openapi: 3.2.0
info:
  contact:
    name: Kibana Team
  description: 'The Kibana REST APIs enable you to manage resources such as connectors, data views, and saved objects.

    The API calls are stateless.

    Each request that you make happens in isolation from other calls and must include all of the necessary information for Kibana to fulfill the

    request.

    API requests return JSON output, which is a format that is machine-readable and works well for automation.


    To interact with Kibana APIs, use the following operations:


    - GET: Fetches the information.

    - PATCH: Applies partial modifications to the existing information.

    - POST: Adds new information.

    - PUT: Updates the existing information.

    - DELETE: Removes the information.


    You can prepend any Kibana API endpoint with `kbn:` and run the request in **Dev Tools → Console**.

    For example:


    ```

    GET kbn:/api/data_views

    ```


    For more information about the console, refer to [Run API requests](https://www.elastic.co/docs/explore-analyze/query-filter/tools/console).


    NOTE: Access to internal Kibana API endpoints will be restricted in Kibana version 9.0. Please move any integrations to publicly documented APIs.


    ## Documentation source and versions


    This documentation is derived from the `main` branch of the [kibana](https://github.com/elastic/kibana) repository.

    It is provided under license [Attribution-NonCommercial-NoDerivatives 4.0 International](https://creativecommons.org/licenses/by-nc-nd/4.0/).


    This documentation contains work-in-progress information for future Elastic Stack releases.

    '
  title: Kibana Alerting V2 API
  version: ''
  x-doc-license:
    name: Attribution-NonCommercial-NoDerivatives 4.0 International
    url: https://creativecommons.org/licenses/by-nc-nd/4.0/
  x-feedbackLink:
    label: Feedback
    url: https://github.com/elastic/docs-content/issues/new?assignees=&labels=feedback%2Ccommunity&projects=&template=api-feedback.yaml&title=%5BFeedback%5D%3A+
servers:
- url: https://{kibana_url}
  variables:
    kibana_url:
      default: localhost:5601
security:
- apiKeyAuth: []
- basicAuth: []
tags:
- name: alerting-v2
  description: 'Alerting V2 is an ES|QL-first alerting API for managing rules, alert actions, and action policies. Use these endpoints to create and manage detection rules, act on alerts, and control when and how notifications are delivered. These APIs are experimental.

