---
type: api
title: Set a detection alert status
description: Set the status of one or more detection alerts.
url: https://www.elastic.co/docs/api/doc/kibana-serverless/operation/operation-setalertsstatus
resource: https://www.elastic.co/docs/api/doc/kibana-serverless/operation/operation-setalertsstatus
products:
  - Kibana
---

# Set a detection alert status

Authentication: required

- Server: `https://{kibana_url}`

## Paths

- `POST` `/api/detection_engine/signals/status`
- `POST` `/s/{space_id}/api/detection_engine/signals/status`

#### Path parameters

- `space_id` (string) — optional
  An identifier for the space. If `space_id` is not provided in the URL, the default space is used. Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

## Description

Set the status of one or more detection alerts.

## Request body

An object containing desired status and explicit alert ids or a query to select alerts

`application/json`

One of:
- **SetAlertsStatusByIds**
  One of:
  - **status: closed** (`status: closed`)
    - `status` (enum) — required
      Values: `closed`
    - `reason` (union oneOf) — optional
      The reason for closing the alerts. Can be one of following predefined reasons: [false_positive, duplicate, true_positive, benign_positive, automated_closure, other] or a custom reason provided by the user through the advanced settings.
      Values: `false_positive`, `duplicate`, `true_positive`, `benign_positive`, `automated_closure`, `other`
    - `signal_ids` (string[] · format: nonempty · min items: 1) — required
      List of alert ids. Use field `_id` on alert document or `kibana.alert.uuid`. Note: signals are a deprecated term for alerts.
  - **SetAlertsStatusByIdsBase** (`status: open | acknowledged | in-progress`)
    - `status` (enum) — required
      The status of an alert, which can be `open`, `acknowledged`, `in-progress`, or `closed`.
      Values: `open`, `acknowledged`, `in-progress`
    - `signal_ids` (string[] · format: nonempty · min items: 1) — required
      List of alert ids. Use field `_id` on alert document or `kibana.alert.uuid`. Note: signals are a deprecated term for alerts.
- **SetAlertsStatusByQuery**
  One of:
  - **status: closed** (`status: closed`)
    - `status` (enum) — required
      Values: `closed`
    - `conflicts` (enum · default: abort) — optional
      Values: `abort`, `proceed`
    - `query` (object) — required
    - `reason` (union oneOf) — optional
      The reason for closing the alerts. Can be one of following predefined reasons: [false_positive, duplicate, true_positive, benign_positive, automated_closure, other] or a custom reason provided by the user through the advanced settings.
      Values: `false_positive`, `duplicate`, `true_positive`, `benign_positive`, `automated_closure`, `other`
    - `runtime_fields` (map string to enum · max properties: 100) — optional
      Optional map of field name to runtime field type. For each entry, the server defines a runtime field of the given type that reads its value from `_source[fieldName]` and attaches it to the underlying `_update_by_query` as `runtime_mappings`. Allows the `query` to reference non-ECS fields stored on the alert `_source` but not in the alerts index mapping — for example, runtime fields the rule's source index defined at the time the alerts were created. Limited to 100 entries per request; larger maps are rejected.
      Map values (enum)
        Values: `keyword`, `long`, `double`, `date`, `ip`, `boolean`, `geo_point`
    - `runtime_mappings` (map string to object · max properties: 100) — optional
      Use this when the query references fields that are not in the alerts index mapping, for example data view runtime fields with a Painless script.
Kibana sends `type`, `script.source`, and `format` to Elasticsearch as `runtime_mappings` on the status-update query. Unlike `runtime_fields`, Kibana keeps your script and runs it at query time. It does not replace the script with a `_source` reader.
When a script is present, Kibana sets `on_script_error` to `continue`. If the script fails on one alert, that field has no value for the alert and the update continues.
Unique field names across `runtime_fields` and `runtime_mappings` combined cannot exceed 100. Larger maps are rejected.
      Map values (object)
      - `format` (string · max length: 100) — optional
        Format string for date runtime fields, for example `strict_date_optional_time`.
      - `script` (object) — optional
        Inline Painless script that Elasticsearch evaluates for each alert. Only `source` is accepted. Stored scripts, parameterized scripts (`params`), and non-default `lang` values are not supported. Extra properties are rejected with a 400 so the script is not run with different semantics.
        - `source` (string · max length: 10000) — required
          Painless script source to execute.
      - `type` (enum) — required
        The data type for the runtime field type. Determines how the field value is indexed and queried.
        Values: `keyword`, `long`, `double`, `date`, `ip`, `boolean`, `geo_point`
  - **SetAlertsStatusByQueryBase** (`status: open | acknowledged | in-progress`)
    - `status` (enum) — required
      The status of an alert, which can be `open`, `acknowledged`, `in-progress`, or `closed`.
      Values: `open`, `acknowledged`, `in-progress`
    - `conflicts` (enum · default: abort) — optional
      Values: `abort`, `proceed`
    - `query` (object) — required
    - `runtime_fields` (map string to enum · max properties: 100) — optional
      Optional map of field name to runtime field type. For each entry, a runtime field of the specified type is created reading its value from `_source[fieldName]` and included in the query as `runtime_mappings`. Use this to reference fields stored on the alert `_source` that are not part of the Elastic Common Schema (ECS) of the alerts index mapping, for example, custom fields that the rule's source index defined when the alerts were created.
      Map values (enum)
        Values: `keyword`, `long`, `double`, `date`, `ip`, `boolean`, `geo_point`
    - `runtime_mappings` (map string to object · max properties: 100) — optional
      Use this when the query references fields that are not in the alerts index mapping, for example data view runtime fields with a Painless script.
Kibana sends `type`, `script.source`, and `format` to Elasticsearch as `runtime_mappings` on the status-update query. Unlike `runtime_fields`, Kibana keeps your script and runs it at query time. It does not replace the script with a `_source` reader.
When a script is present, Kibana sets `on_script_error` to `continue`. If the script fails on one alert, that field has no value for the alert and the update continues.
Unique field names across `runtime_fields` and `runtime_mappings` combined cannot exceed 100. Larger maps are rejected.
      Map values (object)
      - `format` (string · max length: 100) — optional
        Format string for date runtime fields, for example `strict_date_optional_time`.
      - `script` (object) — optional
        Inline Painless script that Elasticsearch evaluates for each alert. Only `source` is accepted. Stored scripts, parameterized scripts (`params`), and non-default `lang` values are not supported. Extra properties are rejected with a 400 so the script is not run with different semantics.
        - `source` (string · max length: 10000) — required
          Painless script source to execute.
      - `type` (enum) — required
        The data type for the runtime field type. Determines how the field value is indexed and queried.
        Values: `keyword`, `long`, `double`, `date`, `ip`, `boolean`, `geo_point`

