---
type: api
title: Create an alerts index
description: **Spaces method and path for this operation:**
url: https://www.elastic.co/elastic/docs-builder/docs/4641/api/doc/kibana/v9/operation/operation-createalertsindex
resource: https://www.elastic.co/elastic/docs-builder/docs/4641/api/doc/kibana/v9/operation/operation-createalertsindex
products:
  - Kibana
---

# Create an alerts index

Authentication: required

- Server: `https://{kibana_url}`

## Paths

- `POST` `/api/detection_engine/index`
- `POST` `/s/{space_id}/api/detection_engine/index`

#### Path parameters

- `space_id` (string) — optional
  An identifier for the space. If `space_id` is not provided in the URL, the default space is used. Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

## Description

Creates an index for Elastic Security alerts. Calling this API is not
required for the detection engine to function properly. You can create
rules and alerts without calling this API.

## Responses

#### `200`

Successful response

`application/json`

- `acknowledged` (boolean)
#### `401`

Unsuccessful authentication response

`application/json`

- `error` (string)
- `message` (string)
- `statusCode` (integer)
#### `403`

Not enough permissions response

`application/json`

- `message` (string)
- `status_code` (integer)
#### `404`

Not found

`application/json`

- `message` (string)
- `status_code` (integer)
#### `500`

Internal server error response

`application/json`

- `message` (string)
- `status_code` (integer)
## Code examples

#### Console

```console
POST kbn:/api/detection_engine/index
```

#### curl

```curl
curl -X POST "${KIBANA_URL}/api/detection_engine/index" \
  -H "Authorization: ApiKey ${API_KEY}"
```

## Response examples

#### Acknowledged

`application/json`

```json
{
  "acknowledged": true
}
```

#### Unauthorized

`application/json`

```json
{
  "error": "Unauthorized",
  "message": "[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]",
  "statusCode": 401
}
```

#### Forbidden

`application/json`

```json
{
  "message": "API [POST /api/detection_engine/index] is unauthorized for the current user. The user must be able to create indices for the Elastic Security solution.",
  "status_code": 403
}
```

#### Not found

`application/json`

```json
{
  "message": "A prerequisite resource required to create the alerts index was not found.",
  "status_code": 404
}
```

#### Server error

`application/json`

```json
{
  "message": "Internal Server Error",
  "status_code": 500
}
```