---
title: "Initiate a detection alert migration"
method: POST
path: "/api/detection_engine/signals/migration"
tags: ["Security Detections API"]
deprecated: true
---

# Initiate a detection alert migration

`POST /api/detection_engine/signals/migration`

> **Deprecated.**

**Spaces method and path for this operation:**

<div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/detection_engine/signals/migration</span></div>

Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

**DEPRECATED.** Legacy API for on-demand reindexing of old `.siem-signals-*` alert indices. Do not build new
integrations; upgrade the Elastic Stack and rely on product-managed data lifecycle instead.
**WARNING:** Migrations can be resource intensive and should be planned during a maintenance window.

Initiate a migration of detection alerts. Migrations are initiated per index. The process is not destructive
and should not remove existing data, but it can consume significant cluster resources. Plan capacity accordingly.

## Request body

- object
  - `index` string[], required — Array of index names to migrate.
  - `requests_per_second` integer — The throttle for the migration task in sub-requests per second. Corresponds to requests_per_second on the Reindex API.
  - `size` integer — Number of alerts to migrate per batch. Corresponds to the source.size option on the Reindex API.
  - `slices` integer — The number of subtasks for the migration task. Corresponds to slices on the Reindex API.

## Response `200`

Successful response

- object
  - `indices` union[], required
    - union
      - SecurityDetectionsAPIAlertsIndexMigrationSuccess
        - `index` string, required
        - `migration_id` string, required
        - `migration_index` string, required
      - SecurityDetectionsAPIAlertsIndexMigrationError
        - `error` object, required
          - `message` string, required
          - `status_code` string, required
        - `index` string, required
      - SecurityDetectionsAPISkippedAlertsIndexMigration
        - `index` string, required

## Other responses

- `400` — Invalid input data response
- `401` — Unsuccessful authentication response
- `500` — Internal server error response

---

[API](https://skmtc.net/elastic/apis/kibana-apis.md) · [All operations](https://skmtc.net/elastic/apis/kibana-apis/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/elastic/kibana-apis/versions/531c9e2a7d23/schema)