agent builder43

alerting23

alerting-v250

APM agent configuration7

APM agent keys1

APM annotations2

APM server schema1

APM sourcemaps3

cases34

connectors9

Dashboards5

Data streams3

data views15

Elastic Agent actions16

Elastic Agent binary download sources5

Elastic Agent policies14

Elastic Agent status1

Elastic Agents18

Elastic Package Manager (EPM)36

Fleet agentless policies7

Fleet cloud connectors6

Fleet cloud onboarding deployments5

Fleet enrollment API keys5

Fleet internals7

Fleet managed integrations7

Fleet outputs7

Fleet package policies9

Fleet proxies5

Fleet remote synced integrations2

Fleet Server hosts5

Fleet service tokens1

Fleet uninstall tokens3

Links5

logstash4

maintenance-window7

Markdowns5

Message Signing Service1

ml3

observability_ai_assistant1

roles5

saved objects16

Security AI Assistant API21

Security Attack discovery API16

Security Detections API29

Security Endpoint Exceptions API6

Security Endpoint Management API29

Security Entity Analytics API29

Security entity store19

Security Exceptions API16

Security Lists API18

Security Osquery API21

Security Solution Initialization API1

Security Timeline API17

short url4

slo15

spaces9

streams18

synthetics19

system2

Tags5

task manager1

upgrade1

uptime2

user session1

Visualizations5

workflows32

alerting-v2

Create a rule

Spaces method and path for this operation:

<div><span class="operation-verb post">post</span> <span class="operation-path">/s/{space_id}/api/alerting/v2/rules</span></div>

Refer to Spaces for more information.

Creates a rule with a server-generated identifier. To create or replace a rule with a client-supplied identifier, use PUT /api/alerting/v2/rules/{id}/.<br/><br/>[Required authorization] Route required privileges: manage_alerting-v2-rules.

post/api/alerting/v2/rules

Headers

kbn-xsrfstring required

Example:true

A required header to protect against CSRF attacks

Request body

time_fieldstring

Document field used as the event time when applying the lookback window. Defaults to @timestamp.

Response

Returns the newly created rule.

created_atstring date-time required

ISO timestamp when the rule was created.

enabledboolean required

Whether the rule is enabled.

idstring required

Unique rule identifier.

time_fieldstring

Document field used as the event time when applying the lookback window. Defaults to @timestamp.

updated_atstring date-time required

ISO timestamp when the rule was last updated.

versionstring

The saved object version token of the rule, used for optimistic concurrency control.

Changes

Changed in 5 of the 176 revisions of this API.5414

Sep 17, 2026883cd57e9ac74See the full diff
- ●
  the / request property's maxLength was set to 32
  request-property-max-length-set
- ●
  the / request property's maxLength was set to 32
  request-property-max-length-set
- ●
  the / request property's maxLength was set to 32
  request-property-max-length-set
- ●
  the / request property's maxLength was set to 32
  request-property-max-length-set
Sep 16, 2026e2104277117c39See the full diff
- ▲
  removed subschema #1 subschema #2 from the request property anyOf list
  request-property-any-of-removed
- ▲
  removed subschema #1 subschema #2 subschema #3 from the request property anyOf list
  request-property-any-of-removed
- ▲
  removed subschema #1 subschema #2 subschema #3 subschema #4 from the request property anyOf list
  request-property-any-of-removed
- ○
  added subschema #1 subschema #2 to the request property anyOf list
  request-property-any-of-added
- ○
  added subschema #1 subschema #2 subschema #3 to the request property anyOf list
  request-property-any-of-added
- ○
  added subschema #1 subschema #2 subschema #3 subschema #4 to the request property anyOf list
  request-property-any-of-added
- ○
  added subschema #1 subschema #2 to the response property anyOf list for the response status
  response-property-any-of-added
- ○
  added subschema #1 subschema #2 subschema #3 to the response property anyOf list for the response status
  response-property-any-of-added
- ○
  added subschema #1 subschema #2 subschema #3 subschema #4 to the response property anyOf list for the response status
  response-property-any-of-added
- ○
  removed subschema #1 subschema #2 from the response property anyOf list for the response status
  response-property-any-of-removed
- ○
  removed subschema #1 subschema #2 subschema #3 from the response property anyOf list for the response status
  response-property-any-of-removed
- ○
  removed subschema #1 subschema #2 subschema #3 subschema #4 from the response property anyOf list for the response status
  response-property-any-of-removed
Aug 22, 202693e11b26687211See the full diff
- ▲
  the response property ///// became optional for the status
  response-property-became-optional
- ○
  the request property ///// became optional
  request-property-became-optional
Aug 18, 2026118c456bb48713See the full diff
- ▲
  removed subschema #1 subschema #2 from the request property anyOf list
  request-property-any-of-removed
- ○
  added subschema #1 subschema #2 to the request property anyOf list
  request-property-any-of-added
- ○
  added subschema #1 subschema #2 to the response property anyOf list for the response status
  response-property-any-of-added
- ○
  removed subschema #1 subschema #2 from the response property anyOf list for the response status
  response-property-any-of-removed
Aug 17, 2026e9badbb5da991See the full diff
- ○
  endpoint added
  endpoint-added

Of the 176 revisions, 20 have no diff computed.

Full history