engine/rules/_export`

- [Api key auth](/elastic/docs-builder/docs/4371/api/doc/kibana/v9/authentication#apikeyauth)
- [Basic auth](/elastic/docs-builder/docs/4371/api/doc/kibana/v9/authentication#basicauth)

## Description

Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

Export detection rules to an `.ndjson` file. The following configuration items are also included in the `.ndjson` file:
- Actions
- Exception lists
> info
> Rule actions and connectors are included in the exported file, but sensitive information about the connector (such as authentication credentials) is not included. You must re-add missing connector details after importing detection rules.

> You can use Kibana’s [Saved Objects](https://www.elastic.co/docs/explore-analyze/find-and-organize/saved-objects) UI (Stack Management → Kibana → Saved Objects) or the Saved Objects APIs (experimental) to [export](https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/v9/operation/operation-post-saved-objects-export) and [import](https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/v9/operation/operation-post-saved-objects-import) any necessary connectors before importing detection rules.

> Similarly, any value lists used for rule exceptions are not included in rule exports or imports. Use the [Manage value lists](https://www.elastic.co/docs/solutions/security/detect-and-alert/create-manage-value-lists) UI (Rules → Detection rules (SIEM) → Manage value lists) to export and import value lists separately.

## Query String Parameters

- `exclude_export_details` (boolean · default: false)
  Determines whether a summary of the exported rules is returned.
- `file_name` (string · default: export.ndjson)
  File name for saving the exported rules.
> info
> When using cURL to export rules to a file, use the -O and -J options to save the rules to the file name specified in the URL.

## Request Body

`application/json`

- `objects` ([] object) — required
  Array of objects with a rule's `rule_id` field. Do not use rule's `id` here. Exports all rules when unspecified.
  - `rule_id` (string) — required
    A stable unique identifier for the rule object. It can be assigned during rule creation. It can be any string, but often is a UUID. It should be unique not only within a given Kibana space, but also across spaces and Elastic environments. The same prebuilt Elastic rule, when installed in two different Kibana spaces or two different Elastic environments, will have the same `rule_id`s.

## Response

Indicates a successful call.

`application/ndjson`

Type: `string`

## Code Examples

#### curl

```curl
curl -X POST "localhost:5601/api/detection_engine/rules/_export?exclude_export_details=true&file_name=exported_rules.ndjson" -H 'kbn-xsrf: true' -H 'Content-Type: application/json' -d'
{
  "objects": [
    {
      "rule_id":"343580b5-c811-447c-8d2d-2ccf052c6900"
    },
    {
      "rule_id":"2938c9fa-53eb-4c04-b79c-33cbf041b18d"
    }
  ]
}
```

## Response Examples

#### Sample ndjson

```json
{"rule_id":"343580b5-c811-447c-8d2d-2ccf052c6900","name":"Example rule","type":"query","enabled":true}
{"exception_list":true}
{"export_summary":{"total_rules":1,"exceptions_count":0}}
```