List action policy executions

Base URL
https://{kibana_url}
  • GET /api/alerting/v2/execution_history/action_policies
  • GET /s/{space_id}/api/alerting/v2/execution_history/action_policies
Auth

Get a paginated list of dispatcher summary events for action policies in the current space.

Required authorization

Privileges read_alerting-v2-execution-history

Path parameters

space_id string optional

An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.

Query parameters

page integer · min: 1 · max: 10000 · default: 1 required

Page number (1-indexed). Defaults to 1.

per_page integer · min: 1 · max: 100 · default: 20 required

Number of events per page. Defaults to 20.

from string · format: date-time · max length: 64

Inclusive ISO datetime lower bound on the event timestamp. Defaults to 24 hours before to, or before the request when to is omitted. Independent of alert_ids — e.g. set it to an alert’s start time to scope results to that alert’s lifetime.

to string · format: date-time · max length: 64

Inclusive ISO datetime upper bound on the event timestamp.

alert_ids string[] · min items: 1 · max items: 50

Alert filter. Narrows events to those referencing at least one of the provided alert IDs.

sort_field enum · default: dispatched_at required

Sort field. Defaults to "dispatched_at".

Values: dispatched_at
sort_order enum · default: desc required

Sort direction. Defaults to "desc".

Values: asc desc

Free-text search. Matches policy name, rule name, policy/rule ID (case-insensitive).

rule_ids string[] · min items: 1 · max items: 50

Explicit rule filter. Narrows events to those referencing at least one of the provided rule IDs. Also unions with the search filter if both are provided.

outcomes enum[] · min items: 1 · max items: 3

Outcome filter. When omitted matches all outcomes. Pass one or more of "success", "throttled", "failure" to narrow.

Values: success throttled failure

Responses

Returns a paginated list of execution history events.

application/json
items object[] required
action_group_count number required
alert_count number required
alerts object[] · max items: 50 required

Alert IDs referenced by this event, bounded to 50. Empty when the event references no alerts. Use alert_count for the true total.

id string required
dispatched_at string · format: date-time · max length: 64 required
error object

Failure details. Omitted when the dispatch did not fail.

message string required
stack_trace string

Omitted when the source recorded no trace.

failure_reason enum
Values: missing_api_key workflow_not_found workflow_disabled schedule_error license_not_supported
outcome enum required
Values: success throttled failure
policy object required
id string required
name string

Omitted when the referenced resource could not be resolved.

rule_count number required

Number of rules referenced by this event after search or rule-filter narrowing. Unlike total on a list response, this is an exact count and it can exceed rules.length when the embedded array is truncated to the cap.

rules object[] · max items: 20 required

Rules referenced by this event, bounded to 20. When a search or rule filter narrows the match, this array is intersected with the matched subset server-side. Use rule_count for the full count.

id string required
name string

Omitted when the referenced resource could not be resolved.

workflows object[] · max items: 100 required
id string required
name string

Omitted when the referenced resource could not be resolved.

page integer · min: 1 · max: 9007199254740991 required
per_page integer · min: 1 · max: 9007199254740991 required
search_matches object

Per-type match counts for the active search. Omitted when no search was provided. When is_truncated is true the server ID filter was capped and the result may be truncated.

is_truncated boolean required

True when the server filter cap was reached and results may be truncated.

policy_count integer · min: 0 · max: 9007199254740991 required

The number of action policies matching the search. This count is an estimate: results above 10,000 may be reported as 10,000.

rule_count integer · min: 0 · max: 9007199254740991 required

The number of rules matching the search. This count is an estimate: results above 10,000 may be reported as 10,000.

total integer · min: 0 · max: 9007199254740991 required

The number of action policy events matching the query. This count is an estimate: results above 10,000 may be reported as 10,000.

Indicates an invalid schema or parameters.

application/json
code string required

Stable error code you can branch on, for example INVALID_SCHEDULE or RULE_ALREADY_EXISTS.

details map string to object

Optional structured context whose keys depend on code. Identifier keys such as rule_id, action_policy_id and group_hash are stable, permanent public identifiers. On a 400 request-validation error, details.source (params, query, or body) names the failing part and is the only guaranteed key. The sibling details.errors may change. Do not branch on it.

error string required

A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.

message string required

A readable explanation of the error. The wording can change without notice. Do not parse this field.

Indicates the request was not authenticated.

application/json
code string required

Stable error code you can branch on, for example INVALID_SCHEDULE or RULE_ALREADY_EXISTS.

details map string to object

Optional structured context whose keys depend on code. Identifier keys such as rule_id, action_policy_id and group_hash are stable, permanent public identifiers. On a 400 request-validation error, details.source (params, query, or body) names the failing part and is the only guaranteed key. The sibling details.errors may change. Do not branch on it.

error string required

A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.

message string required

A readable explanation of the error. The wording can change without notice. Do not parse this field.

Indicates the user does not have the required privileges to perform the request.

application/json
code string required

Stable error code you can branch on, for example INVALID_SCHEDULE or RULE_ALREADY_EXISTS.

details map string to object

Optional structured context whose keys depend on code. Identifier keys such as rule_id, action_policy_id and group_hash are stable, permanent public identifiers. On a 400 request-validation error, details.source (params, query, or body) names the failing part and is the only guaranteed key. The sibling details.errors may change. Do not branch on it.

error string required

A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.

message string required

A readable explanation of the error. The wording can change without notice. Do not parse this field.

Indicates an unexpected server-side error.

application/json
code string required

Stable error code you can branch on, for example INVALID_SCHEDULE or RULE_ALREADY_EXISTS.

details map string to object

Optional structured context whose keys depend on code. Identifier keys such as rule_id, action_policy_id and group_hash are stable, permanent public identifiers. On a 400 request-validation error, details.source (params, query, or body) names the failing part and is the only guaranteed key. The sibling details.errors may change. Do not branch on it.

error string required

A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.

message string required

A readable explanation of the error. The wording can change without notice. Do not parse this field.

Indicates the alerting engine is disabled by the alerting:v2:enabled advanced setting.

application/json
code string required

Stable error code you can branch on, for example INVALID_SCHEDULE or RULE_ALREADY_EXISTS.

details map string to object

Optional structured context whose keys depend on code. Identifier keys such as rule_id, action_policy_id and group_hash are stable, permanent public identifiers. On a 400 request-validation error, details.source (params, query, or body) names the failing part and is the only guaranteed key. The sibling details.errors may change. Do not branch on it.

error string required

A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.

message string required

A readable explanation of the error. The wording can change without notice. Do not parse this field.

Base URL
https://{kibana_url}