    '
  x-displayName: Alerting V2
paths:
  /api/alerting/v2/action_policies:
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/v2/action_policies</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Get a paginated list of action policies with optional filtering and sorting.<br/><br/>[Required authorization] Route required privileges: read_alerting-v2-action-policies.'
      operationId: get-alerting-v2-action-policies
      parameters:
      - description: The page number to return. Defaults to 1.
        in: query
        name: page
        required: false
        schema:
          minimum: 1
          type: number
      - description: The number of action policies to return per page. Defaults to 20.
        in: query
        name: per_page
        required: false
        schema:
          maximum: 100
          minimum: 1
          type: number
      - description: A text string to search across action policy fields.
        in: query
        name: search
        required: false
        schema:
          maxLength: 256
          minLength: 1
          type: string
      - description: Filter by tags. Accepts a single string or an array.
        in: query
        name: tags
        required: false
        schema:
          items:
            maxLength: 128
            minLength: 1
            type: string
          maxItems: 10
          type: array
      - description: Filter by enabled status. Accepts the strings true or false.
        in: query
        name: enabled
        required: false
        schema:
          enum:
          - 'true'
          - 'false'
          type: string
      - description: The field to sort action policies by.
        in: query
        name: sort_field
        required: false
        schema:
          enum:
          - name
          - created_at
          - updated_at
          type: string
      - description: The sort direction.
        in: query
        name: sort_order
        required: false
        schema:
          enum:
          - asc
          - desc
          type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                listActionPoliciesResponse:
                  summary: A page of action policies
                  value:
                    items:
                    - auth:
                        created_by_user: true
                        owner: elastic
                      created_at: '2026-01-15T12:00:00.000Z'
                      created_by: elastic
                      description: Sends a workflow notification when matching host alerts fire.
                      destinations:
                      - id: workflow-1
                        type: workflow
                      enabled: true
                      group_by: null
                      grouping_mode: per_episode
                      id: action-policy-1
                      matcher: 'host.name: "web-*"'
                      name: Notify on host alerts
                      snoozed_until: null
                      tags:
                      - production
                      throttle:
                        interval: null
                        strategy: on_status_change
                      updated_at: '2026-01-15T12:00:00.000Z'
                      updated_by: elastic
                      version: WzAsMV0=
                    page: 1
                    per_page: 20
                    total: 1
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_action_policy_list_response'
          description: Returns a paginated list of action policies.
        '400':
          content:
            application/json:
              examples:
                invalidRequest:
                  summary: Indicates an invalid schema or parameters.
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        errors: []
                        properties:
                          page:
                            errors:
                            - 'Too small: expected number to be >=1'
                    error: Bad Request
                    message: 'page: Too small: expected number to be >=1'
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an invalid schema or parameters.
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the request was not authenticated.
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the user does not have the required privileges to perform the request.
        '500':
          content:
            application/json:
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an unexpected server-side error.
        '503':
          content:
            application/json:
              examples:
                alertingDisabled:
                  summary: Alerting engine is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
      summary: List action policies
      tags:
      - alerting-v2
      x-state: Experimental; added in 9.5.0
      x-metaTags:
      - content: Kibana
        name: product_name
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/v2/action_policies</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Creates an action policy with a server-generated identifier. To create or replace an action policy with a client-supplied identifier, use PUT /api/alerting/v2/action_policies/.<br/><br/>[Required authorization] Route required privileges: manage_alerting-v2-action-policies AND read_alerting-v2-rules.'
      operationId: post-alerting-v2-action-policies
      parameters:
      - description: A required header to protect against CSRF attacks
        in: header
        name: kbn-xsrf
        required: true
        schema:
          example: 'true'
          type: string
      requestBody:
        content:
          application/json:
            examples:
              createActionPolicyRequest:
                summary: Workflow notification for matching host alerts
                value:
                  description: Sends a workflow notification when matching host alerts fire.
                  destinations:
                  - id: workflow-1
                    type: workflow
                  grouping_mode: per_episode
                  matcher: 'host.name: "web-*"'
                  name: Notify on host alerts
                  tags:
                  - production
                  throttle:
                    strategy: on_status_change
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_new_action_policy'
      responses:
        '201':
          content:
            application/json:
              examples:
                createActionPolicyResponse:
                  summary: Newly created action policy
                  value:
                    auth:
                      created_by_user: true
                      owner: elastic
                    created_at: '2026-01-15T12:00:00.000Z'
                    created_by: elastic
                    description: Sends a workflow notification when matching host alerts fire.
                    destinations:
                    - id: workflow-1
                      type: workflow
                    enabled: true
                    group_by: null
                    grouping_mode: per_episode
                    id: action-policy-1
                    matcher: 'host.name: "web-*"'
                    name: Notify on host alerts
                    snoozed_until: null
                    tags:
                    - production
                    throttle:
                      interval: null
                      strategy: on_status_change
                    updated_at: '2026-01-15T12:00:00.000Z'
                    updated_by: elastic
                    version: WzAsMV0=
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_action_policy_response'
          description: Returns the newly created action policy.
        '400':
          content:
            application/json:
              examples:
                invalidRequest:
                  summary: Indicates an invalid schema or parameters.
                  value:
                    code: INVALID_ACTION_POLICY_DATA
                    details:
                      context: create
                      errors:
                        errors: []
                        properties:
                          name:
                            errors:
                            - 'Invalid input: expected string, received undefined'
                    error: Bad Request
                    message: 'Error validating create action policy data - name: Invalid input: expected string, received undefined'
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an invalid schema or parameters.
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the request was not authenticated.
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the user does not have the required privileges to perform the request.
        '500':
          content:
            application/json:
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an unexpected server-side error.
        '503':
          content:
            application/json:
              examples:
                alertingDisabled:
                  summary: Alerting engine is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
      summary: Create an action policy
      tags:
      - alerting-v2
      x-state: Experimental; added in 9.5.0
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/alerting/v2/action_policies/_bulk_delete:
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/v2/action_policies/_bulk_delete</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        [Required authorization] Route required privileges: manage_alerting-v2-action-policies.'
      operationId: post-alerting-v2-action-policies-bulk-delete
      parameters:
      - description: A required header to protect against CSRF attacks
        in: header
        name: kbn-xsrf
        required: true
        schema:
          example: 'true'
          type: string
      requestBody:
        content:
          application/json:
            examples:
              bulkDeleteActionPoliciesRequest:
                summary: Delete two action policies by ID
                value:
                  ids:
                  - action-policy-1
                  - action-policy-2
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_by_ids_request'
      responses:
        '200':
          content:
            application/json:
              examples:
                bulkDeleteActionPoliciesResponse:
                  summary: All targeted policies deleted
                  value:
                    affected_count: 2
                    errors: []
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_operation_response'
          description: Returns the result of the bulk delete operation.
        '400':
          content:
            application/json:
              examples:
                invalidRequest:
                  summary: Indicates an invalid schema or parameters.
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        errors: []
                        properties:
                          ids:
                            errors:
                            - 'Invalid input: expected array, received undefined'
                    error: Bad Request
                    message: 'ids: Invalid input: expected array, received undefined'
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an invalid schema or parameters.
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the request was not authenticated.
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the user does not have the required privileges to perform the request.
        '500':
          content:
            application/json:
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an unexpected server-side error.
        '503':
          content:
            application/json:
              examples:
                alertingDisabled:
                  summary: Alerting engine is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
      summary: Delete action policies in bulk by ID
      tags:
      - alerting-v2
      x-state: Experimental; added in 9.5.0
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/alerting/v2/action_policies/_bulk_disable:
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/v2/action_policies/_bulk_disable</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        [Required authorization] Route required privileges: manage_alerting-v2-action-policies.'
      operationId: post-alerting-v2-action-policies-bulk-disable
      parameters:
      - description: A required header to protect against CSRF attacks
        in: header
        name: kbn-xsrf
        required: true
        schema:
          example: 'true'
          type: string
      requestBody:
        content:
          application/json:
            examples:
              bulkDisableActionPoliciesRequest:
                summary: Disable two action policies by ID
                value:
                  ids:
                  - action-policy-1
                  - action-policy-2
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_by_ids_request'
      responses:
        '200':
          content:
            application/json:
              examples:
                bulkDisableActionPoliciesResponse:
                  summary: All targeted policies disabled
                  value:
                    affected_count: 2
                    errors: []
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_operation_response'
          description: Returns the result of the bulk disable operation.
        '400':
          content:
            application/json:
              examples:
                invalidRequest:
                  summary: Indicates an invalid schema or parameters.
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        errors: []
                        properties:
                          ids:
                            errors:
                            - 'Invalid input: expected array, received undefined'
                    error: Bad Request
                    message: 'ids: Invalid input: expected array, received undefined'
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an invalid schema or parameters.
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the request was not authenticated.
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the user does not have the required privileges to perform the request.
        '500':
          content:
            application/json:
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an unexpected server-side error.
        '503':
          content:
            application/json:
              examples:
                alertingDisabled:
                  summary: Alerting engine is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
      summary: Disable action policies in bulk by ID
      tags:
      - alerting-v2
      x-state: Experimental; added in 9.5.0
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/alerting/v2/action_policies/_bulk_enable:
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/v2/action_policies/_bulk_enable</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        [Required authorization] Route required privileges: manage_alerting-v2-action-policies.'
      operationId: post-alerting-v2-action-policies-bulk-enable
      parameters:
      - description: A required header to protect against CSRF attacks
        in: header
        name: kbn-xsrf
        required: true
        schema:
          example: 'true'
          type: string
      requestBody:
        content:
          application/json:
            examples:
              bulkEnableActionPoliciesRequest:
                summary: Enable two action policies by ID
                value:
                  ids:
                  - action-policy-1
                  - action-policy-2
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_by_ids_request'
      responses:
        '200':
          content:
            application/json:
              examples:
                bulkEnableActionPoliciesResponse:
                  summary: All targeted policies enabled
                  value:
                    affected_count: 2
                    errors: []
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_operation_response'
          description: Returns the result of the bulk enable operation.
        '400':
          content:
            application/json:
              examples:
                invalidRequest:
                  summary: Indicates an invalid schema or parameters.
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        errors: []
                        properties:
                          ids:
                            errors:
                            - 'Invalid input: expected array, received undefined'
                    error: Bad Request
                    message: 'ids: Invalid input: expected array, received undefined'
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an invalid schema or parameters.
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the request was not authenticated.
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the user does not have the required privileges to perform the request.
        '500':
          content:
            application/json:
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an unexpected server-side error.
        '503':
          content:
            application/json:
              examples:
                alertingDisabled:
                  summary: Alerting engine is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
      summary: Enable action policies in bulk by ID
      tags:
      - alerting-v2
      x-state: Experimental; added in 9.5.0
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/alerting/v2/action_policies/_bulk_snooze:
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/v2/action_policies/_bulk_snooze</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        [Required authorization] Route required privileges: manage_alerting-v2-action-policies.'
      operationId: post-alerting-v2-action-policies-bulk-snooze
      parameters:
      - description: A required header to protect against CSRF attacks
        in: header
        name: kbn-xsrf
        required: true
        schema:
          example: 'true'
          type: string
      requestBody:
        content:
          application/json:
            examples:
              bulkSnoozeActionPoliciesRequest:
                summary: Snooze two action policies until a specific timestamp
                value:
                  ids:
                  - action-policy-1
                  - action-policy-2
                  snoozed_until: '2026-01-16T12:00:00.000Z'
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_snooze_action_policies_request'
      responses:
        '200':
          content:
            application/json:
              examples:
                bulkSnoozeActionPoliciesResponse:
                  summary: All targeted policies snoozed
                  value:
                    affected_count: 2
                    errors: []
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_operation_response'
          description: Returns the result of the bulk snooze operation.
        '400':
          content:
            application/json:
              examples:
                invalidRequest:
                  summary: Indicates an invalid schema or parameters.
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        errors: []
                        properties:
                          snoozed_until:
                            errors:
                            - 'Invalid input: expected string, received undefined'
                    error: Bad Request
                    message: 'snoozed_until: Invalid input: expected string, received undefined'
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an invalid schema or parameters.
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the request was not authenticated.
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the user does not have the required privileges to perform the request.
        '500':
          content:
            application/json:
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an unexpected server-side error.
        '503':
          content:
            application/json:
              examples:
                alertingDisabled:
                  summary: Alerting engine is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
      summary: Snooze action policies in bulk by ID
      tags:
      - alerting-v2
      x-state: Experimental; added in 9.5.0
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/alerting/v2/action_policies/_bulk_unsnooze:
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/v2/action_policies/_bulk_unsnooze</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        [Required authorization] Route required privileges: manage_alerting-v2-action-policies.'
      operationId: post-alerting-v2-action-policies-bulk-unsnooze
      parameters:
      - description: A required header to protect against CSRF attacks
        in: header
        name: kbn-xsrf
        required: true
        schema:
          example: 'true'
          type: string
      requestBody:
        content:
          application/json:
            examples:
              bulkUnsnoozeActionPoliciesRequest:
                summary: Cancel snooze for two action policies by ID
                value:
                  ids:
                  - action-policy-1
                  - action-policy-2
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_by_ids_request'
      responses:
        '200':
          content:
            application/json:
              examples:
                bulkUnsnoozeActionPoliciesResponse:
                  summary: All targeted policies unsnoozed
                  value:
                    affected_count: 2
                    errors: []
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_operation_response'
          description: Returns the result of the bulk unsnooze operation.
        '400':
          content:
            application/json:
              examples:
                invalidRequest:
                  summary: Indicates an invalid schema or parameters.
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        errors: []
                        properties:
                          ids:
                            errors:
                            - 'Invalid input: expected array, received undefined'
                    error: Bad Request
                    message: 'ids: Invalid input: expected array, received undefined'
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an invalid schema or parameters.
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the request was not authenticated.
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the user does not have the required privileges to perform the request.
        '500':
          content:
            application/json:
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an unexpected server-side error.
        '503':
          content:
            application/json:
              examples:
                alertingDisabled:
                  summary: Alerting engine is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
      summary: Cancel snooze for action policies in bulk by ID
      tags:
      - alerting-v2
      x-state: Experimental; added in 9.5.0
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/alerting/v2/action_policies/_bulk_update_api_key:
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/v2/action_policies/_bulk_update_api_key</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        [Required authorization] Route required privileges: manage_alerting-v2-action-policies.'
      operationId: post-alerting-v2-action-policies-bulk-update-api-key
      parameters:
      - description: A required header to protect against CSRF attacks
        in: header
        name: kbn-xsrf
        required: true
        schema:
          example: 'true'
          type: string
      requestBody:
        content:
          application/json:
            examples:
              bulkUpdateApiKeyActionPoliciesRequest:
                summary: Rotate API keys for two action policies by ID
                value:
                  ids:
                  - action-policy-1
                  - action-policy-2
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_by_ids_request'
      responses:
        '200':
          content:
            application/json:
              examples:
                bulkUpdateApiKeyActionPoliciesResponse:
                  summary: All targeted policies had their API keys rotated
                  value:
                    affected_count: 2
                    errors: []
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_operation_response'
          description: Returns the result of the bulk API key rotation.
        '400':
          content:
            application/json:
              examples:
                invalidRequest:
                  summary: Indicates an invalid schema or parameters.
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        errors: []
                        properties:
                          ids:
                            errors:
                            - 'Invalid input: expected array, received undefined'
                    error: Bad Request
                    message: 'ids: Invalid input: expected array, received undefined'
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an invalid schema or parameters.
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the request was not authenticated.
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the user does not have the required privileges to perform the request.
        '500':
          content:
            application/json:
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an unexpected server-side error.
        '503':
          content:
            application/json:
              examples:
                alertingDisabled:
                  summary: Alerting engine is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
      summary: Rotate API keys for action policies in bulk by ID
      tags:
      - alerting-v2
      x-state: Experimental; added in 9.5.0
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/alerting/v2/action_policies/_match_for_rule:
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/v2/action_policies/_match_for_rule</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Returns action policies that match a given rule, categorised as direct, global, or global-filtered.<br/><br/>[Required authorization] Route required privileges: read_alerting-v2-action-policies.'
      operationId: post-alerting-v2-action-policies-match-for-rule
      parameters:
      - description: A required header to protect against CSRF attacks
        in: header
        name: kbn-xsrf
        required: true
        schema:
          example: 'true'
          type: string
      requestBody:
        content:
          application/json:
            examples:
              matchActionPoliciesForRuleRequest:
                summary: Rule to match action policies against
                value:
                  rule:
                    id: rule-1
                    name: Host CPU high
                    tags:
                    - production
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_match_action_policies_for_rule_request'
      responses:
        '200':
          content:
            application/json:
              examples:
                matchActionPoliciesForRuleResponse:
                  summary: Action policies matching the rule
                  value:
                    items:
                    - actionPolicy:
                        auth:
                          created_by_user: true
                          owner: elastic
                        created_at: '2026-01-15T12:00:00.000Z'
                        created_by: elastic
                        description: Sends a workflow notification when matching host alerts fire.
                        destinations:
                        - id: workflow-1
                          type: workflow
                        enabled: true
                        group_by: null
                        grouping_mode: per_episode
                        id: action-policy-1
                        matcher: 'host.name: "web-*"'
                        name: Notify on host alerts
                        snoozed_until: null
                        tags:
                        - production
                        throttle:
                          interval: null
                          strategy: on_status_change
                        updated_at: '2026-01-15T12:00:00.000Z'
                        updated_by: elastic
                        version: WzAsMV0=
                      category: global-filtered
                    total: 1
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_match_action_policies_for_rule_response'
          description: Indicates a successful call.
        '400':
          content:
            application/json:
              examples:
                invalidRequest:
                  summary: Indicates an invalid schema or parameters.
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        errors: []
                        properties:
                          rule:
                            errors:
                            - 'Invalid input: expected object, received undefined'
                    error: Bad Request
                    message: 'rule: Invalid input: expected object, received undefined'
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an invalid schema or parameters.
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the request was not authenticated.
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the user does not have the required privileges to perform the request.
        '500':
          content:
            application/json:
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an unexpected server-side error.
        '503':
          content:
            application/json:
              examples:
                alertingDisabled:
                  summary: Alerting engine is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
      summary: Match action policies for a rule
      tags:
      - alerting-v2
      x-state: Experimental; added in 9.5.0
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/alerting/v2/action_policies/{id}:
    delete:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb delete">delete</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/v2/action_policies/{id}</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Delete an action policy by identifier.<br/><br/>[Required authorization] Route required privileges: manage_alerting-v2-action-policies.'
      operationId: delete-alerting-v2-action-policies-id
      parameters:
      - description: A required header to protect against CSRF attacks
        in: header
        name: kbn-xsrf
        required: true
        schema:
          example: 'true'
          type: string
      - description: The action policy identifier.
        in: path
        name: id
        required: true
        schema:
          maxLength: 150
          minLength: 1
          type: string
      responses:
        '204':
          description: The action policy was deleted successfully.
        '400':
          content:
            application/json:
              examples:
                invalidRequest:
                  summary: Indicates an invalid schema or parameters.
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        errors: []
                        properties:
                          page:
                            errors:
                            - 'Too small: expected number to be >=1'
                    error: Bad Request
                    message: 'page: Too small: expected number to be >=1'
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the request failed schema validation.
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the request was not authenticated.
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the user does not have the required privileges to perform the request.
        '404':
          content:
            application/json:
              examples:
                actionPolicyNotFound:
                  summary: Indicates an action policy with the given ID does not exist.
                  value:
                    code: ACTION_POLICY_NOT_FOUND
                    details:
                      action_policy_id: action-policy-1
                    error: Not Found
                    message: Action policy with id "action-policy-1" not found
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an action policy with the given ID does not exist.
        '500':
          content:
            application/json:
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an unexpected server-side error.
        '503':
          content:
            application/json:
              examples:
                alertingDisabled:
                  summary: Alerting engine is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
      summary: Delete an action policy
      tags:
      - alerting-v2
      x-state: Experimental; added in 9.5.0
      x-metaTags:
      - content: Kibana
        name: product_name
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/v2/action_policies/{id}</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Get an action policy by identifier.<br/><br/>[Required authorization] Route required privileges: read_alerting-v2-action-policies.'
      operationId: get-alerting-v2-action-policies-id
      parameters:
      - description: The action policy identifier.
        in: path
        name: id
        required: true
        schema:
          maxLength: 150
          minLength: 1
          type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                getActionPolicyResponse:
                  summary: An action policy
                  value:
                    auth:
                      created_by_user: true
                      owner: elastic
                    created_at: '2026-01-15T12:00:00.000Z'
                    created_by: elastic
                    description: Sends a workflow notification when matching host alerts fire.
                    destinations:
                    - id: workflow-1
                      type: workflow
                    enabled: true
                    group_by: null
                    grouping_mode: per_episode
                    id: action-policy-1
                    matcher: 'host.name: "web-*"'
                    name: Notify on host alerts
                    snoozed_until: null
                    tags:
                    - production
                    throttle:
                      interval: null
                      strategy: on_status_change
                    updated_at: '2026-01-15T12:00:00.000Z'
                    updated_by: elastic
                    version: WzAsMV0=
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_action_policy_response'
          description: Returns the requested action policy.
        '400':
          content:
            application/json:
              examples:
                invalidRequest:
                  summary: Indicates an invalid schema or parameters.
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        errors: []
                        properties:
                          page:
                            errors:
                            - 'Too small: expected number to be >=1'
                    error: Bad Request
                    message: 'page: Too small: expected number to be >=1'
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the request failed schema validation.
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the request was not authenticated.
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the user does not have the required privileges to perform the request.
        '404':
          content:
            application/json:
              examples:
                actionPolicyNotFound:
                  summary: Indicates an action policy with the given ID does not exist.
                  value:
                    code: ACTION_POLICY_NOT_FOUND
                    details:
                      action_policy_id: action-policy-1
                    error: Not Found
                    message: Action policy with id "action-policy-1" not found
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an action policy with the given ID does not exist.
        '500':
          content:
            application/json:
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an unexpected server-side error.
        '503':
          content:
            application/json:
              examples:
                alertingDisabled:
