List action policy executions | Kibana API documentation

List action policy executions Experimental; added in 9.5.0

GET /api/alerting/v2/execution_history/action_policies

Spaces method and path for this operation:

get /s/{space_id}/api/alerting/v2/execution_history/action_policies

Refer to Spaces for more information.

Get a paginated list of dispatcher summary events for action policies in the current space.

[Required authorization] Route required privileges: read_alerting-v2-execution-history.

Query parameters

page integer

Page number (1-indexed). Defaults to 1.

Minimum value is 1, maximum value is 10000.
per_page integer

Number of events per page. Defaults to 20. Pass 0 for a count-only read.

Minimum value is 0, maximum value is 100.
start_date string(date-time)

Inclusive ISO datetime lower bound on the event timestamp; overrides the default 24-hour window. Independent of episode_ids — e.g. set it to an episode’s start time to scope results to that episode’s lifetime.

Format should match the following pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$.
episode_ids array[string]

Episode filter. Narrows events to those referencing at least one of the provided episode ids.

At least 1 but not more than 50 elements. Minimum length of each is 1, maximum length of each is 150.
search string

Free-text search. Matches policy name, rule name, policy/rule ID (case-insensitive).

Minimum length is 1, maximum length is 256.
rule_ids array[string]

Explicit rule filter. Narrows events to those referencing at least one of the provided rule ids. Also unions with the search filter if both are provided.

At least 1 but not more than 50 elements. Minimum length of each is 1, maximum length of each is 150.
outcome array[string]

Outcome filter. When omitted matches all outcomes. Pass one or more of "dispatched", "throttled", "dispatch_failed" to narrow.

At least 1 but not more than 3 elements. Values are dispatched, throttled, or dispatch_failed.

Responses

200 application/json

Returns a paginated list of execution history events.
Hide response attributes Show response attributes object
- items array[object] Required
  
  Hide items attributes Show items attributes object
  
  action_group_count number Required
  
  dispatched_at string Required
  
  episode_count number Required
  
  episodes array[object]
  
  Episode ids referenced by this event, bounded to MAX_EMBEDDED_EPISODES_PER_ITEM. Use episode_count for the true total.
  
  Not more than 50 elements.
  
  Hide episodes attribute Show episodes attribute object
  
  id string Required
  
  error object
  
  Additional properties are NOT allowed.
  
  Hide error attribute Show error attribute object
  
  message string Required
  
  failure_reason string
  
  Values are missing_api_key, workflow_not_found, workflow_disabled, or schedule_error.
  
  outcome string Required
  
  Values are dispatched, throttled, or dispatch_failed.
  
  policy object Required
  
  Additional properties are NOT allowed.
  
  Hide policy attributes Show policy attributes object
  
  id string Required
  
  name string | null
  
  rules array[object] Required
  
  Rules referenced by this event, bounded to MAX_EMBEDDED_RULES_PER_ITEM. When a search or rule filter narrows the match, this array is intersected with the matched subset server-side. Use total_rule_count for the full count.
  
  Not more than 20 elements.
  
  Hide rules attributes Show rules attributes object
  
  id string Required
  
  name string | null
  
  total_rule_count number Required
  
  Total number of rules referenced by this event after search / rule-filter narrowing. May exceed rules.length when the embedded array is truncated to the cap.
  
  workflows array[object] Required
  
  Not more than 100 elements.
  
  Hide workflows attributes Show workflows attributes object
  
  id string Required
  
  name string | null
- page integer Required
  
  Minimum value is 1, maximum value is 9007199254740991.
- per_page integer Required
  
  Minimum value is 0, maximum value is 9007199254740991.
- search_matches object | null Required
  
  Per-type match counts for the active search, plus the cap used as filter. Null when no search was provided. When policies > cap or rules > cap the result is truncated.
  
  Additional properties are NOT allowed.
  
  Hide search_matches attributes Show search_matches attributes object | null
  
  cap number Required
  
  Maximum number of policy/rule ids the server uses as a filter.
  
  policies number Required
  
  Total policies matching the search.
  
  rules number Required
  
  Total rules matching the search.
- total_events integer Required
  
  Minimum value is 0, maximum value is 9007199254740991.
400 application/json

Indicates an invalid schema or parameters.
Hide response attributes Show response attributes object
- code string Required
  
  A stable, machine-readable error code (e.g., "RULE_NOT_FOUND", "INVALID_SCHEDULE"). Safe for clients to branch on.
- details object
  
  Optional structured context (e.g., validation field errors, conflict resource IDs).
  
