Assign an alert to a user

Base URL: https://{kibana_url}

POST /api/alerting/v2/alerts/{id}/_assign
POST /s/{space_id}/api/alerting/v2/alerts/{id}/_assign

Auth

Create an action for a specific alert.

Required authorization

Privileges manage_alerting-v2-alerts

Path parameters

space_id string optional: An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.
id string · min length: 1 · max length: 150 required: Identifier of the alert to apply the action to.

Header parameters

kbn-xsrf string required: A required header to protect against CSRF attacks

Request body

assignee_uid string · min length: 1 · max length: 150 required nullable: User profile UID of the assignee, or null to remove the assignee from the alert.

Responses

204

Indicates the action was created.

Indicates an invalid schema or parameters.

application/json

code string required: Stable error code you can branch on, for example INVALID_SCHEDULE or RULE_ALREADY_EXISTS.
details map string to object: Optional structured context whose keys depend on code. Identifier keys such as rule_id, action_policy_id and group_hash are stable, permanent public identifiers. On a 400 request-validation error, details.source (params, query, or body) names the failing part and is the only guaranteed key. The sibling details.errors may change. Do not branch on it.
error string required: A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.
message string required: A readable explanation of the error. The wording can change without notice. Do not parse this field.

Indicates the request was not authenticated.

application/json

code string required: Stable error code you can branch on, for example INVALID_SCHEDULE or RULE_ALREADY_EXISTS.
details map string to object: Optional structured context whose keys depend on code. Identifier keys such as rule_id, action_policy_id and group_hash are stable, permanent public identifiers. On a 400 request-validation error, details.source (params, query, or body) names the failing part and is the only guaranteed key. The sibling details.errors may change. Do not branch on it.
error string required: A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.
message string required: A readable explanation of the error. The wording can change without notice. Do not parse this field.

Indicates the user does not have the required privileges to perform the request.

application/json

code string required: Stable error code you can branch on, for example INVALID_SCHEDULE or RULE_ALREADY_EXISTS.
details map string to object: Optional structured context whose keys depend on code. Identifier keys such as rule_id, action_policy_id and group_hash are stable, permanent public identifiers. On a 400 request-validation error, details.source (params, query, or body) names the failing part and is the only guaranteed key. The sibling details.errors may change. Do not branch on it.
error string required: A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.
message string required: A readable explanation of the error. The wording can change without notice. Do not parse this field.

Indicates the alert was not found.

application/json

code string required: Stable error code you can branch on, for example INVALID_SCHEDULE or RULE_ALREADY_EXISTS.
details map string to object: Optional structured context whose keys depend on code. Identifier keys such as rule_id, action_policy_id and group_hash are stable, permanent public identifiers. On a 400 request-validation error, details.source (params, query, or body) names the failing part and is the only guaranteed key. The sibling details.errors may change. Do not branch on it.
error string required: A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.
message string required: A readable explanation of the error. The wording can change without notice. Do not parse this field.

Indicates the alert already carries the requested assignee.

application/json

code string required: Stable error code you can branch on, for example INVALID_SCHEDULE or RULE_ALREADY_EXISTS.
details map string to object: Optional structured context whose keys depend on code. Identifier keys such as rule_id, action_policy_id and group_hash are stable, permanent public identifiers. On a 400 request-validation error, details.source (params, query, or body) names the failing part and is the only guaranteed key. The sibling details.errors may change. Do not branch on it.
error string required: A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.
message string required: A readable explanation of the error. The wording can change without notice. Do not parse this field.

Indicates an unexpected server-side error.

application/json

code string required: Stable error code you can branch on, for example INVALID_SCHEDULE or RULE_ALREADY_EXISTS.
details map string to object: Optional structured context whose keys depend on code. Identifier keys such as rule_id, action_policy_id and group_hash are stable, permanent public identifiers. On a 400 request-validation error, details.source (params, query, or body) names the failing part and is the only guaranteed key. The sibling details.errors may change. Do not branch on it.
error string required: A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.
message string required: A readable explanation of the error. The wording can change without notice. Do not parse this field.

Indicates the alerting engine is disabled by the alerting:v2:enabled advanced setting.

application/json

code string required: Stable error code you can branch on, for example INVALID_SCHEDULE or RULE_ALREADY_EXISTS.
details map string to object: Optional structured context whose keys depend on code. Identifier keys such as rule_id, action_policy_id and group_hash are stable, permanent public identifiers. On a 400 request-validation error, details.source (params, query, or body) names the failing part and is the only guaranteed key. The sibling details.errors may change. Do not branch on it.
error string required: A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.
message string required: A readable explanation of the error. The wording can change without notice. Do not parse this field.

Required authorization

Path parameters

Header parameters

Request body { }

Responses

Request body