Elastic Stack

Elastic Stack (ELK Stack) Alerting V2 API

Alerting V2 is an ES|QL-first alerting API for managing rules, alert actions, and action policies. Use these endpoints to create and manage detection rules, act on alerts, and control when and how notifications are delivered. These APIs are experimental.

GitHub OpenAPI

Operations 52

Each operation below carries the questions people ask an LLM about it and the instructions they give an agent to run it. Generated by API Evangelist overlay

GET /api/alerting/v2/action_policies List alerting action policies · List action policies #
Ask an LLM
“Which action policies are set up to route my Kibana alerts to destinations?”
“Can I filter the action policy list to only the enabled ones with a given tag?”
Tell an agent
List all my alerting action policies.
Show enabled action policies tagged {tags}, sorted by {sort_field}.
POST /api/alerting/v2/action_policies Create an action policy with a generated ID · Create an action policy #
Ask an LLM
“How do I create a new action policy that sends matching alerts to a destination?”
“Can a new action policy group alerts by fields before notifying?”
Tell an agent
Create a new action policy named {name} described as {description} that notifies {destinations}.
Add an action policy {name} that only matches alerts where {matcher}, sending to {destinations} with description {description}.
POST /api/alerting/v2/action_policies/_bulk_delete Delete several action policies at once · Delete action policies in bulk by ID #
Ask an LLM
“Can I remove a batch of action policies in one request instead of one by one?”
“What happens to many obsolete action policies if I bulk delete them by ID?”
Tell an agent destructive · confirm first
Bulk delete the action policies with IDs {ids}.
Remove all of these action policies in one call: {ids}.
POST /api/alerting/v2/action_policies/_bulk_disable Disable several action policies at once · Disable action policies in bulk by ID #
Ask an LLM
“Is there a way to turn off a whole set of action policies in a single call?”
“Can I pause notifications from multiple action policies by listing their IDs?”
Tell an agent
Bulk disable the action policies {ids}.
Turn off every action policy in this ID list: {ids}.
POST /api/alerting/v2/action_policies/_bulk_enable Enable several action policies at once · Enable action policies in bulk by ID #
Ask an LLM
“Can I switch a group of disabled action policies back on together?”
“Which call re-enables multiple action policies by ID in one go?”
Tell an agent
Bulk enable the action policies {ids}.
Turn back on every action policy in this ID list: {ids}.
POST /api/alerting/v2/action_policies/_bulk_snooze Snooze several action policies until a time · Snooze action policies in bulk by ID #
Ask an LLM
“Can I silence many action policies until a maintenance window ends?”
“How do I snooze a list of action policies until a specific date and time?”
Tell an agent
Snooze action policies {ids} until {snoozed_until}.
Silence all of these action policies until {snoozed_until}: {ids}.
POST /api/alerting/v2/action_policies/_bulk_unsnooze Cancel the snooze on several action policies · Cancel snooze for action policies in bulk by ID #
Ask an LLM
“Can I end the snooze early on a batch of action policies?”
“What call wakes up multiple snoozed action policies at once?”
Tell an agent
Bulk unsnooze the action policies {ids}.
Cancel the snooze on every action policy in {ids} so they notify again.
POST /api/alerting/v2/action_policies/_bulk_update_api_key Rotate API keys for several action policies · Rotate API keys for action policies in bulk by ID #
Ask an LLM
“Can I rotate the API keys of many action policies in one request?”
“After a credential change, how do I refresh the keys on a list of action policies?”
Tell an agent
Rotate the API keys for action policies {ids}.
Bulk refresh the stored API key on each action policy in {ids}.
POST /api/alerting/v2/action_policies/_match_for_rule Find action policies that apply to a rule · Match action policies for a rule #
Ask an LLM
“Which action policies would fire for a given alerting rule?”
“Can I see whether a rule is covered by direct, global or global-filtered action policies?”
Tell an agent
Show the action policies that match rule {rule}.
Check which direct and global action policies apply to rule {rule}.
DELETE /api/alerting/v2/action_policies/{id} Delete an action policy · Delete an action policy #
Ask an LLM
“How do I permanently remove a single action policy?”
“Can I delete one action policy I no longer need by its ID?”
Tell an agent destructive · confirm first
Delete action policy {id}.
Remove the action policy with ID {id} permanently.
GET /api/alerting/v2/action_policies/{id} Get an action policy · Get an action policy #
Ask an LLM
“What destinations and matcher does a specific action policy use?”
“Can I look up one action policy's full configuration by its ID?”
Tell an agent
Get action policy {id}.
Show me the destinations and grouping of action policy {id}.
