List action policy executions

Base URL
https://{kibana_url}
  • GET /api/alerting/v2/execution_history/action_policies
Auth

Get a paginated list of dispatcher summary events for action policies in the current space.

Required authorization

Privileges read_alerting-v2-execution-history

Query parameters

page integer · min: 1 · max: 10000

Page number (1-indexed). Defaults to 1.

per_page integer · min: 0 · max: 100

Number of events per page. Defaults to 20. Pass 0 for a count-only read.

start_date string · format: date-time · pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$

Inclusive ISO datetime lower bound on the event timestamp; overrides the default 24-hour window. Independent of episode_ids — e.g. set it to an episode’s start time to scope results to that episode’s lifetime.

episode_ids string[] · min items: 1 · max items: 50

Episode filter. Narrows events to those referencing at least one of the provided episode ids.

Free-text search. Matches policy name, rule name, policy/rule ID (case-insensitive).

rule_ids string[] · min items: 1 · max items: 50

Explicit rule filter. Narrows events to those referencing at least one of the provided rule ids. Also unions with the search filter if both are provided.

outcome enum[] · min items: 1 · max items: 3

Outcome filter. When omitted matches all outcomes. Pass one or more of "dispatched", "throttled", "dispatch_failed" to narrow.

Values: dispatched throttled dispatch_failed

Responses

Returns a paginated list of execution history events.

application/json
items object[] required
action_group_count number required
dispatched_at string required
episode_count number required
episodes object[] · max items: 50

Episode ids referenced by this event, bounded to MAX_EMBEDDED_EPISODES_PER_ITEM. Use episode_count for the true total.

id string required
error object
message string required
failure_reason enum
Values: missing_api_key workflow_not_found workflow_disabled schedule_error
outcome enum required
Values: dispatched throttled dispatch_failed
policy object required
id string required
name string nullable
rules object[] · max items: 20 required

Rules referenced by this event, bounded to MAX_EMBEDDED_RULES_PER_ITEM. When a search or rule filter narrows the match, this array is intersected with the matched subset server-side. Use total_rule_count for the full count.

id string required
name string nullable
total_rule_count number required

Total number of rules referenced by this event after search / rule-filter narrowing. May exceed rules.length when the embedded array is truncated to the cap.

workflows object[] · max items: 100 required
id string required
name string nullable
page integer · min: 1 · max: 9007199254740991 required
per_page integer · min: 0 · max: 9007199254740991 required
search_matches object required nullable

Per-type match counts for the active search, plus the cap used as filter. Null when no search was provided. When policies > cap or rules > cap the result is truncated.

cap number required

Maximum number of policy/rule ids the server uses as a filter.

policies number required

Total policies matching the search.

rules number required

Total rules matching the search.

total_events integer · min: 0 · max: 9007199254740991 required

Indicates an invalid schema or parameters.

application/json
code string required

Stable error code you can branch on, for example INVALID_SCHEDULE or RULE_ALREADY_EXISTS.

details map string to object

Optional extra information about the error, for example field validation issues or the rule_id when that ID already exists.

error string required

A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.

message string required

A readable explanation of the error. The wording can change without notice. Do not parse this field.

Indicates the request was not authenticated.

application/json
code string required

Stable error code you can branch on, for example INVALID_SCHEDULE or RULE_ALREADY_EXISTS.

details map string to object

Optional extra information about the error, for example field validation issues or the rule_id when that ID already exists.

error string required

A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.

message string required

A readable explanation of the error. The wording can change without notice. Do not parse this field.

Indicates the user does not have the required privileges to perform the request.

application/json
code string required

Stable error code you can branch on, for example INVALID_SCHEDULE or RULE_ALREADY_EXISTS.

details map string to object

Optional extra information about the error, for example field validation issues or the rule_id when that ID already exists.

error string required

A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.

message string required

A readable explanation of the error. The wording can change without notice. Do not parse this field.

Indicates an unexpected server-side error.

application/json
code string required

Stable error code you can branch on, for example INVALID_SCHEDULE or RULE_ALREADY_EXISTS.

details map string to object

Optional extra information about the error, for example field validation issues or the rule_id when that ID already exists.

error string required

A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.

message string required

A readable explanation of the error. The wording can change without notice. Do not parse this field.

Indicates the alerting engine is disabled by the alerting:v2:enabled advanced setting.

application/json
code string required

Stable error code you can branch on, for example INVALID_SCHEDULE or RULE_ALREADY_EXISTS.

details map string to object

Optional extra information about the error, for example field validation issues or the rule_id when that ID already exists.

error string required

A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.

message string required

A readable explanation of the error. The wording can change without notice. Do not parse this field.

Base URL
https://{kibana_url}