                  summary: Alerting engine is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
      summary: Get an action policy
      tags:
      - alerting-v2
      x-state: Experimental; added in 9.5.0
      x-metaTags:
      - content: Kibana
        name: product_name
    patch:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb patch">patch</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/v2/action_policies/{id}</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Apply a partial update to an existing action policy. Fields not present in the body are left unchanged.<br/><br/>[Required authorization] Route required privileges: manage_alerting-v2-action-policies.'
      operationId: patch-alerting-v2-action-policies-id
      parameters:
      - description: A required header to protect against CSRF attacks
        in: header
        name: kbn-xsrf
        required: true
        schema:
          example: 'true'
          type: string
      - description: The action policy identifier.
        in: path
        name: id
        required: true
        schema:
          maxLength: 150
          minLength: 1
          type: string
      requestBody:
        content:
          application/json:
            examples:
              updateActionPolicyRequest:
                summary: Rename and update the description
                value:
                  description: Updated description.
                  name: Notify on host alerts (updated)
                  version: WzAsMV0=
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_update_action_policy'
      responses:
        '200':
          content:
            application/json:
              examples:
                updateActionPolicyResponse:
                  summary: Updated action policy
                  value:
                    auth:
                      created_by_user: true
                      owner: elastic
                    created_at: '2026-01-15T12:00:00.000Z'
                    created_by: elastic
                    description: Updated description.
                    destinations:
                    - id: workflow-1
                      type: workflow
                    enabled: true
                    group_by: null
                    grouping_mode: per_episode
                    id: action-policy-1
                    matcher: 'host.name: "web-*"'
                    name: Notify on host alerts (updated)
                    snoozed_until: null
                    tags:
                    - production
                    throttle:
                      interval: null
                      strategy: on_status_change
                    updated_at: '2026-01-15T12:00:00.000Z'
                    updated_by: elastic
                    version: WzAsMV0=
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_action_policy_response'
          description: Returns the updated action policy.
        '400':
          content:
            application/json:
              examples:
                invalidRequest:
                  summary: Indicates an invalid schema or parameters.
                  value:
                    code: INVALID_ACTION_POLICY_DATA
                    details:
                      context: update
                      errors:
                        errors: []
                        properties:
                          name:
                            errors:
                            - 'Invalid input: expected string, received undefined'
                    error: Bad Request
                    message: 'Error validating update action policy data - name: Invalid input: expected string, received undefined'
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an invalid schema or parameters.
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the request was not authenticated.
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the user does not have the required privileges to perform the request.
        '404':
          content:
            application/json:
              examples:
                actionPolicyNotFound:
                  summary: Indicates an action policy with the given ID does not exist.
                  value:
                    code: ACTION_POLICY_NOT_FOUND
                    details:
                      action_policy_id: action-policy-1
                    error: Not Found
                    message: Action policy with id "action-policy-1" not found
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an action policy with the given ID does not exist.
        '409':
          content:
            application/json:
              examples:
                actionPolicyVersionConflict:
                  summary: Indicates the action policy was concurrently updated by another caller.
                  value:
                    code: ACTION_POLICY_VERSION_CONFLICT
                    details:
                      action_policy_id: action-policy-1
                    error: Conflict
                    message: Action policy with id "action-policy-1" has already been updated by another user
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the action policy was concurrently updated by another caller.
        '500':
          content:
            application/json:
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an unexpected server-side error.
        '503':
          content:
            application/json:
              examples:
                alertingDisabled:
                  summary: Alerting engine is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
      summary: Partially update an action policy.
      tags:
      - alerting-v2
      x-state: Experimental; added in 9.5.0
      x-metaTags:
      - content: Kibana
        name: product_name
    put:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb put">put</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/v2/action_policies/{id}</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Creates an action policy with the given identifier, or fully replaces it if one already exists.<br/><br/>[Required authorization] Route required privileges: manage_alerting-v2-action-policies AND read_alerting-v2-rules.'
      operationId: put-alerting-v2-action-policies-id
      parameters:
      - description: A required header to protect against CSRF attacks
        in: header
        name: kbn-xsrf
        required: true
        schema:
          example: 'true'
          type: string
      - description: The identifier for the action policy.
        in: path
        name: id
        required: true
        schema:
          maxLength: 150
          minLength: 1
          type: string
      requestBody:
        content:
          application/json:
            examples:
              upsertActionPolicyRequest:
                summary: Action policy to create or replace at the given id
                value:
                  description: Sends a workflow notification when matching host alerts fire.
                  destinations:
                  - id: workflow-1
                    type: workflow
                  grouping_mode: per_episode
                  matcher: 'host.name: "web-*"'
                  name: Notify on host alerts
                  tags:
                  - production
                  throttle:
                    strategy: on_status_change
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_new_action_policy'
      responses:
        '200':
          content:
            application/json:
              examples:
                upsertActionPolicyReplacedResponse:
                  summary: Replaced an existing action policy
                  value:
                    auth:
                      created_by_user: true
                      owner: elastic
                    created_at: '2026-01-15T12:00:00.000Z'
                    created_by: elastic
                    description: Sends a workflow notification when matching host alerts fire.
                    destinations:
                    - id: workflow-1
                      type: workflow
                    enabled: true
                    group_by: null
                    grouping_mode: per_episode
                    id: action-policy-1
                    matcher: 'host.name: "web-*"'
                    name: Notify on host alerts
                    snoozed_until: null
                    tags:
                    - production
                    throttle:
                      interval: null
                      strategy: on_status_change
                    updated_at: '2026-01-15T12:00:00.000Z'
                    updated_by: elastic
                    version: WzAsMV0=
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_action_policy_response'
          description: Returns the replaced action policy.
        '201':
          content:
            application/json:
              examples:
                upsertActionPolicyCreatedResponse:
                  summary: Created a new action policy
                  value:
                    auth:
                      created_by_user: true
                      owner: elastic
                    created_at: '2026-01-15T12:00:00.000Z'
                    created_by: elastic
                    description: Sends a workflow notification when matching host alerts fire.
                    destinations:
                    - id: workflow-1
                      type: workflow
                    enabled: true
                    group_by: null
                    grouping_mode: per_episode
                    id: action-policy-1
                    matcher: 'host.name: "web-*"'
                    name: Notify on host alerts
                    snoozed_until: null
                    tags:
                    - production
                    throttle:
                      interval: null
                      strategy: on_status_change
                    updated_at: '2026-01-15T12:00:00.000Z'
                    updated_by: elastic
                    version: WzAsMV0=
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_action_policy_response'
          description: Returns the newly created action policy.
        '400':
          content:
            application/json:
              examples:
                invalidRequest:
                  summary: Indicates an invalid schema or parameters.
                  value:
                    code: INVALID_ACTION_POLICY_DATA
                    details:
                      context: upsert
                      errors:
                        errors: []
                        properties:
                          name:
                            errors:
                            - 'Invalid input: expected string, received undefined'
                    error: Bad Request
                    message: 'Error validating upsert action policy data - name: Invalid input: expected string, received undefined'
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an invalid schema or parameters.
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the request was not authenticated.
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the user does not have the required privileges to perform the request.
        '404':
          content:
            application/json:
              examples:
                actionPolicyNotFound:
                  summary: Indicates an action policy with the given ID does not exist.
                  value:
                    code: ACTION_POLICY_NOT_FOUND
                    details:
                      action_policy_id: action-policy-1
                    error: Not Found
                    message: Action policy with id "action-policy-1" not found
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an action policy with the given ID does not exist.
        '409':
          content:
            application/json:
              examples:
                actionPolicyVersionConflict:
                  summary: Indicates the action policy was concurrently updated by another caller.
                  value:
                    code: ACTION_POLICY_VERSION_CONFLICT
                    details:
                      action_policy_id: action-policy-1
                    error: Conflict
                    message: Action policy with id "action-policy-1" has already been updated by another user
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the action policy was created or updated concurrently by another caller.
        '500':
          content:
            application/json:
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an unexpected server-side error.
        '503':
          content:
            application/json:
              examples:
                alertingDisabled:
                  summary: Alerting engine is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
      summary: Create or replace an action policy
      tags:
      - alerting-v2
      x-state: Experimental; added in 9.5.0
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/alerting/v2/action_policies/{id}/_disable:
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/v2/action_policies/{id}/_disable</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Disable an action policy by identifier.<br/><br/>[Required authorization] Route required privileges: manage_alerting-v2-action-policies.'
      operationId: post-alerting-v2-action-policies-id-disable
      parameters:
      - description: A required header to protect against CSRF attacks
        in: header
        name: kbn-xsrf
        required: true
        schema:
          example: 'true'
          type: string
      - description: The action policy identifier.
        in: path
        name: id
        required: true
        schema:
          maxLength: 150
          minLength: 1
          type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                disableActionPolicyResponse:
                  summary: Disabled action policy
                  value:
                    auth:
                      created_by_user: true
                      owner: elastic
                    created_at: '2026-01-15T12:00:00.000Z'
                    created_by: elastic
                    description: Sends a workflow notification when matching host alerts fire.
                    destinations:
                    - id: workflow-1
                      type: workflow
                    enabled: false
                    group_by: null
                    grouping_mode: per_episode
                    id: action-policy-1
                    matcher: 'host.name: "web-*"'
                    name: Notify on host alerts
                    snoozed_until: null
                    tags:
                    - production
                    throttle:
                      interval: null
                      strategy: on_status_change
                    updated_at: '2026-01-15T12:00:00.000Z'
                    updated_by: elastic
                    version: WzAsMV0=
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_action_policy_response'
          description: Returns the disabled action policy.
        '400':
          content:
            application/json:
              examples:
                invalidRequest:
                  summary: Indicates an invalid schema or parameters.
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        errors: []
                        properties:
                          page:
                            errors:
                            - 'Too small: expected number to be >=1'
                    error: Bad Request
                    message: 'page: Too small: expected number to be >=1'
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the request failed schema validation.
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the request was not authenticated.
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the user does not have the required privileges to perform the request.
        '404':
          content:
            application/json:
              examples:
                actionPolicyNotFound:
                  summary: Indicates an action policy with the given ID does not exist.
                  value:
                    code: ACTION_POLICY_NOT_FOUND
                    details:
                      action_policy_id: action-policy-1
                    error: Not Found
                    message: Action policy with id "action-policy-1" not found
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an action policy with the given ID does not exist.
        '409':
          content:
            application/json:
              examples:
                actionPolicyVersionConflict:
                  summary: Indicates the action policy was concurrently updated by another caller.
                  value:
                    code: ACTION_POLICY_VERSION_CONFLICT
                    details:
                      action_policy_id: action-policy-1
                    error: Conflict
                    message: Action policy with id "action-policy-1" has already been updated by another user
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the action policy was concurrently updated by another caller.
        '500':
          content:
            application/json:
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an unexpected server-side error.
        '503':
          content:
            application/json:
              examples:
                alertingDisabled:
                  summary: Alerting engine is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
      summary: Disable an action policy
      tags:
      - alerting-v2
      x-state: Experimental; added in 9.5.0
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/alerting/v2/action_policies/{id}/_enable:
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/v2/action_policies/{id}/_enable</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Enable an action policy by identifier.<br/><br/>[Required authorization] Route required privileges: manage_alerting-v2-action-policies.'
      operationId: post-alerting-v2-action-policies-id-enable
      parameters:
      - description: A required header to protect against CSRF attacks
        in: header
        name: kbn-xsrf
        required: true
        schema:
          example: 'true'
          type: string
      - description: The action policy identifier.
        in: path
        name: id
        required: true
        schema:
          maxLength: 150
          minLength: 1
          type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                enableActionPolicyResponse:
                  summary: Enabled action policy
                  value:
                    auth:
                      created_by_user: true
                      owner: elastic
                    created_at: '2026-01-15T12:00:00.000Z'
                    created_by: elastic
                    description: Sends a workflow notification when matching host alerts fire.
                    destinations:
                    - id: workflow-1
                      type: workflow
                    enabled: true
                    group_by: null
                    grouping_mode: per_episode
                    id: action-policy-1
                    matcher: 'host.name: "web-*"'
                    name: Notify on host alerts
                    snoozed_until: null
                    tags:
                    - production
                    throttle:
                      interval: null
                      strategy: on_status_change
                    updated_at: '2026-01-15T12:00:00.000Z'
                    updated_by: elastic
                    version: WzAsMV0=
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_action_policy_response'
          description: Returns the enabled action policy.
        '400':
          content:
            application/json:
              examples:
                invalidRequest:
                  summary: Indicates an invalid schema or parameters.
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        errors: []
                        properties:
                          page:
                            errors:
                            - 'Too small: expected number to be >=1'
                    error: Bad Request
                    message: 'page: Too small: expected number to be >=1'
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the request failed schema validation.
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the request was not authenticated.
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the user does not have the required privileges to perform the request.
        '404':
          content:
            application/json:
              examples:
                actionPolicyNotFound:
                  summary: Indicates an action policy with the given ID does not exist.
                  value:
                    code: ACTION_POLICY_NOT_FOUND
                    details:
                      action_policy_id: action-policy-1
                    error: Not Found
                    message: Action policy with id "action-policy-1" not found
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an action policy with the given ID does not exist.
        '409':
          content:
            application/json:
              examples:
                actionPolicyVersionConflict:
                  summary: Indicates the action policy was concurrently updated by another caller.
                  value:
                    code: ACTION_POLICY_VERSION_CONFLICT
                    details:
                      action_policy_id: action-policy-1
                    error: Conflict
                    message: Action policy with id "action-policy-1" has already been updated by another user
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the action policy was concurrently updated by another caller.
        '500':
          content:
            application/json:
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an unexpected server-side error.
        '503':
          content:
            application/json:
              examples:
                alertingDisabled:
                  summary: Alerting engine is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
      summary: Enable an action policy
      tags:
      - alerting-v2
      x-state: Experimental; added in 9.5.0
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/alerting/v2/action_policies/{id}/_snooze:
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/v2/action_policies/{id}/_snooze</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Snooze an action policy until a specified time.<br/><br/>[Required authorization] Route required privileges: manage_alerting-v2-action-policies.'
      operationId: post-alerting-v2-action-policies-id-snooze
      parameters:
      - description: A required header to protect against CSRF attacks
        in: header
        name: kbn-xsrf
        required: true
        schema:
          example: 'true'
          type: string
      - description: The action policy identifier.
        in: path
        name: id
        required: true
        schema:
          maxLength: 150
          minLength: 1
          type: string
      requestBody:
        content:
          application/json:
            examples:
              snoozeActionPolicyRequest:
                summary: Snooze until a specific timestamp
                value:
                  snoozed_until: '2026-01-16T12:00:00.000Z'
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_snooze_action_policy_request'
      responses:
        '200':
          content:
            application/json:
              examples:
                snoozeActionPolicyResponse:
                  summary: Snoozed action policy
                  value:
                    auth:
                      created_by_user: true
                      owner: elastic
                    created_at: '2026-01-15T12:00:00.000Z'
                    created_by: elastic
                    description: Sends a workflow notification when matching host alerts fire.
                    destinations:
                    - id: workflow-1
                      type: workflow
                    enabled: true
                    group_by: null
                    grouping_mode: per_episode
                    id: action-policy-1
                    matcher: 'host.name: "web-*"'
                    name: Notify on host alerts
                    snoozed_until: '2026-01-16T12:00:00.000Z'
                    tags:
                    - production
                    throttle:
                      interval: null
                      strategy: on_status_change
                    updated_at: '2026-01-15T12:00:00.000Z'
                    updated_by: elastic
                    version: WzAsMV0=
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_action_policy_response'
          description: Returns the snoozed action policy.
        '400':
          content:
            application/json:
              examples:
                invalidRequest:
                  summary: Indicates an invalid schema or parameters.
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        errors: []
                        properties:
                          snoozed_until:
                            errors:
                            - 'Invalid input: expected string, received undefined'
                    error: Bad Request
                    message: 'snoozed_until: Invalid input: expected string, received undefined'
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an invalid schema or parameters.
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the request was not authenticated.
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the user does not have the required privileges to perform the request.
        '404':
          content:
            application/json:
              examples:
                actionPolicyNotFound:
                  summary: Indicates an action policy with the given ID does not exist.
                  value:
                    code: ACTION_POLICY_NOT_FOUND
                    details:
                      action_policy_id: action-policy-1
                    error: Not Found
                    message: Action policy with id "action-policy-1" not found
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an action policy with the given ID does not exist.
        '409':
          content:
            application/json:
              examples:
                actionPolicyVersionConflict:
                  summary: Indicates the action policy was concurrently updated by another caller.
                  value:
                    code: ACTION_POLICY_VERSION_CONFLICT
                    details:
                      action_policy_id: action-policy-1
                    error: Conflict
                    message: Action policy with id "action-policy-1" has already been updated by another user
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the action policy was concurrently updated by another caller.
        '500':
          content:
            application/json:
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an unexpected server-side error.
        '503':
          content:
            application/json:
              examples:
                alertingDisabled:
                  summary: Alerting engine is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
      summary: Snooze an action policy
      tags:
      - alerting-v2
      x-state: Experimental; added in 9.5.0
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/alerting/v2/action_policies/{id}/_unsnooze:
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/v2/action_policies/{id}/_unsnooze</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Remove the snooze from an action policy.<br/><br/>[Required authorization] Route required privileges: manage_alerting-v2-action-policies.'
      operationId: post-alerting-v2-action-policies-id-unsnooze
      parameters:
      - description: A required header to protect against CSRF attacks
        in: header
        name: kbn-xsrf
        required: true
        schema:
          example: 'true'
          type: string
      - description: The action policy identifier.
        in: path
        name: id
        required: true
        schema:
          maxLength: 150
          minLength: 1
          type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                unsnoozeActionPolicyResponse:
                  summary: Unsnoozed action policy
                  value:
                    auth:
                      created_by_user: true
                      owner: elastic
                    created_at: '2026-01-15T12:00:00.000Z'
                    created_by: elastic
                    description: Sends a workflow notification when matching host alerts fire.
                    destinations:
                    - id: workflow-1
                      type: workflow
                    enabled: true
                    group_by: null
                    grouping_mode: per_episode
                    id: action-policy-1
                    matcher: 'host.name: "web-*"'
                    name: Notify on host alerts
                    snoozed_until: null
                    tags:
                    - production
                    throttle:
                      interval: null
                      strategy: on_status_change
                    updated_at: '2026-01-15T12:00:00.000Z'
                    updated_by: elastic
                    version: WzAsMV0=
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_action_policy_response'
          description: Returns the unsnoozed action policy.
        '400':
          content:
            application/json:
              examples:
                invalidRequest:
                  summary: Indicates an invalid schema or parameters.
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        errors: []
                        properties:
                          page:
                            errors:
                            - 'Too small: expected number to be >=1'
                    error: Bad Request
                    message: 'page: Too small: expected number to be >=1'
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the request failed schema validation.
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the request was not authenticated.
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the user does not have the required privileges to perform the request.
        '404':
          content:
            application/json:
              examples:
                actionPolicyNotFound:
                  summary: Indicates an action policy with the given ID does not exist.
                  value:
                    code: ACTION_POLICY_NOT_FOUND
                    details:
                      action_policy_id: action-policy-1
                    error: Not Found
                    message: Action policy with id "action-policy-1" not found
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an action policy with the given ID does not exist.
        '409':
          content:
            application/json:
              examples:
                actionPolicyVersionConflict:
                  summary: Indicates the action policy was concurrently updated by another caller.
                  value:
                    code: ACTION_POLICY_VERSION_CONFLICT
                    details:
                      action_policy_id: action-policy-1
                    error: Conflict
                    message: Action policy with id "action-policy-1" has already been updated by another user
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the action policy was concurrently updated by another caller.
        '500':
          content:
            application/json:
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an unexpected server-side error.
        '503':
          content:
            application/json:
              examples:
                alertingDisabled:
                  summary: Alerting engine is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
      summary: Unsnooze an action policy
      tags:
      - alerting-v2
      x-state: Experimental; added in 9.5.0
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/alerting/v2/action_policies/{id}/_update_api_key:
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/v2/action_policies/{id}/_update_api_key</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Rotate the API key for an action policy.<br/><br/>[Required authorization] Route required privileges: manage_alerting-v2-action-policies.'
      operationId: post-alerting-v2-action-policies-id-update-api-key
      parameters:
      - description: A required header to protect against CSRF attacks
        in: header
        name: kbn-xsrf
        required: true
        schema:
          example: 'true'
          type: string
      - description: The action policy identifier.
        in: path
        name: id
        required: true
        schema:
          maxLength: 150
          minLength: 1
          type: string
      responses:
        '204':
          description: Returns the action policy with the updated API key.
        '400':
          content:
            application/json:
              examples:
                invalidRequest:
                  summary: Indicates an invalid schema or parameters.
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        errors: []
                        properties:
                          page:
                            errors:
                            - 'Too small: expected number to be >=1'
                    error: Bad Request
                    message: 'page: Too small: expected number to be >=1'
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the request failed schema validation.
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the request was not authenticated.
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the user does not have the required privileges to perform the request.
        '404':
          content:
            application/json:
              examples:
                actionPolicyNotFound:
                  summary: Indicates an action policy with the given ID does not exist.
                  value:
                    code: ACTION_POLICY_NOT_FOUND
                    details:
                      action_policy_id: action-policy-1
                    error: Not Found
                    message: Action policy with id "action-policy-1" not found
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an action policy with the given ID does not exist.
        '409':
          content:
            application/json:
              examples:
                actionPolicyVersionConflict:
                  summary: Indicates the action policy was concurrently updated by another caller.
                  value:
                    code: ACTION_POLICY_VERSION_CONFLICT
                    details:
                      action_policy_id: action-policy-1
                    error: Conflict
                    message: Action policy with id "action-policy-1" has already been updated by another user
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the action policy was concurrently updated by another caller.
        '500':
          content:
            application/json:
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an unexpected server-side error.
        '503':
          content:
            application/json:
              examples:
                alertingDisabled:
                  summary: Alerting engine is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
      summary: Update an action policy API key
      tags:
      - alerting-v2
      x-state: Experimental; added in 9.5.0
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/alerting/v2/action_policies/tags:
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/v2/action_policies/tags</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Get unique tags used across action policies.<br/><br/>[Required authorization] Route required privileges: read_alerting-v2-action-policies.'
      operationId: get-alerting-v2-action-policies-tags
      parameters:
      - description: Prefix to filter tags by. Returns all most-used tags when omitted.
        in: query
        name: search
        required: false
        schema:
          maxLength: 256
          type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                actionPolicyTagsResponse:
                  summary: Action policy tags
                  value:
                    tags:
                    - production
                    - critical
                    - hosts
              schema:
                additionalProperties: false
                description: All unique tags across action policies.
                type: object
                properties:
                  tags:
                    description: The list of unique tags.
                    items:
                      type: string
                    type: array
                required:
                - tags
          description: Returns the action policy tags.
        '400':
          content:
            application/json:
              examples:
                invalidRequest:
                  summary: Indicates an invalid schema or parameters.
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        errors: []
                        properties:
                          search:
                            errors:
                            - 'Too big: expected string to have <=256 characters'
                    error: Bad Request
                    message: 'search: Too big: expected string to have <=256 characters'
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an invalid schema or parameters.
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the request was not authenticated.
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the user does not have the required privileges to perform the request.
        '500':
          content:
            application/json:
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an unexpected server-side error.
        '503':
          content:
            application/json:
              examples:
                alertingDisabled:
                  summary: Alerting engine is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
      summary: Get action policy tags
      tags:
      - alerting-v2
      x-state: Experimental; added in 9.5.0
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/alerting/v2/alerts/_bulk_action:
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/v2/alerts/_bulk_action</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Create actions for multiple alert groups in a single request.<br/><br/>[Required authorization] Route required privileges: manage_alerting-v2-alerts.'
      operationId: post-alerting-v2-alerts-bulk-action
      parameters:
      - description: A required header to protect against CSRF attacks
        in: header
        name: kbn-xsrf
        required: true
        schema:
          example: 'true'
          type: string
      requestBody:
        content:
          application/json:
            examples:
              bulkCreateAlertActionRequest:
                summary: Acknowledge one episode and tag another alert group
                value:
                - action_type: ack
                  episode_id: episode-1
                  group_hash: group-hash-1
                - action_type: tag
                  group_hash: group-hash-2
                  tags:
                  - production
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_create_alert_actions_request'
      responses:
        '200':
          content:
            application/json:
              examples:
                bulkCreateAlertActionResponse:
                  summary: Both actions processed successfully
                  value:
                    affected_count: 2
                    errors: []
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_operation_response'
          description: Returns the number of created actions and per-item errors for actions that were not created.
        '400':
          content:
            application/json:
              examples:
                invalidRequest:
                  summary: Bulk body is an empty array
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        ? ''
                        : - At least one action must be provided
                    error: Bad Request
                    message: At least one action must be provided
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an invalid schema or parameters.
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the request was not authenticated.
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the user does not have the required privileges to perform the request.
        '500':
          content:
            application/json:
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an unexpected server-side error.
        '503':
          content:
            application/json:
              examples:
                alertingDisabled:
                  summary: Alerting engine is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
      summary: Bulk create alert actions
      tags:
      - alerting-v2
      x-state: Experimental; added in 9.5.0
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/alerting/v2/alerts/{group_hash}/_ack:
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/v2/alerts/{group_hash}/_ack</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Create an action for a specific alert group.<br/><br/>[Required authorization] Route required privileges: manage_alerting-v2-alerts.'
      operationId: post-alerting-v2-alerts-group-hash-ack
      parameters:
      - description: A required header to protect against CSRF attacks
        in: header
        name: kbn-xsrf
        required: true
        schema:
          example: 'true'
          type: string
      - description: Hash identifying the alert group to apply the action to.
        in: path
        name: group_hash
        required: true
        schema:
          maxLength: 256
          minLength: 1
          type: string
      requestBody:
        content:
          application/json:
            examples:
              createAckAlertActionRequest:
                summary: Acknowledge episode episode-1
                value:
                  episode_id: episode-1
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_new_ack_alert_action'
      responses:
        '204':
          description: Returns the newly created alert action.
        '400':
          content:
            application/json:
              examples:
                invalidRequest:
                  summary: Path is missing required group_hash
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        group_hash:
                        - Required
                    error: Bad Request
                    message: 'group_hash: Required'
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an invalid schema or parameters.
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the request was not authenticated.
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the user does not have the required privileges to perform the request.
        '404':
          content:
            application/json:
              examples:
                alertEventNotFound:
                  summary: No alert event exists for the given group_hash and episode_id
                  value:
                    code: ALERT_EVENT_NOT_FOUND
                    details:
                      episode_id: episode-1
                      group_hash: group-hash-1
                    error: Not Found
                    message: Alert event with group_hash [group-hash-1] and episode_id [episode-1] not found
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the alert event was not found.
        '500':
          content:
            application/json:
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an unexpected server-side error.
        '503':
          content:
            application/json:
              examples:
                alertingDisabled:
                  summary: Alerting engine is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
      summary: Acknowledge an alert
      tags:
      - alerting-v2
      x-state: Experimental; added in 9.5.0
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/alerting/v2/alerts/{group_hash}/_activate:
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/v2/alerts/{group_hash}/_activate</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Create an action for a specific alert group.<br/><br/>[Required authorization] Route required privileges: manage_alerting-v2-alerts.'
      operationId: post-alerting-v2-alerts-group-hash-activate
      parameters:
      - description: A required header to protect against CSRF attacks
        in: header
        name: kbn-xsrf
        required: true
        schema:
          example: 'true'
          type: string
      - description: Hash identifying the alert group to apply the action to.
        in: path
        name: group_hash
        required: true
        schema:
          maxLength: 256
          minLength: 1
          type: string
      requestBody:
        content:
          application/json:
            examples:
              createActivateAlertActionRequest:
                summary: Activate with a reason
                value:
                  reason: Issue reappeared after silence window.
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_new_activate_alert_action'
      responses:
        '204':
          description: Returns the newly created alert action.
        '400':
          content:
            application/json:
              examples:
                invalidRequest:
                  summary: Cannot activate an already-active episode
                  value:
                    code: INVALID_EPISODE_STATE_TRANSITION
                    details:
                      action_type: activate
                      episode_id: episode-1
                      episode_status: active
                      group_hash: group-hash-1
                    error: Bad Request
                    message: Cannot activate episode [episode-1]. It is already active
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an invalid schema or parameters.
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the request was not authenticated.
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the user does not have the required privileges to perform the request.
        '404':
          content:
            application/json:
              examples:
                alertEventNotFound:
                  summary: No alert event exists for the given group_hash and episode_id
                  value:
                    code: ALERT_EVENT_NOT_FOUND
                    details:
                      episode_id: episode-1
                      group_hash: group-hash-1
                    error: Not Found
                    message: Alert event with group_hash [group-hash-1] and episode_id [episode-1] not found
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the alert event was not found.
        '500':
          content:
            application/json:
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an unexpected server-side error.
        '503':
          content:
            application/json:
              examples:
                alertingDisabled:
                  summary: Alerting engine is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
      summary: Activate an alert
      tags:
      - alerting-v2
      x-state: Experimental; added in 9.5.0
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/alerting/v2/alerts/{group_hash}/_assign:
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/v2/alerts/{group_hash}/_assign</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Create an action for a specific alert group.<br/><br/>[Required authorization] Route required privileges: manage_alerting-v2-alerts.'
      operationId: post-alerting-v2-alerts-group-hash-assign
      parameters:
      - description: A required header to protect against CSRF attacks
        in: header
        name: kbn-xsrf
        required: true
        schema:
          example: 'true'
          type: string
      - description: Hash identifying the alert group to apply the action to.
        in: path
        name: group_hash
        required: true
        schema:
          maxLength: 256
          minLength: 1
          type: string
      requestBody:
        content:
          application/json:
            examples:
              createAssignAlertActionRequest:
                summary: Assign episode episode-1 to user u_abc123
                value:
                  assignee_uid: u_abc123
                  episode_id: episode-1
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_new_assign_alert_action'
      responses:
        '204':
          description: Returns the newly created alert action.
        '400':
          content:
            application/json:
              examples:
                invalidRequest:
                  summary: Path is missing required group_hash
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        group_hash:
                        - Required
                    error: Bad Request
                    message: 'group_hash: Required'
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an invalid schema or parameters.
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the request was not authenticated.
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the user does not have the required privileges to perform the request.
        '404':
          content:
            application/json:
              examples:
                alertEventNotFound:
                  summary: No alert event exists for the given group_hash and episode_id
                  value:
                    code: ALERT_EVENT_NOT_FOUND
                    details:
                      episode_id: episode-1
                      group_hash: group-hash-1
                    error: Not Found
                    message: Alert event with group_hash [group-hash-1] and episode_id [episode-1] not found
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the alert event was not found.
        '500':
          content:
            application/json:
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an unexpected server-side error.
        '503':
          content:
            application/json:
              examples:
                alertingDisabled:
                  summary: Alerting engine is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
      summary: Assign an alert to a user
      tags:
      - alerting-v2
      x-state: Experimental; added in 9.5.0
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/alerting/v2/alerts/{group_hash}/_deactivate:
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/v2/alerts/{group_hash}/_deactivate</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Create an action for a specific alert group.<br/><br/>[Required authorization] Route required privileges: manage_alerting-v2-alerts.'
      operationId: post-alerting-v2-alerts-group-hash-deactivate
      parameters:
      - description: A required header to protect against CSRF attacks
        in: header
        name: kbn-xsrf
        required: true
        schema:
          example: 'true'
          type: string
      - description: Hash identifying the alert group to apply the action to.
        in: path
        name: group_hash
        required: true
        schema:
          maxLength: 256
          minLength: 1
          type: string
      requestBody:
        content:
          application/json:
            examples:
              createDeactivateAlertActionRequest:
                summary: Deactivate as a false positive
                value:
                  reason: False positive confirmed by on-call.
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_new_deactivate_alert_action'
      responses:
        '204':
          description: Returns the newly created alert action.
        '400':
          content:
            application/json:
              examples:
                invalidRequest:
                  summary: Cannot deactivate an already-inactive episode
                  value:
                    code: INVALID_EPISODE_STATE_TRANSITION
                    details:
                      action_type: deactivate
                      episode_id: episode-1
                      episode_status: inactive
                      group_hash: group-hash-1
                    error: Bad Request
                    message: Cannot deactivate episode [episode-1]. It is already inactive
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an invalid schema or parameters.
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the request was not authenticated.
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the user does not have the required privileges to perform the request.
        '404':
          content:
            application/json:
              examples:
                alertEventNotFound:
                  summary: No alert event exists for the given group_hash and episode_id
                  value:
                    code: ALERT_EVENT_NOT_FOUND
                    details:
                      episode_id: episode-1
                      group_hash: group-hash-1
                    error: Not Found
                    message: Alert event with group_hash [group-hash-1] and episode_id [episode-1] not found
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the alert event was not found.
        '500':
          content:
            application/json:
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an unexpected server-side error.
        '503':
          content:
            application/json:
              examples:
                alertingDisabled:
                  summary: Alerting engine is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
      summary: Deactivate an alert
      tags:
      - alerting-v2
      x-state: Experimental; added in 9.5.0
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/alerting/v2/alerts/{group_hash}/_snooze:
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/v2/alerts/{group_hash}/_snooze</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Create an action for a specific alert group.<br/><br/>[Required authorization] Route required privileges: manage_alerting-v2-alerts.'
      operationId: post-alerting-v2-alerts-group-hash-snooze
      parameters:
      - description: A required header to protect against CSRF attacks
        in: header
        name: kbn-xsrf
        required: true
        schema:
          example: 'true'
          type: string
      - description: Hash identifying the alert group to apply the action to.
        in: path
        name: group_hash
        required: true
        schema:
          maxLength: 256
          minLength: 1
          type: string
      requestBody:
        content:
          application/json:
            examples:
              createSnoozeAlertActionRequest:
                summary: Snooze until 2026-01-16T12:00:00.000Z
                value:
                  expiry: '2026-01-16T12:00:00.000Z'
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_new_snooze_alert_action'
      responses:
        '204':
          description: Returns the newly created alert action.
        '400':
          content:
            application/json:
              examples:
                invalidRequest:
                  summary: Path is missing required group_hash
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        group_hash:
                        - Required
                    error: Bad Request
                    message: 'group_hash: Required'
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an invalid schema or parameters.
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the request was not authenticated.
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the user does not have the required privileges to perform the request.
        '404':
          content:
            application/json:
              examples:
                alertEventNotFound:
                  summary: No alert event exists for the given group_hash and episode_id
                  value:
                    code: ALERT_EVENT_NOT_FOUND
                    details:
                      episode_id: episode-1
                      group_hash: group-hash-1
                    error: Not Found
                    message: Alert event with group_hash [group-hash-1] and episode_id [episode-1] not found
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the alert event was not found.
        '500':
          content:
            application/json:
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an unexpected server-side error.
        '503':
          content:
            application/json:
              examples:
                alertingDisabled:
                  summary: Alerting engine is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
      summary: Snooze an alert
      tags:
      - alerting-v2
      x-state: Experimental; added in 9.5.0
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/alerting/v2/alerts/{group_hash}/_tag:
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/v2/alerts/{group_hash}/_tag</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Create an action for a specific alert group.<br/><br/>[Required authorization] Route required privileges: manage_alerting-v2-alerts.'
      operationId: post-alerting-v2-alerts-group-hash-tag
      parameters:
      - description: A required header to protect against CSRF attacks
        in: header
        name: kbn-xsrf
        required: true
        schema:
          example: 'true'
          type: string
      - description: Hash identifying the alert group to apply the action to.
        in: path
        name: group_hash
        required: true
        schema:
          maxLength: 256
          minLength: 1
          type: string
      requestBody:
        content:
          application/json:
            examples:
              createTagAlertActionRequest:
                summary: Tag the alert with production and investigating
                value:
                  tags:
                  - production
                  - investigating
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_new_tag_alert_action'
      responses:
        '204':
          description: Returns the newly created alert action.
        '400':
          content:
            application/json:
              examples:
                invalidRequest:
                  summary: Path is missing required group_hash
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        group_hash:
                        - Required
                    error: Bad Request
                    message: 'group_hash: Required'
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an invalid schema or parameters.
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the request was not authenticated.
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the user does not have the required privileges to perform the request.
        '404':
          content:
            application/json:
              examples:
                alertEventNotFound:
                  summary: No alert event exists for the given group_hash and episode_id
                  value:
                    code: ALERT_EVENT_NOT_FOUND
                    details:
                      episode_id: episode-1
                      group_hash: group-hash-1
                    error: Not Found
                    message: Alert event with group_hash [group-hash-1] and episode_id [episode-1] not found
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the alert event was not found.
        '500':
          content:
            application/json:
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an unexpected server-side error.
        '503':
          content:
            application/json:
              examples:
                alertingDisabled:
                  summary: Alerting engine is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
      summary: Add tags to an alert
      tags:
      - alerting-v2
      x-state: Experimental; added in 9.5.0
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/alerting/v2/alerts/{group_hash}/_unack:
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/v2/alerts/{group_hash}/_unack</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Create an action for a specific alert group.<br/><br/>[Required authorization] Route required privileges: manage_alerting-v2-alerts.'
      operationId: post-alerting-v2-alerts-group-hash-unack
      parameters:
      - description: A required header to protect against CSRF attacks
        in: header
        name: kbn-xsrf
        required: true
        schema:
          example: 'true'
          type: string
      - description: Hash identifying the alert group to apply the action to.
        in: path
        name: group_hash
        required: true
        schema:
          maxLength: 256
          minLength: 1
          type: string
      requestBody:
        content:
          application/json:
            examples:
              createUnackAlertActionRequest:
                summary: Unacknowledge episode episode-1
                value:
                  episode_id: episode-1
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_new_unack_alert_action'
      responses:
        '204':
          description: Returns the newly created alert action.
        '400':
          content:
            application/json:
              examples:
                invalidRequest:
                  summary: Path is missing required group_hash
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        group_hash:
                        - Required
                    error: Bad Request
                    message: 'group_hash: Required'
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an invalid schema or parameters.
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the request was not authenticated.
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the user does not have the required privileges to perform the request.
        '404':
          content:
            application/json:
              examples:
                alertEventNotFound:
                  summary: No alert event exists for the given group_hash and episode_id
                  value:
                    code: ALERT_EVENT_NOT_FOUND
                    details:
                      episode_id: episode-1
                      group_hash: group-hash-1
                    error: Not Found
                    message: Alert event with group_hash [group-hash-1] and episode_id [episode-1] not found
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the alert event was not found.
        '500':
          content:
            application/json:
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an unexpected server-side error.
        '503':
          content:
            application/json:
              examples:
                alertingDisabled:
                  summary: Alerting engine is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
      summary: Unacknowledge an alert
      tags:
      - alerting-v2
      x-state: Experimental; added in 9.5.0
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/alerting/v2/alerts/{group_hash}/_unsnooze:
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/v2/alerts/{group_hash}/_unsnooze</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Create an action for a specific alert group.<br/><br/>[Required authorization] Route required privileges: manage_alerting-v2-alerts.'
      operationId: post-alerting-v2-alerts-group-hash-unsnooze
      parameters:
      - description: A required header to protect against CSRF attacks
        in: header
        name: kbn-xsrf
        required: true
        schema:
          example: 'true'
          type: string
      - description: Hash identifying the alert group to apply the action to.
        in: path
        name: group_hash
        required: true
        schema:
          maxLength: 256
          minLength: 1
          type: string
      requestBody:
        content:
          application/json:
            examples:
              createUnsnoozeAlertActionRequest:
                summary: Clear the current snooze
                value: {}
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_new_unsnooze_alert_action'
      responses:
        '204':
          description: Returns the newly created alert action.
        '400':
          content:
            application/json:
              examples:
                invalidRequest:
                  summary: Path is missing required group_hash
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        group_hash:
                        - Required
                    error: Bad Request
                    message: 'group_hash: Required'
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an invalid schema or parameters.
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the request was not authenticated.
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the user does not have the required privileges to perform the request.
        '404':
          content:
            application/json:
              examples:
                alertEventNotFound:
                  summary: No alert event exists for the given group_hash and episode_id
                  value:
                    code: ALERT_EVENT_NOT_FOUND
                    details:
                      episode_id: episode-1
                      group_hash: group-hash-1
                    error: Not Found
                    message: Alert event with group_hash [group-hash-1] and episode_id [episode-1] not found
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the alert event was not found.
        '500':
          content:
            application/json:
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an unexpected server-side error.
        '503':
          content:
            application/json:
              examples:
                alertingDisabled:
                  summary: Alerting engine is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
      summary: Unsnooze an alert
      tags:
      - alerting-v2
      x-state: Experimental; added in 9.5.0
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/alerting/v2/execution_history/action_policies:
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/v2/execution_history/action_policies</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Get a paginated list of dispatcher summary events for action policies in the current space.<br/><br/>[Required authorization] Route required privileges: read_alerting-v2-execution-history.'
      operationId: get-alerting-v2-execution-history-action-policies
      parameters:
      - description: Page number (1-indexed). Defaults to 1.
        in: query
        name: page
        required: false
        schema:
          maximum: 10000
          minimum: 1
          type: integer
      - description: Number of events per page. Defaults to 20. Pass 0 for a count-only read.
        in: query
        name: per_page
        required: false
        schema:
          maximum: 100
          minimum: 0
          type: integer
      - description: Inclusive ISO datetime lower bound on the event timestamp; overrides the default 24-hour window. Independent of episode_ids — e.g. set it to an episode’s start time to scope results to that episode’s lifetime.
        in: query
        name: start_date
        required: false
        schema:
          format: date-time
          pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
          type: string
      - description: Episode filter. Narrows events to those referencing at least one of the provided episode ids.
        in: query
        name: episode_ids
        required: false
        schema:
          items:
            maxLength: 150
            minLength: 1
            type: string
          maxItems: 50
          minItems: 1
          type: array
      - description: Free-text search. Matches policy name, rule name, policy/rule ID (case-insensitive).
        in: query
        name: search
        required: false
        schema:
          maxLength: 256
          minLength: 1
          type: string
      - description: Explicit rule filter. Narrows events to those referencing at least one of the provided rule ids. Also unions with the search filter if both are provided.
        in: query
        name: rule_ids
        required: false
        schema:
          items:
            maxLength: 150
            minLength: 1
            type: string
          maxItems: 50
          minItems: 1
          type: array
      - description: Outcome filter. When omitted matches all outcomes. Pass one or more of "dispatched", "throttled", "dispatch_failed" to narrow.
        in: query
        name: outcome
        required: false
        schema:
          items:
            enum:
            - dispatched
            - throttled
            - dispatch_failed
            type: string
          maxItems: 3
          minItems: 1
          type: array
      responses:
        '200':
          content:
            application/json:
              examples:
                listActionPolicyExecutionsResponse:
                  summary: A page of action policy execution events
                  value:
                    items:
                    - action_group_count: 1
                      dispatched_at: '2026-01-15T12:05:00.000Z'
                      episode_count: 1
                      episodes:
                      - id: episode-1
                      outcome: dispatched
                      policy:
                        id: action-policy-1
                        name: Notify on host alerts
                      rules:
                      - id: rule-1
                        name: Host CPU high
                      total_rule_count: 1
                      workflows:
                      - id: workflow-1
                        name: Notify oncall
                    page: 1
                    per_page: 20
                    search_matches: null
                    total_events: 1
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_policy_execution_history_response'
          description: Returns a paginated list of execution history events.
        '400':
          content:
            application/json:
              examples:
                invalidRequest:
                  summary: Exceeds the max result window
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        page:
                        - page * per_page cannot exceed 10000.
                    error: Bad Request
                    message: page * per_page cannot exceed 10000.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an invalid schema or parameters.
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the request was not authenticated.
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the user does not have the required privileges to perform the request.
        '500':
          content:
            application/json:
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an unexpected server-side error.
        '503':
          content:
            application/json:
              examples:
                alertingDisabled:
                  summary: Alerting engine is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
      summary: List action policy executions
      tags:
      - alerting-v2
      x-state: Experimental; added in 9.5.0
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/alerting/v2/execution_history/rules:
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/v2/execution_history/rules</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Get a paginated list of rule execution events.<br/><br/>[Required authorization] Route required privileges: read_alerting-v2-execution-history.'
      operationId: get-alerting-v2-execution-history-rules
      parameters:
      - description: 'Rule id filter. '
        in: query
        name: rule_ids
        required: false
        schema:
          items:
            maxLength: 150
            minLength: 1
            type: string
          maxItems: 50
          minItems: 1
          type: array
      - description: 'Outcome filter. '
        in: query
        name: outcome
        required: false
        schema:
          items:
            enum:
            - success
            - failure
            type: string
          maxItems: 2
          minItems: 1
          type: array
      - description: Inclusive ISO datetime lower bound on event.start.
        in: query
        name: from
        required: false
        schema:
          format: date-time
          pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
          type: string
      - description: Inclusive ISO datetime upper bound on event.start.
        in: query
        name: to
        required: false
        schema:
          format: date-time
          pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
          type: string
      - description: Sort field. Defaults to started_at.
        in: query
        name: sort
        required: true
        schema:
          default: started_at
          enum:
          - started_at
          - duration
          type: string
      - description: Sort direction.
        in: query
        name: sort_order
        required: true
        schema:
          default: desc
          enum:
          - asc
          - desc
          type: string
      - description: Page number.
        in: query
