Create a maintenance window. | Kibana Serverless API documentation

Create a maintenance window. Generally available

POST /api/maintenance_window

Api key auth

Spaces method and path for this operation:

post /s/{space_id}/api/maintenance_window

Refer to Spaces for more information.

[Required authorization] Route required privileges: write-maintenance-window.

Headers

kbn-xsrf string Required

A required header to protect against CSRF attacks

application/json

Body

enabled boolean

Whether the current maintenance window is enabled. Disabled maintenance windows do not suppress notifications.
schedule object Required

Additional properties are NOT allowed.
Hide schedule attribute Show schedule attribute object
- custom object Required
  
  Additional properties are NOT allowed.
  Hide custom attributes Show custom attributes object
  
  duration string Required
  
  The duration of the schedule. It allows values in <integer><unit> format. <unit> is one of d, h, m, or s for hours, minutes, seconds. For example: 1d, 5h, 30m, 5000s.
  
  recurring object
  
  Additional properties are NOT allowed.
  
  Hide recurring attributes Show recurring attributes object
  
  end string
  
  The end date of a recurring schedule, provided in ISO 8601 format and set to the UTC timezone. For example: 2025-04-01T00:00:00.000Z.
  
  every string
  
  The interval and frequency of a recurring schedule. It allows values in <integer><unit> format. <unit> is one of d, w, M, or y for days, weeks, months, years. For example: 15d, 2w, 3m, 1y.
  
  occurrences number
  
  The total number of recurrences of the schedule.
  
  Minimum value is 1.
  
  onMonth array[number]
  
  The specific months for a recurring schedule. Valid values are 1-12.
  
  At least 1 element. Minimum value of each is 1, maximum value of each is 12.
  
  onMonthDay array[number]
  
  The specific days of the month for a recurring schedule. Valid values are 1-31.
  
  At least 1 element. Minimum value of each is 1, maximum value of each is 31.
  
  onWeekDay array[string]
  
  The specific days of the week ([MO,TU,WE,TH,FR,SA,SU]) or nth day of month ([+1MO, -3FR, +2WE, -4SA, -5SU]) for a recurring schedule.
  
  At least 1 element.
  
  start string Required
  
  The start date and time of the schedule, provided in ISO 8601 format and set to the UTC timezone. For example: 2025-03-12T12:00:00.000Z.
  
  timezone string
  
  The timezone of the schedule. The default timezone is UTC.
scope object

Additional properties are NOT allowed.
Hide scope attribute Show scope attribute object
- alerting object Required
  
  Additional properties are NOT allowed.
  Hide alerting attribute Show alerting attribute object
  
  query object Required
  
  Additional properties are NOT allowed.
  
  Hide query attribute Show query attribute object
  
  kql string Required
  
  A filter written in Kibana Query Language (KQL). Only alerts matching this query will be supressed by the maintenance window.
title string Required

The name of the maintenance window. While this name does not have to be unique, a distinctive name can help you identify a specific maintenance window.

Responses

200 application/json

Indicates a successful call.
Hide response attributes Show response attributes object
- created_at string Required
  
  The date and time when the maintenance window was created.
- created_by string | null Required
  
  The identifier for the user that created the maintenance window.
- enabled boolean Required
  
  Whether the current maintenance window is enabled. Disabled maintenance windows do not suppress notifications.
- id string Required
  
  The identifier for the maintenance window.
- schedule object Required
  
  Additional properties are NOT allowed.
  
  Hide schedule attribute Show schedule attribute object
  
  custom object Required
  
  Additional properties are NOT allowed.
  
  Hide custom attributes Show custom attributes object
  
  duration string Required
  
  The duration of the schedule. It allows values in <integer><unit> format. <unit> is one of d, h, m, or s for hours, minutes, seconds. For example: 1d, 5h, 30m, 5000s.
  
  recurring object
  
  Additional properties are NOT allowed.
  
