How AI is applied across API Evangelist and APIs.io. Read my AI disclosure →
API Evangelist API Evangelist
Discovery
Learnings
Guidance
Toolbox
Alignment
API Evangelist LLC

Elastic Stack (ELK Stack) Alerting V2 API

Alerting V2 is an ES|QL-first alerting API for managing rules, alert actions, and action policies. Use these endpoints to create and manage detection rules, act on alerts, and control when and how notifications are delivered. These APIs are experimental.

Elastic Stack (ELK Stack) Alerting V2 API is one of 132 APIs that Elastic Stack (ELK Stack) publishes on the APIs.io network, described by a machine-readable OpenAPI specification.

Tagged areas include alerting-v2. The published artifact set on APIs.io includes an OpenAPI specification, API documentation, and an API reference.

This API exposes 52 operations across 44 paths, and defines 56 schemas. It is described by OpenAPI 3.2.0.

Requests are made against a single base URL, https://{kibana_url}.

52 operations 44 paths 56 schemas 2 DELETE11 GET2 PATCH35 POST2 PUT

Metadata

The identity and technical contract details declared by the specification.

Specification
OpenAPI 3.2.0
Base URL
https://{elasticsearch_endpoint}
Authentication
API Key, HTTP Basic
Contact
Kibana Team
Resource Areas
1

Authentication & Security 2

Elastic Stack (ELK Stack) Alerting V2 API declares 2 security schemes for authenticating requests. An API key is passed in the header as Authorization (apiKeyAuth). It accepts HTTP basic authentication (basicAuth). By default, every request must be authenticated.

  • apiKeyAuth — These APIs use key-based authentication. You must create an API key and use the encoded value in the request header. For example: Authorization: ApiKey base64A…

Paths & Operations 52

Across 44 paths, the API surfaces 52 operations — 2 DELETE, 11 GET, 2 PATCH, 35 POST, 2 PUT. Each is listed below with its method, path, parameters, and response codes.

alerting-v2 52

Alerting V2 is an ES|QL-first alerting API for managing rules, alert actions, and action policies. Use these endpoints to create and manage detection rules, act on alerts, and con…

