---
title: "Delete rules matching a query (dry-run by default)"
method: POST
path: "/api/alerting/v2/rules/_delete_by_query"
tags: ["alerting-v2"]
---

# Delete rules matching a query (dry-run by default)

`POST /api/alerting/v2/rules/_delete_by_query`

**Spaces method and path for this operation:**

<div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/v2/rules/_delete_by_query</span></div>

Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

[Required authorization] Route required privileges: manage_alerting-v2-rules.

## Headers

- `kbn-xsrf` string, required

## Request body

- KibanaHTTPAPIsAlertingBulkByQueryRequest
  - `filter` string — KQL filter string to match target resources. At most 10000 matching resources are processed per request. Cannot be empty; to target every resource use `match_all: true`.
  - `force` boolean — When true, executes the operation. When false (default), returns a dry-run preview with `match_count` and a `sample` of matching resource IDs so the client can verify before committing.
  - `match_all` true — When true, targets every resource. Requires an explicit opt-in. Omitted by default.
  - `search` string — Free-text search string matched against the resource-defined searchable fields. Cannot be empty; to target every resource use `match_all: true`.

## Response `200`

Returns a dry-run preview by default, or the executed operation when `force` is true.

- union
  - KibanaHTTPAPIsAlertingBulkDryRunResponse — Dry-run preview returned by a by-query bulk endpoint when `force` is false.
    - `match_count` integer, required — Total number of resources matching the query. A dry run never fails on size, but if this exceeds 10000, re-sending the same query with `force: true` is rejected with `BULK_QUERY_MATCH_LIMIT_EXCEEDED`; narrow the query before executing.
    - `sample` string[], required — Sample of matching resource IDs (up to 100) for spot-checking before executing.
  - KibanaHTTPAPIsAlertingBulkOperationResponse — Result of an executed bulk operation.
    - `affected_count` integer, required — Number of resources the operation successfully touched.
    - `errors` object[], required — Errors encountered during the operation.
      - `error` object, required
        - `code` string, required — A stable, machine-readable error code (e.g., "RULE_NOT_FOUND", "INVALID_SCHEDULE"). Safe for clients to branch on.
        - `details` object — Optional structured context (e.g., validation field errors, conflict resource IDs).
        - `message` string, required — A human-friendly explanation of the error. Subject to change without notice. Do not parse or rely on its content.
      - `id` string, required — The identifier of the resource that failed.

## Other responses

- `400` — Indicates an invalid schema or parameters.
- `401` — Indicates the request was not authenticated.
- `403` — Indicates the user does not have the required privileges to perform the request.
- `500` — Indicates an unexpected server-side error.
- `503` — Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.

---

[API](https://skmtc.net/elastic/apis/kibana-apis.md) · [All operations](https://skmtc.net/elastic/apis/kibana-apis/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/elastic/kibana-apis/revisions/34c3066fc261/schema)