  Hide recurring attributes Show recurring attributes object
  
  end string
  
  The end date of a recurring schedule, provided in ISO 8601 format and set to the UTC timezone. For example: 2025-04-01T00:00:00.000Z.
  
  every string
  
  The interval and frequency of a recurring schedule. It allows values in <integer><unit> format. <unit> is one of d, w, M, or y for days, weeks, months, years. For example: 15d, 2w, 3m, 1y.
  
  occurrences number
  
  The total number of recurrences of the schedule.
  
  onMonth array[number]
  
  The specific months for a recurring schedule. Valid values are 1-12.
  
  onMonthDay array[number]
  
  The specific days of the month for a recurring schedule. Valid values are 1-31.
  
  onWeekDay array[string]
  
  The specific days of the week ([MO,TU,WE,TH,FR,SA,SU]) or nth day of month ([+1MO, -3FR, +2WE, -4SA, -5SU]) for a recurring schedule.
  
  start string Required
  
  The start date and time of the schedule, provided in ISO 8601 format and set to the UTC timezone. For example: 2025-03-12T12:00:00.000Z.
  
  timezone string
  
  The timezone of the schedule. The default timezone is UTC.
- scope object
  
  Additional properties are NOT allowed.
  
  Hide scope attribute Show scope attribute object
  
  alerting object Required
  
  Additional properties are NOT allowed.
  
  Hide alerting attribute Show alerting attribute object
  
  query object Required
  
  Additional properties are NOT allowed.
  
  Hide query attribute Show query attribute object
  
  kql string Required
  
  A filter written in Kibana Query Language (KQL).
- status string Required
  
  The current status of the maintenance window.
  
  Values are running, upcoming, finished, archived, or disabled.
- title string Required
  
  The name of the maintenance window.
- updated_at string Required
  
  The date and time when the maintenance window was last updated.
- updated_by string | null Required
  
  The identifier for the user that last updated this maintenance window.
400

Indicates an invalid schema or parameters.
403

Indicates that this call is forbidden.

POST /api/maintenance_window

curl \
 --request POST 'https://<KIBANA_URL>/api/maintenance_window' \
 --header "Authorization: $API_KEY" \
 --header "Content-Type: application/json" \
 --header "kbn-xsrf: true" \
 --data '{"enabled":true,"schedule":{"custom":{"duration":"2h","recurring":{"every":"1w","occurrences":10,"onWeekDay":["MO","WE"]},"start":"2025-03-01T08:00:00.000Z","timezone":"Europe/Amsterdam"}},"scope":{"alerting":{"query":{"kql":"kibana.alert.tags: \"infra\""}}},"title":"Weekly Maintenance Window"}'

Request example

Create a maintenance window that recurs every week on Monday and Wednesday for two hours, with a scope that filters specific alerts using a KQL query.

{
  "enabled": true,
  "schedule": {
    "custom": {
      "duration": "2h",
      "recurring": {
        "every": "1w",
        "occurrences": 10,
        "onWeekDay": [
          "MO",
          "WE"
        ]
      },
      "start": "2025-03-01T08:00:00.000Z",
      "timezone": "Europe/Amsterdam"
    }
  },
  "scope": {
    "alerting": {
      "query": {
        "kql": "kibana.alert.tags: \"infra\""
      }
    }
  },
  "title": "Weekly Maintenance Window"
}

Response examples (200)

The response returned when a maintenance window is successfully created.

{
  "created_at": "2025-02-25T10:00:00.000Z",
  "created_by": "elastic",
  "enabled": true,
  "id": "f0cb1780-537a-4e34-8adf-3b4336862858",
  "schedule": {
    "custom": {
      "duration": "2h",
      "recurring": {
        "every": "1w",
        "occurrences": 10,
        "onWeekDay": [
          "MO",
          "WE"
        ]
      },
      "start": "2025-03-01T08:00:00.000Z",
      "timezone": "Europe/Amsterdam"
    }
  },
  "scope": {
    "alerting": {
      "query": {
        "kql": "kibana.alert.tags: \"infra\""
      }
    }
  },
  "status": "upcoming",
  "title": "Weekly Maintenance Window",
  "updated_at": "2025-02-25T10:00:00.000Z",
  "updated_by": "elastic"
}