Alerting V2 is an ES|QL-first alerting API for managing rules, alert actions, and action policies. Use these endpoints to create and manage detection rules, act on alerts, and control when and how notifications are delivered. These APIs are experimental.

Operations quick access
GET /api/alerting/v2/action_policies POST /api/alerting/v2/action_policies POST /api/alerting/v2/action_policies/_bulk_delete POST /api/alerting/v2/action_policies/_bulk_disable POST /api/alerting/v2/action_policies/_bulk_enable POST /api/alerting/v2/action_policies/_bulk_snooze POST /api/alerting/v2/action_policies/_bulk_unsnooze POST /api/alerting/v2/action_policies/_bulk_update_api_key POST /api/alerting/v2/action_policies/_match_for_rule GET /api/alerting/v2/action_policies/{id} PUT /api/alerting/v2/action_policies/{id} DELETE /api/alerting/v2/action_policies/{id} PATCH /api/alerting/v2/action_policies/{id} POST /api/alerting/v2/action_policies/{id}/_disable POST /api/alerting/v2/action_policies/{id}/_enable POST /api/alerting/v2/action_policies/{id}/_snooze POST /api/alerting/v2/action_policies/{id}/_unsnooze POST /api/alerting/v2/action_policies/{id}/_update_api_key GET /api/alerting/v2/action_policies/tags POST /api/alerting/v2/alerts/_bulk_action POST /api/alerting/v2/alerts/{group_hash}/_ack POST /api/alerting/v2/alerts/{group_hash}/_activate POST /api/alerting/v2/alerts/{group_hash}/_assign POST /api/alerting/v2/alerts/{group_hash}/_deactivate POST /api/alerting/v2/alerts/{group_hash}/_snooze POST /api/alerting/v2/alerts/{group_hash}/_tag POST /api/alerting/v2/alerts/{group_hash}/_unack POST /api/alerting/v2/alerts/{group_hash}/_unsnooze GET /api/alerting/v2/execution_history/action_policies GET /api/alerting/v2/execution_history/rules GET /api/alerting/v2/rules POST /api/alerting/v2/rules POST /api/alerting/v2/rules/_bulk_delete POST /api/alerting/v2/rules/_bulk_disable POST /api/alerting/v2/rules/_bulk_enable POST /api/alerting/v2/rules/_bulk_get POST /api/alerting/v2/rules/_bulk_update_api_key POST /api/alerting/v2/rules/_delete_by_query POST /api/alerting/v2/rules/_disable_by_query POST /api/alerting/v2/rules/_enable_by_query POST /api/alerting/v2/rules/_update_api_key_by_query GET /api/alerting/v2/rules/{id} PUT /api/alerting/v2/rules/{id} DELETE /api/alerting/v2/rules/{id} PATCH /api/alerting/v2/rules/{id} POST /api/alerting/v2/rules/{id}/_disable POST /api/alerting/v2/rules/{id}/_enable POST /api/alerting/v2/rules/{id}/_run GET /api/alerting/v2/rules/{id}/history GET /api/alerting/v2/rules/{id}/history/{eventId} GET /api/alerting/v2/rules/tags GET /api/alerting/v2/suggestions/rule_event_fields