---
type: api
title: List rule executions
description: **Spaces method and path for this operation:**
url: https://www.elastic.co/elastic/docs-builder/docs/4641/api/doc/kibana/v9/operation/operation-get-alerting-v2-execution-history-rules
resource: https://www.elastic.co/elastic/docs-builder/docs/4641/api/doc/kibana/v9/operation/operation-get-alerting-v2-execution-history-rules
products:
  - Kibana
---

# List rule executions

Authentication: required

Availability: Planned

- Server: `https://{kibana_url}`

## Paths

- `GET` `/api/alerting/v2/execution_history/rules`
- `GET` `/s/{space_id}/api/alerting/v2/execution_history/rules`

#### Path parameters

- `space_id` (string) — optional
  An identifier for the space. If `space_id` is not provided in the URL, the default space is used. Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

## Description

Get a paginated list of rule execution events.

## Required authorization

- Privileges: `read_alerting-v2-execution-history`

## Query string parameters

- `rule_ids` (string[] · min items: 1 · max items: 50) — optional
  Rule id filter.
- `search` (string · min length: 1 · max length: 256) — optional
  Free-text search. Matches rule name, description or rule ID (case-insensitive). Combined with rule_ids using AND.
- `outcomes` (enum[] · min items: 1 · max items: 2) — optional
  Outcome filter.
  Values: `success`, `failure`
- `from` (string · format: date-time · max length: 64) — optional
  Inclusive ISO datetime lower bound on event.start. Defaults to 24 hours before `to`, or before the request when `to` is omitted. Set it to see older executions.
- `to` (string · format: date-time · max length: 64) — optional
  Inclusive ISO datetime upper bound on event.start.
- `sort_field` (enum · default: started_at) — required
  Sort field. Defaults to started_at.
  Values: `started_at`, `duration_ms`
- `sort_order` (enum · default: desc) — required
  Sort direction.
  Values: `asc`, `desc`
- `page` (integer · min: 1 · max: 10000 · default: 1) — required
  Page number.
- `per_page` (integer · min: 1 · max: 100 · default: 20) — required
  Number of results per page.

## Responses

#### `200`

Returns a paginated list of rule execution events.

`application/json`

- `items` (object[])
  - `ended_at` (string · format: date-time · max length: 64)
  - `error` (object)
    Failure details. Omitted on a successful run, or when the failure was unclassified.
    - `message` (string)
    - `stack_trace` (string)
      Omitted when the source recorded no trace.
  - `id` (string)
  - `outcome` (enum)
    Values: `success`, `failure`
  - `reason` (string)
    Why the run ended the way it did. Omitted when the source recorded no reason.
  - `rule` (object)
    - `id` (string)
    - `version` (integer · min: -9007199254740991 · max: 9007199254740991)
      The rule version this run executed. Omitted until the rule executor emits its own event; the `task-run` event does not carry one.
  - `started_at` (string · format: date-time · max length: 64)
  - `timings` (object)
    - `duration_ms` (integer · min: 0 · max: 9007199254740991)
      Wall-clock duration of the run, in milliseconds.
    - `scheduled_delay_ms` (integer · min: -9007199254740991 · max: 9007199254740991)
      Delay between the scheduled run time and the actual start, in milliseconds. Negative when the run started ahead of its scheduled time.
- `page` (integer · min: 1 · max: 9007199254740991)
- `per_page` (integer · min: 1 · max: 9007199254740991)
- `search_matches` (object)
  Match counts for the active search. Omitted when no search was provided.
  - `is_truncated` (boolean)
    True when more than 500 rules matched the search. Only the executions of the first 500 matching rules are returned, so the results are incomplete. Narrow the search to see the rest.
  - `rule_count` (integer · min: 0 · max: 9007199254740991)
    The number of rules matching the search. This count is an estimate: results above 10,000 may be reported as 10,000.
- `total` (integer · min: 0 · max: 9007199254740991)
  The number of rule executions matching the query. This count is an estimate: results above 10,000 may be reported as 10,000.
#### `400`

Indicates an invalid schema or parameters.

`application/json`

- `code` (string)
  Stable error code you can branch on, for example `INVALID_SCHEDULE` or `RULE_ALREADY_EXISTS`.
- `details` (map string to object)
  Optional structured context whose keys depend on `code`. Identifier keys such as `rule_id`, `action_policy_id` and `group_hash` are stable, permanent public identifiers. On a 400 request-validation error, `details.source` (`params`, `query`, or `body`) names the failing part and is the only guaranteed key. The sibling `details.errors` may change. Do not branch on it.
- `error` (string)
  A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.
- `message` (string)
  A readable explanation of the error. The wording can change without notice. Do not parse this field.
#### `401`

Indicates the request was not authenticated.