GET
/api/alerting/v2/action_policies
List action policies
get-alerting-v2-action-policies 7 params → 200400401403500503
POST
/api/alerting/v2/action_policies
Create an action policy
post-alerting-v2-action-policies 1 param body → 201400401403500503
POST
/api/alerting/v2/action_policies/_bulk_delete
Delete action policies in bulk by ID
post-alerting-v2-action-policies-bulk-delete 1 param body → 200400401403500503
POST
/api/alerting/v2/action_policies/_bulk_disable
Disable action policies in bulk by ID
post-alerting-v2-action-policies-bulk-disable 1 param body → 200400401403500503
POST
/api/alerting/v2/action_policies/_bulk_enable
Enable action policies in bulk by ID
post-alerting-v2-action-policies-bulk-enable 1 param body → 200400401403500503
POST
/api/alerting/v2/action_policies/_bulk_snooze
Snooze action policies in bulk by ID
post-alerting-v2-action-policies-bulk-snooze 1 param body → 200400401403500503
POST
/api/alerting/v2/action_policies/_bulk_unsnooze
Cancel snooze for action policies in bulk by ID
post-alerting-v2-action-policies-bulk-unsnooze 1 param body → 200400401403500503
POST
/api/alerting/v2/action_policies/_bulk_update_api_key
Rotate API keys for action policies in bulk by ID
post-alerting-v2-action-policies-bulk-update-api-key 1 param body → 200400401403500503
POST
/api/alerting/v2/action_policies/_match_for_rule
Match action policies for a rule
post-alerting-v2-action-policies-match-for-rule 1 param body → 200400401403500503
DELETE
/api/alerting/v2/action_policies/{id}
Delete an action policy
delete-alerting-v2-action-policies-id 2 params → 204400401403404500503
GET
/api/alerting/v2/action_policies/{id}
Get an action policy
get-alerting-v2-action-policies-id 1 param → 200400401403404500503
PATCH
/api/alerting/v2/action_policies/{id}
Partially update an action policy.
patch-alerting-v2-action-policies-id 2 params body → 200400401403404409500503
PUT
/api/alerting/v2/action_policies/{id}
Create or replace an action policy
put-alerting-v2-action-policies-id 2 params body → 200201400401403404409500
POST
/api/alerting/v2/action_policies/{id}/_disable
Disable an action policy
post-alerting-v2-action-policies-id-disable 2 params → 200400401403404409500503
POST
/api/alerting/v2/action_policies/{id}/_enable
Enable an action policy
post-alerting-v2-action-policies-id-enable 2 params → 200400401403404409500503
POST
/api/alerting/v2/action_policies/{id}/_snooze
Snooze an action policy
post-alerting-v2-action-policies-id-snooze 2 params body → 200400401403404409500503
POST
/api/alerting/v2/action_policies/{id}/_unsnooze
Unsnooze an action policy
post-alerting-v2-action-policies-id-unsnooze 2 params → 200400401403404409500503
POST
/api/alerting/v2/action_policies/{id}/_update_api_key
Update an action policy API key
post-alerting-v2-action-policies-id-update-api-key 2 params → 204400401403404409500503
GET
/api/alerting/v2/action_policies/tags
Get action policy tags
get-alerting-v2-action-policies-tags 1 param → 200400401403500503
POST
/api/alerting/v2/alerts/_bulk_action
Bulk create alert actions
post-alerting-v2-alerts-bulk-action 1 param body → 200400401403500503
POST
/api/alerting/v2/alerts/{group_hash}/_ack
Acknowledge an alert
post-alerting-v2-alerts-group-hash-ack 2 params body → 204400401403404500503
POST
/api/alerting/v2/alerts/{group_hash}/_activate
Activate an alert
post-alerting-v2-alerts-group-hash-activate 2 params body → 204400401403404500503
POST
/api/alerting/v2/alerts/{group_hash}/_assign
Assign an alert to a user
post-alerting-v2-alerts-group-hash-assign 2 params body → 204400401403404500503
POST
/api/alerting/v2/alerts/{group_hash}/_deactivate
Deactivate an alert
post-alerting-v2-alerts-group-hash-deactivate 2 params body → 204400401403404500503
POST
/api/alerting/v2/alerts/{group_hash}/_snooze
Snooze an alert
post-alerting-v2-alerts-group-hash-snooze 2 params body → 204400401403404500503
POST
/api/alerting/v2/alerts/{group_hash}/_tag
Add tags to an alert
post-alerting-v2-alerts-group-hash-tag 2 params body → 204400401403404500503
POST
/api/alerting/v2/alerts/{group_hash}/_unack
Unacknowledge an alert
post-alerting-v2-alerts-group-hash-unack 2 params body → 204400401403404500503
POST
/api/alerting/v2/alerts/{group_hash}/_unsnooze
Unsnooze an alert
post-alerting-v2-alerts-group-hash-unsnooze 2 params body → 204400401403404500503
GET
/api/alerting/v2/execution_history/action_policies
List action policy executions
get-alerting-v2-execution-history-action-policies 7 params → 200400401403500503
GET
/api/alerting/v2/execution_history/rules
List rule executions
get-alerting-v2-execution-history-rules 8 params → 200400401403500503
GET
/api/alerting/v2/rules
List rules
get-alerting-v2-rules 6 params → 200400401403500503
POST
/api/alerting/v2/rules
Create a rule
post-alerting-v2-rules 1 param body → 201400401403500503
POST
/api/alerting/v2/rules/_bulk_delete
Delete rules in bulk by ID
post-alerting-v2-rules-bulk-delete 1 param body → 200400401403500503
POST
/api/alerting/v2/rules/_bulk_disable
Disable rules in bulk by ID
post-alerting-v2-rules-bulk-disable 1 param body → 200400401403500503
POST
/api/alerting/v2/rules/_bulk_enable
Enable rules in bulk by ID
post-alerting-v2-rules-bulk-enable 1 param body → 200400401403500503
POST
/api/alerting/v2/rules/_bulk_get
Get rules in bulk
post-alerting-v2-rules-bulk-get 1 param body → 200400401403404500503
POST
/api/alerting/v2/rules/_bulk_update_api_key
Update the API key of rules in bulk by ID
post-alerting-v2-rules-bulk-update-api-key 1 param body → 200400401403500503
POST
/api/alerting/v2/rules/_delete_by_query
Delete rules matching a query (dry-run by default)
post-alerting-v2-rules-delete-by-query 1 param body → 200400401403500503
POST
/api/alerting/v2/rules/_disable_by_query
Disable rules matching a query (dry-run by default)
post-alerting-v2-rules-disable-by-query 1 param body → 200400401403500503
POST
/api/alerting/v2/rules/_enable_by_query
Enable rules matching a query (dry-run by default)
post-alerting-v2-rules-enable-by-query 1 param body → 200400401403500503
POST
/api/alerting/v2/rules/_update_api_key_by_query
Update the API key of rules matching a query (dry-run by default)
post-alerting-v2-rules-update-api-key-by-query 1 param body → 200400401403500503
DELETE
/api/alerting/v2/rules/{id}
Delete a rule
delete-alerting-v2-rules-id 2 params → 204400401403404500503
GET
/api/alerting/v2/rules/{id}
Get a rule
get-alerting-v2-rules-id 1 param → 200400401403404500503
PATCH
/api/alerting/v2/rules/{id}
Update a rule
patch-alerting-v2-rules-id 2 params body → 200400401403404409500503
PUT
/api/alerting/v2/rules/{id}
Create or replace a rule
put-alerting-v2-rules-id 2 params body → 200201400401403404409500
POST
/api/alerting/v2/rules/{id}/_disable
Disable a rule
post-alerting-v2-rules-id-disable 2 params → 200400401403404409500503
POST
/api/alerting/v2/rules/{id}/_enable
Enable a rule
post-alerting-v2-rules-id-enable 2 params → 200400401403404409500503
POST
/api/alerting/v2/rules/{id}/_run
Run a rule now
post-alerting-v2-rules-id-run 2 params → 204400401403404409500503
GET
/api/alerting/v2/rules/{id}/history
List rule change history
get-alerting-v2-rules-id-history 3 params → 200400401403500503
GET
/api/alerting/v2/rules/{id}/history/{eventId}
Get a rule change-history event
get-alerting-v2-rules-id-history-eventid 2 params → 200400401403404500503
GET
/api/alerting/v2/rules/tags
Get rule tags
get-alerting-v2-rules-tags 2 params → 200400401403500503
GET
/api/alerting/v2/suggestions/rule_event_fields
Get matcher data fields suggestions
get-alerting-v2-suggestions-rule-event-fields 1 param → 200400401403500503

