---
type: api
title: Get a paginated set of alerts
description: **Spaces method and path for this operation:**
url: https://www.elastic.co/elastic/docs-builder/docs/4493/api/doc/kibana/v8/operation/operation-legacyfindalerts
resource: https://www.elastic.co/elastic/docs-builder/docs/4493/api/doc/kibana/v8/operation/operation-legacyfindalerts
products:
  - Kibana
---

# Get a paginated set of alerts

deprecated

- Server: `https://{kibana_url}`

## Paths

- `GET` `/api/alerts/alerts/_find`
- `GET` `/s/{space_id}/api/alerts/alerts/_find`

## Description

Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

Deprecated in 7.13.0. Use the find rules API instead. NOTE: Alert `params` are stored as a flattened field type and analyzed as keywords. As alerts change in Kibana, the results on each page of the response also change. Use the find API for traditional paginated results, but avoid using it to export large amounts of data.

## Authentication

- Api key: `Authorization: <value>`
  These APIs use key-based authentication. You must create an API key and use the encoded value in the request header. For example: `Authorization: ApiKey base64AccessApiKey`
- Basic: `Authorization: Basic <credentials>`

## Query string parameters

- `default_search_operator` (string · default: OR) — optional
  The default operator to use for the `simple_query_string`.
- `fields` (string[]) — optional
  The fields to return in the `attributes` key of the response.
- `filter` (string) — optional
  A KQL string that you filter with an attribute from your saved object. It should look like `savedObjectType.attributes.title: "myTitle"`. However, if you used a direct attribute of a saved object, such as `updatedAt`, you must define your filter, for example, `savedObjectType.updatedAt > 2018-12-22`.
- `has_reference` (object) — optional
  Filters the rules that have a relation with the reference objects with a specific type and identifier.
  - `id` (string) — optional
  - `type` (string) — optional
- `page` (integer · default: 1) — optional
  The page number to return.
- `per_page` (integer · default: 20) — optional
  The number of alerts to return per page.
- `search` (string) — optional
  An Elasticsearch `simple_query_string` query that filters the alerts in the response.
- `search_fields` (union string | string[]) — optional
  The fields to perform the `simple_query_string` parsed query against.
- `sort_field` (string) — optional
  Determines which field is used to sort the results. The field must exist in the `attributes` key of the response.
- `sort_order` (enum · default: desc) — optional
  Determines the sort order.
  Values: `asc`, `desc`

## Responses

#### `200`

Indicates a successful call.

`application/json`

- `data` (object[])
  - `actions` (object[])
  - `alertTypeId` (string)
  - `apiKeyOwner` (string) — nullable
  - `createdAt` (string · format: date-time)
    The date and time that the alert was created.
  - `createdBy` (string)
    The identifier for the user that created the alert.
  - `enabled` (boolean)
    Indicates whether the alert is currently enabled.
  - `executionStatus` (object)
    - `lastExecutionDate` (string · format: date-time)
    - `status` (string)
  - `id` (string)
    The identifier for the alert.
  - `muteAll` (boolean)
  - `mutedInstanceIds` (string[]) — nullable
  - `name` (string)
    The name of the alert.
  - `notifyWhen` (string)
  - `params` (object)
  - `schedule` (object)
    - `interval` (string)
  - `scheduledTaskId` (string)
  - `tags` (string[])
  - `throttle` (string) — nullable
  - `updatedAt` (string)
  - `updatedBy` (string) — nullable
    The identifier for the user that updated this alert most recently.
- `page` (integer)
- `perPage` (integer)
- `total` (integer)
#### `401`

Authorization information is missing or invalid.

`application/json`

- `error` (enum)
  Values: `Unauthorized`
- `message` (string)
- `statusCode` (enum)
  Values: `401`
## Code examples

#### Console

```console
GET kbn:/api/alerts/alerts/_find
```

#### curl

```curl
curl -X GET "${KIBANA_URL}/api/alerts/alerts/_find" \
  -H "Authorization: ApiKey ${API_KEY}"
```