# Elastic Stack (ELK Stack) Alerting V2 API

**Canonical:** https://apis.io/apis/elk-stack/elk-stack-alerting-v2-api/  
**Provider:** Elastic Stack (ELK Stack) — https://apis.io/providers/elk-stack/  
**Base URL:** https://{elasticsearch_endpoint}  
**Documentation:** https://www.elastic.co/docs/api/doc/elasticsearch/

Elastic Stack (ELK Stack) Alerting V2 API is one of 132 APIs that [Elastic Stack (ELK Stack)](https://apis.io/providers/elk-stack/) publishes on the [APIs.io](https://apis.io/) network, described by a machine-readable OpenAPI specification. Tagged areas include alerting-v2. The published artifact set on APIs.io includes an OpenAPI specification, API documentation, and an API reference.

Alerting V2 is an ES|QL-first alerting API for managing rules, alert actions, and action policies. Use these endpoints to create and manage detection rules, act on alerts, and control when and how notifications are delivered. These APIs are experimental.

## Operations (52)

| Method | Path | Summary |
|---|---|---|
| GET | `/api/alerting/v2/action_policies` | List action policies |
| POST | `/api/alerting/v2/action_policies` | Create an action policy |
| POST | `/api/alerting/v2/action_policies/_bulk_delete` | Delete action policies in bulk by ID |
| POST | `/api/alerting/v2/action_policies/_bulk_disable` | Disable action policies in bulk by ID |
| POST | `/api/alerting/v2/action_policies/_bulk_enable` | Enable action policies in bulk by ID |
| POST | `/api/alerting/v2/action_policies/_bulk_snooze` | Snooze action policies in bulk by ID |
| POST | `/api/alerting/v2/action_policies/_bulk_unsnooze` | Cancel snooze for action policies in bulk by ID |
| POST | `/api/alerting/v2/action_policies/_bulk_update_api_key` | Rotate API keys for action policies in bulk by ID |
| POST | `/api/alerting/v2/action_policies/_match_for_rule` | Match action policies for a rule |
| DELETE | `/api/alerting/v2/action_policies/{id}` | Delete an action policy |
| GET | `/api/alerting/v2/action_policies/{id}` | Get an action policy |
| PATCH | `/api/alerting/v2/action_policies/{id}` | Partially update an action policy. |
| PUT | `/api/alerting/v2/action_policies/{id}` | Create or replace an action policy |
| POST | `/api/alerting/v2/action_policies/{id}/_disable` | Disable an action policy |
| POST | `/api/alerting/v2/action_policies/{id}/_enable` | Enable an action policy |
| POST | `/api/alerting/v2/action_policies/{id}/_snooze` | Snooze an action policy |
| POST | `/api/alerting/v2/action_policies/{id}/_unsnooze` | Unsnooze an action policy |
| POST | `/api/alerting/v2/action_policies/{id}/_update_api_key` | Update an action policy API key |
| GET | `/api/alerting/v2/action_policies/tags` | Get action policy tags |
| POST | `/api/alerting/v2/alerts/_bulk_action` | Bulk create alert actions |
| POST | `/api/alerting/v2/alerts/{group_hash}/_ack` | Acknowledge an alert |
| POST | `/api/alerting/v2/alerts/{group_hash}/_activate` | Activate an alert |
| POST | `/api/alerting/v2/alerts/{group_hash}/_assign` | Assign an alert to a user |
| POST | `/api/alerting/v2/alerts/{group_hash}/_deactivate` | Deactivate an alert |
| POST | `/api/alerting/v2/alerts/{group_hash}/_snooze` | Snooze an alert |
| POST | `/api/alerting/v2/alerts/{group_hash}/_tag` | Add tags to an alert |
| POST | `/api/alerting/v2/alerts/{group_hash}/_unack` | Unacknowledge an alert |
| POST | `/api/alerting/v2/alerts/{group_hash}/_unsnooze` | Unsnooze an alert |
| GET | `/api/alerting/v2/execution_history/action_policies` | List action policy executions |
| GET | `/api/alerting/v2/execution_history/rules` | List rule executions |
| GET | `/api/alerting/v2/rules` | List rules |
| POST | `/api/alerting/v2/rules` | Create a rule |
| POST | `/api/alerting/v2/rules/_bulk_delete` | Delete rules in bulk by ID |
| POST | `/api/alerting/v2/rules/_bulk_disable` | Disable rules in bulk by ID |
| POST | `/api/alerting/v2/rules/_bulk_enable` | Enable rules in bulk by ID |
| POST | `/api/alerting/v2/rules/_bulk_get` | Get rules in bulk |
| POST | `/api/alerting/v2/rules/_bulk_update_api_key` | Update the API key of rules in bulk by ID |
| POST | `/api/alerting/v2/rules/_delete_by_query` | Delete rules matching a query (dry-run by default) |
| POST | `/api/alerting/v2/rules/_disable_by_query` | Disable rules matching a query (dry-run by default) |
| POST | `/api/alerting/v2/rules/_enable_by_query` | Enable rules matching a query (dry-run by default) |
| POST | `/api/alerting/v2/rules/_update_api_key_by_query` | Update the API key of rules matching a query (dry-run by default) |
| DELETE | `/api/alerting/v2/rules/{id}` | Delete a rule |
| GET | `/api/alerting/v2/rules/{id}` | Get a rule |
| PATCH | `/api/alerting/v2/rules/{id}` | Update a rule |
| PUT | `/api/alerting/v2/rules/{id}` | Create or replace a rule |
| POST | `/api/alerting/v2/rules/{id}/_disable` | Disable a rule |
| POST | `/api/alerting/v2/rules/{id}/_enable` | Enable a rule |
| POST | `/api/alerting/v2/rules/{id}/_run` | Run a rule now |
| GET | `/api/alerting/v2/rules/{id}/history` | List rule change history |
| GET | `/api/alerting/v2/rules/{id}/history/{eventId}` | Get a rule change-history event |
| GET | `/api/alerting/v2/rules/tags` | Get rule tags |
| GET | `/api/alerting/v2/suggestions/rule_event_fields` | Get matcher data fields suggestions |