  Additional properties are allowed.
- error string Required
  
  A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.
- message string Required
  
  A human-friendly explanation of the error. Subject to change without notice. Do not parse or rely on its content.
401 application/json

Indicates the request was not authenticated.
Hide response attributes Show response attributes object
- code string Required
  
  A stable, machine-readable error code (e.g., "RULE_NOT_FOUND", "INVALID_SCHEDULE"). Safe for clients to branch on.
- details object
  
  Optional structured context (e.g., validation field errors, conflict resource IDs).
  
  Additional properties are allowed.
- error string Required
  
  A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.
- message string Required
  
  A human-friendly explanation of the error. Subject to change without notice. Do not parse or rely on its content.
403 application/json

Indicates the user does not have the required privileges to perform the request.
Hide response attributes Show response attributes object
- code string Required
  
  A stable, machine-readable error code (e.g., "RULE_NOT_FOUND", "INVALID_SCHEDULE"). Safe for clients to branch on.
- details object
  
  Optional structured context (e.g., validation field errors, conflict resource IDs).
  
  Additional properties are allowed.
- error string Required
  
  A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.
- message string Required
  
  A human-friendly explanation of the error. Subject to change without notice. Do not parse or rely on its content.
500 application/json

Indicates an unexpected server-side error.
Hide response attributes Show response attributes object
- code string Required
  
  A stable, machine-readable error code (e.g., "RULE_NOT_FOUND", "INVALID_SCHEDULE"). Safe for clients to branch on.
- details object
  
  Optional structured context (e.g., validation field errors, conflict resource IDs).
  
  Additional properties are allowed.
- error string Required
  
  A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.
- message string Required
  
  A human-friendly explanation of the error. Subject to change without notice. Do not parse or rely on its content.
503 application/json

Indicates the alerting engine is disabled by the alerting:v2:enabled advanced setting.
Hide response attributes Show response attributes object
- code string Required
  
  A stable, machine-readable error code (e.g., "RULE_NOT_FOUND", "INVALID_SCHEDULE"). Safe for clients to branch on.
- details object
  
  Optional structured context (e.g., validation field errors, conflict resource IDs).
  
  Additional properties are allowed.
- error string Required
  
  A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.
- message string Required
  
  A human-friendly explanation of the error. Subject to change without notice. Do not parse or rely on its content.

GET /api/alerting/v2/execution_history/action_policies

curl \
 --request GET 'https://localhost:5601/api/alerting/v2/execution_history/action_policies' \
 --header "Authorization: $API_KEY"

Response examples (200)

{
  "items": [
    {
      "action_group_count": 1,
      "dispatched_at": "2026-01-15T12:05:00.000Z",
      "episode_count": 1,
      "episodes": [
        {
          "id": "episode-1"
        }
      ],
      "outcome": "dispatched",
      "policy": {
        "id": "action-policy-1",
        "name": "Notify on host alerts"
      },
      "rules": [
        {
          "id": "rule-1",
          "name": "Host CPU high"
        }
      ],
      "total_rule_count": 1,
      "workflows": [
        {
          "id": "workflow-1",
          "name": "Notify oncall"
        }
      ]
    }
  ],
  "page": 1,
  "per_page": 20,
  "search_matches": null,
  "total_events": 1
}

Response examples (400)

{
  "code": "BAD_REQUEST",
  "details": {
    "errors": {
      "page": [
        "page * per_page cannot exceed 10000."
      ]
    }
  },
  "error": "Bad Request",
  "message": "page * per_page cannot exceed 10000."
}

Response examples (401)

{
  "code": "UNAUTHORIZED",
  "error": "Unauthorized",
  "message": "Authentication required to access this API."
}

Response examples (403)

{
  "code": "FORBIDDEN",
  "error": "Forbidden",
  "message": "The current user does not have the required privileges for this request."
}

Response examples (500)

{
  "code": "INTERNAL_SERVER_ERROR",
  "error": "Internal Server Error",
  "message": "An unexpected error occurred."
}

Response examples (503)

{
  "code": "ALERTING_DISABLED",
  "error": "Service Unavailable",
  "message": "Alerting is disabled."
}