Enable rules matching a query (dry-run by default)

Auth

Required authorization

space_id string optional: An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.

kbn-xsrf string required: A required header to protect against CSRF attacks

filter string · min length: 1 · max length: 4096: KQL filter string to match target resources. At most 10000 matching resources are processed per request. Cannot be empty; to target every resource use match_all: true.
force boolean · default: false: When true, executes the operation. When false (default), returns a dry-run preview with match_count and a sample of matching resource IDs so the client can verify before committing.
match_all enum: When true, targets every resource. Requires an explicit opt-in. Omitted by default.; Values: true
search string · min length: 1 · max length: 256: Free-text search string matched against the resource-defined searchable fields. Cannot be empty; to target every resource use match_all: true.

Returns a dry-run preview by default, or the executed operation when force is true.

application/json

Any of:

Dry-run preview returned by a by-query bulk endpoint when force is false.

match_count integer · min: 0 · max: 9007199254740991 required: Total number of resources matching the query. A dry run never fails on size, but if this exceeds 10000, re-sending the same query with force: true is rejected with BULK_QUERY_MATCH_LIMIT_EXCEEDED; narrow the query before executing.
sample string[] · max items: 100 required: Sample of matching resource IDs (up to 100) for spot-checking before executing.

Indicates an invalid schema or parameters.

application/json

code string required: Stable error code you can branch on, for example INVALID_SCHEDULE or RULE_ALREADY_EXISTS.
details map string to object: Optional structured context whose keys depend on code. Identifier keys such as rule_id, action_policy_id and group_hash are stable, permanent public identifiers. On a 400 request-validation error, details.source (params, query, or body) names the failing part and is the only guaranteed key. The sibling details.errors may change. Do not branch on it.
error string required: A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.
message string required: A readable explanation of the error. The wording can change without notice. Do not parse this field.

Indicates the request was not authenticated.

application/json

code string required: Stable error code you can branch on, for example INVALID_SCHEDULE or RULE_ALREADY_EXISTS.
details map string to object: Optional structured context whose keys depend on code. Identifier keys such as rule_id, action_policy_id and group_hash are stable, permanent public identifiers. On a 400 request-validation error, details.source (params, query, or body) names the failing part and is the only guaranteed key. The sibling details.errors may change. Do not branch on it.
error string required: A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.
message string required: A readable explanation of the error. The wording can change without notice. Do not parse this field.

Indicates the user does not have the required privileges to perform the request.

application/json

code string required: Stable error code you can branch on, for example INVALID_SCHEDULE or RULE_ALREADY_EXISTS.
details map string to object: Optional structured context whose keys depend on code. Identifier keys such as rule_id, action_policy_id and group_hash are stable, permanent public identifiers. On a 400 request-validation error, details.source (params, query, or body) names the failing part and is the only guaranteed key. The sibling details.errors may change. Do not branch on it.
error string required: A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.
message string required: A readable explanation of the error. The wording can change without notice. Do not parse this field.

Indicates an unexpected server-side error.

application/json

code string required: Stable error code you can branch on, for example INVALID_SCHEDULE or RULE_ALREADY_EXISTS.
details map string to object: Optional structured context whose keys depend on code. Identifier keys such as rule_id, action_policy_id and group_hash are stable, permanent public identifiers. On a 400 request-validation error, details.source (params, query, or body) names the failing part and is the only guaranteed key. The sibling details.errors may change. Do not branch on it.
error string required: A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.
message string required: A readable explanation of the error. The wording can change without notice. Do not parse this field.

Indicates the alerting engine is disabled by the alerting:v2:enabled advanced setting.

application/json

code string required: Stable error code you can branch on, for example INVALID_SCHEDULE or RULE_ALREADY_EXISTS.
details map string to object: Optional structured context whose keys depend on code. Identifier keys such as rule_id, action_policy_id and group_hash are stable, permanent public identifiers. On a 400 request-validation error, details.source (params, query, or body) names the failing part and is the only guaranteed key. The sibling details.errors may change. Do not branch on it.
error string required: A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.
message string required: A readable explanation of the error. The wording can change without notice. Do not parse this field.