List rule executions | Kibana Serverless API documentation

List rule executions Experimental

GET /api/alerting/v2/execution_history/rules

Spaces method and path for this operation:

get /s/{space_id}/api/alerting/v2/execution_history/rules

Refer to Spaces for more information.

Get a paginated list of rule execution events.

[Required authorization] Route required privileges: read_alerting-v2-execution-history.

Query parameters

rule_ids array[string]

Rule id filter.

At least 1 but not more than 50 elements. Minimum length of each is 1, maximum length of each is 150.
outcomes array[string]

Outcome filter.

At least 1 but not more than 2 elements. Values are success or failure.
from string(date-time)

Inclusive ISO datetime lower bound on event.start.
to string(date-time)

Inclusive ISO datetime upper bound on event.start.
sort_field string Required

Sort field. Defaults to started_at.

Values are started_at or duration_ms. Default value is started_at.
sort_order string Required

Sort direction.

Values are asc or desc. Default value is desc.
page integer Required

Page number.

Minimum value is 1, maximum value is 10000. Default value is 1.
per_page integer Required

Number of results per page.

Minimum value is 1, maximum value is 100. Default value is 20.

Responses

200 application/json

Returns a paginated list of rule execution events.
Hide response attributes Show response attributes object
- items array[object] Required
  
  Hide items attributes Show items attributes object
  
  ended_at string(date-time) Required
  
  error object
  
  Failure details. Omitted on a successful run, or when the failure was unclassified.
  
  Additional properties are NOT allowed.
  
  Hide error attributes Show error attributes object
  
  message string Required
  
  stack_trace string
  
  Omitted when the source recorded no trace.
  
  id string Required
  
  outcome string Required
  
  Values are success or failure.
  
  reason string
  
  Why the run ended the way it did. Omitted when the source recorded no reason.
  
  rule object Required
  
  Additional properties are NOT allowed.
  
  Hide rule attributes Show rule attributes object
  
  id string Required
  
  version integer
  
  The rule version this run executed. Omitted until the rule executor emits its own event; the task-run event does not carry one.
  
  Minimum value is -9007199254740991, maximum value is 9007199254740991.
  
  space_id string Required
  
  started_at string(date-time) Required
  
  timings object Required
  
  Additional properties are NOT allowed.
  
  Hide timings attributes Show timings attributes object
  
  duration_ms integer Required
  
  Wall-clock duration of the run, in milliseconds.
  
  Minimum value is 0, maximum value is 9007199254740991.
  
  scheduled_delay_ms integer Required
  
  Delay between the scheduled run time and the actual start, in milliseconds. Negative when the run started ahead of its scheduled time.
  
  Minimum value is -9007199254740991, maximum value is 9007199254740991.
- page integer Required
  
  Minimum value is 1, maximum value is 9007199254740991.
- per_page integer Required
  
  Minimum value is 1, maximum value is 9007199254740991.
- total integer Required
  
  The number of rule executions matching the query. This count is an estimate: results above 10,000 may be reported as 10,000.
  
  Minimum value is 0, maximum value is 9007199254740991.
400 application/json

Indicates an invalid schema or parameters.
Hide response attributes Show response attributes object
- code string Required
  
  Stable error code you can branch on, for example INVALID_SCHEDULE or RULE_ALREADY_EXISTS.
- details object
  
  Optional extra information about the error, for example field validation issues or the rule_id when that ID already exists.
  
  Additional properties are allowed.
- error string Required
  
  A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.
- message string Required
  
  A readable explanation of the error. The wording can change without notice. Do not parse this field.
401 application/json

Indicates the request was not authenticated.
Hide response attributes Show response attributes object
- code string Required
  
  Stable error code you can branch on, for example INVALID_SCHEDULE or RULE_ALREADY_EXISTS.
- details object
  
  Optional extra information about the error, for example field validation issues or the rule_id when that ID already exists.
  
  Additional properties are allowed.
- error string Required
  
  A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.
- message string Required
  
  A readable explanation of the error. The wording can change without notice. Do not parse this field.
403 application/json

Indicates the user does not have the required privileges to perform the request.
Hide response attributes Show response attributes object
- code string Required
  
  Stable error code you can branch on, for example INVALID_SCHEDULE or RULE_ALREADY_EXISTS.
- details object
  
  Optional extra information about the error, for example field validation issues or the rule_id when that ID already exists.
  
  Additional properties are allowed.
- error string Required
  
  A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.
- message string Required
  
  A readable explanation of the error. The wording can change without notice. Do not parse this field.
500 application/json

Indicates an unexpected server-side error.
Hide response attributes Show response attributes object
- code string Required
  
  Stable error code you can branch on, for example INVALID_SCHEDULE or RULE_ALREADY_EXISTS.
- details object
  
  Optional extra information about the error, for example field validation issues or the rule_id when that ID already exists.
  
  Additional properties are allowed.
- error string Required
  
  A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.
- message string Required
  
  A readable explanation of the error. The wording can change without notice. Do not parse this field.
503 application/json

Indicates the alerting engine is disabled by the alerting:v2:enabled advanced setting.
Hide response attributes Show response attributes object
- code string Required
  
  Stable error code you can branch on, for example INVALID_SCHEDULE or RULE_ALREADY_EXISTS.
- details object
  
  Optional extra information about the error, for example field validation issues or the rule_id when that ID already exists.
  
  Additional properties are allowed.
- error string Required
  
  A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.
- message string Required
  
  A readable explanation of the error. The wording can change without notice. Do not parse this field.

GET /api/alerting/v2/execution_history/rules

curl \
 --request GET 'https://<KIBANA_URL>/api/alerting/v2/execution_history/rules?sort_field=started_at&sort_order=desc&page=1&per_page=20' \
 --header "Authorization: $API_KEY"

Response examples (200)

{
  "items": [
    {
      "ended_at": "2026-01-15T12:00:01.250Z",
      "id": "execution-1",
      "outcome": "success",
      "rule": {
        "id": "rule-1",
        "version": 3
      },
      "space_id": "default",
      "started_at": "2026-01-15T12:00:00.000Z",
      "timings": {
        "duration_ms": 1250,
        "scheduled_delay_ms": 40
      }
    }
  ],
  "page": 1,
  "per_page": 20,
  "total": 1
}

Response examples (400)

{
  "code": "BAD_REQUEST",
  "details": {
    "errors": {
      "page": [
        "page * per_page cannot exceed 10000."
      ]
    }
  },
  "error": "Bad Request",
  "message": "page * per_page cannot exceed 10000."
}

Response examples (401)

{
  "code": "UNAUTHORIZED",
  "error": "Unauthorized",
  "message": "Authentication required to access this API."
}

Response examples (403)

{
  "code": "FORBIDDEN",
  "error": "Forbidden",
  "message": "The current user does not have the required privileges for this request."
}

Response examples (500)

{
  "code": "INTERNAL_SERVER_ERROR",
  "error": "Internal Server Error",
  "message": "An unexpected error occurred."
}

Response examples (503)

{
  "code": "ALERTING_DISABLED",
  "error": "Service Unavailable",
  "message": "Alerting is disabled."
}