PATCH /api/alerting/v2/action_policies/{id} Partially update an action policy · Partially update an action policy #
Ask an LLM
“Can I change just one field of an action policy and leave the rest unchanged?”
“Why does a partial action policy update need the current version number?”
Tell an agent
Rename action policy {id} to {name}, using version {version}.
Patch action policy {id} at version {version} so its throttle is {throttle}.
PUT /api/alerting/v2/action_policies/{id} Create or fully replace an action policy by ID · Create or replace an action policy #
Ask an LLM
“Can I create an action policy with my own chosen identifier?”
“How do I overwrite an existing action policy's whole configuration in one request?”
Tell an agent
Create or replace action policy {id} named {name}, described as {description}, sending to {destinations}.
Fully replace action policy {id} so it is named {name} with description {description} and destinations {destinations}.
POST /api/alerting/v2/action_policies/{id}/_disable Disable an action policy · Disable an action policy #
Ask an LLM
“How do I turn off a single action policy without deleting it?”
“Can I stop one action policy from sending notifications for now?”
Tell an agent
Disable action policy {id}.
Switch off the action policy {id} but keep its configuration.
POST /api/alerting/v2/action_policies/{id}/_enable Enable an action policy · Enable an action policy #
Ask an LLM
“How do I turn a disabled action policy back on?”
“Can I reactivate a single action policy by ID?”
Tell an agent
Enable action policy {id}.
Turn the action policy {id} back on so it notifies again.
POST /api/alerting/v2/action_policies/{id}/_snooze Snooze an action policy until a time · Snooze an action policy #
Ask an LLM
“Can I mute one action policy until a certain date?”
“How long can a single action policy stay snoozed?”
Tell an agent
Snooze action policy {id} until {snoozed_until}.
Quiet the action policy {id} until {snoozed_until} during maintenance.
POST /api/alerting/v2/action_policies/{id}/_unsnooze Remove the snooze from an action policy · Unsnooze an action policy #
Ask an LLM
“How do I end the snooze on one action policy early?”
“Can I unsnooze a single action policy so it resumes notifying?”
Tell an agent
Unsnooze action policy {id}.
Clear the snooze on the action policy {id} right now.
POST /api/alerting/v2/action_policies/{id}/_update_api_key Rotate the API key of one action policy · Update an action policy API key #
Ask an LLM
“How do I rotate the API key for a single action policy?”
“Can I refresh the credentials one action policy runs with?”
Tell an agent
Rotate the API key for action policy {id}.
Update the API key used by the action policy {id} to my current credentials.
GET /api/alerting/v2/action_policies/tags List tags used on action policies · Get action policy tags #
Ask an LLM
“Which tags are in use across my action policies?”
“Can I search the distinct tags on action policies by prefix?”
Tell an agent
List the unique tags used by action policies.
Show action policy tags matching {search}.
POST /api/alerting/v2/alerts/_bulk_action Apply actions to many alert groups at once · Bulk create alert actions #
Ask an LLM
“Can I acknowledge or tag many alert groups in a single request?”
“Is there a bulk endpoint for creating actions across multiple alert groups?”
Tell an agent
Apply bulk alert actions across multiple alert groups, sending kbn-xsrf header {kbn_xsrf}.
Run one batch of alert group actions in a single request.
POST /api/alerting/v2/alerts/{group_hash}/_ack Acknowledge an alert group · Acknowledge an alert #
Ask an LLM
“How do I acknowledge an alert so the team knows someone is on it?”
“Does acknowledging an alert need the episode ID?”
Tell an agent
Acknowledge alert group {group_hash} for episode {episode_id}.
Mark episode {episode_id} of alert {group_hash} as acknowledged.
POST /api/alerting/v2/alerts/{group_hash}/_activate Activate an alert group with a reason · Activate an alert #
Ask an LLM
“Can I manually reactivate an alert group and record why?”
“What reason do I have to give when activating an alert?”
Tell an agent
Activate alert group {group_hash} because {reason}.
Set alert {group_hash} active again with the reason {reason}.
POST /api/alerting/v2/alerts/{group_hash}/_assign Assign an alert to a user · Assign an alert to a user #
Ask an LLM
“How do I assign an alert to a specific teammate?”
“Can I hand ownership of an alert episode to another user?”
Tell an agent
Assign alert group {group_hash} episode {episode_id} to user {assignee_uid}.
Make {assignee_uid} the owner of episode {episode_id} on alert {group_hash}.
POST /api/alerting/v2/alerts/{group_hash}/_deactivate Deactivate an alert group with a reason · Deactivate an alert #
Ask an LLM
“Can I manually deactivate an alert group that is no longer relevant?”
“Do I need to explain why when I deactivate an alert?”
Tell an agent
Deactivate alert group {group_hash} because {reason}.
