Bulk assign alert episodes | Kibana API documentation

Bulk assign alert episodes Experimental; added in 9.5.0

POST /api/alerting/v2/episodes/_bulk_assign

Spaces method and path for this operation:

post /s/{space_id}/api/alerting/v2/episodes/_bulk_assign

Refer to Spaces for more information.

Create the same action for multiple alert episodes in a single request.

[Required authorization] Route required privileges: manage_alerting-v2-alerts.

Headers

kbn-xsrf string Required

A required header to protect against CSRF attacks

application/json

Body

items array[object] Required

List of 1 to 100 assign actions to create.

At least 1 but not more than 100 elements.
Hide items attributes Show items attributes object
- assignee_uid string | null Required
  
  User profile UID of the assignee, or null to remove the assignee from the episode.
  
  Maximum length is 256.
- episode_id string Required
  
  Identifier of the alert episode to apply the action to.
  
  Minimum length is 1, maximum length is 150.

Responses

200 application/json

Returns the number of created actions and per-item errors for actions that were not created.
Hide response attributes Show response attributes object
- affected_count integer Required
  
  Number of resources the operation successfully touched.
  
  Minimum value is 0, maximum value is 9007199254740991.
- errors array[object] Required
  
  Errors encountered during the operation.
  
  Hide errors attributes Show errors attributes object
  
  error object Required
  
  Hide error attributes Show error attributes object
  
  code string Required
  
  Stable error code you can branch on, for example INVALID_SCHEDULE or RULE_ALREADY_EXISTS.
  
  details object
  
  Optional extra information about the error, for example field validation issues or the rule_id when that ID already exists.
  
  Additional properties are allowed.
  
  message string Required
  
  A readable explanation of the error. The wording can change without notice. Do not parse this field.
  
  id string Required
  
  The identifier of the resource that failed.
400 application/json

Indicates an invalid schema or parameters.
Hide response attributes Show response attributes object
- code string Required
  
  Stable error code you can branch on, for example INVALID_SCHEDULE or RULE_ALREADY_EXISTS.
- details object
  
  Optional extra information about the error, for example field validation issues or the rule_id when that ID already exists.
  
  Additional properties are allowed.
- error string Required
  
  A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.
- message string Required
  
  A readable explanation of the error. The wording can change without notice. Do not parse this field.
401 application/json

Indicates the request was not authenticated.
Hide response attributes Show response attributes object
- code string Required
  
  Stable error code you can branch on, for example INVALID_SCHEDULE or RULE_ALREADY_EXISTS.
- details object
  
  Optional extra information about the error, for example field validation issues or the rule_id when that ID already exists.
  
  Additional properties are allowed.
- error string Required
  
  A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.
- message string Required
  
  A readable explanation of the error. The wording can change without notice. Do not parse this field.
403 application/json

Indicates the user does not have the required privileges to perform the request.
Hide response attributes Show response attributes object
- code string Required
  
  Stable error code you can branch on, for example INVALID_SCHEDULE or RULE_ALREADY_EXISTS.
- details object
  
  Optional extra information about the error, for example field validation issues or the rule_id when that ID already exists.
  
  Additional properties are allowed.
- error string Required
  
  A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.
- message string Required
  
  A readable explanation of the error. The wording can change without notice. Do not parse this field.
500 application/json

Indicates an unexpected server-side error.
Hide response attributes Show response attributes object
- code string Required
  
  Stable error code you can branch on, for example INVALID_SCHEDULE or RULE_ALREADY_EXISTS.
- details object
  
  Optional extra information about the error, for example field validation issues or the rule_id when that ID already exists.
  
  Additional properties are allowed.
- error string Required
  
  A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.
- message string Required
  
  A readable explanation of the error. The wording can change without notice. Do not parse this field.
503 application/json

Indicates the alerting engine is disabled by the alerting:v2:enabled advanced setting.
Hide response attributes Show response attributes object
- code string Required
  
  Stable error code you can branch on, for example INVALID_SCHEDULE or RULE_ALREADY_EXISTS.
- details object
  
  Optional extra information about the error, for example field validation issues or the rule_id when that ID already exists.
  
  Additional properties are allowed.
- error string Required
  
  A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.
- message string Required
  
  A readable explanation of the error. The wording can change without notice. Do not parse this field.

POST /api/alerting/v2/episodes/_bulk_assign

curl \
 --request POST 'https://localhost:5601/api/alerting/v2/episodes/_bulk_assign' \
 --header "Authorization: $API_KEY" \
 --header "Content-Type: application/json" \
 --header "kbn-xsrf: true" \
 --data '{
  "items": [
    {
      "assignee_uid": "u_abc123",
      "episode_id": "episode-1"
    },
    {
      "assignee_uid": null,
      "episode_id": "episode-2"
    }
  ]
}'

Request example

{
  "items": [
    {
      "assignee_uid": "u_abc123",
      "episode_id": "episode-1"
    },
    {
      "assignee_uid": null,
      "episode_id": "episode-2"
    }
  ]
}

Response examples (200)

{
  "affected_count": 2,
  "errors": []
}

Response examples (400)

{
  "code": "BAD_REQUEST",
  "details": {
    "errors": {
      "items": [
        "At least one action must be provided"
      ]
    }
  },
  "error": "Bad Request",
  "message": "items: At least one action must be provided"
}

Response examples (401)

{
  "code": "UNAUTHORIZED",
  "error": "Unauthorized",
  "message": "Authentication required to access this API."
}

Response examples (403)

{
  "code": "FORBIDDEN",
  "error": "Forbidden",
  "message": "The current user does not have the required privileges for this request."
}

Response examples (500)

{
  "code": "INTERNAL_SERVER_ERROR",
  "error": "Internal Server Error",
  "message": "An unexpected error occurred."
}

Response examples (503)

{
  "code": "ALERTING_DISABLED",
  "error": "Service Unavailable",
  "message": "Alerting is disabled."
}