        name: page
        required: true
        schema:
          default: 1
          maximum: 10000
          minimum: 1
          type: integer
      - description: Number of results per page.
        in: query
        name: per_page
        required: true
        schema:
          default: 20
          maximum: 100
          minimum: 1
          type: integer
      responses:
        '200':
          content:
            application/json:
              examples:
                listRuleExecutionsResponse:
                  summary: One successful rule execution
                  value:
                    items:
                    - ended_at: '2026-01-15T12:00:01.250Z'
                      error: null
                      id: execution-1
                      outcome: success
                      reason: null
                      rule:
                        id: rule-1
                        version: 3
                      space_id: default
                      started_at: '2026-01-15T12:00:00.000Z'
                      timings:
                        duration: 1250
                        scheduled_delay: 40
                    page: 1
                    per_page: 20
                    total: 1
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_rule_executions_response'
          description: Returns a paginated list of rule execution events.
        '400':
          content:
            application/json:
              examples:
                invalidRequest:
                  summary: Exceeds the max result window
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        page:
                        - page * per_page cannot exceed 10000.
                    error: Bad Request
                    message: page * per_page cannot exceed 10000.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an invalid schema or parameters.
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the request was not authenticated.
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the user does not have the required privileges to perform the request.
        '500':
          content:
            application/json:
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an unexpected server-side error.
        '503':
          content:
            application/json:
              examples:
                alertingDisabled:
                  summary: Alerting engine is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
      summary: List rule executions
      tags:
      - alerting-v2
      x-state: Experimental; added in 9.5.0
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/alerting/v2/rules:
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/v2/rules</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        [Required authorization] Route required privileges: read_alerting-v2-rules.'
      operationId: get-alerting-v2-rules
      parameters:
      - description: The page number to return. Defaults to 1.
        in: query
        name: page
        required: false
        schema:
          minimum: 1
          type: number
      - description: The number of rules to return per page. Defaults to 20.
        in: query
        name: per_page
        required: false
        schema:
          maximum: 1000
          minimum: 1
          type: number
      - description: The filter to apply to the rules.
        in: query
        name: filter
        required: false
        schema:
          maxLength: 4096
          type: string
      - description: The field to sort rules by.
        in: query
        name: sort_field
        required: false
        schema:
          enum:
          - kind
          - enabled
          - name
          type: string
      - description: The direction to sort rules.
        in: query
        name: sort_order
        required: false
        schema:
          enum:
          - asc
          - desc
          type: string
      - description: A text string to search across rule fields.
        in: query
        name: search
        required: false
        schema:
          maxLength: 256
          minLength: 1
          type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                listRulesResponse:
                  summary: Paginated list containing one matching rule
                  value:
                    items:
                    - created_at: '2026-01-15T12:00:00.000Z'
                      created_by: elastic
                      enabled: true
                      grouping:
                        fields:
                        - host.name
                      id: rule-1
                      kind: alert
                      metadata:
                        description: Alerts when average CPU usage exceeds a threshold.
                        name: Host CPU high
                        tags:
                        - production
                        - infra
                        version: 1
                      query:
                        breach:
                          query: FROM metrics-* | WHERE host.cpu.usage > 0.9 | STATS avg_cpu = AVG(host.cpu.usage) BY host.name
                        format: standalone
                      recovery_strategy: no_breach
                      schedule:
                        every: 1m
                        lookback: 5m
                      state_transition:
                        pending_count: 1
                        recovering_count: 1
                      time_field: '@timestamp'
                      updated_at: '2026-01-15T12:00:00.000Z'
                      updated_by: elastic
                      version: WzAsMV0=
                    page: 1
                    per_page: 20
                    total: 1
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_rule_list_response'
          description: Returns a paginated list of rules.
        '400':
          content:
            application/json:
              examples:
                invalidRequest:
                  summary: Indicates an invalid schema or parameters.
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        errors: []
                        properties:
                          page:
                            errors:
                            - 'Too small: expected number to be >=1'
                    error: Bad Request
                    message: 'page: Too small: expected number to be >=1'
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an invalid schema or parameters.
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the request was not authenticated.
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the user does not have the required privileges to perform the request.
        '500':
          content:
            application/json:
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an unexpected server-side error.
        '503':
          content:
            application/json:
              examples:
                alertingDisabled:
                  summary: Alerting engine is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
      summary: List rules
      tags:
      - alerting-v2
      x-state: Experimental; added in 9.5.0
      x-metaTags:
      - content: Kibana
        name: product_name
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/v2/rules</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Creates a rule with a server-generated identifier. To create or replace a rule with a client-supplied identifier, use PUT /api/alerting/v2/rules/.<br/><br/>[Required authorization] Route required privileges: manage_alerting-v2-rules.'
      operationId: post-alerting-v2-rules
      parameters:
      - description: A required header to protect against CSRF attacks
        in: header
        name: kbn-xsrf
        required: true
        schema:
          example: 'true'
          type: string
      requestBody:
        content:
          application/json:
            examples:
              createRuleRequest:
                summary: Create a host CPU threshold rule
                value:
                  grouping:
                    fields:
                    - host.name
                  kind: alert
                  metadata:
                    description: Alerts when average CPU usage exceeds a threshold.
                    name: Host CPU high
                    tags:
                    - production
                    - infra
                  query:
                    breach:
                      query: FROM metrics-* | WHERE host.cpu.usage > 0.9 | STATS avg_cpu = AVG(host.cpu.usage) BY host.name
                    format: standalone
                  recovery_strategy: no_breach
                  schedule:
                    every: 1m
                    lookback: 5m
                  state_transition:
                    pending_count: 1
                    recovering_count: 1
                  time_field: '@timestamp'
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_new_rule'
      responses:
        '201':
          content:
            application/json:
              examples:
                createRuleResponse:
                  summary: Created host CPU threshold rule
                  value:
                    created_at: '2026-01-15T12:00:00.000Z'
                    created_by: elastic
                    enabled: true
                    grouping:
                      fields:
                      - host.name
                    id: rule-1
                    kind: alert
                    metadata:
                      description: Alerts when average CPU usage exceeds a threshold.
                      name: Host CPU high
                      tags:
                      - production
                      - infra
                      version: 1
                    query:
                      breach:
                        query: FROM metrics-* | WHERE host.cpu.usage > 0.9 | STATS avg_cpu = AVG(host.cpu.usage) BY host.name
                      format: standalone
                    recovery_strategy: no_breach
                    schedule:
                      every: 1m
                      lookback: 5m
                    state_transition:
                      pending_count: 1
                      recovering_count: 1
                    time_field: '@timestamp'
                    updated_at: '2026-01-15T12:00:00.000Z'
                    updated_by: elastic
                    version: WzAsMV0=
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_rule_response'
          description: Returns the newly created rule.
        '400':
          content:
            application/json:
              examples:
                invalidRequest:
                  summary: Missing required rule metadata
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        metadata:
                        - Required
                    error: Bad Request
                    message: 'metadata: Required'
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an invalid schema or parameters.
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the request was not authenticated.
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the user does not have the required privileges to perform the request.
        '500':
          content:
            application/json:
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an unexpected server-side error.
        '503':
          content:
            application/json:
              examples:
                alertingDisabled:
                  summary: Alerting engine is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
      summary: Create a rule
      tags:
      - alerting-v2
      x-state: Experimental; added in 9.5.0
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/alerting/v2/rules/_bulk_delete:
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/v2/rules/_bulk_delete</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        [Required authorization] Route required privileges: manage_alerting-v2-rules.'
      operationId: post-alerting-v2-rules-bulk-delete
      parameters:
      - description: A required header to protect against CSRF attacks
        in: header
        name: kbn-xsrf
        required: true
        schema:
          example: 'true'
          type: string
      requestBody:
        content:
          application/json:
            examples:
              bulkDeleteRulesRequest:
                summary: Delete two rules by ID
                value:
                  ids:
                  - rule-1
                  - rule-2
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_by_ids_request'
      responses:
        '200':
          content:
            application/json:
              examples:
                bulkDeleteRulesResponse:
                  summary: Deleted both requested rules
                  value:
                    affected_count: 2
                    errors: []
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_operation_response'
          description: Returns the result of the bulk delete operation.
        '400':
          content:
            application/json:
              examples:
                invalidRequest:
                  summary: Request body is missing required rule ids
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        ids:
                        - Required
                    error: Bad Request
                    message: 'ids: Required'
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an invalid schema or parameters.
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the request was not authenticated.
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the user does not have the required privileges to perform the request.
        '500':
          content:
            application/json:
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an unexpected server-side error.
        '503':
          content:
            application/json:
              examples:
                alertingDisabled:
                  summary: Alerting engine is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
      summary: Delete rules in bulk by ID
      tags:
      - alerting-v2
      x-state: Experimental; added in 9.5.0
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/alerting/v2/rules/_bulk_disable:
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/v2/rules/_bulk_disable</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        [Required authorization] Route required privileges: manage_alerting-v2-rules.'
      operationId: post-alerting-v2-rules-bulk-disable
      parameters:
      - description: A required header to protect against CSRF attacks
        in: header
        name: kbn-xsrf
        required: true
        schema:
          example: 'true'
          type: string
      requestBody:
        content:
          application/json:
            examples:
              bulkDisableRulesRequest:
                summary: Disable two rules by ID
                value:
                  ids:
                  - rule-1
                  - rule-2
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_by_ids_request'
      responses:
        '200':
          content:
            application/json:
              examples:
                bulkDisableRulesResponse:
                  summary: Disabled both requested rules
                  value:
                    affected_count: 2
                    errors: []
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_operation_response'
          description: Returns the result of the bulk disable operation.
        '400':
          content:
            application/json:
              examples:
                invalidRequest:
                  summary: Request body is missing required rule ids
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        ids:
                        - Required
                    error: Bad Request
                    message: 'ids: Required'
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an invalid schema or parameters.
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the request was not authenticated.
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the user does not have the required privileges to perform the request.
        '500':
          content:
            application/json:
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an unexpected server-side error.
        '503':
          content:
            application/json:
              examples:
                alertingDisabled:
                  summary: Alerting engine is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
      summary: Disable rules in bulk by ID
      tags:
      - alerting-v2
      x-state: Experimental; added in 9.5.0
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/alerting/v2/rules/_bulk_enable:
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/v2/rules/_bulk_enable</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        [Required authorization] Route required privileges: manage_alerting-v2-rules.'
      operationId: post-alerting-v2-rules-bulk-enable
      parameters:
      - description: A required header to protect against CSRF attacks
        in: header
        name: kbn-xsrf
        required: true
        schema:
          example: 'true'
          type: string
      requestBody:
        content:
          application/json:
            examples:
              bulkEnableRulesRequest:
                summary: Enable two rules by ID
                value:
                  ids:
                  - rule-1
                  - rule-2
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_by_ids_request'
      responses:
        '200':
          content:
            application/json:
              examples:
                bulkEnableRulesResponse:
                  summary: Enabled both requested rules
                  value:
                    affected_count: 2
                    errors: []
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_operation_response'
          description: Returns the result of the bulk enable operation.
        '400':
          content:
            application/json:
              examples:
                invalidRequest:
                  summary: Request body is missing required rule ids
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        ids:
                        - Required
                    error: Bad Request
                    message: 'ids: Required'
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an invalid schema or parameters.
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the request was not authenticated.
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the user does not have the required privileges to perform the request.
        '500':
          content:
            application/json:
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an unexpected server-side error.
        '503':
          content:
            application/json:
              examples:
                alertingDisabled:
                  summary: Alerting engine is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
      summary: Enable rules in bulk by ID
      tags:
      - alerting-v2
      x-state: Experimental; added in 9.5.0
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/alerting/v2/rules/_bulk_get:
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/v2/rules/_bulk_get</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        [Required authorization] Route required privileges: read_alerting-v2-rules.'
      operationId: post-alerting-v2-rules-bulk-get
      parameters:
      - description: A required header to protect against CSRF attacks
        in: header
        name: kbn-xsrf
        required: true
        schema:
          example: 'true'
          type: string
      requestBody:
        content:
          application/json:
            examples:
              bulkGetRulesRequest:
                summary: Fetch two rules by ID
                value:
                  ids:
                  - rule-1
                  - rule-2
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_get_rules_request'
      responses:
        '200':
          content:
            application/json:
              examples:
                bulkGetRulesResponse:
                  summary: Returned the requested rules
                  value:
                    rules:
                    - created_at: '2026-01-15T12:00:00.000Z'
                      created_by: elastic
                      enabled: true
                      grouping:
                        fields:
                        - host.name
                      id: rule-1
                      kind: alert
                      metadata:
                        description: Alerts when average CPU usage exceeds a threshold.
                        name: Host CPU high
                        tags:
                        - production
                        - infra
                        version: 1
                      query:
                        breach:
                          query: FROM metrics-* | WHERE host.cpu.usage > 0.9 | STATS avg_cpu = AVG(host.cpu.usage) BY host.name
                        format: standalone
                      recovery_strategy: no_breach
                      schedule:
                        every: 1m
                        lookback: 5m
                      state_transition:
                        pending_count: 1
                        recovering_count: 1
                      time_field: '@timestamp'
                      updated_at: '2026-01-15T12:00:00.000Z'
                      updated_by: elastic
                      version: WzAsMV0=
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_get_rules_response'
          description: Returns the requested rules.
        '400':
          content:
            application/json:
              examples:
                invalidRequest:
                  summary: Request body is missing required rule ids
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        ids:
                        - Required
                    error: Bad Request
                    message: 'ids: Required'
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an invalid schema or parameters.
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the request was not authenticated.
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the user does not have the required privileges to perform the request.
        '404':
          content:
            application/json:
              examples:
                rulesNotFound:
                  summary: One or more requested rule ids could not be found
                  value:
                    code: NOT_FOUND
                    error: Not Found
                    message: Saved object [alerting_rule/rule-1] not found
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: One or more rule ids could not be found.
        '500':
          content:
            application/json:
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an unexpected server-side error.
        '503':
          content:
            application/json:
              examples:
                alertingDisabled:
                  summary: Alerting engine is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
      summary: Get rules in bulk
      tags:
      - alerting-v2
      x-state: Experimental; added in 9.5.0
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/alerting/v2/rules/_bulk_update_api_key:
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/v2/rules/_bulk_update_api_key</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Rotates each rule executor task API key to one derived from the current user’s credentials.<br/><br/>[Required authorization] Route required privileges: manage_alerting-v2-rules.'
      operationId: post-alerting-v2-rules-bulk-update-api-key
      parameters:
      - description: A required header to protect against CSRF attacks
        in: header
        name: kbn-xsrf
        required: true
        schema:
          example: 'true'
          type: string
      requestBody:
        content:
          application/json:
            examples:
              bulkUpdateApiKeyRequest:
                summary: Rotate API keys for two rules by ID
                value:
                  ids:
                  - rule-1
                  - rule-2
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_by_ids_request'
      responses:
        '200':
          content:
            application/json:
              examples:
                bulkUpdateApiKeyResponse:
                  summary: Rotated API keys for both requested rules
                  value:
                    affected_count: 2
                    errors: []
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_operation_response'
          description: Returns the result of the bulk update API key operation.
        '400':
          content:
            application/json:
              examples:
                invalidRequest:
                  summary: Request body is missing required rule ids
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        ids:
                        - Required
                    error: Bad Request
                    message: 'ids: Required'
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an invalid schema or parameters.
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the request was not authenticated.
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the user does not have the required privileges to perform the request.
        '500':
          content:
            application/json:
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an unexpected server-side error.
        '503':
          content:
            application/json:
              examples:
                alertingDisabled:
                  summary: Alerting engine is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
      summary: Update the API key of rules in bulk by ID
      tags:
      - alerting-v2
      x-state: Experimental; added in 9.5.0
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/alerting/v2/rules/_delete_by_query:
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/v2/rules/_delete_by_query</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        [Required authorization] Route required privileges: manage_alerting-v2-rules.'
      operationId: post-alerting-v2-rules-delete-by-query
      parameters:
      - description: A required header to protect against CSRF attacks
        in: header
        name: kbn-xsrf
        required: true
        schema:
          example: 'true'
          type: string
      requestBody:
        content:
          application/json:
            examples:
              deleteRulesByQueryRequest:
                summary: 'Delete rules tagged production (dry-run by default, or set `force: true` to execute)'
                value:
                  filter: 'tags: production'
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_by_query_request'
      responses:
        '200':
          content:
            application/json:
              examples:
                deleteRulesByQueryDryRunResponse:
                  summary: 'Dry-run preview of matching rules; set `force: true` on the request to execute'
                  value:
                    match_count: 2
                    sample:
                    - rule-1
                    - rule-2
              schema:
                anyOf:
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_dry_run_response'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_operation_response'
          description: Returns a dry-run preview by default, or the executed operation when `force` is true.
        '400':
          content:
            application/json:
              examples:
                invalidRequest:
                  summary: By-query body omits filter, search, and match_all
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        ? ''
                        : - At least one of filter, search, or match_all must be provided.
                    error: Bad Request
                    message: At least one of filter, search, or match_all must be provided.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an invalid schema or parameters.
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the request was not authenticated.
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the user does not have the required privileges to perform the request.
        '500':
          content:
            application/json:
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an unexpected server-side error.
        '503':
          content:
            application/json:
              examples:
                alertingDisabled:
                  summary: Alerting engine is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
      summary: Delete rules matching a query (dry-run by default)
      tags:
      - alerting-v2
      x-state: Experimental; added in 9.5.0
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/alerting/v2/rules/_disable_by_query:
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/v2/rules/_disable_by_query</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        [Required authorization] Route required privileges: manage_alerting-v2-rules.'
      operationId: post-alerting-v2-rules-disable-by-query
      parameters:
      - description: A required header to protect against CSRF attacks
        in: header
        name: kbn-xsrf
        required: true
        schema:
          example: 'true'
          type: string
      requestBody:
        content:
          application/json:
            examples:
              disableRulesByQueryRequest:
                summary: 'Disable rules tagged production (dry-run by default, or set `force: true` to execute)'
                value:
                  filter: 'tags: production'
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_by_query_request'
      responses:
        '200':
          content:
            application/json:
              examples:
                disableRulesByQueryDryRunResponse:
                  summary: 'Dry-run preview of matching rules; set `force: true` on the request to execute'
                  value:
                    match_count: 2
                    sample:
                    - rule-1
                    - rule-2
              schema:
                anyOf:
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_dry_run_response'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_operation_response'
          description: Returns a dry-run preview by default, or the executed operation when `force` is true.
        '400':
          content:
            application/json:
              examples:
                invalidRequest:
                  summary: By-query body omits filter, search, and match_all
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        ? ''
                        : - At least one of filter, search, or match_all must be provided.
                    error: Bad Request
                    message: At least one of filter, search, or match_all must be provided.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an invalid schema or parameters.
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the request was not authenticated.
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the user does not have the required privileges to perform the request.
        '500':
          content:
            application/json:
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an unexpected server-side error.
        '503':
          content:
            application/json:
              examples:
                alertingDisabled:
                  summary: Alerting engine is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
      summary: Disable rules matching a query (dry-run by default)
      tags:
      - alerting-v2
      x-state: Experimental; added in 9.5.0
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/alerting/v2/rules/_enable_by_query:
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/v2/rules/_enable_by_query</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        [Required authorization] Route required privileges: manage_alerting-v2-rules.'
      operationId: post-alerting-v2-rules-enable-by-query
      parameters:
      - description: A required header to protect against CSRF attacks
        in: header
        name: kbn-xsrf
        required: true
        schema:
          example: 'true'
          type: string
      requestBody:
        content:
          application/json:
            examples:
              enableRulesByQueryRequest:
                summary: 'Enable rules tagged production (dry-run by default, or set `force: true` to execute)'
                value:
                  filter: 'tags: production'
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_by_query_request'
      responses:
        '200':
          content:
            application/json:
              examples:
                enableRulesByQueryDryRunResponse:
                  summary: 'Dry-run preview of matching rules; set `force: true` on the request to execute'
                  value:
                    match_count: 2
                    sample:
                    - rule-1
                    - rule-2
              schema:
                anyOf:
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_dry_run_response'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_operation_response'
          description: Returns a dry-run preview by default, or the executed operation when `force` is true.
        '400':
          content:
            application/json:
              examples:
                invalidRequest:
                  summary: By-query body omits filter, search, and match_all
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        ? ''
                        : - At least one of filter, search, or match_all must be provided.
                    error: Bad Request
                    message: At least one of filter, search, or match_all must be provided.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an invalid schema or parameters.
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the request was not authenticated.
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the user does not have the required privileges to perform the request.
        '500':
          content:
            application/json:
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an unexpected server-side error.
        '503':
          content:
            application/json:
              examples:
                alertingDisabled:
                  summary: Alerting engine is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
      summary: Enable rules matching a query (dry-run by default)
      tags:
      - alerting-v2
      x-state: Experimental; added in 9.5.0
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/alerting/v2/rules/_update_api_key_by_query:
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/v2/rules/_update_api_key_by_query</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Rotates each matching rule executor task API key to one derived from the current user’s credentials.<br/><br/>[Required authorization] Route required privileges: manage_alerting-v2-rules.'
      operationId: post-alerting-v2-rules-update-api-key-by-query
      parameters:
      - description: A required header to protect against CSRF attacks
        in: header
        name: kbn-xsrf
        required: true
        schema:
          example: 'true'
          type: string
      requestBody:
        content:
          application/json:
            examples:
              updateApiKeyByQueryRequest:
                summary: 'Rotate API keys for rules tagged production (dry-run by default, or set `force: true` to execute)'
                value:
                  filter: 'tags: production'
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_by_query_request'
      responses:
        '200':
          content:
            application/json:
              examples:
                updateApiKeyByQueryDryRunResponse:
                  summary: 'Dry-run preview of matching rules; set `force: true` on the request to execute'
                  value:
                    match_count: 2
                    sample:
                    - rule-1
                    - rule-2
              schema:
                anyOf:
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_dry_run_response'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_operation_response'
          description: Returns a dry-run preview by default, or the executed operation when `force` is true.
        '400':
          content:
            application/json:
              examples:
                invalidRequest:
                  summary: By-query body omits filter, search, and match_all
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        ? ''
                        : - At least one of filter, search, or match_all must be provided.