Set alert {group_hash} inactive with the reason {reason}.
POST /api/alerting/v2/alerts/{group_hash}/_snooze Snooze an alert group · Snooze an alert #
Ask an LLM
“Can I snooze a single noisy alert group until a set time?”
“Is an expiry optional when snoozing an alert?”
Tell an agent
Snooze alert group {group_hash} until {expiry}.
Snooze the alert {group_hash} with no expiry.
POST /api/alerting/v2/alerts/{group_hash}/_tag Tag an alert group · Add tags to an alert #
Ask an LLM
“How do I label an alert with tags for triage?”
“Can I add several tags to one alert group at once?”
Tell an agent
Add tags {tags} to alert group {group_hash}.
Tag the alert {group_hash} with {tags}.
POST /api/alerting/v2/alerts/{group_hash}/_unack Unacknowledge an alert group · Unacknowledge an alert #
Ask an LLM
“Can I take back an acknowledgement on an alert?”
“How do I mark an acknowledged alert episode as unhandled again?”
Tell an agent
Unacknowledge alert group {group_hash} for episode {episode_id}.
Remove my acknowledgement from episode {episode_id} of alert {group_hash}.
POST /api/alerting/v2/alerts/{group_hash}/_unsnooze Unsnooze an alert group · Unsnooze an alert #
Ask an LLM
“How do I end the snooze on one alert group early?”
“Can a snoozed alert group start notifying again before its expiry?”
Tell an agent
Unsnooze alert group {group_hash}.
Wake the snoozed alert {group_hash} back up.
GET /api/alerting/v2/execution_history/action_policies List action policy execution history · List action policy executions #
Ask an LLM
“Did my action policies actually dispatch notifications recently?”
“Can I filter action policy executions by rule and outcome?”
Tell an agent
List action policy dispatch events in this space.
Show action policy executions for rules {rule_ids} with outcome {outcome} since {start_date}.
GET /api/alerting/v2/execution_history/rules List rule execution events · List rule executions #
Ask an LLM
“When did my alerting rules last run and did they fail?”
“Can I page through rule execution history between two dates?”
Tell an agent
List rule executions sorted by {sort} {sort_order}, page {page} with {per_page} per page.
Show failed runs of rules {rule_ids} from {from} to {to}, sorted by {sort} {sort_order}, page {page} of {per_page}.
GET /api/alerting/v2/rules List alerting rules · List rules #
Ask an LLM
“What alerting rules exist in my Kibana space?”
“Can I filter and sort the rule list by a KQL filter?”
Tell an agent
List my alerting rules.
Find rules matching {search}, sorted by {sort_field}.
POST /api/alerting/v2/rules Create an alerting rule with a generated ID · Create a rule #
Ask an LLM
“How do I create a new alerting rule that runs a query on a schedule?”
“What does a new rule need besides its query and schedule?”
Tell an agent
Create a new {kind} rule with metadata {metadata} that runs {query} on schedule {schedule}.
Add a rule of kind {kind} running query {query} every {schedule}, metadata {metadata}, grouped by {grouping}.
POST /api/alerting/v2/rules/_bulk_delete Delete several rules by ID · Delete rules in bulk by ID #
Ask an LLM
“Can I delete a list of alerting rules in one request?”
“What is the quickest way to remove many rules when I already know their IDs?”
Tell an agent destructive · confirm first
Bulk delete the rules {ids}.
Remove every rule in this ID list: {ids}.
POST /api/alerting/v2/rules/_bulk_disable Disable several rules by ID · Disable rules in bulk by ID #
Ask an LLM
“Can I switch off a specific list of rules together?”
“Which call pauses many alerting rules when I have their IDs?”
Tell an agent
Bulk disable the rules {ids}.
Pause every rule in this ID list: {ids}.
POST /api/alerting/v2/rules/_bulk_enable Enable several rules by ID · Enable rules in bulk by ID #
Ask an LLM
“Can I turn on a specific list of disabled rules at once?”
“Which call resumes many alerting rules when I have their IDs?”
Tell an agent
Bulk enable the rules {ids}.
Resume every rule in this ID list: {ids}.
POST /api/alerting/v2/rules/_bulk_get Fetch several rules by ID · Get rules in bulk #
Ask an LLM
“Can I fetch the definitions of several rules in one request?”
“Is there a batch lookup for alerting rules by ID?”
Tell an agent
Get the rules {ids} in one request.
Look up the configurations of rules {ids}.
POST /api/alerting/v2/rules/_bulk_update_api_key Rotate API keys for several rules by ID · Update the API key of rules in bulk by ID #
Ask an LLM
“Can I rotate the executor API keys for a list of rules at once?”
“How do I move many rules onto my current credentials?”
Tell an agent
Rotate the API keys for rules {ids}.
Re-key rules {ids} with credentials derived from my user.
POST /api/alerting/v2/rules/_delete_by_query Delete rules matching a query · Delete rules matching a query (dry-run by default) #
Ask an LLM
“Can I preview which rules a KQL filter would delete before deleting them?”
“What is the cap on rules processed per delete-by-query request?”
Tell an agent destructive · confirm first
Dry-run deleting the rules that match filter {filter}.
