Bulk create alert actions | Kibana API documentation

Bulk create alert actions Experimental; added in 9.5.0

POST /api/alerting/v2/alerts/_bulk_action

Spaces method and path for this operation:

post /s/{space_id}/api/alerting/v2/alerts/_bulk_action

Refer to Spaces for more information.

Create actions for multiple alert groups in a single request.

[Required authorization] Route required privileges: manage_alerting-v2-alerts.

Headers

kbn-xsrf string Required

A required header to protect against CSRF attacks

application/json

Body

action_type Required Discriminator

Deactivates an alert.
episode_id string Required

The episode identifier to assign.

Minimum length is 1, maximum length is 150.
assignee_uid string | null Required

User profile UID of the assignee, or null to remove the assignee from the episode.

Maximum length is 256.
tags array[string] Required

List of tags to add to the alert.

Not more than 20 elements. Minimum length of each is 1, maximum length of each is 128.
expiry string(date-time)

ISO datetime when snooze should expire.

Format should match the following pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$.
reason string Required

Reason for deactivating the alert.

Minimum length is 1, maximum length is 1024.
group_hash string Required

Hash identifying the alert group to apply the action to.

Minimum length is 1, maximum length is 256.

Responses

200 application/json

Returns the number of created actions and per-item errors for actions that were not created.
Hide response attributes Show response attributes object
- affected_count integer Required
  
  Number of resources the operation successfully touched.
  
  Minimum value is 0, maximum value is 9007199254740991.
- errors array[object] Required
  
  Errors encountered during the operation.
  
  Hide errors attributes Show errors attributes object
  
  error object Required
  
  Hide error attributes Show error attributes object
  
  code string Required
  
  A stable, machine-readable error code (e.g., "RULE_NOT_FOUND", "INVALID_SCHEDULE"). Safe for clients to branch on.
  
  details object
  
  Optional structured context (e.g., validation field errors, conflict resource IDs).
  
  Additional properties are allowed.
  
  message string Required
  
  A human-friendly explanation of the error. Subject to change without notice. Do not parse or rely on its content.
  
  id string Required
  
  The identifier of the resource that failed.
400 application/json

Indicates an invalid schema or parameters.
Hide response attributes Show response attributes object
- code string Required
  
  A stable, machine-readable error code (e.g., "RULE_NOT_FOUND", "INVALID_SCHEDULE"). Safe for clients to branch on.
- details object
  
  Optional structured context (e.g., validation field errors, conflict resource IDs).
  
  Additional properties are allowed.
- error string Required
  
  A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.
- message string Required
  
  A human-friendly explanation of the error. Subject to change without notice. Do not parse or rely on its content.
401 application/json

Indicates the request was not authenticated.
Hide response attributes Show response attributes object
- code string Required
  
  A stable, machine-readable error code (e.g., "RULE_NOT_FOUND", "INVALID_SCHEDULE"). Safe for clients to branch on.
- details object
  
  Optional structured context (e.g., validation field errors, conflict resource IDs).
  
  Additional properties are allowed.
- error string Required
  
  A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.
- message string Required
  
  A human-friendly explanation of the error. Subject to change without notice. Do not parse or rely on its content.
403 application/json

Indicates the user does not have the required privileges to perform the request.
Hide response attributes Show response attributes object
- code string Required
  
  A stable, machine-readable error code (e.g., "RULE_NOT_FOUND", "INVALID_SCHEDULE"). Safe for clients to branch on.
- details object
  
  Optional structured context (e.g., validation field errors, conflict resource IDs).
  
  Additional properties are allowed.
- error string Required
  
  A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.
- message string Required
  
  A human-friendly explanation of the error. Subject to change without notice. Do not parse or rely on its content.
500 application/json

Indicates an unexpected server-side error.
Hide response attributes Show response attributes object
- code string Required
  
  A stable, machine-readable error code (e.g., "RULE_NOT_FOUND", "INVALID_SCHEDULE"). Safe for clients to branch on.
- details object
  
  Optional structured context (e.g., validation field errors, conflict resource IDs).
  
  Additional properties are allowed.
- error string Required
  
  A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.
- message string Required
  
  A human-friendly explanation of the error. Subject to change without notice. Do not parse or rely on its content.
503 application/json

Indicates the alerting engine is disabled by the alerting:v2:enabled advanced setting.
Hide response attributes Show response attributes object
- code string Required
  
  A stable, machine-readable error code (e.g., "RULE_NOT_FOUND", "INVALID_SCHEDULE"). Safe for clients to branch on.
- details object
  
  Optional structured context (e.g., validation field errors, conflict resource IDs).
  
  Additional properties are allowed.
- error string Required
  
  A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.
- message string Required
  
  A human-friendly explanation of the error. Subject to change without notice. Do not parse or rely on its content.

POST /api/alerting/v2/alerts/_bulk_action

curl \
 --request POST 'https://localhost:5601/api/alerting/v2/alerts/_bulk_action' \
 --header "Authorization: $API_KEY" \
 --header "Content-Type: application/json" \
 --header "kbn-xsrf: true" \
 --data '"[\n  {\n    \"action_type\": \"ack\",\n    \"episode_id\": \"episode-1\",\n    \"group_hash\": \"group-hash-1\"\n  },\n  {\n    \"action_type\": \"tag\",\n    \"group_hash\": \"group-hash-2\",\n    \"tags\": [\n      \"production\"\n    ]\n  }\n]"'

Request example

[
  {
    "action_type": "ack",
    "episode_id": "episode-1",
    "group_hash": "group-hash-1"
  },
  {
    "action_type": "tag",
    "group_hash": "group-hash-2",
    "tags": [
      "production"
    ]
  }
]

Response examples (200)

{
  "affected_count": 2,
  "errors": []
}

Response examples (400)

{
  "code": "BAD_REQUEST",
  "details": {
    "errors": {
      "": [
        "At least one action must be provided"
      ]
    }
  },
  "error": "Bad Request",
  "message": "At least one action must be provided"
}

Response examples (401)

{
  "code": "UNAUTHORIZED",
  "error": "Unauthorized",
  "message": "Authentication required to access this API."
}

Response examples (403)

{
  "code": "FORBIDDEN",
  "error": "Forbidden",
  "message": "The current user does not have the required privileges for this request."
}

Response examples (500)

{
  "code": "INTERNAL_SERVER_ERROR",
  "error": "Internal Server Error",
  "message": "An unexpected error occurred."
}

Response examples (503)

{
  "code": "ALERTING_DISABLED",
  "error": "Service Unavailable",
  "message": "Alerting is disabled."
}