List action policy executions

Base URL: https://{kibana_url}

GET /api/alerting/v2/execution_history/action_policies
GET /s/{space_id}/api/alerting/v2/execution_history/action_policies

Refer to Spaces for more information.

Get a paginated list of dispatcher summary events for action policies in the current space.

Required authorization

Authentication

Api key

Authorization: <value>

These APIs use key-based authentication. You must create an API key and use the encoded value in the request header. For example: Authorization: ApiKey base64AccessApiKey

Basic

Authorization: Basic <credentials>

Query parameters

Responses

Returns a paginated list of execution history events.

application/json

items object[] required
page integer · min: 1 · max: 9007199254740991 required
per_page integer · min: 1 · max: 9007199254740991 required
search_matches object: Per-type match counts for the active search. Omitted when no search was provided. When is_truncated is true the server ID filter was capped and the result may be truncated.
total integer · min: 0 · max: 9007199254740991 required: The number of action policy events matching the query. This count is an estimate: results above 10,000 may be reported as 10,000.

Indicates an invalid schema or parameters.

application/json

Indicates the request was not authenticated.

application/json

Indicates the user does not have the required privileges to perform the request.

application/json

Indicates an unexpected server-side error.

application/json

Indicates the alerting engine is disabled by the alerting:v2:enabled advanced setting.

application/json

Base URL: https://{kibana_url}

Examples

Request Console 1 / 2 languages

Console Kibana Dev Tools

GET kbn:/api/alerting/v2/execution_history/action_policies?page=1&per_page=20&sort_field=dispatched_at&sort_order=desc

Generated from the API spec

curl Shell

curl -X GET "${KIBANA_URL}/api/alerting/v2/execution_history/action_policies?page=1&per_page=20&sort_field=dispatched_at&sort_order=desc" \
  -H "Authorization: ApiKey ${API_KEY}"

Generated from the API spec

Response

{
  "items": [
    {
      "action_group_count": 1,
      "alert_count": 1,
      "alerts": [
        {
          "id": "alert-1"
        }
      ],
      "dispatched_at": "2026-01-15T12:05:00.000Z",
      "outcome": "success",
      "policy": {
        "id": "action-policy-1",
        "name": "Notify on production alerts"
      },
      "rule_count": 1,
      "rules": [
        {
          "id": "rule-1",
          "name": "Host CPU high"
        }
      ],
      "workflows": [
        {
          "id": "workflow-1",
          "name": "Notify oncall"
        }
      ]
    }
  ],
  "page": 1,
  "per_page": 20,
  "total": 1
}

{
  "code": "BAD_REQUEST",
  "details": {
    "errors": {
      "page": [
        "page * per_page cannot exceed 10000."
      ]
    }
  },
  "error": "Bad Request",
  "message": "page * per_page cannot exceed 10000."
}

{
  "code": "UNAUTHORIZED",
  "error": "Unauthorized",
  "message": "Authentication required to access this API."
}

{
  "code": "FORBIDDEN",
  "error": "Forbidden",
  "message": "The current user does not have the required privileges for this request."
}

{
  "code": "INTERNAL_SERVER_ERROR",
  "error": "Internal Server Error",
  "message": "An unexpected error occurred."
}

{
  "code": "ALERTING_DISABLED",
  "error": "Service Unavailable",
  "message": "Alerting is disabled."
}