Delete for real every rule whose text matches {search}, with force set to {force}.
POST /api/alerting/v2/rules/_disable_by_query Disable rules matching a query · Disable rules matching a query (dry-run by default) #
Ask an LLM
“Can I disable every rule that matches a KQL filter?”
“Does disabling rules by query default to a dry run?”
Tell an agent
Preview disabling the rules that match filter {filter}.
Disable all rules matching search {search}, force {force}.
POST /api/alerting/v2/rules/_enable_by_query Enable rules matching a query · Enable rules matching a query (dry-run by default) #
Ask an LLM
“Can I enable every rule that matches a KQL filter?”
“How do I preview which rules enabling by query would touch?”
Tell an agent
Preview enabling the rules that match filter {filter}.
Enable all rules matching search {search}, force {force}.
POST /api/alerting/v2/rules/_update_api_key_by_query Rotate API keys for rules matching a query · Update the API key of rules matching a query (dry-run by default) #
Ask an LLM
“Can I rotate executor API keys on every rule that matches a filter?”
“Is there a dry run before re-keying rules selected by a query?”
Tell an agent
Preview rotating API keys on rules matching filter {filter}.
Rotate API keys on all rules, with match_all {match_all} and force {force}.
DELETE /api/alerting/v2/rules/{id} Delete an alerting rule · Delete a rule #
Ask an LLM
“How do I permanently delete one alerting rule?”
“Can I remove a single rule I no longer need by its ID?”
Tell an agent destructive · confirm first
Delete rule {id}.
Permanently remove the alerting rule {id}.
GET /api/alerting/v2/rules/{id} Get an alerting rule · Get a rule #
Ask an LLM
“What query and schedule does a specific rule use?”
“Can I look up one alerting rule by its ID?”
Tell an agent
Get rule {id}.
Show me the current definition of alerting rule {id}.
PATCH /api/alerting/v2/rules/{id} Partially update an alerting rule · Update a rule #
Ask an LLM
“Can I change just the schedule of a rule without resending everything?”
“Which rule fields can I patch in place?”
Tell an agent
Change the schedule of rule {id} to {schedule}.
Update rule {id} to use the query {query}.
PUT /api/alerting/v2/rules/{id} Create or fully replace a rule by ID · Create or replace a rule #
Ask an LLM
“Can I create an alerting rule with an identifier I choose myself?”
“How do I overwrite a rule's entire definition in one request?”
Tell an agent
Create or replace rule {id} as a {kind} rule running {query} on schedule {schedule} with metadata {metadata}.
Fully replace rule {id}: kind {kind}, query {query}, schedule {schedule}, metadata {metadata}.
POST /api/alerting/v2/rules/{id}/_disable Disable an alerting rule · Disable a rule #
Ask an LLM
“How do I stop one rule from running without deleting it?”
“Can I disable a single alerting rule by ID?”
Tell an agent
Disable rule {id}.
Stop the alerting rule {id} from running for now.
POST /api/alerting/v2/rules/{id}/_enable Enable an alerting rule · Enable a rule #
Ask an LLM
“How do I turn one disabled rule back on?”
“Can I enable a single alerting rule by ID?”
Tell an agent
Enable rule {id}.
Start the alerting rule {id} running on its schedule again.
POST /api/alerting/v2/rules/{id}/_run Run a rule immediately · Run a rule now #
Ask an LLM
“Can I trigger a rule right now instead of waiting for its schedule?”
“How do I test a rule by running it on demand?”
Tell an agent
Run rule {id} now.
Trigger an immediate execution of rule {id} outside its schedule.
GET /api/alerting/v2/rules/{id}/history List a rule's change history · List rule change history #
Ask an LLM
“Who changed a rule and what did earlier versions look like?”
“Can I page through the prior configurations of an alerting rule?”
Tell an agent
List the change history of rule {id}, page {page} with {per_page} per page.
Show the first {per_page} past edits to rule {id} on page {page}.
GET /api/alerting/v2/rules/{id}/history/{eventId} Get one rule change-history event · Get a rule change-history event #
Ask an LLM
“Can I see the full rule configuration snapshot from a specific past change?”
“What did a rule look like at one point in its change history?”
Tell an agent
Get change event {eventId} for rule {id}.
Show the full snapshot of rule {id} saved in history event {eventId}.
GET /api/alerting/v2/rules/tags List tags used on alerting rules · Get rule tags #
Ask an LLM
“Which tags are applied across my alerting rules?”
“Can I narrow rule tags to one rule kind?”
Tell an agent
List the tags used by my alerting rules.
Show rule tags matching {search} for rules of kind {kind}.
GET /api/alerting/v2/suggestions/rule_event_fields Suggest data fields for alert matchers · Get matcher data fields suggestions #
Ask an LLM
“Which data fields can I use when writing an alert matcher?”
“Can I get field name suggestions scoped to a partial matcher expression?”
Tell an agent
Suggest matcher data fields for rule events.
Suggest data fields that fit the matcher {matcher}.

