List action policies

Base URL: https://{kibana_url}

GET /api/alerting/v2/action_policies
GET /s/{space_id}/api/alerting/v2/action_policies

Refer to Spaces for more information.

Get a paginated list of action policies with optional filtering and sorting.

Required authorization

Authentication

Api key

Authorization: <value>

These APIs use key-based authentication. You must create an API key and use the encoded value in the request header. For example: Authorization: ApiKey base64AccessApiKey

Basic

Authorization: Basic <credentials>

Query parameters

Responses

Returns a paginated list of action policies.

application/json

items object[] required: The list of action policies.
page number required: The current page number.
per_page number required: The number of action policies per page.
total number required: The number of action policies matching the query. This count is an estimate: results above 10,000 may be reported as 10,000.

Indicates an invalid schema or parameters.

application/json

Indicates the request was not authenticated.

application/json

Indicates the user does not have the required privileges to perform the request.

application/json

Indicates an unexpected server-side error.

application/json

Indicates the alerting engine is disabled by the alerting:v2:enabled advanced setting.

application/json

Base URL: https://{kibana_url}

Examples

Request Console 1 / 2 languages

Console Kibana Dev Tools

GET kbn:/api/alerting/v2/action_policies

Generated from the API spec

curl Shell

curl -X GET "${KIBANA_URL}/api/alerting/v2/action_policies" \
  -H "Authorization: ApiKey ${API_KEY}"

Generated from the API spec

Response

{
  "items": [
    {
      "created_at": "2026-01-15T12:00:00.000Z",
      "created_by": {
        "profile_uid": "u_elastic_0"
      },
      "description": "Sends notifications for alerts generated by rules with the production tag.",
      "destinations": [
        {
          "id": "workflow-1",
          "type": "workflow"
        }
      ],
      "enabled": true,
      "grouping": {
        "mode": "per_alert"
      },
      "id": "action-policy-1",
      "matcher": {
        "tags": [
          "production"
        ]
      },
      "name": "Notify on production alerts",
      "throttle": {
        "strategy": "on_status_change"
      },
      "updated_at": "2026-01-15T12:00:00.000Z",
      "updated_by": {
        "profile_uid": "u_elastic_0"
      }
    }
  ],
  "page": 1,
  "per_page": 20,
  "total": 1
}

{
  "code": "BAD_REQUEST",
  "details": {
    "errors": {
      "errors": [],
      "properties": {
        "page": {
          "errors": [
            "Too small: expected number to be \u003E=1"
          ]
        }
      }
    }
  },
  "error": "Bad Request",
  "message": "page: Too small: expected number to be \u003E=1"
}

{
  "code": "UNAUTHORIZED",
  "error": "Unauthorized",
  "message": "Authentication required to access this API."
}

{
  "code": "FORBIDDEN",
  "error": "Forbidden",
  "message": "The current user does not have the required privileges for this request."
}

{
  "code": "INTERNAL_SERVER_ERROR",
  "error": "Internal Server Error",
  "message": "An unexpected error occurred."
}

{
  "code": "ALERTING_DISABLED",
  "error": "Service Unavailable",
  "message": "Alerting is disabled."
}