Schemas 56

The contract defines 56 schemas that model the data the API accepts and returns. The most detailed are Kibana_HTTP_APIs_alerting_action_policy_response (17 properties), Kibana_HTTP_APIs_alerting_rule_response (17 properties), Kibana_HTTP_APIs_alerting_policy_execution_history_item (11 properties), Kibana_HTTP_APIs_alerting_new_rule (10 properties). Each schema is shown below with its type and property counts.

Kibana_HTTP_APIs_alerting_alert_action
Request body for creating a single alert action. One of: ack, unack, assign, tag, snooze, unsnooze, activate, deactivate.
Kibana_HTTP_APIs_alerting_match_action_policies_for_rule_request
object
1 property
Kibana_HTTP_APIs_alerting_action_policy_throttle
object
2 properties
Kibana_HTTP_APIs_alerting_action_policy_grouping_mode
The grouping mode: perepisode groups by episode lifecycle, all sends a single notification for all alerts, perfield groups by the specified fields.
Kibana_HTTP_APIs_alerting_unsnooze_alert_action
object
1 property 1 required
Kibana_HTTP_APIs_alerting_bulk_dry_run_response
object
Dry-run preview returned by a by-query bulk endpoint when force is false.
2 properties 2 required
Kibana_HTTP_APIs_alerting_update_action_policy
object
9 properties 1 required
Kibana_HTTP_APIs_alerting_rule_response
object
17 properties 10 required
Kibana_HTTP_APIs_alerting_bulk_snooze_action_policies_request
object
2 properties 2 required
Kibana_HTTP_APIs_alerting_new_ack_alert_action
object
1 property 1 required
Kibana_HTTP_APIs_alerting_new_tag_alert_action
object
1 property 1 required
Kibana_HTTP_APIs_alerting_bulk_get_rules_request
object
1 property 1 required
Kibana_HTTP_APIs_alerting_tag_alert_action
object
2 properties 2 required
Kibana_HTTP_APIs_alerting_rule_response_metadata
object
6 properties 2 required
Kibana_HTTP_APIs_alerting_update_rule
object
10 properties
Kibana_HTTP_APIs_alerting_policy_execution_history_response
object
5 properties 5 required
Kibana_HTTP_APIs_alerting_rule_query
Detection query configuration.
Kibana_HTTP_APIs_alerting_activate_alert_action
object
2 properties 2 required
Kibana_HTTP_APIs_alerting_rule_execution
object
9 properties 9 required
Kibana_HTTP_APIs_alerting_new_assign_alert_action
object
2 properties 2 required
Kibana_HTTP_APIs_alerting_action_policy_list_response
object
Paginated list of action policies.
4 properties 4 required
Kibana_HTTP_APIs_alerting_new_rule
object
10 properties 4 required
Kibana_HTTP_APIs_alerting_standalone_rule_query
object
Standalone queries: independent full queries for breach, recovery, and nodata.
4 properties 2 required
Kibana_HTTP_APIs_alerting_rule_executions_response
object
4 properties 4 required
Kibana_HTTP_APIs_alerting_bulk_create_alert_action_item
Kibana_HTTP_APIs_alerting_error_response
object
4 properties 3 required
Kibana_HTTP_APIs_alerting_assign_alert_action
object
3 properties 3 required
Kibana_HTTP_APIs_alerting_snooze_alert_action
object
2 properties 1 required
Kibana_HTTP_APIs_alerting_matched_action_policy
object
An action policy that matches a rule, along with the reason it matched.
2 properties 2 required
Kibana_HTTP_APIs_alerting_unack_alert_action
object
2 properties 2 required
Kibana_HTTP_APIs_alerting_new_activate_alert_action
object
1 property 1 required
Kibana_HTTP_APIs_alerting_rule_metadata
object
Rule metadata.
5 properties 1 required
Kibana_HTTP_APIs_alerting_policy_execution_history_item
object
11 properties 8 required
Kibana_HTTP_APIs_alerting_bulk_get_rules_response
object
1 property 1 required
Kibana_HTTP_APIs_alerting_new_unack_alert_action
object
1 property 1 required
Kibana_HTTP_APIs_alerting_bulk_create_alert_actions_request
array
Request body for bulk create alert actions. Array of 1 to 100 actions, each with grouphash and action payload.
Kibana_HTTP_APIs_alerting_new_action_policy
object
8 properties 3 required
Kibana_HTTP_APIs_alerting_rule_schedule
object
Execution schedule configuration.
2 properties 1 required
Kibana_HTTP_APIs_alerting_deactivate_alert_action
object
2 properties 2 required
Kibana_HTTP_APIs_alerting_snooze_action_policy_request
object
1 property 1 required
Kibana_HTTP_APIs_alerting_action_policy_response
object
17 properties 16 required
Kibana_HTTP_APIs_alerting_match_action_policies_for_rule_response
object
Action policies that match a given rule, grouped by match category.
2 properties 2 required
Kibana_HTTP_APIs_alerting_rule_grouping
object
Grouping configuration.
1 property 1 required
Kibana_HTTP_APIs_alerting_new_snooze_alert_action
object
1 property
Kibana_HTTP_APIs_alerting_action_policy_destination
An action policy destination configuration.
Kibana_HTTP_APIs_alerting_composed_rule_query
object
Composed query: a shared base with appendable breach and recovery segments.
4 properties 2 required
Kibana_HTTP_APIs_alerting_workflow_action_policy_destination
object
2 properties 2 required
Kibana_HTTP_APIs_alerting_rule_list_response
object
Paginated list of rules.
4 properties 4 required
Kibana_HTTP_APIs_alerting_bulk_by_ids_request
object
1 property 1 required
Kibana_HTTP_APIs_alerting_bulk_operation_response
object
Result of an executed bulk operation.
2 properties 2 required
Kibana_HTTP_APIs_alerting_new_deactivate_alert_action
object
1 property 1 required
Kibana_HTTP_APIs_alerting_new_unsnooze_alert_action
object
Kibana_HTTP_APIs_alerting_bulk_by_query_request
object
4 properties
Kibana_HTTP_APIs_alerting_rule_artifact
object
3 properties 3 required
Kibana_HTTP_APIs_alerting_rule_tags_response
object
All unique tags across rules.
1 property 1 required
Kibana_HTTP_APIs_alerting_ack_alert_action
object
2 properties 2 required