## Machine-readable artifacts (8)

- **OpenAPI** — https://raw.githubusercontent.com/api-evangelist/elk-stack/refs/heads/main/openapi/elk-stack-alerting-v2-api-openapi.yml
- **Documentation** — https://www.elastic.co/docs/reference/elasticsearch
- **APIReference** — https://www.elastic.co/docs/api/doc/elasticsearch/
- **SourceCode** — https://github.com/elastic/elasticsearch-specification
- **Documentation** — https://www.elastic.co/docs/reference/kibana
- **APIReference** — https://www.elastic.co/docs/api/doc/kibana/
- **SourceCode** — https://github.com/elastic/kibana
- **ToolCrosswalk** — https://raw.githubusercontent.com/api-evangelist/elk-stack/refs/heads/main/mcp/elk-stack-tool-crosswalk.yml

## Other Elastic Stack (ELK Stack) APIs (12)

- [Elastic Cloud API](https://apis.io/apis/elk-stack/elastic-cloud-api/)
- [Elastic Stack (ELK Stack) Accounts API](https://apis.io/apis/elk-stack/elk-stack-accounts-api/)
- [Elastic Stack (ELK Stack) Actions API](https://apis.io/apis/elk-stack/elk-stack-actions-api/)
- [Elastic Stack (ELK Stack) agent builder API](https://apis.io/apis/elk-stack/elk-stack-agent-builder-api/)
- [Elastic Stack (ELK Stack) Alerting API](https://apis.io/apis/elk-stack/elk-stack-alerting-api/)
- [Elastic Stack (ELK Stack) Analytics API](https://apis.io/apis/elk-stack/elk-stack-analytics-api/)
- [Elastic Stack (ELK Stack) APM agent configuration API](https://apis.io/apis/elk-stack/elk-stack-apm-agent-configuration-api/)
- [Elastic Stack (ELK Stack) APM agent keys API](https://apis.io/apis/elk-stack/elk-stack-apm-agent-keys-api/)
- [Elastic Stack (ELK Stack) APM annotations API](https://apis.io/apis/elk-stack/elk-stack-apm-annotations-api/)
- [Elastic Stack (ELK Stack) APM server schema API](https://apis.io/apis/elk-stack/elk-stack-apm-server-schema-api/)
- [Elastic Stack (ELK Stack) APM sourcemaps API](https://apis.io/apis/elk-stack/elk-stack-apm-sourcemaps-api/)
- [Elastic Stack (ELK Stack) Authentication API](https://apis.io/apis/elk-stack/elk-stack-authentication-api/)

## Tags

alerting-v2

---

Profiled by [API Evangelist](https://apievangelist.com) and published on [APIs.io](https://apis.io/apis/elk-stack/elk-stack-alerting-v2-api/). The API's provider profile, Kin Score and agent-readiness rating are at https://apis.io/providers/elk-stack/.