List rule executions

Base URL: https://{kibana_url}

GET /api/alerting/v2/execution_history/rules
GET /s/{space_id}/api/alerting/v2/execution_history/rules

Refer to Spaces for more information.

Get a paginated list of rule execution events.

Required authorization

Authentication

Api key

Authorization: <value>

These APIs use key-based authentication. You must create an API key and use the encoded value in the request header. For example: Authorization: ApiKey base64AccessApiKey

Basic

Authorization: Basic <credentials>

Query parameters

Responses

Returns a paginated list of rule execution events.

application/json

items object[] required
page integer · min: 1 · max: 9007199254740991 required
per_page integer · min: 1 · max: 9007199254740991 required
total integer · min: 0 · max: 9007199254740991 required: The number of rule executions matching the query. This count is an estimate: results above 10,000 may be reported as 10,000.

Indicates an invalid schema or parameters.

application/json

Indicates the request was not authenticated.

application/json

Indicates the user does not have the required privileges to perform the request.

application/json

Indicates an unexpected server-side error.

application/json

Indicates the alerting engine is disabled by the alerting:v2:enabled advanced setting.

application/json

Base URL: https://{kibana_url}

Examples

Request Console 1 / 2 languages

Console Kibana Dev Tools

GET kbn:/api/alerting/v2/execution_history/rules?sort_field=started_at&sort_order=desc&page=1&per_page=20

Generated from the API spec

curl Shell

curl -X GET "${KIBANA_URL}/api/alerting/v2/execution_history/rules?sort_field=started_at&sort_order=desc&page=1&per_page=20" \
  -H "Authorization: ApiKey ${API_KEY}"

Generated from the API spec

Response

{
  "items": [
    {
      "ended_at": "2026-01-15T12:00:01.250Z",
      "id": "execution-1",
      "outcome": "success",
      "rule": {
        "id": "rule-1",
        "version": 3
      },
      "space_id": "default",
      "started_at": "2026-01-15T12:00:00.000Z",
      "timings": {
        "duration_ms": 1250,
        "scheduled_delay_ms": 40
      }
    }
  ],
  "page": 1,
  "per_page": 20,
  "total": 1
}

{
  "code": "BAD_REQUEST",
  "details": {
    "errors": {
      "page": [
        "page * per_page cannot exceed 10000."
      ]
    }
  },
  "error": "Bad Request",
  "message": "page * per_page cannot exceed 10000."
}

{
  "code": "UNAUTHORIZED",
  "error": "Unauthorized",
  "message": "Authentication required to access this API."
}

{
  "code": "FORBIDDEN",
  "error": "Forbidden",
  "message": "The current user does not have the required privileges for this request."
}

{
  "code": "INTERNAL_SERVER_ERROR",
  "error": "Internal Server Error",
  "message": "An unexpected error occurred."
}

{
  "code": "ALERTING_DISABLED",
  "error": "Service Unavailable",
  "message": "Alerting is disabled."
}