---
type: api
title: Update an alert
description: **Spaces method and path for this operation:**
url: https://www.elastic.co/elastic/docs-builder/docs/4641/api/doc/kibana/v8/operation/operation-legacyupdatealert
resource: https://www.elastic.co/elastic/docs-builder/docs/4641/api/doc/kibana/v8/operation/operation-legacyupdatealert
products:
  - Kibana
---

# Update an alert

deprecated

Authentication: required

- Server: `https://{kibana_url}`

## Paths

- `PUT` `/api/alerts/alert/{alertId}`
- `PUT` `/s/{space_id}/api/alerts/alert/{alertId}`

#### Path parameters

- `space_id` (string) — optional
  An identifier for the space. If `space_id` is not provided in the URL, the default space is used. Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
- `alertId` (string) — required
  The identifier for the alert.
  Example: `41893910-6bca-11eb-9e0d-85d233e3ee35`

## Description

Deprecated in 7.13.0. Use the update rule API instead.

## Header parameters

- `kbn-xsrf` (string) — required
  Cross-site request forgery protection

## Request body

`application/json`

- `actions` (object[]) — optional
  - `actionTypeId` (string) — required
    The identifier for the action type.
  - `group` (string) — required
    Grouping actions is recommended for escalations for different types of alert instances. If you don't need this functionality, set it to `default`.
  - `id` (string) — required
    The ID of the action saved object.
  - `params` (object) — required
    The map to the `params` that the action type will receive. `params` are handled as Mustache templates and passed a default set of context.
- `name` (string) — required
  A name to reference and search.
- `notifyWhen` (enum) — required
  The condition for throttling the notification.
  Values: `onActionGroupChange`, `onActiveAlert`, `onThrottleInterval`
- `params` (object) — required
  The parameters to pass to the alert type executor `params` value. This will also validate against the alert type params validator, if defined.
- `schedule` (object) — required
  The schedule specifying when this alert should be run. A schedule is structured such that the key specifies the format you wish to use and its value specifies the schedule.
  - `interval` (string) — optional
    The interval format specifies the interval in seconds, minutes, hours or days at which the alert should run.
- `tags` (string[]) — optional
  A list of keywords to reference and search.
- `throttle` (string) — optional
  How often this alert should fire the same actions. This will prevent the alert from sending out the same notification over and over. For example, if an alert with a schedule of 1 minute stays in a triggered state for 90 minutes, setting a throttle of `10m` or `1h` will prevent it from sending 90 notifications during this period.

## Responses

#### `200`

Indicates a successful call.

`application/json`

- `actions` (object[])
- `alertTypeId` (string)
- `apiKeyOwner` (string) — nullable
- `createdAt` (string · format: date-time)
  The date and time that the alert was created.
- `createdBy` (string)
  The identifier for the user that created the alert.
- `enabled` (boolean)
  Indicates whether the alert is currently enabled.
- `executionStatus` (object)
  - `lastExecutionDate` (string · format: date-time)
  - `status` (string)
- `id` (string)
  The identifier for the alert.
- `muteAll` (boolean)
- `mutedInstanceIds` (string[]) — nullable
- `name` (string)
  The name of the alert.
- `notifyWhen` (string)
- `params` (object)
- `schedule` (object)
  - `interval` (string)
- `scheduledTaskId` (string)
- `tags` (string[])
- `throttle` (string) — nullable
- `updatedAt` (string)
- `updatedBy` (string) — nullable
  The identifier for the user that updated this alert most recently.
#### `401`

Authorization information is missing or invalid.

`application/json`

- `error` (enum)
  Values: `Unauthorized`
- `message` (string)
- `statusCode` (enum)
  Values: `401`
## Code examples

#### Console

```console
PUT kbn:/api/alerts/alert/41893910-6bca-11eb-9e0d-85d233e3ee35
{
  "name": "string",
  "notifyWhen": "onActionGroupChange",
  "params": {},
  "schedule": {}
}
```

#### curl

```curl
curl -X PUT "${KIBANA_URL}/api/alerts/alert/41893910-6bca-11eb-9e0d-85d233e3ee35" \
  -H "kbn-xsrf: true" \
  -H "Authorization: ApiKey ${API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "string",
    "notifyWhen": "onActionGroupChange",
    "params": {},
    "schedule": {}
  }'
```

## Response examples

#### 200

`application/json`

Generated from the API spec. Values are representative. Unions use the first variant; deeply nested or large bodies may omit fields.

```json
{
  "actions": [
    {}
  ],
  "alertTypeId": ".index-threshold",
  "apiKeyOwner": "elastic",
  "createdAt": "2022-12-05T23:36:58.284Z",
  "createdBy": "elastic",
  "enabled": true,
  "executionStatus": {
    "lastExecutionDate": "2022-12-06T00:13:43.890Z",
    "status": "ok"
  },
  "id": "b530fed0-74f5-11ed-9801-35303b735aef",
  "muteAll": false,
  "mutedInstanceIds": [
    "string"
  ],
  "name": "my alert",
  "notifyWhen": "onActionGroupChange",
  "params": {},
  "schedule": {
    "interval": "string"
  },
  "scheduledTaskId": "b530fed0-74f5-11ed-9801-35303b735aef",
  "tags": [
    "string"
  ],
  "throttle": "string",
  "updatedAt": "2022-12-05T23:36:58.284Z",
  "updatedBy": "elastic"
}
```

#### 401

`application/json`

Generated from the API spec. Values are representative. Unions use the first variant; deeply nested or large bodies may omit fields.

```json
{
  "error": "Unauthorized",
  "message": "string",
  "statusCode": 401
}
```