---
title: "Bulk create alert actions"
method: POST
path: "/api/alerting/v2/alerts/_bulk_action"
tags: ["alerting-v2"]
---

# Bulk create alert actions

`POST /api/alerting/v2/alerts/_bulk_action`

**Spaces method and path for this operation:**

<div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/v2/alerts/_bulk_action</span></div>

Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

Create actions for multiple alert groups in a single request.<br/><br/>[Required authorization] Route required privileges: manage_alerting-v2-alerts.

## Headers

- `kbn-xsrf` string, required

## Request body

- KibanaHTTPAPIsAlertingBulkCreateAlertActionItem[] — Request body for bulk create alert actions. Array of 1 to 100 actions, each with group_hash and action payload.
  - union
    - object — Alert action payload with group identifier for bulk requests.
      - `action_type` 'ack', required — Acknowledges an alert.
      - `episode_id` string, required — The episode identifier for the alert to acknowledge.
      - `group_hash` string, required — Hash identifying the alert group to apply the action to.
    - object — Alert action payload with group identifier for bulk requests.
      - `action_type` 'unack', required — Removes acknowledgement from an alert.
      - `episode_id` string, required — The episode identifier for the alert to unacknowledge.
      - `group_hash` string, required — Hash identifying the alert group to apply the action to.
    - object — Alert action payload with group identifier for bulk requests.
      - `action_type` 'assign', required — Assigns an alerting episode to a user, or clears the assignee when null.
      - `assignee_uid` string, nullable, required — User profile UID of the assignee, or null to remove the assignee from the episode.
      - `episode_id` string, required — The episode identifier to assign.
      - `group_hash` string, required — Hash identifying the alert group to apply the action to.
    - object — Alert action payload with group identifier for bulk requests.
      - `action_type` 'tag', required — Adds tags to an alert.
      - `tags` string[], required — List of tags to add to the alert.
      - `group_hash` string, required — Hash identifying the alert group to apply the action to.
    - object — Alert action payload with group identifier for bulk requests.
      - `action_type` 'snooze', required — Snoozes an alert.
      - `expiry` string, date-time — ISO datetime when snooze should expire.
      - `group_hash` string, required — Hash identifying the alert group to apply the action to.
    - object — Alert action payload with group identifier for bulk requests.
      - `action_type` 'unsnooze', required — Removes snooze from an alert.
      - `group_hash` string, required — Hash identifying the alert group to apply the action to.
    - object — Alert action payload with group identifier for bulk requests.
      - `action_type` 'activate', required — Activates an alert.
      - `reason` string, required — Reason for activating the alert.
      - `group_hash` string, required — Hash identifying the alert group to apply the action to.
    - object — Alert action payload with group identifier for bulk requests.
      - `action_type` 'deactivate', required — Deactivates an alert.
      - `reason` string, required — Reason for deactivating the alert.
      - `group_hash` string, required — Hash identifying the alert group to apply the action to.

## Response `200`

Returns the number of created actions and per-item errors for actions that were not created.

- KibanaHTTPAPIsAlertingBulkOperationResponse — Result of an executed bulk operation.
  - `affected_count` integer, required — Number of resources the operation successfully touched.
  - `errors` object[], required — Errors encountered during the operation.
    - `error` object, required
      - `code` string, required — A stable, machine-readable error code (e.g., "RULE_NOT_FOUND", "INVALID_SCHEDULE"). Safe for clients to branch on.
      - `details` object — Optional structured context (e.g., validation field errors, conflict resource IDs).
      - `message` string, required — A human-friendly explanation of the error. Subject to change without notice. Do not parse or rely on its content.
    - `id` string, required — The identifier of the resource that failed.

## Other responses

- `400` — Indicates an invalid schema or parameters.
- `401` — Indicates the request was not authenticated.
- `403` — Indicates the user does not have the required privileges to perform the request.
- `500` — Indicates an unexpected server-side error.
- `503` — Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.

---

[API](https://skmtc.net/elastic/apis/kibana-apis.md) · [All operations](https://skmtc.net/elastic/apis/kibana-apis/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/elastic/kibana-apis/revisions/34c3066fc261/schema)