`application/json`

- `code` (string)
  Stable error code you can branch on, for example `INVALID_SCHEDULE` or `RULE_ALREADY_EXISTS`.
- `details` (map string to object)
  Optional structured context whose keys depend on `code`. Identifier keys such as `rule_id`, `action_policy_id` and `group_hash` are stable, permanent public identifiers. On a 400 request-validation error, `details.source` (`params`, `query`, or `body`) names the failing part and is the only guaranteed key. The sibling `details.errors` may change. Do not branch on it.
- `error` (string)
  A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.
- `message` (string)
  A readable explanation of the error. The wording can change without notice. Do not parse this field.
#### `403`

Indicates the user does not have the required privileges to perform the request.

`application/json`

- `code` (string)
  Stable error code you can branch on, for example `INVALID_SCHEDULE` or `RULE_ALREADY_EXISTS`.
- `details` (map string to object)
  Optional structured context whose keys depend on `code`. Identifier keys such as `rule_id`, `action_policy_id` and `group_hash` are stable, permanent public identifiers. On a 400 request-validation error, `details.source` (`params`, `query`, or `body`) names the failing part and is the only guaranteed key. The sibling `details.errors` may change. Do not branch on it.
- `error` (string)
  A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.
- `message` (string)
  A readable explanation of the error. The wording can change without notice. Do not parse this field.
#### `500`

Indicates an unexpected server-side error.

`application/json`

- `code` (string)
  Stable error code you can branch on, for example `INVALID_SCHEDULE` or `RULE_ALREADY_EXISTS`.
- `details` (map string to object)
  Optional structured context whose keys depend on `code`. Identifier keys such as `rule_id`, `action_policy_id` and `group_hash` are stable, permanent public identifiers. On a 400 request-validation error, `details.source` (`params`, `query`, or `body`) names the failing part and is the only guaranteed key. The sibling `details.errors` may change. Do not branch on it.
- `error` (string)
  A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.
- `message` (string)
  A readable explanation of the error. The wording can change without notice. Do not parse this field.
#### `503`

Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.

`application/json`

- `code` (string)
  Stable error code you can branch on, for example `INVALID_SCHEDULE` or `RULE_ALREADY_EXISTS`.
- `details` (map string to object)
  Optional structured context whose keys depend on `code`. Identifier keys such as `rule_id`, `action_policy_id` and `group_hash` are stable, permanent public identifiers. On a 400 request-validation error, `details.source` (`params`, `query`, or `body`) names the failing part and is the only guaranteed key. The sibling `details.errors` may change. Do not branch on it.
- `error` (string)
  A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.
- `message` (string)
  A readable explanation of the error. The wording can change without notice. Do not parse this field.
## Code examples

#### Console

```console
GET kbn:/api/alerting/v2/execution_history/rules?sort_field=started_at&sort_order=desc&page=1&per_page=20
```

#### curl

```curl
curl -X GET "${KIBANA_URL}/api/alerting/v2/execution_history/rules?sort_field=started_at&sort_order=desc&page=1&per_page=20" \
  -H "Authorization: ApiKey ${API_KEY}"
```

## Response examples

#### One successful rule execution

`application/json`

```json
{
  "items": [
    {
      "ended_at": "2026-01-15T12:00:01.250Z",
      "id": "execution-1",
      "outcome": "success",
      "rule": {
        "id": "rule-1",
        "version": 3
      },
      "started_at": "2026-01-15T12:00:00.000Z",
      "timings": {
        "duration_ms": 1250,
        "scheduled_delay_ms": 40
      }
    }
  ],
  "page": 1,
  "per_page": 20,
  "total": 1
}
```

#### Exceeds the max result window

`application/json`

```json
{
  "code": "BAD_REQUEST",
  "details": {
    "errors": {
      "page": [
        "page * per_page cannot exceed 10000."
      ]
    }
  },
  "error": "Bad Request",
  "message": "page * per_page cannot exceed 10000."
}
```

#### Request was not authenticated

`application/json`

```json
{
  "code": "UNAUTHORIZED",
  "error": "Unauthorized",
  "message": "Authentication required to access this API."
}
```

#### Caller lacks required privileges

`application/json`

```json
{
  "code": "FORBIDDEN",
  "error": "Forbidden",
  "message": "The current user does not have the required privileges for this request."
}
```

#### Unexpected server-side error

`application/json`

```json
{
  "code": "INTERNAL_SERVER_ERROR",
  "error": "Internal Server Error",
  "message": "An unexpected error occurred."
}
```

#### Alerting V2 is disabled

`application/json`

```json
{
  "code": "ALERTING_DISABLED",
  "error": "Service Unavailable",
  "message": "Alerting is disabled."
}
```