                    error: Bad Request
                    message: At least one of filter, search, or match_all must be provided.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an invalid schema or parameters.
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the request was not authenticated.
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the user does not have the required privileges to perform the request.
        '500':
          content:
            application/json:
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an unexpected server-side error.
        '503':
          content:
            application/json:
              examples:
                alertingDisabled:
                  summary: Alerting engine is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
      summary: Update the API key of rules matching a query (dry-run by default)
      tags:
      - alerting-v2
      x-state: Experimental; added in 9.5.0
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/alerting/v2/rules/{id}:
    delete:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb delete">delete</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/v2/rules/{id}</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        [Required authorization] Route required privileges: manage_alerting-v2-rules.'
      operationId: delete-alerting-v2-rules-id
      parameters:
      - description: A required header to protect against CSRF attacks
        in: header
        name: kbn-xsrf
        required: true
        schema:
          example: 'true'
          type: string
      - description: The identifier for the rule.
        in: path
        name: id
        required: true
        schema:
          maxLength: 150
          minLength: 1
          type: string
      responses:
        '204':
          description: The rule was deleted successfully.
        '400':
          content:
            application/json:
              examples:
                invalidRequest:
                  summary: Indicates an invalid schema or parameters.
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        errors: []
                        properties:
                          page:
                            errors:
                            - 'Too small: expected number to be >=1'
                    error: Bad Request
                    message: 'page: Too small: expected number to be >=1'
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the request failed schema validation.
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the request was not authenticated.
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the user does not have the required privileges to perform the request.
        '404':
          content:
            application/json:
              examples:
                ruleNotFound:
                  summary: No rule exists for the given ID
                  value:
                    code: RULE_NOT_FOUND
                    details:
                      rule_id: rule-1
                    error: Not Found
                    message: Rule with id "rule-1" not found
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates a rule with the given ID does not exist.
        '500':
          content:
            application/json:
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an unexpected server-side error.
        '503':
          content:
            application/json:
              examples:
                alertingDisabled:
                  summary: Alerting engine is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
      summary: Delete a rule
      tags:
      - alerting-v2
      x-state: Experimental; added in 9.5.0
      x-metaTags:
      - content: Kibana
        name: product_name
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/v2/rules/{id}</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        [Required authorization] Route required privileges: read_alerting-v2-rules.'
      operationId: get-alerting-v2-rules-id
      parameters:
      - description: The identifier for the rule.
        in: path
        name: id
        required: true
        schema:
          maxLength: 150
          minLength: 1
          type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                getRuleResponse:
                  summary: Retrieved host CPU threshold rule
                  value:
                    created_at: '2026-01-15T12:00:00.000Z'
                    created_by: elastic
                    enabled: true
                    grouping:
                      fields:
                      - host.name
                    id: rule-1
                    kind: alert
                    metadata:
                      description: Alerts when average CPU usage exceeds a threshold.
                      name: Host CPU high
                      tags:
                      - production
                      - infra
                      version: 1
                    query:
                      breach:
                        query: FROM metrics-* | WHERE host.cpu.usage > 0.9 | STATS avg_cpu = AVG(host.cpu.usage) BY host.name
                      format: standalone
                    recovery_strategy: no_breach
                    schedule:
                      every: 1m
                      lookback: 5m
                    state_transition:
                      pending_count: 1
                      recovering_count: 1
                    time_field: '@timestamp'
                    updated_at: '2026-01-15T12:00:00.000Z'
                    updated_by: elastic
                    version: WzAsMV0=
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_rule_response'
          description: Returns the requested rule.
        '400':
          content:
            application/json:
              examples:
                invalidRequest:
                  summary: Indicates an invalid schema or parameters.
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        errors: []
                        properties:
                          page:
                            errors:
                            - 'Too small: expected number to be >=1'
                    error: Bad Request
                    message: 'page: Too small: expected number to be >=1'
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the request failed schema validation.
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the request was not authenticated.
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the user does not have the required privileges to perform the request.
        '404':
          content:
            application/json:
              examples:
                ruleNotFound:
                  summary: No rule exists for the given ID
                  value:
                    code: RULE_NOT_FOUND
                    details:
                      rule_id: rule-1
                    error: Not Found
                    message: Rule with id "rule-1" not found
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates a rule with the given ID does not exist.
        '500':
          content:
            application/json:
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an unexpected server-side error.
        '503':
          content:
            application/json:
              examples:
                alertingDisabled:
                  summary: Alerting engine is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
      summary: Get a rule
      tags:
      - alerting-v2
      x-state: Experimental; added in 9.5.0
      x-metaTags:
      - content: Kibana
        name: product_name
    patch:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb patch">patch</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/v2/rules/{id}</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        [Required authorization] Route required privileges: manage_alerting-v2-rules.'
      operationId: patch-alerting-v2-rules-id
      parameters:
      - description: A required header to protect against CSRF attacks
        in: header
        name: kbn-xsrf
        required: true
        schema:
          example: 'true'
          type: string
      - description: The identifier for the rule.
        in: path
        name: id
        required: true
        schema:
          maxLength: 150
          minLength: 1
          type: string
      requestBody:
        content:
          application/json:
            examples:
              updateRuleRequest:
                summary: Update a rule name and description
                value:
                  metadata:
                    description: Updated description.
                    name: Host CPU high (updated)
                  version: WzAsMV0=
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_update_rule'
      responses:
        '200':
          content:
            application/json:
              examples:
                updateRuleResponse:
                  summary: Updated rule metadata
                  value:
                    created_at: '2026-01-15T12:00:00.000Z'
                    created_by: elastic
                    enabled: true
                    grouping:
                      fields:
                      - host.name
                    id: rule-1
                    kind: alert
                    metadata:
                      description: Updated description.
                      name: Host CPU high (updated)
                      tags:
                      - production
                      - infra
                      version: 1
                    query:
                      breach:
                        query: FROM metrics-* | WHERE host.cpu.usage > 0.9 | STATS avg_cpu = AVG(host.cpu.usage) BY host.name
                      format: standalone
                    recovery_strategy: no_breach
                    schedule:
                      every: 1m
                      lookback: 5m
                    state_transition:
                      pending_count: 1
                      recovering_count: 1
                    time_field: '@timestamp'
                    updated_at: '2026-01-15T12:00:00.000Z'
                    updated_by: elastic
                    version: WzAsMV0=
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_rule_response'
          description: Returns the updated rule.
        '400':
          content:
            application/json:
              examples:
                invalidRequest:
                  summary: Update body includes an unrecognized field
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        unknownField:
                        - Unrecognized key
                    error: Bad Request
                    message: 'Unrecognized key(s) in object: ''unknownField'''
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an invalid schema or parameters.
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the request was not authenticated.
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the user does not have the required privileges to perform the request.
        '404':
          content:
            application/json:
              examples:
                ruleNotFound:
                  summary: No rule exists for the given ID
                  value:
                    code: RULE_NOT_FOUND
                    details:
                      rule_id: rule-1
                    error: Not Found
                    message: Rule with id "rule-1" not found
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates a rule with the given ID does not exist.
        '409':
          content:
            application/json:
              examples:
                ruleVersionConflict:
                  summary: Indicates the rule was concurrently updated by another caller.
                  value:
                    code: RULE_VERSION_CONFLICT
                    details:
                      rule_id: rule-1
                    error: Conflict
                    message: Rule with id "rule-1" has already been updated by another user
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the rule was concurrently updated by another caller.
        '500':
          content:
            application/json:
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an unexpected server-side error.
        '503':
          content:
            application/json:
              examples:
                alertingDisabled:
                  summary: Alerting engine is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
      summary: Update a rule
      tags:
      - alerting-v2
      x-state: Experimental; added in 9.5.0
      x-metaTags:
      - content: Kibana
        name: product_name
    put:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb put">put</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/v2/rules/{id}</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Creates a rule with the given identifier, or fully replaces it if one already exists.<br/><br/>[Required authorization] Route required privileges: manage_alerting-v2-rules.'
      operationId: put-alerting-v2-rules-id
      parameters:
      - description: A required header to protect against CSRF attacks
        in: header
        name: kbn-xsrf
        required: true
        schema:
          example: 'true'
          type: string
      - description: The identifier for the rule.
        in: path
        name: id
        required: true
        schema:
          maxLength: 150
          minLength: 1
          type: string
      requestBody:
        content:
          application/json:
            examples:
              upsertRuleRequest:
                summary: Create or replace a host CPU threshold rule
                value:
                  grouping:
                    fields:
                    - host.name
                  kind: alert
                  metadata:
                    description: Alerts when average CPU usage exceeds a threshold.
                    name: Host CPU high
                    tags:
                    - production
                    - infra
                  query:
                    breach:
                      query: FROM metrics-* | WHERE host.cpu.usage > 0.9 | STATS avg_cpu = AVG(host.cpu.usage) BY host.name
                    format: standalone
                  recovery_strategy: no_breach
                  schedule:
                    every: 1m
                    lookback: 5m
                  state_transition:
                    pending_count: 1
                    recovering_count: 1
                  time_field: '@timestamp'
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_new_rule'
      responses:
        '200':
          content:
            application/json:
              examples:
                upsertRuleReplacedResponse:
                  summary: Replaced an existing rule
                  value:
                    created_at: '2026-01-15T12:00:00.000Z'
                    created_by: elastic
                    enabled: true
                    grouping:
                      fields:
                      - host.name
                    id: rule-1
                    kind: alert
                    metadata:
                      description: Alerts when average CPU usage exceeds a threshold.
                      name: Host CPU high
                      tags:
                      - production
                      - infra
                      version: 1
                    query:
                      breach:
                        query: FROM metrics-* | WHERE host.cpu.usage > 0.9 | STATS avg_cpu = AVG(host.cpu.usage) BY host.name
                      format: standalone
                    recovery_strategy: no_breach
                    schedule:
                      every: 1m
                      lookback: 5m
                    state_transition:
                      pending_count: 1
                      recovering_count: 1
                    time_field: '@timestamp'
                    updated_at: '2026-01-15T12:00:00.000Z'
                    updated_by: elastic
                    version: WzAsMV0=
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_rule_response'
          description: Returns the replaced rule.
        '201':
          content:
            application/json:
              examples:
                upsertRuleCreatedResponse:
                  summary: Created a new rule with the given ID
                  value:
                    created_at: '2026-01-15T12:00:00.000Z'
                    created_by: elastic
                    enabled: true
                    grouping:
                      fields:
                      - host.name
                    id: rule-1
                    kind: alert
                    metadata:
                      description: Alerts when average CPU usage exceeds a threshold.
                      name: Host CPU high
                      tags:
                      - production
                      - infra
                      version: 1
                    query:
                      breach:
                        query: FROM metrics-* | WHERE host.cpu.usage > 0.9 | STATS avg_cpu = AVG(host.cpu.usage) BY host.name
                      format: standalone
                    recovery_strategy: no_breach
                    schedule:
                      every: 1m
                      lookback: 5m
                    state_transition:
                      pending_count: 1
                      recovering_count: 1
                    time_field: '@timestamp'
                    updated_at: '2026-01-15T12:00:00.000Z'
                    updated_by: elastic
                    version: WzAsMV0=
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_rule_response'
          description: Returns the newly created rule.
        '400':
          content:
            application/json:
              examples:
                invalidRequest:
                  summary: Upsert body is missing required rule metadata
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        metadata:
                        - Required
                    error: Bad Request
                    message: 'metadata: Required'
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an invalid schema or parameters.
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the request was not authenticated.
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the user does not have the required privileges to perform the request.
        '404':
          content:
            application/json:
              examples:
                ruleNotFound:
                  summary: No rule exists for the given ID
                  value:
                    code: RULE_NOT_FOUND
                    details:
                      rule_id: rule-1
                    error: Not Found
                    message: Rule with id "rule-1" not found
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates a rule with the given ID does not exist.
        '409':
          content:
            application/json:
              examples:
                ruleVersionConflict:
                  summary: Rule was changed concurrently by another caller
                  value:
                    code: RULE_VERSION_CONFLICT
                    details:
                      rule_id: rule-1
                    error: Conflict
                    message: Rule with id "rule-1" has already been updated by another user
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the rule was created or updated concurrently, or the request changes immutable fields.
        '500':
          content:
            application/json:
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an unexpected server-side error.
        '503':
          content:
            application/json:
              examples:
                alertingDisabled:
                  summary: Alerting engine is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
      summary: Create or replace a rule
      tags:
      - alerting-v2
      x-state: Experimental; added in 9.5.0
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/alerting/v2/rules/{id}/_disable:
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/v2/rules/{id}/_disable</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Disable a rule by identifier.<br/><br/>[Required authorization] Route required privileges: manage_alerting-v2-rules.'
      operationId: post-alerting-v2-rules-id-disable
      parameters:
      - description: A required header to protect against CSRF attacks
        in: header
        name: kbn-xsrf
        required: true
        schema:
          example: 'true'
          type: string
      - description: The identifier for the rule.
        in: path
        name: id
        required: true
        schema:
          maxLength: 150
          minLength: 1
          type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                disableRuleResponse:
                  summary: Disabled host CPU threshold rule
                  value:
                    created_at: '2026-01-15T12:00:00.000Z'
                    created_by: elastic
                    enabled: false
                    grouping:
                      fields:
                      - host.name
                    id: rule-1
                    kind: alert
                    metadata:
                      description: Alerts when average CPU usage exceeds a threshold.
                      name: Host CPU high
                      tags:
                      - production
                      - infra
                      version: 1
                    query:
                      breach:
                        query: FROM metrics-* | WHERE host.cpu.usage > 0.9 | STATS avg_cpu = AVG(host.cpu.usage) BY host.name
                      format: standalone
                    recovery_strategy: no_breach
                    schedule:
                      every: 1m
                      lookback: 5m
                    state_transition:
                      pending_count: 1
                      recovering_count: 1
                    time_field: '@timestamp'
                    updated_at: '2026-01-15T12:00:00.000Z'
                    updated_by: elastic
                    version: WzAsMV0=
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_rule_response'
          description: Returns the disabled rule.
        '400':
          content:
            application/json:
              examples:
                invalidRequest:
                  summary: Indicates an invalid schema or parameters.
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        errors: []
                        properties:
                          page:
                            errors:
                            - 'Too small: expected number to be >=1'
                    error: Bad Request
                    message: 'page: Too small: expected number to be >=1'
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the request failed schema validation.
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the request was not authenticated.
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the user does not have the required privileges to perform the request.
        '404':
          content:
            application/json:
              examples:
                ruleNotFound:
                  summary: No rule exists for the given ID
                  value:
                    code: RULE_NOT_FOUND
                    details:
                      rule_id: rule-1
                    error: Not Found
                    message: Rule with id "rule-1" not found
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates a rule with the given ID does not exist.
        '409':
          content:
            application/json:
              examples:
                ruleVersionConflict:
                  summary: Indicates the rule was concurrently updated by another caller.
                  value:
                    code: RULE_VERSION_CONFLICT
                    details:
                      rule_id: rule-1
                    error: Conflict
                    message: Rule with id "rule-1" has already been updated by another user
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the rule was concurrently updated by another caller.
        '500':
          content:
            application/json:
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an unexpected server-side error.
        '503':
          content:
            application/json:
              examples:
                alertingDisabled:
                  summary: Alerting engine is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
      summary: Disable a rule
      tags:
      - alerting-v2
      x-state: Experimental; added in 9.5.0
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/alerting/v2/rules/{id}/_enable:
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/v2/rules/{id}/_enable</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Enable a rule by identifier.<br/><br/>[Required authorization] Route required privileges: manage_alerting-v2-rules.'
      operationId: post-alerting-v2-rules-id-enable
      parameters:
      - description: A required header to protect against CSRF attacks
        in: header
        name: kbn-xsrf
        required: true
        schema:
          example: 'true'
          type: string
      - description: The identifier for the rule.
        in: path
        name: id
        required: true
        schema:
          maxLength: 150
          minLength: 1
          type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                enableRuleResponse:
                  summary: Enabled host CPU threshold rule
                  value:
                    created_at: '2026-01-15T12:00:00.000Z'
                    created_by: elastic
                    enabled: true
                    grouping:
                      fields:
                      - host.name
                    id: rule-1
                    kind: alert
                    metadata:
                      description: Alerts when average CPU usage exceeds a threshold.
                      name: Host CPU high
                      tags:
                      - production
                      - infra
                      version: 1
                    query:
                      breach:
                        query: FROM metrics-* | WHERE host.cpu.usage > 0.9 | STATS avg_cpu = AVG(host.cpu.usage) BY host.name
                      format: standalone
                    recovery_strategy: no_breach
                    schedule:
                      every: 1m
                      lookback: 5m
                    state_transition:
                      pending_count: 1
                      recovering_count: 1
                    time_field: '@timestamp'
                    updated_at: '2026-01-15T12:00:00.000Z'
                    updated_by: elastic
                    version: WzAsMV0=
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_rule_response'
          description: Returns the enabled rule.
        '400':
          content:
            application/json:
              examples:
                maxSchedulesPerMinuteExceeded:
                  summary: Indicates the request is invalid, for example enabling the rule would exceed the configured schedule limit.
                  value:
                    code: MAX_SCHEDULES_PER_MINUTE_EXCEEDED
                    details:
                      interval: 1m
                      maxScheduledPerMinute: 400
                    error: Bad Request
                    message: Rule schedule of "1m" would exceed the limit of 400 rule runs per minute
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the request is invalid, for example enabling the rule would exceed the configured schedule limit.
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the request was not authenticated.
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the user does not have the required privileges to perform the request.
        '404':
          content:
            application/json:
              examples:
                ruleNotFound:
                  summary: No rule exists for the given ID
                  value:
                    code: RULE_NOT_FOUND
                    details:
                      rule_id: rule-1
                    error: Not Found
                    message: Rule with id "rule-1" not found
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates a rule with the given ID does not exist.
        '409':
          content:
            application/json:
              examples:
                ruleVersionConflict:
                  summary: Indicates the rule was concurrently updated by another caller.
                  value:
                    code: RULE_VERSION_CONFLICT
                    details:
                      rule_id: rule-1
                    error: Conflict
                    message: Rule with id "rule-1" has already been updated by another user
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the rule was concurrently updated by another caller.
        '500':
          content:
            application/json:
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an unexpected server-side error.
        '503':
          content:
            application/json:
              examples:
                alertingDisabled:
                  summary: Alerting engine is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
      summary: Enable a rule
      tags:
      - alerting-v2
      x-state: Experimental; added in 9.5.0
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/alerting/v2/rules/{id}/_run:
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/v2/rules/{id}/_run</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        [Required authorization] Route required privileges: manage_alerting-v2-rules.'
      operationId: post-alerting-v2-rules-id-run
      parameters:
      - description: A required header to protect against CSRF attacks
        in: header
        name: kbn-xsrf
        required: true
        schema:
          example: 'true'
          type: string
      - description: The identifier for the rule.
        in: path
        name: id
        required: true
        schema:
          maxLength: 150
          minLength: 1
          type: string
      responses:
        '204':
          description: The rule run was triggered successfully.
        '400':
          content:
            application/json:
              examples:
                ruleDisabled:
                  summary: Indicates the rule is disabled and cannot be run.
                  value:
                    code: RULE_DISABLED
                    details:
                      rule_id: rule-1
                    error: Bad Request
                    message: Rule with id "rule-1" is disabled and cannot be run
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the rule is disabled and cannot be run.
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the request was not authenticated.
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the user does not have the required privileges to perform the request.
        '404':
          content:
            application/json:
              examples:
                ruleNotFound:
                  summary: No rule exists for the given ID
                  value:
                    code: RULE_NOT_FOUND
                    details:
                      rule_id: rule-1
                    error: Not Found
                    message: Rule with id "rule-1" not found
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates a rule with the given ID does not exist.
        '409':
          content:
            application/json:
              examples:
                ruleAlreadyRunning:
                  summary: Indicates the rule is already running or the run request conflicted.
                  value:
                    code: RULE_ALREADY_RUNNING
                    details:
                      rule_id: rule-1
                    error: Conflict
                    message: Rule with id "rule-1" is already running
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the rule is already running or the run request conflicted.
        '500':
          content:
            application/json:
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an unexpected server-side error.
        '503':
          content:
            application/json:
              examples:
                alertingDisabled:
                  summary: Alerting engine is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
      summary: Run a rule now
      tags:
      - alerting-v2
      x-state: Experimental; added in 9.5.0
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/alerting/v2/rules/{id}/history:
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/v2/rules/{id}/history</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Get a paginated list of prior configurations for a rule from change history. List rows are lean (diff summary only); use the detail route for full snapshots.<br/><br/>[Required authorization] Route required privileges: read_alerting-v2-rules.'
      operationId: get-alerting-v2-rules-id-history
      parameters:
      - description: The identifier for the rule.
        in: path
        name: id
        required: true
        schema:
          maxLength: 150
          minLength: 1
          type: string
      - description: Page number (1-based).
        in: query
        name: page
        required: true
        schema:
          default: 1
          maximum: 10000
          minimum: 1
          type: integer
      - description: Number of results per page.
        in: query
        name: per_page
        required: true
        schema:
          default: 20
          maximum: 100
          minimum: 1
          type: integer
      responses:
        '200':
          content:
            application/json:
              examples:
                listRuleChangeHistoryResponse:
                  summary: Two rule change-history events (newest first)
                  value:
                    items:
                    - action: rule_update
                      actor:
                        name: elastic
                        profileId: u_profile_1
                      changes:
                        count: 1
                        summary:
                          metadata:
                            name: Host CPU high
                      id: 0194f0c8-aaaa-7bbb-8ccc-ddddeeeeffff
                      isCurrent: true
                      metadata:
                        version: 2
                      timestamp: '2026-01-15T12:05:00.000Z'
                    - action: rule_create
                      actor:
                        name: elastic
                        profileId: u_profile_1
                      id: 0194f0c8-1111-7222-8333-444455556666
                      metadata:
                        version: 1
                      timestamp: '2026-01-15T12:00:00.000Z'
                    total: 2
              schema:
                additionalProperties: false
                type: object
                properties:
                  items:
                    items:
                      type: object
                      properties:
                        action:
                          type: string
                        actor:
                          type: object
                          properties:
                            name:
                              type: string
                            profileId:
                              type: string
                          required:
                          - name
                        changes:
                          type: object
                          properties:
                            count:
                              maximum: 9007199254740991
                              minimum: 0
                              type: integer
                            summary:
                              additionalProperties: {}
                              type: object
                          required:
                          - count
                        comment:
                          type: string
                        id:
                          type: string
                        isCurrent:
                          type: boolean
                        metadata:
                          additionalProperties: {}
                          type: object
                        tags:
                          items:
                            type: string
                          type: array
                        timestamp:
                          type: string
                      required:
                      - id
                      - timestamp
                      - actor
                      - action
                    type: array
                  total:
                    maximum: 9007199254740991
                    minimum: 0
                    type: integer
                required:
                - items
                - total
          description: Returns a paginated list of rule change-history events.
        '400':
          content:
            application/json:
              examples:
                invalidRequest:
                  summary: Exceeds the max result window
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        page:
                        - page * per_page cannot exceed 10000.
                    error: Bad Request
                    message: page * per_page cannot exceed 10000.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an invalid schema or parameters.
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the request was not authenticated.
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the user does not have the required privileges to perform the request.
        '500':
          content:
            application/json:
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an unexpected server-side error.
        '503':
          content:
            application/json:
              examples:
                alertingDisabled:
                  summary: Alerting engine is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
                ruleChangeHistoryUnavailable:
                  summary: Change history data stream is not initialized
                  value:
                    code: RULE_CHANGE_HISTORY_UNAVAILABLE
                    error: Service Unavailable
                    message: Rule change history is unavailable
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
      summary: List rule change history
      tags:
      - alerting-v2
      x-state: Experimental; added in 9.5.0
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/alerting/v2/rules/{id}/history/{eventId}:
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/v2/rules/{id}/history/{eventId}</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Get the full detail for a single rule change-history event, including the rule configuration snapshot.<br/><br/>[Required authorization] Route required privileges: read_alerting-v2-rules.'
      operationId: get-alerting-v2-rules-id-history-eventid
      parameters:
      - description: The identifier for the rule.
        in: path
        name: id
        required: true
        schema:
          maxLength: 150
          minLength: 1
          type: string
      - description: The change-history event identifier (`event.id`).
        in: path
        name: eventId
        required: true
        schema:
          maxLength: 150
          minLength: 1
          type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                getRuleChangeHistoryEventResponse:
                  summary: Retrieved rule change-history event with snapshot
                  value:
                    action: rule_update
                    actor:
                      name: elastic
                      profileId: u_profile_1
                    changes:
                      count: 1
                      summary:
                        metadata:
                          name: Host CPU high
                    id: 0194f0c8-aaaa-7bbb-8ccc-ddddeeeeffff
                    isCurrent: true
                    metadata:
                      version: 2
                    snapshot:
                      created_at: '2026-01-15T12:00:00.000Z'
                      created_by: elastic
                      enabled: true
                      grouping:
                        fields:
                        - host.name
                      id: rule-1
                      kind: alert
                      metadata:
                        description: Alerts when average CPU usage exceeds a threshold.
                        name: Host CPU critical
                        tags:
                        - production
                        - infra
                        version: 2
                      query:
                        breach:
                          query: FROM metrics-* | WHERE host.cpu.usage > 0.9 | STATS avg_cpu = AVG(host.cpu.usage) BY host.name
                        format: standalone
                      recovery_strategy: no_breach
                      schedule:
                        every: 1m
                        lookback: 5m
                      state_transition:
                        pending_count: 1
                        recovering_count: 1
                      time_field: '@timestamp'
                      updated_at: '2026-01-15T12:00:00.000Z'
                      updated_by: elastic
                    timestamp: '2026-01-15T12:05:00.000Z'
              schema:
                additionalProperties: false
                type: object
                properties:
                  action:
                    type: string
                  actor:
                    additionalProperties: false
                    type: object
                    properties:
                      name:
                        type: string
                      profileId:
                        type: string
                    required:
                    - name
                  changes:
                    additionalProperties: false
                    type: object
                    properties:
                      count:
                        maximum: 9007199254740991
                        minimum: 0
                        type: integer
                      summary:
                        additionalProperties: {}
                        type: object
                    required:
                    - count
                  comment:
                    type: string
                  id:
                    type: string
                  isCurrent:
                    type: boolean
                  metadata:
                    additionalProperties: {}
                    type: object
                  reason:
                    type: string
                  snapshot:
                    additionalProperties: {}
                    type: object
                  tags:
                    items:
                      type: string
                    type: array
                  timestamp:
                    type: string
                required:
                - id
                - timestamp
                - actor
                - action
                - snapshot
          description: Returns the requested rule change-history event.
        '400':
          content:
            application/json:
              examples:
                invalidRequest:
                  summary: Indicates an invalid schema or parameters.
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        errors: []
                        properties:
                          eventId:
                            errors:
                            - 'Too small: expected string to have >=1 characters'
                    error: Bad Request
                    message: 'eventId: Too small: expected string to have >=1 characters'
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the request failed schema validation.
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the request was not authenticated.
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the user does not have the required privileges to perform the request.
        '404':
          content:
            application/json:
              examples:
                ruleChangeNotFound:
                  summary: No change-history event exists for the given ID
                  value:
                    code: RULE_CHANGE_NOT_FOUND
                    details:
                      event_id: missing-event
                      rule_id: rule-1
                    error: Not Found
                    message: Rule change with event id "missing-event" not found for rule "rule-1"
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates a change-history event with the given ID does not exist.
        '500':
          content:
            application/json:
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an unexpected server-side error.
        '503':
          content:
            application/json:
              examples:
                alertingDisabled:
                  summary: Alerting engine is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
                ruleChangeHistoryUnavailable:
                  summary: Change history data stream is not initialized
                  value:
                    code: RULE_CHANGE_HISTORY_UNAVAILABLE
                    error: Service Unavailable
                    message: Rule change history is unavailable
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
      summary: Get a rule change-history event
      tags:
      - alerting-v2
      x-state: Experimental; added in 9.5.0
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/alerting/v2/rules/tags:
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/v2/rules/tags</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        [Required authorization] Route required privileges: read_alerting-v2-rules.'
      operationId: get-alerting-v2-rules-tags
      parameters:
      - description: Prefix to filter tags by. Returns all most-used tags when omitted.
        in: query
        name: search
        required: false
        schema:
          maxLength: 256
          type: string
      - description: Restrict tags to rules of the given kind.
        in: query
        name: kind
        required: false
        schema:
          anyOf:
          - description: Default. Tracks each problem as an alert episode and its lifecycle, link it to workflows to notify your team. Use when the user wants to detect and respond.
            enum:
            - alert
            type: string
          - description: Matches are stored as queryable events. No alerts, no notifications - just data. Use when the user wants to collect evidence.
            enum:
            - signal
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                ruleTagsResponse:
                  summary: Unique tags across matching rules
                  value:
                    tags:
                    - production
                    - infra
                    - critical
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_rule_tags_response'
          description: Returns the requested rule tags.
        '400':
          content:
            application/json:
              examples:
                invalidRequest:
                  summary: Indicates an invalid schema or parameters.
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        errors: []
                        properties:
                          search:
                            errors:
                            - 'Too big: expected string to have <=256 characters'
                    error: Bad Request
                    message: 'search: Too big: expected string to have <=256 characters'
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an invalid schema or parameters.
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the request was not authenticated.
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the user does not have the required privileges to perform the request.
        '500':
          content:
            application/json:
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an unexpected server-side error.
        '503':
          content:
            application/json:
              examples:
                alertingDisabled:
                  summary: Alerting engine is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
      summary: Get rule tags
      tags:
      - alerting-v2
      x-state: Experimental; added in 9.5.0
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/alerting/v2/suggestions/rule_event_fields:
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/v2/suggestions/rule_event_fields</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Get suggestions for matcher data fields.<br/><br/>[Required authorization] Route required privileges: read_alerting-v2-alerts.'
      operationId: get-alerting-v2-suggestions-rule-event-fields
      parameters:
      - description: Optional matcher expression used to scope suggested data field names.
        in: query
        name: matcher
        required: false
        schema:
          maxLength: 2048
          minLength: 1
          type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                matcherDataFieldsResponse:
                  summary: Available matcher data fields
                  value:
                  - host.name
                  - host.ip
                  - kibana.alert.rule.name
              schema:
                description: The list of available matcher data field names.
                items:
                  type: string
                type: array
          description: Returns the available matcher data field names.
        '400':
          content:
            application/json:
              examples:
                invalidRequest:
                  summary: Indicates an invalid schema or parameters.
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        errors: []
                        properties:
                          matcher:
                            errors:
                            - 'Too small: expected string to have >=1 characters'
                    error: Bad Request
                    message: 'matcher: Too small: expected string to have >=1 characters'
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an invalid schema or parameters.
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the request was not authenticated.
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the user does not have the required privileges to perform the request.
        '500':
          content:
            application/json:
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an unexpected server-side error.
        '503':
          content:
            application/json:
              examples:
                alertingDisabled:
                  summary: Alerting engine is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
      summary: Get matcher data fields suggestions
      tags:
      - alerting-v2
      x-state: Experimental; added in 9.5.0
      x-metaTags:
      - content: Kibana
        name: product_name
components:
  schemas:
    Kibana_HTTP_APIs_alerting_alert_action:
      description: 'Request body for creating a single alert action. One of: ack, unack, assign, tag, snooze, unsnooze, activate, deactivate.'
      discriminator:
        mapping:
          ack: '#/components/schemas/Kibana_HTTP_APIs_alerting_ack_alert_action'
          activate: '#/components/schemas/Kibana_HTTP_APIs_alerting_activate_alert_action'
          assign: '#/components/schemas/Kibana_HTTP_APIs_alerting_assign_alert_action'
          deactivate: '#/components/schemas/Kibana_HTTP_APIs_alerting_deactivate_alert_action'
          snooze: '#/components/schemas/Kibana_HTTP_APIs_alerting_snooze_alert_action'
          tag: '#/components/schemas/Kibana_HTTP_APIs_alerting_tag_alert_action'
          unack: '#/components/schemas/Kibana_HTTP_APIs_alerting_unack_alert_action'
          unsnooze: '#/components/schemas/Kibana_HTTP_APIs_alerting_unsnooze_alert_action'
        propertyName: action_type
      oneOf:
      - $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_ack_alert_action'
      - $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_unack_alert_action'
      - $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_assign_alert_action'
      - $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_tag_alert_action'
      - $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_snooze_alert_action'
      - $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_unsnooze_alert_action'
      - $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_activate_alert_action'
      - $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_deactivate_alert_action'
    Kibana_HTTP_APIs_alerting_match_action_policies_for_rule_request:
      additionalProperties: false
      type: object
      properties:
        rule:
          additionalProperties: false
          type: object
          properties:
            id:
              description: The ID of the rule.
              maxLength: 256
              minLength: 1
              type: string
            name:
              description: The name of the rule, used to evaluate global matcher expressions.
              maxLength: 256
              minLength: 1
              type: string
            tags:
              description: The tags of the rule, used to evaluate global matcher expressions.
              items:
                maxLength: 256
                minLength: 1
                type: string
              maxItems: 100
              type: array
    Kibana_HTTP_APIs_alerting_action_policy_throttle:
      additionalProperties: false
      type: object
      properties:
        interval:
          description: The throttle interval duration (e.g. 5m, 1h), or null when the strategy is intervalless.
          type:
          - string
          - 'null'
        strategy:
          anyOf:
          - description: notify only on episode status transitions (default for `per_episode`).
            enum:
            - on_status_change
            type: string
          - description: notify on transitions and at regular intervals.
            enum:
            - per_status_interval
            type: string
          - description: notify at regular intervals regardless of status (default for `all`/`per_field`).
            enum:
            - time_interval
            type: string
          - description: notify on every evaluation cycle (high volume).
            enum:
            - every_time
            type: string
          description: The throttle strategy.
    Kibana_HTTP_APIs_alerting_action_policy_grouping_mode:
      anyOf:
      - description: one notification per alert episode lifecycle (default).
        enum:
        - per_episode
        type: string
      - description: a single notification for all matching episodes.
        enum:
        - all
        type: string
      - description: group by specified `groupBy` fields.
        enum:
        - per_field
        type: string
      description: 'The grouping mode: per_episode groups by episode lifecycle, all sends a single notification for all alerts, per_field groups by the specified fields.'
    Kibana_HTTP_APIs_alerting_unsnooze_alert_action:
      additionalProperties: false
      type: object
      properties:
        action_type:
          description: Removes snooze from an alert.
          enum:
          - unsnooze
          type: string
      required:
      - action_type
    Kibana_HTTP_APIs_alerting_bulk_dry_run_response:
      additionalProperties: false
      description: Dry-run preview returned by a by-query bulk endpoint when `force` is false.
      type: object
      properties:
        match_count:
          description: 'Total number of resources matching the query. A dry run never fails on size, but if this exceeds 10000, re-sending the same query with `force: true` is rejected with `BULK_QUERY_MATCH_LIMIT_EXCEEDED`; narrow the query before executing.'
          maximum: 9007199254740991
          minimum: 0
          type: integer
        sample:
          description: Sample of matching resource IDs (up to 100) for spot-checking before executing.
          items:
            type: string
          maxItems: 100
          type: array
      required:
      - match_count
      - sample
    Kibana_HTTP_APIs_alerting_update_action_policy:
      additionalProperties: false
      type: object
      properties:
        description:
          description: A description of the action policy.
          maxLength: 1024
          type: string
        destinations:
          description: The list of destinations. At least one is required.
          items:
            $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_action_policy_destination'
          maxItems: 10
          minItems: 1
          type: array
        group_by:
          description: The fields used to group alerts.
          items:
            maxLength: 256
            minLength: 1
            type: string
          maxItems: 16
          type:
          - array
          - 'null'
        grouping_mode:
          allOf:
          - $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_action_policy_grouping_mode'
          description: The grouping mode for alert notifications.
        matcher:
          description: A KQL query string to match alerts.
          maxLength: 4096
          type:
          - string
          - 'null'
        name:
          description: The name of the action policy.
          maxLength: 256
          minLength: 1
          type: string
        tags:
          description: Tags for categorizing the action policy.
          items:
            maxLength: 128
            minLength: 1
            type: string
          maxItems: 20
          type:
          - array
          - 'null'
        throttle:
          allOf:
          - $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_action_policy_throttle'
          description: The throttle configuration for notifications.
        version:
          description: The current version of the action policy, used for optimistic concurrency control.
          maxLength: 256
          minLength: 1
          type: string
      required:
      - version
    Kibana_HTTP_APIs_alerting_rule_response:
      additionalProperties: false
      type: object
      properties:
        artifacts:
          description: Artifacts attached to the rule, each shaped as `{ id, type, data }`. `data` is a type-specific object (for example a `runbook` may carry `content`, a `dashboard` may carry `dashboardId`). Per-type shape is validated by the artifact-type registry when the type is registered; unregistered types pass through with envelope bounds only.
          items:
            $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_rule_artifact'
          maxItems: 100
          type: array
        created_at:
          description: ISO timestamp when the rule was created.
          type: string
        created_by:
          description: User who created the rule.
          type:
          - string
          - 'null'
        enabled:
          description: Whether the rule is enabled.
          type: boolean
        grouping:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_rule_grouping'
        id:
          description: Unique rule identifier.
          type: string
        kind:
          anyOf:
          - description: Default. Tracks each problem as an alert episode and its lifecycle, link it to workflows to notify your team. Use when the user wants to detect and respond.
            enum:
            - alert
            type: string
          - description: Matches are stored as queryable events. No alerts, no notifications - just data. Use when the user wants to collect evidence.
            enum:
            - signal
            type: string
          description: The kind of the rule.
        metadata:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_rule_response_metadata'
        no_data_strategy:
          anyOf:
          - description: Holds the last known episode status when no data is present.
            enum:
            - last_known_status
            type: string
          - description: Emits a `no_data` alert event when no_data query returns no rows for the group. "emit" is not currently accepted by the create/update API.
            enum:
            - emit
            type: string
          - description: Resolves the alert episode to inactive on the first no-data run.
            enum:
            - recover
            type: string
          - description: No-data situations are ignored (default).
            enum:
            - none
            type: string
          description: How to handle no-data situations. "last_known_status" holds the last known status; "recover" forces recovery; "none" disables no-data detection. "emit" is not currently accepted by the create/update API. Standalone-format rules must provide a `no_data` query block when this is not "none"; composed-format rules use `base` as the data-presence query.
        query:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_rule_query'
        recovery_strategy:
          anyOf:
          - description: recovers groups that stop breaching (default).
            enum:
            - no_breach
            type: string
          - description: uses a custom recovery query to detect recovery.
            enum:
            - query
            type: string
          - description: disables recovery entirely.
            enum:
            - none
            type: string
          description: How recovery is detected. "no_breach" recovers groups that stop breaching; "query" uses a custom recovery query; "none" disables recovery.
        schedule:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_rule_schedule'
        state_transition:
          additionalProperties: false
          description: Episode state transition thresholds (alert-only).
          type:
          - object
          - 'null'
          properties:
            pending_count:
              description: Consecutive breaches before transitioning to active.
              maximum: 1000
              minimum: 0
              type: integer
            pending_operator:
              description: How to combine count and timeframe for pending.
              enum:
              - AND
              - OR
              type: string
            pending_timeframe:
              description: Time window for pending evaluation, e.g. 5m, 15m.
              type: string
            recovering_count:
              description: Consecutive recoveries before transitioning to inactive.
              maximum: 1000
              minimum: 0
              type: integer
            recovering_operator:
              description: How to combine count and timeframe for recovering.
              enum:
              - AND
              - OR
              type: string
            recovering_timeframe:
              description: Time window for recovering evaluation, e.g. 5m, 15m.
              type: string
        time_field:
          default: '@timestamp'
          description: Time field used for the lookback window range filter.
          maxLength: 128
          minLength: 1
          type: string
        updated_at:
          description: ISO timestamp when the rule was last updated.
          type: string
        updated_by:
          description: User who last updated the rule.
          type:
          - string
          - 'null'
        version:
          description: The saved object version token of the rule, used for optimistic concurrency control.
          type: string
      required:
      - kind
      - metadata
      - schedule
      - query
      - id
      - enabled
      - created_by
      - created_at
      - updated_by
      - updated_at
    Kibana_HTTP_APIs_alerting_bulk_snooze_action_policies_request:
      additionalProperties: false
      type: object
      properties:
        ids:
          description: Explicit list of IDs to operate on.
          items:
            maxLength: 150
            minLength: 1
            type: string
          maxItems: 100
          minItems: 1
          type: array
        snoozed_until:
          description: The ISO datetime until which the targeted action policies should be snoozed.
          format: date-time
          pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
          type: string
      required:
      - ids
      - snoozed_until
    Kibana_HTTP_APIs_alerting_new_ack_alert_action:
      additionalProperties: false
      type: object
      properties:
        episode_id:
          description: The episode identifier for the alert to acknowledge.
          maxLength: 150
          minLength: 1
          type: string
      required:
      - episode_id
    Kibana_HTTP_APIs_alerting_new_tag_alert_action:
      additionalProperties: false
      type: object
      properties:
        tags:
          description: List of tags to add to the alert.
          items:
            maxLength: 128
            minLength: 1
            type: string
          maxItems: 20
          type: array
      required:
      - tags
    Kibana_HTTP_APIs_alerting_bulk_get_rules_request:
      additionalProperties: false
      type: object
      properties:
        ids:
          description: Rule identifiers to retrieve. The response preserved this order.
          items:
            description: A rule identifier.
            maxLength: 150
            minLength: 1
            type: string
          maxItems: 100
          minItems: 1
          type: array
      required:
      - ids
    Kibana_HTTP_APIs_alerting_tag_alert_action:
      additionalProperties: false
      type: object
      properties:
        action_type:
          description: Adds tags to an alert.
          enum:
          - tag
          type: string
        tags:
          description: List of tags to add to the alert.
          items:
            maxLength: 128
            minLength: 1
            type: string
          maxItems: 20
          type: array
      required:
      - action_type
      - tags
    Kibana_HTTP_APIs_alerting_rule_response_metadata:
      additionalProperties: false
      type: object
      properties:
        builder_type:
          description: Identifies the rule builder that authored this rule (e.g. "threshold"). Absent for rules authored directly in ES|QL.
          maxLength: 64
          type: string
        description:
          description: Human-readable description of the rule.
          maxLength: 1024
          type: string
        name:
          description: Rule name (must be unique within the space).
          maxLength: 256
          minLength: 1
          type: string
        owner:
          description: Owner of the rule.
          maxLength: 256
          type: string
        tags:
          description: Tags for categorization, e.g. ["production", "infra"].
          items:
            maxLength: 128
            minLength: 1
            type: string
          maxItems: 20
          minItems: 1
          type: array
        version:
          description: Monotonically increasing integer number representing a rule configuration version, incremented on every change. Used on generated rule events as `rule.version`.
          maximum: 9007199254740991
          minimum: 1
          type: integer
      required:
      - name
      - version
    Kibana_HTTP_APIs_alerting_update_rule:
      additionalProperties: false
      type: object
      properties:
        artifacts:
          description: Artifacts attached to the rule, each shaped as `{ id, type, data }`. `data` is a type-specific object (for example a `runbook` may carry `content`, a `dashboard` may carry `dashboardId`). Per-type shape is validated by the artifact-type registry when the type is registered; unregistered types pass through with envelope bounds only.
          items:
            $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_rule_artifact'
          maxItems: 100
          type:
          - array
          - 'null'
        grouping:
          allOf:
          - $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_rule_grouping'
        metadata:
          additionalProperties: false
          type: object
          properties:
            builder_type:
              maxLength: 64
              type:
              - string
              - 'null'
            description:
              description: Human-readable description of the rule.
              maxLength: 1024
              type: string
            name:
              description: Rule name (must be unique within the space).
              maxLength: 256
              minLength: 1
              type: string
            owner:
              description: Owner of the rule.
              maxLength: 256
              type: string
            tags:
              description: Tags for categorization, e.g. ["production", "infra"].
              items:
                maxLength: 128
                minLength: 1
                type: string
              maxItems: 20
              minItems: 1
              type: array
        no_data_strategy:
          anyOf:
          - description: Holds the last known episode status when no data is present.
            enum:
            - last_known_status
            type: string
          - description: Emits a `no_data` alert event when no_data query returns no rows for the group. "emit" is not currently accepted by the create/update API.
            enum:
            - emit
            type: string
          - description: Resolves the alert episode to inactive on the first no-data run.
            enum:
            - recover
            type: string
          - description: No-data situations are ignored (default).
            enum:
            - none
            type: string
        query:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_rule_query'
        recovery_strategy:
          anyOf:
          - description: recovers groups that stop breaching (default).
            enum:
            - no_breach
            type: string
          - description: uses a custom recovery query to detect recovery.
            enum:
            - query
            type: string
          - description: disables recovery entirely.
            enum:
            - none
            type: string
        schedule:
          additionalProperties: false
          type:
          - object
          - 'null'
          properties:
            every:
              description: Execution interval, e.g. 1m, 5m, 1h.
              type: string
            lookback:
              description: Lookback window for the query, e.g. 5m, 1h. Can also be expressed in ES|QL.
              type: string
        state_transition:
          anyOf:
          - additionalProperties: false
            description: Episode state transition thresholds (alert-only).
            type: object
            properties:
              pending_count:
                description: Consecutive breaches before transitioning to active.
                maximum: 1000
                minimum: 0
                type: integer
              pending_operator:
                description: How to combine count and timeframe for pending.
                enum:
                - AND
                - OR
                type: string
              pending_timeframe:
                description: Time window for pending evaluation, e.g. 5m, 15m.
                type: string
              recovering_count:
                description: Consecutive recoveries before transitioning to inactive.
                maximum: 1000
                minimum: 0
                type: integer
              recovering_operator:
                description: How to combine count and timeframe for recovering.
                enum:
                - AND
                - OR
                type: string
              recovering_timeframe:
                description: Time window for recovering evaluation, e.g. 5m, 15m.
                type: string
          - {}
        time_field:
          maxLength: 128
          minLength: 1
          type: string
        version:
          description: The current version of the rule, used for optimistic concurrency control.
          maxLength: 256
          minLength: 1
          type: string
    Kibana_HTTP_APIs_alerting_policy_execution_history_response:
      additionalProperties: false
      type: object
      properties:
        items:
          items:
            $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_policy_execution_history_item'
          type: array
        page:
          maximum: 9007199254740991
          minimum: 1
          type: integer
        per_page:
          maximum: 9007199254740991
          minimum: 0
          type: integer
        search_matches:
          additionalProperties: false
          description: Per-type match counts for the active search, plus the cap used as filter. Null when no search was provided. When policies > cap or rules > cap the result is truncated.
          type:
          - object
          - 'null'
          properties:
            cap:
              description: Maximum number of policy/rule ids the server uses as a filter.
              type: number
            policies:
              description: Total policies matching the search.
              type: number
            rules:
              description: Total rules matching the search.
              type: number
          required:
          - policies
          - rules
          - cap
        total_events:
