---
title: "Bulk activate alerts"
method: POST
path: "/api/alerting/v2/alerts/_bulk_activate"
tags: ["alerting-v2"]
---

# Bulk activate alerts

`POST /api/alerting/v2/alerts/_bulk_activate`

## Request

- Base URL: `https://localhost:5601`
- URL: `https://localhost:5601/api/alerting/v2/alerts/_bulk_activate`
- Auth: one of:
  - API key in header `Authorization`
  - HTTP basic

**Spaces method and path for this operation:**

<div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/v2/alerts/_bulk_activate</span></div>

Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

Create the same action for multiple alerts in a single request.<br/><br/>[Required authorization] Route required privileges: manage_alerting-v2-alerts.

## Headers

- `kbn-xsrf` string, required

## Request body

- KibanaHTTPAPIsAlertingBulkActivateAlertsRequest
  - `items` KibanaHTTPAPIsAlertingBulkActivateAlertsItem[], required: List of 1 to 100 activate actions to create, each for a different `alert_id`.
    - `alert_id` string, required: Identifier of the alert to apply the action to.
    - `reason` string, required: Reason for activating the alert.

## Response `200`

Returns the number of created actions and per-item errors for actions that were not created.

- KibanaHTTPAPIsAlertingBulkOperationResponse: Result of an executed bulk operation.
  - `affected_count` integer, required: Number of resources the operation successfully touched.
  - `errors` object[], required: Errors encountered during the operation.
    - `error` object, required
      - `code` string, required: Stable error code you can branch on, for example `INVALID_SCHEDULE` or `RULE_ALREADY_EXISTS`.
      - `details` object: Optional structured context whose keys depend on `code`. Identifier keys such as `rule_id`, `action_policy_id` and `group_hash` are stable, permanent public identifiers. On a 400 request-validation error, `details.source` (`params`, `query`, or `body`) names the failing part and is the only guaranteed key. The sibling `details.errors` may change. Do not branch on it.
      - `message` string, required: A readable explanation of the error. The wording can change without notice. Do not parse this field.
    - `id` string, required: The identifier of the resource that failed.

## Other responses

- `400`: Indicates an invalid schema or parameters.
- `401`: Indicates the request was not authenticated.
- `403`: Indicates the user does not have the required privileges to perform the request.
- `500`: Indicates an unexpected server-side error.
- `503`: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.

---

[API](https://skmtc.dev/elastic/apis/kibana-apis.md) - [All operations](https://skmtc.dev/elastic/apis/kibana-apis/llms.txt) - [OpenAPI document](https://skmtc.dev/elastic/apis/kibana-apis/revisions/b87131d80c52?raw)