---
type: api
title: Delete multiple detection rules
description: **Spaces method and path for this operation:**
url: https://www.elastic.co/elastic/docs-builder/docs/4641/api/doc/kibana/v8/operation/operation-bulkdeleterulespost
resource: https://www.elastic.co/elastic/docs-builder/docs/4641/api/doc/kibana/v8/operation/operation-bulkdeleterulespost
products:
  - Kibana
---

# Delete multiple detection rules

deprecated

Authentication: required

- Server: `https://{kibana_url}`

## Paths

- `POST` (also `DELETE`) `/api/detection_engine/rules/_bulk_delete`
- `POST` `/s/{space_id}/api/detection_engine/rules/_bulk_delete`

#### Path parameters

- `space_id` (string) — optional
  An identifier for the space. If `space_id` is not provided in the URL, the default space is used. Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

## Description

Delete detection rules in bulk.
> warn
> This API is deprecated and will be removed in Kibana v9.0.

## Request body

A JSON array of `id` or `rule_id` fields of the rules you want to delete.

`application/json`

Type: `object[]`

An array; each item has these fields:

- `id` (string · format: uuid) — optional
  A universally unique identifier
- `rule_id` (string) — optional
  A stable unique identifier for the rule object. It can be assigned during rule creation. It can be any string, but often is a UUID. It should be unique not only within a given Kibana space, but also across spaces and Elastic environments. The same prebuilt Elastic rule, when installed in two different Kibana spaces or two different Elastic environments, will have the same `rule_id`s.

## Responses

#### `200`

Indicates a successful call.

`application/json`

Type: `union[]`

#### `400`

Invalid input data response

`application/json`

One of:
- **PlatformErrorResponse**
  - `error` (string)
  - `message` (string)
  - `statusCode` (integer)
- **SiemErrorResponse**
  - `message` (string)
  - `status_code` (integer)
#### `401`

Unsuccessful authentication response

`application/json`

- `error` (string)
- `message` (string)
- `statusCode` (integer)
#### `500`

Internal server error response

`application/json`

- `message` (string)
- `status_code` (integer)
## Code examples

#### Console

```console
POST kbn:/api/detection_engine/rules/_bulk_delete
[
  {
    "rule_id": "process_started_by_ms_office_program_possible_payload"
  },
  {
    "id": "51658332-a15e-4c9e-912a-67214e2e2359"
  }
]
```

#### curl

```curl
curl -X POST "${KIBANA_URL}/api/detection_engine/rules/_bulk_delete" \
  -H "Authorization: ApiKey ${API_KEY}" \
  -H "Content-Type: application/json" \
  -d '[
    {
      "rule_id": "process_started_by_ms_office_program_possible_payload"
    },
    {
      "id": "51658332-a15e-4c9e-912a-67214e2e2359"
    }
  ]'
```

## Response examples

#### 200

`application/json`

Generated from the API spec. Values are representative. Unions use the first variant; deeply nested or large bodies may omit fields.

```json
[
  {
    "actions": [
      {
        "action_type_id": "string",
        "group": "string",
        "id": "string",
        "uuid": "string"
      }
    ],
    "alias_purpose": "savedObjectConversion",
    "alias_target_id": "string",
    "author": [
      "string"
    ],
    "building_block_type": "string",
    "description": "Detects anomalous Windows process creation events.",
    "enabled": false,
    "exceptions_list": [
      {
        "id": "string",
        "list_id": "string",
        "namespace_type": "agnostic",
        "type": "detection"
      }
    ],
    "false_positives": [
      "string"
    ],
    "from": "string",
    "interval": "string",
    "investigation_fields": {
      "field_names": [
        "string"
      ]
    },
    "license": "string",
    "max_signals": 100,
    "meta": {},
    "name": "Anomalous Windows Process Creation",
    "namespace": "string",
    "note": "string",
    "outcome": "exactMatch",
    "output_index": "string",
    "references": [
      "string"
    ],
    "related_integrations": [
      {
        "integration": "activitylogs",
        "package": "azure",
        "version": "~1.1.6"
      }
    ],
    "required_fields": [
      {
        "name": "string",
        "type": "string"
      }
    ],
    "response_actions": [],
    "risk_score": 0,
    "risk_score_mapping": [
      {
        "field": "string",
        "operator": "equals",
        "risk_score": 0,
        "value": "string"
      }
    ],
    "rule_name_override": "string",
    "setup": "string",
    "severity": "low",
    "severity_mapping": [
      {
        "field": "string",
        "operator": "equals",
        "severity": "low",
        "value": "string"
      }
    ],
    "tags": [
      "string"
    ],
    "threat": [
      {
        "framework": "string"
      }
    ],
    "throttle": "no_actions",
    "timeline_id": "string",
    "timeline_title": "string",
    "timestamp_override": "string",
    "timestamp_override_fallback_disabled": false,
    "to": "string",
    "version": 0,
    "created_at": "string",
    "created_by": "string",
    "execution_summary": {
      "last_execution": {
        "date": "string",
        "message": "string",
        "status": "going to run",
        "status_order": 0
      }
    },
    "id": "string",
    "immutable": false,
    "revision": 0,
    "rule_id": "string",
    "rule_source": {
      "is_customized": false,
      "type": "external"
    },
    "updated_at": "string",
    "updated_by": "string",
    "language": "eql",
    "query": "string",
    "type": "eql",
    "alert_suppression": {
      "duration": {
        "unit": "s",
        "value": 0
      },
      "group_by": [
        "string"
      ],
      "missing_fields_strategy": "doNotSuppress"
    },
    "data_view_id": "string",
    "event_category_override": "string",
    "filters": [],
    "index": [
      "string"
    ],
    "tiebreaker_field": "string",
    "timestamp_field": "string"
  }
]
```

#### 400

`application/json`

Generated from the API spec. Values are representative. Unions use the first variant; deeply nested or large bodies may omit fields.

```json
{
  "error": "string",
  "message": "string",
  "statusCode": 0
}
```

#### 401

`application/json`

Generated from the API spec. Values are representative. Unions use the first variant; deeply nested or large bodies may omit fields.

```json
{
  "error": "string",
  "message": "string",
  "statusCode": 0
}
```

#### 500

`application/json`

Generated from the API spec. Values are representative. Unions use the first variant; deeply nested or large bodies may omit fields.

```json
{
  "message": "string",
  "status_code": 0
}
```