          maximum: 9007199254740991
          minimum: 0
          type: integer
      required:
      - items
      - page
      - per_page
      - total_events
      - search_matches
    Kibana_HTTP_APIs_alerting_rule_query:
      description: Detection query configuration.
      discriminator:
        mapping:
          composed: '#/components/schemas/Kibana_HTTP_APIs_alerting_composed_rule_query'
          standalone: '#/components/schemas/Kibana_HTTP_APIs_alerting_standalone_rule_query'
        propertyName: format
      oneOf:
      - $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_composed_rule_query'
      - $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_standalone_rule_query'
    Kibana_HTTP_APIs_alerting_activate_alert_action:
      additionalProperties: false
      type: object
      properties:
        action_type:
          description: Activates an alert.
          enum:
          - activate
          type: string
        reason:
          description: Reason for activating the alert.
          maxLength: 1024
          minLength: 1
          type: string
      required:
      - action_type
      - reason
    Kibana_HTTP_APIs_alerting_rule_execution:
      additionalProperties: false
      type: object
      properties:
        ended_at:
          type: string
        error:
          additionalProperties: false
          type:
          - object
          - 'null'
          properties:
            message:
              type: string
            stack_trace:
              type:
              - string
              - 'null'
          required:
          - message
          - stack_trace
        id:
          type: string
        outcome:
          enum:
          - success
          - failure
          type: string
        reason:
          type:
          - string
          - 'null'
        rule:
          additionalProperties: false
          type: object
          properties:
            id:
              type: string
            version:
              maximum: 9007199254740991
              minimum: -9007199254740991
              type:
              - integer
              - 'null'
          required:
          - id
          - version
        space_id:
          type: string
        started_at:
          type: string
        timings:
          additionalProperties: false
          type: object
          properties:
            duration:
              maximum: 9007199254740991
              minimum: 0
              type: integer
            scheduled_delay:
              maximum: 9007199254740991
              minimum: -9007199254740991
              type: integer
          required:
          - duration
          - scheduled_delay
      required:
      - id
      - rule
      - space_id
      - started_at
      - ended_at
      - timings
      - outcome
      - reason
      - error
    Kibana_HTTP_APIs_alerting_new_assign_alert_action:
      additionalProperties: false
      type: object
      properties:
        assignee_uid:
          description: User profile UID of the assignee, or null to remove the assignee from the episode.
          maxLength: 256
          type:
          - string
          - 'null'
        episode_id:
          description: The episode identifier to assign.
          maxLength: 150
          minLength: 1
          type: string
      required:
      - episode_id
      - assignee_uid
    Kibana_HTTP_APIs_alerting_action_policy_list_response:
      additionalProperties: false
      description: Paginated list of action policies.
      type: object
      properties:
        items:
          description: The list of action policies.
          items:
            $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_action_policy_response'
          type: array
        page:
          description: The current page number.
          type: number
        per_page:
          description: The number of action policies per page.
          type: number
        total:
          description: The total number of action policies matching the query.
          type: number
      required:
      - items
      - total
      - page
      - per_page
    Kibana_HTTP_APIs_alerting_new_rule:
      additionalProperties: false
      type: object
      properties:
        artifacts:
          description: Artifacts attached to the rule, each shaped as `{ id, type, data }`. `data` is a type-specific object (for example a `runbook` may carry `content`, a `dashboard` may carry `dashboardId`). Per-type shape is validated by the artifact-type registry when the type is registered; unregistered types pass through with envelope bounds only.
          items:
            $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_rule_artifact'
          maxItems: 100
          type: array
        grouping:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_rule_grouping'
        kind:
          anyOf:
          - description: Default. Tracks each problem as an alert episode and its lifecycle, link it to workflows to notify your team. Use when the user wants to detect and respond.
            enum:
            - alert
            type: string
          - description: Matches are stored as queryable events. No alerts, no notifications - just data. Use when the user wants to collect evidence.
            enum:
            - signal
            type: string
          description: The kind of the rule.
        metadata:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_rule_metadata'
        no_data_strategy:
          anyOf:
          - description: Holds the last known episode status when no data is present.
            enum:
            - last_known_status
            type: string
          - description: Emits a `no_data` alert event when no_data query returns no rows for the group. "emit" is not currently accepted by the create/update API.
            enum:
            - emit
            type: string
          - description: Resolves the alert episode to inactive on the first no-data run.
            enum:
            - recover
            type: string
          - description: No-data situations are ignored (default).
            enum:
            - none
            type: string
          description: How to handle no-data situations. "last_known_status" holds the last known status; "recover" forces recovery; "none" disables no-data detection. "emit" is not currently accepted by the create/update API. Standalone-format rules must provide a `no_data` query block when this is not "none"; composed-format rules use `base` as the data-presence query.
        query:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_rule_query'
        recovery_strategy:
          anyOf:
          - description: recovers groups that stop breaching (default).
            enum:
            - no_breach
            type: string
          - description: uses a custom recovery query to detect recovery.
            enum:
            - query
            type: string
          - description: disables recovery entirely.
            enum:
            - none
            type: string
          description: How recovery is detected. "no_breach" recovers groups that stop breaching; "query" uses a custom recovery query; "none" disables recovery.
        schedule:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_rule_schedule'
        state_transition:
          additionalProperties: false
          description: Episode state transition thresholds (alert-only).
          type:
          - object
          - 'null'
          properties:
            pending_count:
              description: Consecutive breaches before transitioning to active.
              maximum: 1000
              minimum: 0
              type: integer
            pending_operator:
              description: How to combine count and timeframe for pending.
              enum:
              - AND
              - OR
              type: string
            pending_timeframe:
              description: Time window for pending evaluation, e.g. 5m, 15m.
              type: string
            recovering_count:
              description: Consecutive recoveries before transitioning to inactive.
              maximum: 1000
              minimum: 0
              type: integer
            recovering_operator:
              description: How to combine count and timeframe for recovering.
              enum:
              - AND
              - OR
              type: string
            recovering_timeframe:
              description: Time window for recovering evaluation, e.g. 5m, 15m.
              type: string
        time_field:
          default: '@timestamp'
          description: Time field used for the lookback window range filter.
          maxLength: 128
          minLength: 1
          type: string
      required:
      - kind
      - metadata
      - schedule
      - query
    Kibana_HTTP_APIs_alerting_standalone_rule_query:
      additionalProperties: false
      description: 'Standalone queries: independent full queries for breach, recovery, and no_data.'
      type: object
      properties:
        breach:
          additionalProperties: false
          description: Breach detection configuration (required).
          type: object
          properties:
            query:
              description: Full ES|QL query for breach detection (required).
              maxLength: 10000
              minLength: 1
              type: string
          required:
          - query
        format:
          enum:
          - standalone
          type: string
        no_data:
          additionalProperties: false
          description: No-data detection query. Required when no_data_strategy is not "none".
          type: object
          properties:
            query:
              description: Full ES|QL query that detects presence of data.
              maxLength: 10000
              minLength: 1
              type: string
          required:
          - query
        recovery:
          additionalProperties: false
          description: Recovery query. Required when recovery_strategy is "query".
          type: object
          properties:
            query:
              description: Full ES|QL query for recovery detection.
              maxLength: 10000
              minLength: 1
              type: string
          required:
          - query
      required:
      - format
      - breach
    Kibana_HTTP_APIs_alerting_rule_executions_response:
      additionalProperties: false
      type: object
      properties:
        items:
          items:
            $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_rule_execution'
          type: array
        page:
          maximum: 9007199254740991
          minimum: 1
          type: integer
        per_page:
          maximum: 9007199254740991
          minimum: 1
          type: integer
        total:
          maximum: 9007199254740991
          minimum: 0
          type: integer
      required:
      - items
      - total
      - page
      - per_page
    Kibana_HTTP_APIs_alerting_bulk_create_alert_action_item:
      allOf:
      - $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_alert_action'
      - additionalProperties: false
        description: Alert action payload with group identifier for bulk requests.
        type: object
        properties:
          group_hash:
            description: Hash identifying the alert group to apply the action to.
            maxLength: 256
            minLength: 1
            type: string
        required:
        - group_hash
    Kibana_HTTP_APIs_alerting_error_response:
      additionalProperties: false
      type: object
      properties:
        code:
          description: A stable, machine-readable error code (e.g., "RULE_NOT_FOUND", "INVALID_SCHEDULE"). Safe for clients to branch on.
          type: string
        details:
          additionalProperties: {}
          description: Optional structured context (e.g., validation field errors, conflict resource IDs).
          type: object
        error:
          description: A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.
          type: string
        message:
          description: A human-friendly explanation of the error. Subject to change without notice. Do not parse or rely on its content.
          type: string
      required:
      - code
      - error
      - message
    Kibana_HTTP_APIs_alerting_assign_alert_action:
      additionalProperties: false
      type: object
      properties:
        action_type:
          description: Assigns an alerting episode to a user, or clears the assignee when null.
          enum:
          - assign
          type: string
        assignee_uid:
          description: User profile UID of the assignee, or null to remove the assignee from the episode.
          maxLength: 256
          type:
          - string
          - 'null'
        episode_id:
          description: The episode identifier to assign.
          maxLength: 150
          minLength: 1
          type: string
      required:
      - action_type
      - episode_id
      - assignee_uid
    Kibana_HTTP_APIs_alerting_snooze_alert_action:
      additionalProperties: false
      type: object
      properties:
        action_type:
          description: Snoozes an alert.
          enum:
          - snooze
          type: string
        expiry:
          description: ISO datetime when snooze should expire.
          format: date-time
          pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
          type: string
      required:
      - action_type
    Kibana_HTTP_APIs_alerting_matched_action_policy:
      additionalProperties: false
      description: An action policy that matches a rule, along with the reason it matched.
      type: object
      properties:
        actionPolicy:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_action_policy_response'
          description: The matched action policy.
        category:
          description: 'Why this action policy matches the rule: "global" (applies to all rules, no filter), or "global-filtered" (applies to all rules, KQL filter evaluated to true).'
          enum:
          - global
          - global-filtered
          type: string
      required:
      - actionPolicy
      - category
    Kibana_HTTP_APIs_alerting_unack_alert_action:
      additionalProperties: false
      type: object
      properties:
        action_type:
          description: Removes acknowledgement from an alert.
          enum:
          - unack
          type: string
        episode_id:
          description: The episode identifier for the alert to unacknowledge.
          maxLength: 150
          minLength: 1
          type: string
      required:
      - action_type
      - episode_id
    Kibana_HTTP_APIs_alerting_new_activate_alert_action:
      additionalProperties: false
      type: object
      properties:
        reason:
          description: Reason for activating the alert.
          maxLength: 1024
          minLength: 1
          type: string
      required:
      - reason
    Kibana_HTTP_APIs_alerting_rule_metadata:
      additionalProperties: false
      description: Rule metadata.
      type: object
      properties:
        builder_type:
          description: Identifies the rule builder that authored this rule (e.g. "threshold"). Absent for rules authored directly in ES|QL.
          maxLength: 64
          type: string
        description:
          description: Human-readable description of the rule.
          maxLength: 1024
          type: string
        name:
          description: Rule name (must be unique within the space).
          maxLength: 256
          minLength: 1
          type: string
        owner:
          description: Owner of the rule.
          maxLength: 256
          type: string
        tags:
          description: Tags for categorization, e.g. ["production", "infra"].
          items:
            maxLength: 128
            minLength: 1
            type: string
          maxItems: 20
          minItems: 1
          type: array
      required:
      - name
    Kibana_HTTP_APIs_alerting_policy_execution_history_item:
      additionalProperties: false
      type: object
      properties:
        action_group_count:
          type: number
        dispatched_at:
          type: string
        episode_count:
          type: number
        episodes:
          description: Episode ids referenced by this event, bounded to MAX_EMBEDDED_EPISODES_PER_ITEM. Use `episode_count` for the true total.
          items:
            type: object
            properties:
              id:
                type: string
            required:
            - id
          maxItems: 50
          type: array
        error:
          additionalProperties: false
          type: object
          properties:
            message:
              type: string
          required:
          - message
        failure_reason:
          enum:
          - missing_api_key
          - workflow_not_found
          - workflow_disabled
          - schedule_error
          type: string
        outcome:
          enum:
          - dispatched
          - throttled
          - dispatch_failed
          type: string
        policy:
          additionalProperties: false
          type: object
          properties:
            id:
              type: string
            name:
              type:
              - string
              - 'null'
          required:
          - id
        rules:
          description: Rules referenced by this event, bounded to MAX_EMBEDDED_RULES_PER_ITEM. When a search or rule filter narrows the match, this array is intersected with the matched subset server-side. Use `total_rule_count` for the full count.
          items:
            type: object
            properties:
              id:
                type: string
              name:
                type:
                - string
                - 'null'
            required:
            - id
          maxItems: 20
          type: array
        total_rule_count:
          description: Total number of rules referenced by this event after search / rule-filter narrowing. May exceed `rules.length` when the embedded array is truncated to the cap.
          type: number
        workflows:
          items:
            type: object
            properties:
              id:
                type: string
              name:
                type:
                - string
                - 'null'
            required:
            - id
          maxItems: 100
          type: array
      required:
      - dispatched_at
      - policy
      - outcome
      - episode_count
      - action_group_count
      - rules
      - total_rule_count
      - workflows
    Kibana_HTTP_APIs_alerting_bulk_get_rules_response:
      additionalProperties: false
      type: object
      properties:
        rules:
          description: The requested rules, in the same order as the requested ids.
          items:
            $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_rule_response'
          type: array
      required:
      - rules
    Kibana_HTTP_APIs_alerting_new_unack_alert_action:
      additionalProperties: false
      type: object
      properties:
        episode_id:
          description: The episode identifier for the alert to unacknowledge.
          maxLength: 150
          minLength: 1
          type: string
      required:
      - episode_id
    Kibana_HTTP_APIs_alerting_bulk_create_alert_actions_request:
      description: Request body for bulk create alert actions. Array of 1 to 100 actions, each with group_hash and action payload.
      items:
        $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_create_alert_action_item'
      maxItems: 100
      minItems: 1
      type: array
    Kibana_HTTP_APIs_alerting_new_action_policy:
      additionalProperties: false
      type: object
      properties:
        description:
          description: A description of the action policy.
          maxLength: 1024
          type: string
        destinations:
          description: The list of destinations. At least one is required.
          items:
            $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_action_policy_destination'
          maxItems: 10
          minItems: 1
          type: array
        group_by:
          description: The fields used to group alerts.
          items:
            maxLength: 256
            minLength: 1
            type: string
          maxItems: 16
          type: array
        grouping_mode:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_action_policy_grouping_mode'
          description: The grouping mode for alert notifications.
        matcher:
          description: A KQL query string to match alerts.
          maxLength: 4096
          type: string
        name:
          description: The name of the action policy.
          maxLength: 256
          minLength: 1
          type: string
        tags:
          description: Tags for categorizing the action policy.
          items:
            maxLength: 128
            minLength: 1
            type: string
          maxItems: 20
          type: array
        throttle:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_action_policy_throttle'
          description: The throttle configuration for notifications.
      required:
      - name
      - description
      - destinations
    Kibana_HTTP_APIs_alerting_rule_schedule:
      additionalProperties: false
      description: Execution schedule configuration.
      type: object
      properties:
        every:
          description: Execution interval, e.g. 1m, 5m, 1h.
          type: string
        lookback:
          description: Lookback window for the query, e.g. 5m, 1h. Can also be expressed in ES|QL.
          type: string
      required:
      - every
    Kibana_HTTP_APIs_alerting_deactivate_alert_action:
      additionalProperties: false
      type: object
      properties:
        action_type:
          description: Deactivates an alert.
          enum:
          - deactivate
          type: string
        reason:
          description: Reason for deactivating the alert.
          maxLength: 1024
          minLength: 1
          type: string
      required:
      - action_type
      - reason
    Kibana_HTTP_APIs_alerting_snooze_action_policy_request:
      additionalProperties: false
      type: object
      properties:
        snoozed_until:
          description: The ISO datetime until which the action policy should be snoozed.
          format: date-time
          pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
          type: string
      required:
      - snoozed_until
    Kibana_HTTP_APIs_alerting_action_policy_response:
      additionalProperties: false
      type: object
      properties:
        auth:
          additionalProperties: false
          description: Authentication and ownership information.
          type: object
          properties:
            created_by_user:
              description: Whether this policy was created by a user (vs system-generated).
              type: boolean
            owner:
              description: The owner of the action policy.
              type: string
          required:
          - owner
          - created_by_user
        created_at:
          description: The ISO datetime when the action policy was created.
          type: string
        created_by:
          description: The user ID who created the action policy.
          type:
          - string
          - 'null'
        description:
          description: A description of the action policy.
          type: string
        destinations:
          description: The list of destinations.
          items:
            $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_action_policy_destination'
          type: array
        enabled:
          description: Whether the action policy is enabled.
          type: boolean
        group_by:
          description: The fields used to group alerts, or null for no grouping.
          items:
            type: string
          type:
          - array
          - 'null'
        grouping_mode:
          allOf:
          - $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_action_policy_grouping_mode'
          description: The grouping mode for alert notifications.
        id:
          description: The unique identifier for the action policy.
          type: string
        matcher:
          description: A KQL query to match alerts, or null to match all.
          type:
          - string
          - 'null'
        name:
          description: The name of the action policy.
          type: string
        snoozed_until:
          description: The ISO datetime until which the policy is snoozed, or null if not snoozed.
          type:
          - string
          - 'null'
        tags:
          description: Tags associated with the action policy.
          items:
            type: string
          type:
          - array
          - 'null'
        throttle:
          additionalProperties: false
          description: The throttle configuration for notifications.
          type:
          - object
          - 'null'
          properties:
            interval:
              description: The throttle interval duration (e.g. 5m, 1h), or null when the strategy is intervalless.
              type:
              - string
              - 'null'
            strategy:
              anyOf:
              - description: notify only on episode status transitions (default for `per_episode`).
                enum:
                - on_status_change
                type: string
              - description: notify on transitions and at regular intervals.
                enum:
                - per_status_interval
                type: string
              - description: notify at regular intervals regardless of status (default for `all`/`per_field`).
                enum:
                - time_interval
                type: string
              - description: notify on every evaluation cycle (high volume).
                enum:
                - every_time
                type: string
              description: The throttle strategy.
          required:
          - interval
        updated_at:
          description: The ISO datetime when the action policy was last updated.
          type: string
        updated_by:
          description: The user ID who last updated the action policy.
          type:
          - string
          - 'null'
        version:
          description: The version, used for optimistic concurrency control.
          type: string
      required:
      - id
      - name
      - description
      - enabled
      - destinations
      - matcher
      - group_by
      - tags
      - grouping_mode
      - throttle
      - snoozed_until
      - auth
      - created_by
      - created_at
      - updated_by
      - updated_at
    Kibana_HTTP_APIs_alerting_match_action_policies_for_rule_response:
      additionalProperties: false
      description: Action policies that match a given rule, grouped by match category.
      type: object
      properties:
        items:
          description: The list of matched action policies.
          items:
            $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_matched_action_policy'
          type: array
        total:
          description: Total number of action policies in the space. If greater than the number evaluated, the match results may be incomplete.
          maximum: 9007199254740991
          minimum: 0
          type: integer
      required:
      - items
      - total
    Kibana_HTTP_APIs_alerting_rule_grouping:
      additionalProperties: false
      description: Grouping configuration.
      type: object
      properties:
        fields:
          description: Fields to group alerts by, e.g. ["host.name", "service.name"]. Should match ES|QL GROUP BY fields.
          items:
            maxLength: 256
            minLength: 1
            type: string
          maxItems: 16
          type: array
      required:
      - fields
    Kibana_HTTP_APIs_alerting_new_snooze_alert_action:
      additionalProperties: false
      type: object
      properties:
        expiry:
          description: ISO datetime when snooze should expire.
          format: date-time
          pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
          type: string
    Kibana_HTTP_APIs_alerting_action_policy_destination:
      description: An action policy destination configuration.
      discriminator:
        mapping:
          workflow: '#/components/schemas/Kibana_HTTP_APIs_alerting_workflow_action_policy_destination'
        propertyName: type
      oneOf:
      - $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_workflow_action_policy_destination'
    Kibana_HTTP_APIs_alerting_composed_rule_query:
      additionalProperties: false
      description: 'Composed query: a shared base with appendable breach and recovery segments.'
      type: object
      properties:
        base:
          description: Base ES|QL query. Time filters are applied automatically via the lookback window.
          maxLength: 10000
          minLength: 1
          type: string
        breach:
          additionalProperties: false
          description: Breach detection configuration. Omit to treat every base row as a breach.
          type: object
          properties:
            segment:
              description: A clause appended to the end of the rule's ES|QL query. Required in breach blocks.
              maxLength: 10000
              minLength: 1
              type: string
          required:
          - segment
        format:
          enum:
          - composed
          type: string
        recovery:
          additionalProperties: false
          description: Recovery query segment. Required when recovery_strategy is "query".
          type: object
          properties:
            segment:
              description: Appendable ES|QL segment for recovery detection.
              maxLength: 10000
              minLength: 1
              type: string
          required:
          - segment
      required:
      - format
      - base
    Kibana_HTTP_APIs_alerting_workflow_action_policy_destination:
      additionalProperties: false
      type: object
      properties:
        id:
          description: The workflow connector identifier.
          maxLength: 150
          minLength: 1
          type: string
        type:
          description: The destination type.
          enum:
          - workflow
          type: string
      required:
      - type
      - id
    Kibana_HTTP_APIs_alerting_rule_list_response:
      additionalProperties: false
      description: Paginated list of rules.
      type: object
      properties:
        items:
          description: The list of rules.
          items:
            $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_rule_response'
          type: array
        page:
          description: The current page number.
          type: number
        per_page:
          description: The number of rules per page.
          type: number
        total:
          description: The total number of rules matching the query.
          type: number
      required:
      - items
      - total
      - page
      - per_page
    Kibana_HTTP_APIs_alerting_bulk_by_ids_request:
      additionalProperties: false
      type: object
      properties:
        ids:
          description: Explicit list of IDs to operate on.
          items:
            maxLength: 150
            minLength: 1
            type: string
          maxItems: 100
          minItems: 1
          type: array
      required:
      - ids
    Kibana_HTTP_APIs_alerting_bulk_operation_response:
      additionalProperties: false
      description: Result of an executed bulk operation.
      type: object
      properties:
        affected_count:
          description: Number of resources the operation successfully touched.
          maximum: 9007199254740991
          minimum: 0
          type: integer
        errors:
          description: Errors encountered during the operation.
          items:
            type: object
            properties:
              error:
                type: object
                properties:
                  code:
                    description: A stable, machine-readable error code (e.g., "RULE_NOT_FOUND", "INVALID_SCHEDULE"). Safe for clients to branch on.
                    type: string
                  details:
                    additionalProperties: {}
                    description: Optional structured context (e.g., validation field errors, conflict resource IDs).
                    type: object
                  message:
                    description: A human-friendly explanation of the error. Subject to change without notice. Do not parse or rely on its content.
                    type: string
                required:
                - code
                - message
              id:
                description: The identifier of the resource that failed.
                type: string
            required:
            - id
            - error
          type: array
      required:
      - affected_count
      - errors
    Kibana_HTTP_APIs_alerting_new_deactivate_alert_action:
      additionalProperties: false
      type: object
      properties:
        reason:
          description: Reason for deactivating the alert.
          maxLength: 1024
          minLength: 1
          type: string
      required:
      - reason
    Kibana_HTTP_APIs_alerting_new_unsnooze_alert_action:
      additionalProperties: false
      type: object
      properties: {}
    Kibana_HTTP_APIs_alerting_bulk_by_query_request:
      additionalProperties: false
      type: object
      properties:
        filter:
          description: 'KQL filter string to match target resources. At most 10000 matching resources are processed per request. Cannot be empty; to target every resource use `match_all: true`.'
          maxLength: 4096
          minLength: 1
          type: string
        force:
          default: false
          description: When true, executes the operation. When false (default), returns a dry-run preview with `match_count` and a `sample` of matching resource IDs so the client can verify before committing.
          type: boolean
        match_all:
          description: When true, targets every resource. Requires an explicit opt-in. Omitted by default.
          enum:
          - true
          type: boolean
        search:
          description: 'Free-text search string matched against the resource-defined searchable fields. Cannot be empty; to target every resource use `match_all: true`.'
          maxLength: 256
          minLength: 1
          type: string
    Kibana_HTTP_APIs_alerting_rule_artifact:
      additionalProperties: false
      type: object
      properties:
        data:
          additionalProperties: {}
          description: Structured artifact data.
          type: object
        id:
          description: Artifact identifier.
          maxLength: 256
          minLength: 1
          type: string
        type:
          description: Artifact type.
          maxLength: 128
          minLength: 1
          type: string
      required:
      - id
      - type
      - data
    Kibana_HTTP_APIs_alerting_rule_tags_response:
      additionalProperties: false
      description: All unique tags across rules.
      type: object
      properties:
        tags:
          description: The list of unique tags.
          items:
            type: string
          type: array
      required:
      - tags
    Kibana_HTTP_APIs_alerting_ack_alert_action:
      additionalProperties: false
      type: object
      properties:
        action_type:
          description: Acknowledges an alert.
          enum:
          - ack
          type: string
        episode_id:
          description: The episode identifier for the alert to acknowledge.
          maxLength: 150
          minLength: 1
          type: string
      required:
      - action_type
      - episode_id
  securitySchemes:
    apiKeyAuth:
      description: 'These APIs use key-based authentication. You must create an API key and use the encoded value in the request header. For example: `Authorization: ApiKey base64AccessApiKey`

        '
      in: header
      name: Authorization
      type: apiKey
    basicAuth:
      scheme: basic
      type: http
x-topics:
- title: Kibana spaces
  content: "Spaces enable you to organize your dashboards and other saved objects into meaningful categories.\nYou can use the default space or create your own spaces.\n\nTo run APIs in non-default spaces, you must add `s/{space_id}/` to the path.\nFor example:\n\n```bash\ncurl -X GET \"http://${KIBANA_URL}/s/marketing/api/data_views\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\"\n```\n\nIf you use the Kibana console to send API requests, it automatically adds the appropriate space identifier.\n\nTo learn more, check out [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces).\n"