Snooze an alert

Base URL
https://{kibana_url}
Auth

Path parameters

rule_id string · max length: 256 required

The identifier for the rule.

alert_id string · max length: 1000 required

The identifier for the alert.

Query parameters

validate_alerts_existence boolean

Set to true to validate that the specified alert exists. If a 400 error is returned, the specified alert does not exist. Defaults to true.

Header parameters

kbn-xsrf string required

A required header to protect against CSRF attacks

Request body

condition_operator enum

Logical operator applied to the conditions array. "any" expires the snooze when at least one condition is met; "all" requires every condition to be met. When conditions are provided but this field is omitted, defaults to "any".

Values: any all
conditions union anyOf[] · max items: 10

One or more conditions that, when met, automatically expire the snooze. Supported types: field_change, severity_change, severity_equals.

Any of:

Expires the snooze when the value of the specified alert field changes.

type enum required
Values: field_change
field string · max length: 1000 required

The alert field to watch, written as a dot-notation path. When the value of the specified alert field changes, the snooze expires

expires_at string · max length: 30

The datetime at which the snooze expires, in ISO 8601 format (YYYY-MM-DDTHH:mm:ss.sssZ). When omitted, the snooze persists indefinitely unless manually removed or a defined condition is met.

Responses

204

Indicates a successful call.

400

Indicates an invalid schema or parameters.

403

Indicates that this call is forbidden.

404

Indicates the specified rule or alert doesn't exist.

Base URL
https://{kibana_url}