Bulk acknowledge alerts

Auth

Create the same action for multiple alerts in a single request.

Required authorization

space_id string optional: An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.

kbn-xsrf string required: A required header to protect against CSRF attacks

items object[] · min items: 1 · max items: 100 required: List of 1 to 100 ack actions to create, each for a different alert_id.

Returns the number of created actions and per-item errors for actions that were not created.

application/json

affected_count integer · min: 0 · max: 9007199254740991 required: Number of resources the operation successfully touched.
errors object[] required: Errors encountered during the operation.

Indicates an invalid schema or parameters.

application/json

code string required: Stable error code you can branch on, for example INVALID_SCHEDULE or RULE_ALREADY_EXISTS.
details map string to object: Optional structured context whose keys depend on code. Identifier keys such as rule_id, action_policy_id and group_hash are stable, permanent public identifiers. On a 400 request-validation error, details.source (params, query, or body) names the failing part and is the only guaranteed key. The sibling details.errors may change. Do not branch on it.
error string required: A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.
message string required: A readable explanation of the error. The wording can change without notice. Do not parse this field.

Indicates the request was not authenticated.

application/json

code string required: Stable error code you can branch on, for example INVALID_SCHEDULE or RULE_ALREADY_EXISTS.
details map string to object: Optional structured context whose keys depend on code. Identifier keys such as rule_id, action_policy_id and group_hash are stable, permanent public identifiers. On a 400 request-validation error, details.source (params, query, or body) names the failing part and is the only guaranteed key. The sibling details.errors may change. Do not branch on it.
error string required: A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.
message string required: A readable explanation of the error. The wording can change without notice. Do not parse this field.

Indicates the user does not have the required privileges to perform the request.

application/json

code string required: Stable error code you can branch on, for example INVALID_SCHEDULE or RULE_ALREADY_EXISTS.
details map string to object: Optional structured context whose keys depend on code. Identifier keys such as rule_id, action_policy_id and group_hash are stable, permanent public identifiers. On a 400 request-validation error, details.source (params, query, or body) names the failing part and is the only guaranteed key. The sibling details.errors may change. Do not branch on it.
error string required: A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.
message string required: A readable explanation of the error. The wording can change without notice. Do not parse this field.

Indicates an unexpected server-side error.

application/json

code string required: Stable error code you can branch on, for example INVALID_SCHEDULE or RULE_ALREADY_EXISTS.
details map string to object: Optional structured context whose keys depend on code. Identifier keys such as rule_id, action_policy_id and group_hash are stable, permanent public identifiers. On a 400 request-validation error, details.source (params, query, or body) names the failing part and is the only guaranteed key. The sibling details.errors may change. Do not branch on it.
error string required: A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.
message string required: A readable explanation of the error. The wording can change without notice. Do not parse this field.

Indicates the alerting engine is disabled by the alerting:v2:enabled advanced setting.

application/json

code string required: Stable error code you can branch on, for example INVALID_SCHEDULE or RULE_ALREADY_EXISTS.
details map string to object: Optional structured context whose keys depend on code. Identifier keys such as rule_id, action_policy_id and group_hash are stable, permanent public identifiers. On a 400 request-validation error, details.source (params, query, or body) names the failing part and is the only guaranteed key. The sibling details.errors may change. Do not branch on it.
error string required: A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.
message string required: A readable explanation of the error. The wording can change without notice. Do not parse this field.