## Responses

#### `200`

Successful response

`application/json`

Type: `object`

#### `400`

Invalid input data response

`application/json`

One of:
- **PlatformErrorResponse**
  - `error` (string)
  - `message` (string)
  - `statusCode` (integer)
- **SiemErrorResponse**
  - `message` (string)
  - `status_code` (integer)
#### `401`

Unsuccessful authentication response

`application/json`

- `error` (string)
- `message` (string)
- `statusCode` (integer)
#### `500`

Internal server error response

`application/json`

- `message` (string)
- `status_code` (integer)
## Code examples

#### Console

```console
POST kbn:/api/detection_engine/signals/status
{
  "signal_ids": [
    "80e1383f856e67c1b7f7a1634744fa6d66b6e2ef7aa26d226e57afb5a7b2b4a1"
  ],
  "status": "closed"
}
```

#### curl

```curl
curl -X POST "${KIBANA_URL}/api/detection_engine/signals/status" \
  -H "Authorization: ApiKey ${API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{
    "signal_ids": [
      "80e1383f856e67c1b7f7a1634744fa6d66b6e2ef7aa26d226e57afb5a7b2b4a1"
    ],
    "status": "closed"
  }'
```

## Response examples

#### By id

`application/json`

```json
{
  "batches": 1,
  "deleted": 0,
  "failures": [],
  "noops": 0,
  "requests_per_second": -1,
  "retries": {
    "bulk": 0,
    "search": 0
  },
  "throttled_millis": 0,
  "throttled_until_millis": 0,
  "timed_out": false,
  "took": 81,
  "total": 1,
  "updated": 1,
  "version_conflicts": 0
}
```

#### By query

`application/json`

```json
{
  "batches": 1,
  "deleted": 0,
  "failures": [],
  "noops": 0,
  "requests_per_second": -1,
  "retries": {
    "bulk": 0,
    "search": 0
  },
  "throttled_millis": 0,
  "throttled_until_millis": 0,
  "timed_out": false,
  "took": 100,
  "total": 17,
  "updated": 17,
  "version_conflicts": 0
}
```

#### Bad

`application/json`

```json
{
  "error": "Bad Request",
  "message": "[request body].signal_ids: at least one alert id is required to update status",
  "statusCode": 400
}
```

#### Unauthorized

`application/json`

```json
{
  "error": "Unauthorized",
  "message": "[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]",
  "statusCode": 401
}
```

#### Server error

`application/json`

```json
{
  "message": "Internal Server Error",
  "status_code": 500
}
```