List rule change history Experimental; added in 9.5.0

GET /api/alerting/v2/rules/{id}/history
Api key auth Basic auth

Spaces method and path for this operation:

get /s/{space_id}/api/alerting/v2/rules/{id}/history

Refer to Spaces for more information.

Get a paginated list of prior configurations for a rule from change history. List rows are lean (diff summary only); use the detail route for full snapshots.

[Required authorization] Route required privileges: read_alerting-v2-rules.

Path parameters

  • id string Required

    The identifier for the rule.

    Minimum length is 1, maximum length is 150.

Query parameters

  • page integer Required

    Page number (1-based).

    Minimum value is 1, maximum value is 10000. Default value is 1.

  • per_page integer Required

    Number of results per page.

    Minimum value is 1, maximum value is 100. Default value is 20.

Responses

  • 200 application/json

    Returns a paginated list of rule change-history events.

    Hide response attributes Show response attributes object
    • items array[object] Required
      Hide items attributes Show items attributes object
      • action string Required
      • actor object Required
        Hide actor attributes Show actor attributes object
        • name string Required
        • profileId string
      • changes object
        Hide changes attributes Show changes attributes object
        • count integer Required

          Minimum value is 0, maximum value is 9007199254740991.

        • summary object

          Additional properties are allowed.

      • comment string
      • id string Required
      • isCurrent boolean
      • metadata object

        Additional properties are allowed.

      • tags array[string]
      • timestamp string Required
    • total integer Required

      Minimum value is 0, maximum value is 9007199254740991.
  • 400 application/json

    Indicates an invalid schema or parameters.

    Hide response attributes Show response attributes object
    • code string Required

      A stable, machine-readable error code (e.g., "RULE_NOT_FOUND", "INVALID_SCHEDULE"). Safe for clients to branch on.

    • details object

      Optional structured context (e.g., validation field errors, conflict resource IDs).

      Additional properties are allowed.

    • error string Required

      A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.

    • message string Required

      A human-friendly explanation of the error. Subject to change without notice. Do not parse or rely on its content.
  • 401 application/json

    Indicates the request was not authenticated.

    Hide response attributes Show response attributes object
    • code string Required

      A stable, machine-readable error code (e.g., "RULE_NOT_FOUND", "INVALID_SCHEDULE"). Safe for clients to branch on.

    • details object

      Optional structured context (e.g., validation field errors, conflict resource IDs).

      Additional properties are allowed.

    • error string Required

      A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.

    • message string Required

      A human-friendly explanation of the error. Subject to change without notice. Do not parse or rely on its content.
  • 403 application/json

    Indicates the user does not have the required privileges to perform the request.

    Hide response attributes Show response attributes object
    • code string Required

      A stable, machine-readable error code (e.g., "RULE_NOT_FOUND", "INVALID_SCHEDULE"). Safe for clients to branch on.

    • details object

      Optional structured context (e.g., validation field errors, conflict resource IDs).

      Additional properties are allowed.

    • error string Required

      A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.

    • message string Required

      A human-friendly explanation of the error. Subject to change without notice. Do not parse or rely on its content.
  • 500 application/json

    Indicates an unexpected server-side error.

    Hide response attributes Show response attributes object
    • code string Required

      A stable, machine-readable error code (e.g., "RULE_NOT_FOUND", "INVALID_SCHEDULE"). Safe for clients to branch on.

    • details object

      Optional structured context (e.g., validation field errors, conflict resource IDs).

      Additional properties are allowed.

    • error string Required

      A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.

    • message string Required

      A human-friendly explanation of the error. Subject to change without notice. Do not parse or rely on its content.
  • 503 application/json

    Indicates the alerting engine is disabled by the alerting:v2:enabled advanced setting.

    Hide response attributes Show response attributes object
    • code string Required

      A stable, machine-readable error code (e.g., "RULE_NOT_FOUND", "INVALID_SCHEDULE"). Safe for clients to branch on.

    • details object

      Optional structured context (e.g., validation field errors, conflict resource IDs).

      Additional properties are allowed.

    • error string Required

      A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.

    • message string Required

      A human-friendly explanation of the error. Subject to change without notice. Do not parse or rely on its content.
GET /api/alerting/v2/rules/{id}/history 
curl \
 --request GET 'https://localhost:5601/api/alerting/v2/rules/{id}/history?page=1&per_page=20' \
 --header "Authorization: $API_KEY"
Response examples (200) 
{
  "items": [
    {
      "action": "rule_update",
      "actor": {
        "name": "elastic",
        "profileId": "u_profile_1"
      },
      "changes": {
        "count": 1,
        "summary": {
          "metadata": {
            "name": "Host CPU high"
          }
        }
      },
      "id": "0194f0c8-aaaa-7bbb-8ccc-ddddeeeeffff",
      "isCurrent": true,
      "metadata": {
        "version": 2
      },
      "timestamp": "2026-01-15T12:05:00.000Z"
    },
    {
      "action": "rule_create",
      "actor": {
        "name": "elastic",
        "profileId": "u_profile_1"
      },
      "id": "0194f0c8-1111-7222-8333-444455556666",
      "metadata": {
        "version": 1
      },
      "timestamp": "2026-01-15T12:00:00.000Z"
    }
  ],
  "total": 2
}
Response examples (400) 
{
  "code": "BAD_REQUEST",
  "details": {
    "errors": {
      "page": [
        "page * per_page cannot exceed 10000."
      ]
    }
  },
  "error": "Bad Request",
  "message": "page * per_page cannot exceed 10000."
}
Response examples (401) 
{
  "code": "UNAUTHORIZED",
  "error": "Unauthorized",
  "message": "Authentication required to access this API."
}
Response examples (403) 
{
  "code": "FORBIDDEN",
  "error": "Forbidden",
  "message": "The current user does not have the required privileges for this request."
}
Response examples (500) 
{
  "code": "INTERNAL_SERVER_ERROR",
  "error": "Internal Server Error",
  "message": "An unexpected error occurred."
}
Response examples (503) 
{
  "code": "ALERTING_DISABLED",
  "error": "Service Unavailable",
  "message": "Alerting is disabled."
}
{
  "code": "RULE_CHANGE_HISTORY_UNAVAILABLE",
  "error": "Service Unavailable",
  "message": "Rule change history is unavailable"
}