---
type: api
title: Delete multiple detection rules
description: **Spaces method and path for this operation:**
url: https://www.elastic.co/elastic/docs-builder/docs/4493/api/doc/kibana/v8/operation/operation-bulkdeleterulespost
resource: https://www.elastic.co/elastic/docs-builder/docs/4493/api/doc/kibana/v8/operation/operation-bulkdeleterulespost
products:
  - Kibana
---

# Delete multiple detection rules

deprecated

- Server: `https://{kibana_url}`

## Paths

- `POST` (also `DELETE`) `/api/detection_engine/rules/_bulk_delete`
- `POST` `/s/{space_id}/api/detection_engine/rules/_bulk_delete`

## Description

Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

Delete detection rules in bulk.
> warn
> This API is deprecated and will be removed in Kibana v9.0.

## Authentication

- Api key: `Authorization: <value>`
  These APIs use key-based authentication. You must create an API key and use the encoded value in the request header. For example: `Authorization: ApiKey base64AccessApiKey`
- Basic: `Authorization: Basic <credentials>`

## Request body

A JSON array of `id` or `rule_id` fields of the rules you want to delete.

`application/json`

Type: `object[]`

An array; each item has these fields:

- `id` (string · format: uuid) — optional
  A universally unique identifier
- `rule_id` (string) — optional
  A stable unique identifier for the rule object. It can be assigned during rule creation. It can be any string, but often is a UUID. It should be unique not only within a given Kibana space, but also across spaces and Elastic environments. The same prebuilt Elastic rule, when installed in two different Kibana spaces or two different Elastic environments, will have the same `rule_id`s.

## Responses

#### `200`

Indicates a successful call.

`application/json`

Type: `union[]`

#### `400`

Invalid input data response

`application/json`

One of:
- **{ error, statusCode }**
  - `error` (string)
  - `message` (string)
  - `statusCode` (integer)
- **{ status_code }**
  - `message` (string)
  - `status_code` (integer)
#### `401`

Unsuccessful authentication response

`application/json`

- `error` (string)
- `message` (string)
- `statusCode` (integer)
#### `500`

Internal server error response

`application/json`

- `message` (string)
- `status_code` (integer)
## Code examples

#### Console

```console
POST kbn:/api/detection_engine/rules/_bulk_delete
[
  {
    "rule_id": "process_started_by_ms_office_program_possible_payload"
  },
  {
    "id": "51658332-a15e-4c9e-912a-67214e2e2359"
  }
]
```

#### curl

```curl
curl -X POST "${KIBANA_URL}/api/detection_engine/rules/_bulk_delete" \
  -H "Authorization: ApiKey ${API_KEY}" \
  -H "Content-Type: application/json" \
  -d '[
    {
      "rule_id": "process_started_by_ms_office_program_possible_payload"
    },
    {
      "id": "51658332-a15e-4c9e-912a-67214e2e2359"
    }
  ]'
```