Specification

The full machine-readable OpenAPI contract behind this narrative.

Source

elk-stack-alerting-v2-api-openapi.yml Raw ↑

Other APIs Elastic Stack (ELK Stack) publishes across the network.

Elastic Cloud API
Elastic Stack (ELK Stack) Accounts API
Elastic Stack (ELK Stack) Actions API
Elastic Stack (ELK Stack) agent builder API
Elastic Stack (ELK Stack) Alerting API
Elastic Stack (ELK Stack) Analytics API
Elastic Stack (ELK Stack) APM agent configuration API
Elastic Stack (ELK Stack) APM agent keys API
Elastic Stack (ELK Stack) APM annotations API
Elastic Stack (ELK Stack) APM server schema API
Elastic Stack (ELK Stack) APM sourcemaps API
Elastic Stack (ELK Stack) Authentication API
Where this information came from

This is an independent, third-party profile of Elastic Stack (ELK Stack) Alerting V2 API, published by API Evangelist. We do not operate, host, resell, or support these APIs, and we are not affiliated with or endorsed by the company unless stated above. Everything here is built from publicly available information — the company's own site, developer portal, documentation, public repositories, and the specifications it publishes for public use. Nothing is obtained by breaching a system, defeating an access control, or using credentials.

The Kin Score and Agent Readiness rating are independently calculated assessments of a company's public API artifacts, scored against a published rubric. They are not certifications, endorsements, security assessments, or audits.

Corrections, re-scores, and removal are free — no partnership or purchase required, and you do not need to justify the request. A removed company is recorded as unrated, never scored zero for having asked. Acknowledgement within one business day; removal within two.

info@apievangelist.com · Read the full data-sourcing policy →
On a security or compliance team? Put security in the subject line and you will get a person, not a form — we will tell you exactly which public URLs this profile was built from.