List rule executions | Kibana API documentation

List rule executions Experimental; added in 9.5.0

GET /api/alerting/v2/execution_history/rules

Spaces method and path for this operation:

get /s/{space_id}/api/alerting/v2/execution_history/rules

Refer to Spaces for more information.

Get a paginated list of rule execution events.

[Required authorization] Route required privileges: read_alerting-v2-execution-history.

Query parameters

rule_ids array[string]

Rule id filter.

At least 1 but not more than 50 elements. Minimum length of each is 1, maximum length of each is 150.
outcome array[string]

Outcome filter.

At least 1 but not more than 2 elements. Values are success or failure.
from string(date-time)

Inclusive ISO datetime lower bound on event.start.

Format should match the following pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$.
to string(date-time)

Inclusive ISO datetime upper bound on event.start.

Format should match the following pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$.
sort string Required

Sort field. Defaults to started_at.

Values are started_at or duration. Default value is started_at.
sort_order string Required

Sort direction.

Values are asc or desc. Default value is desc.
page integer Required

Page number.

Minimum value is 1, maximum value is 10000. Default value is 1.
per_page integer Required

Number of results per page.

Minimum value is 1, maximum value is 100. Default value is 20.

Responses

200 application/json

Returns a paginated list of rule execution events.
Hide response attributes Show response attributes object
- items array[object] Required
  
  Hide items attributes Show items attributes object
  
  ended_at string Required
  
  error object | null Required
  
  Additional properties are NOT allowed.
  
  Hide error attributes Show error attributes object | null
  
  message string Required
  
  stack_trace string | null Required
  
  id string Required
  
  outcome string Required
  
  Values are success or failure.
  
  reason string | null Required
  
  rule object Required
  
  Additional properties are NOT allowed.
  
  Hide rule attributes Show rule attributes object
  
  id string Required
  
  version integer | null Required
  
  Minimum value is -9007199254740991, maximum value is 9007199254740991.
  
  space_id string Required
  
  started_at string Required
  
  timings object Required
  
  Additional properties are NOT allowed.
  
  Hide timings attributes Show timings attributes object
  
  duration integer Required
  
  Minimum value is 0, maximum value is 9007199254740991.
  
  scheduled_delay integer Required
  
  Minimum value is -9007199254740991, maximum value is 9007199254740991.
- page integer Required
  
  Minimum value is 1, maximum value is 9007199254740991.
- per_page integer Required
  
  Minimum value is 1, maximum value is 9007199254740991.
- total integer Required
  
  Minimum value is 0, maximum value is 9007199254740991.
400 application/json

Indicates an invalid schema or parameters.
Hide response attributes Show response attributes object
- code string Required
  
  A stable, machine-readable error code (e.g., "RULE_NOT_FOUND", "INVALID_SCHEDULE"). Safe for clients to branch on.
- details object
  
  Optional structured context (e.g., validation field errors, conflict resource IDs).
  
  Additional properties are allowed.
- error string Required
  
  A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.
- message string Required
  
  A human-friendly explanation of the error. Subject to change without notice. Do not parse or rely on its content.
401 application/json

Indicates the request was not authenticated.
Hide response attributes Show response attributes object
- code string Required
  
  A stable, machine-readable error code (e.g., "RULE_NOT_FOUND", "INVALID_SCHEDULE"). Safe for clients to branch on.
- details object
  
  Optional structured context (e.g., validation field errors, conflict resource IDs).
  
  Additional properties are allowed.
- error string Required
  
  A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.
- message string Required
  
  A human-friendly explanation of the error. Subject to change without notice. Do not parse or rely on its content.
403 application/json

Indicates the user does not have the required privileges to perform the request.
Hide response attributes Show response attributes object
- code string Required
  
  A stable, machine-readable error code (e.g., "RULE_NOT_FOUND", "INVALID_SCHEDULE"). Safe for clients to branch on.
- details object
  
  Optional structured context (e.g., validation field errors, conflict resource IDs).
  
  Additional properties are allowed.
- error string Required
  
  A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.
- message string Required
  
  A human-friendly explanation of the error. Subject to change without notice. Do not parse or rely on its content.
500 application/json

Indicates an unexpected server-side error.
Hide response attributes Show response attributes object
- code string Required
  
  A stable, machine-readable error code (e.g., "RULE_NOT_FOUND", "INVALID_SCHEDULE"). Safe for clients to branch on.
- details object
  
  Optional structured context (e.g., validation field errors, conflict resource IDs).
  
  Additional properties are allowed.
- error string Required
  
  A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.
- message string Required
  
  A human-friendly explanation of the error. Subject to change without notice. Do not parse or rely on its content.
503 application/json

Indicates the alerting engine is disabled by the alerting:v2:enabled advanced setting.
Hide response attributes Show response attributes object
- code string Required
  
  A stable, machine-readable error code (e.g., "RULE_NOT_FOUND", "INVALID_SCHEDULE"). Safe for clients to branch on.
- details object
  
  Optional structured context (e.g., validation field errors, conflict resource IDs).
  
  Additional properties are allowed.
- error string Required
  
  A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.
- message string Required
  
  A human-friendly explanation of the error. Subject to change without notice. Do not parse or rely on its content.

GET /api/alerting/v2/execution_history/rules

curl \
 --request GET 'https://localhost:5601/api/alerting/v2/execution_history/rules?sort=started_at&sort_order=desc&page=1&per_page=20' \
 --header "Authorization: $API_KEY"

Response examples (200)

{
  "items": [
    {
      "ended_at": "2026-01-15T12:00:01.250Z",
      "error": null,
      "id": "execution-1",
      "outcome": "success",
      "reason": null,
      "rule": {
        "id": "rule-1",
        "version": 3
      },
      "space_id": "default",
      "started_at": "2026-01-15T12:00:00.000Z",
      "timings": {
        "duration": 1250,
        "scheduled_delay": 40
      }
    }
  ],
  "page": 1,
  "per_page": 20,
  "total": 1
}

Response examples (400)

{
  "code": "BAD_REQUEST",
  "details": {
    "errors": {
      "page": [
        "page * per_page cannot exceed 10000."
      ]
    }
  },
  "error": "Bad Request",
  "message": "page * per_page cannot exceed 10000."
}

Response examples (401)

{
  "code": "UNAUTHORIZED",
  "error": "Unauthorized",
  "message": "Authentication required to access this API."
}

Response examples (403)

{
  "code": "FORBIDDEN",
  "error": "Forbidden",
  "message": "The current user does not have the required privileges for this request."
}

Response examples (500)

{
  "code": "INTERNAL_SERVER_ERROR",
  "error": "Internal Server Error",
  "message": "An unexpected error occurred."
}

Response examples (503)

{
  "code": "ALERTING_DISABLED",
  "error": "Service Unavailable",
  "message": "Alerting is disabled."
}