Documentation

📖
Documentation
https://www.elastic.co/docs/reference/elasticsearch
📖
APIReference
https://www.elastic.co/docs/api/doc/elasticsearch/
📖
Documentation
https://www.elastic.co/docs/reference/kibana
📖
APIReference
https://www.elastic.co/docs/api/doc/kibana/

Specifications

⚙
OpenAPI
https://raw.githubusercontent.com/api-evangelist/elk-stack/refs/heads/main/openapi/elk-stack-alerting-v2-api-openapi.yml

Other Resources

🔗
SourceCode
https://github.com/elastic/elasticsearch-specification
🔗
SourceCode
https://github.com/elastic/kibana
🔗
ToolCrosswalk
https://raw.githubusercontent.com/api-evangelist/elk-stack/refs/heads/main/mcp/elk-stack-tool-crosswalk.yml

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this
  • find_apisBrowse and filter every API in the catalog.
  • get_api_artifactsOne API's artifacts, grouped by type.
  • get_openapiThe primary OpenAPI for this API.
  • find_similar_apisAPIs that look like this one.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This API 
curl "https://apis.io/api/v1/apis/elk-stack:elk-stack-alerting-v2-api"
All apis 
curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

elk-stack-alerting-v2-api-openapi.yml Raw ↑ 
openapi: 3.2.0
info:
  contact:
    name: Kibana Team
  description: The Kibana REST APIs enable you to manage resources such as connectors, data views, and saved objects.
  title: Kibana Alerting V2 API
  version: ''
  x-doc-license:
    name: Attribution-NonCommercial-NoDerivatives 4.0 International
    url: https://creativecommons.org/licenses/by-nc-nd/4.0/
  x-feedbackLink:
    label: Feedback
    url: https://github.com/elastic/docs-content/issues/new?assignees=&labels=feedback%2Ccommunity&projects=&template=api-feedback.yaml&title=%5BFeedback%5D%3A+
servers:
- url: https://{kibana_url}
  variables:
    kibana_url:
      default: localhost:5601
security:
- apiKeyAuth: []
- basicAuth: []
tags:


# --- truncated at 32 KB (359 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/elk-stack/refs/heads/main/openapi/elk-stack-alerting-v2-api-openapi.yml