---
type: api
title: Get the rule types
description: If you have `read` privileges for one or more Kibana features, the API response contains information about the appropriate rule types. For example, there are rule types associated with the **Management > Stack Rules** feature, **Analytics > Discover** and **Machine Learning** features, **Observability** features, and **Security** features. To get rule types associated with the **Stack Monitoring** feature, use the `monitoring_user` built-in role.
url: https://www.elastic.co/docs/api/doc/kibana/v0/operation/operation-getruletypes
resource: https://www.elastic.co/docs/api/doc/kibana/v0/operation/operation-getruletypes
products:
  - Kibana
---

# Get the rule types

Authentication: required

- Server: `https://{kibana_url}`

## Paths

- `GET` `/api/alerting/rule_types`

## Description

If you have `read` privileges for one or more Kibana features, the API response contains information about the appropriate rule types. For example, there are rule types associated with the **Management > Stack Rules** feature, **Analytics > Discover** and **Machine Learning** features, **Observability** features, and **Security** features. To get rule types associated with the **Stack Monitoring** feature, use the `monitoring_user` built-in role.

## Responses

#### `200`

Indicates a successful call.

`application/json`

Type: `object[]`

An array; each item has these fields:

- `action_groups` (object[])
  An explicit list of groups for which the rule type can schedule actions, each with the action group's unique ID and human readable name. Rule actions validation uses this configuration to ensure that groups are valid.
  - `id` (string)
  - `name` (string)
- `action_variables` (object)
  A list of action variables that the rule type makes available via context and state in action parameter templates, and a short human readable description. When you create a rule in Kibana, it uses this information to prompt you for these variables in action parameter editors.
  - `context` (object[])
    - `description` (string)
    - `name` (string)
    - `useWithTripleBracesInTemplates` (boolean)
  - `params` (object[])
    - `description` (string)
    - `name` (string)
  - `state` (object[])
    - `description` (string)
    - `name` (string)
- `alerts` (object)
  Details for writing alerts as data documents for this rule type.
  - `context` (enum)
    The namespace for this rule type.
    Values: `ml.anomaly-detection`, `observability.apm`, `observability.logs`, `observability.metrics`, `observability.slo`, `observability.threshold`, `observability.uptime`, `security`, `stack`
  - `dynamic` (enum)
    Indicates whether new fields are added dynamically.
    Values: `false`, `runtime`, `strict`, `true`
  - `isSpaceAware` (boolean)
    Indicates whether the alerts are space-aware. If true, space-specific alert indices are used.
  - `mappings` (object)
    - `fieldMap` (map string to object)
      Mapping information for each field supported in alerts as data documents for this rule type. For more information about mapping parameters, refer to the Elasticsearch documentation.
      Map values (object)
      - `array` (boolean)
        Indicates whether the field is an array.
      - `dynamic` (boolean)
        Indicates whether it is a dynamic field mapping.
      - `format` (string)
        Indicates the format of the field. For example, if the `type` is `date_range`, the `format` can be `epoch_millis||strict_date_optional_time`.
      - `ignore_above` (integer)
        Specifies the maximum length of a string field. Longer strings are not indexed or stored.
      - `index` (boolean)
        Indicates whether field values are indexed.
      - `path` (string)
        TBD
      - `properties` (map string to object)
        Details about the object properties. This property is applicable when `type` is `object`.
        Map values (object)
        - `type` (string)
          The data type for each object property.
      - `required` (boolean)
        Indicates whether the field is required.
      - `scaling_factor` (integer)
        The scaling factor to use when encoding values. This property is applicable when `type` is `scaled_float`. Values will be multiplied by this factor at index time and rounded to the closest long value.
      - `type` (string)
        Specifies the data type for the field.
  - `secondaryAlias` (string)
    A secondary alias. It is typically used to support the signals alias for detection rules.
  - `shouldWrite` (boolean)
    Indicates whether the rule should write out alerts as data.
  - `useEcs` (boolean)
    Indicates whether to include the ECS component template for the alerts.
  - `useLegacyAlerts` (boolean · default: false)
    Indicates whether to include the legacy component template for the alerts.
- `authorized_consumers` (object)
  The list of the plugins IDs that have access to the rule type.
  - `alerts` (object)
    - `all` (boolean)
    - `read` (boolean)
  - `apm` (object)
    - `all` (boolean)
    - `read` (boolean)
  - `discover` (object)
    - `all` (boolean)
    - `read` (boolean)
  - `infrastructure` (object)
    - `all` (boolean)
    - `read` (boolean)
  - `logs` (object)
    - `all` (boolean)
    - `read` (boolean)
  - `ml` (object)
    - `all` (boolean)
    - `read` (boolean)
  - `monitoring` (object)
    - `all` (boolean)
    - `read` (boolean)
  - `siem` (object)
    - `all` (boolean)
    - `read` (boolean)
  - `slo` (object)
    - `all` (boolean)
    - `read` (boolean)
  - `stackAlerts` (object)
    - `all` (boolean)
    - `read` (boolean)
  - `uptime` (object)
    - `all` (boolean)
    - `read` (boolean)
- `category` (enum)
  The rule category, which is used by features such as category-specific maintenance windows.
  Values: `management`, `observability`, `securitySolution`
- `default_action_group_id` (string)
  The default identifier for the rule type group.
- `does_set_recovery_context` (boolean)
  Indicates whether the rule passes context variables to its recovery action.
- `enabled_in_license` (boolean)
  Indicates whether the rule type is enabled or disabled based on the subscription.
- `has_alerts_mappings` (boolean)
  Indicates whether the rule type has custom mappings for the alert data.
- `has_fields_for_a_a_d` (boolean)
- `id` (string)
  The unique identifier for the rule type.
- `is_exportable` (boolean)
  Indicates whether the rule type is exportable in **Stack Management > Saved Objects**.
- `minimum_license_required` (string)
  The subscriptions required to use the rule type.
- `name` (string)
  The descriptive name of the rule type.
- `producer` (string)
  An identifier for the application that produces this rule type.
- `recovery_action_group` (object)
  An action group to use when an alert goes from an active state to an inactive one.
  - `id` (string)
  - `name` (string)
- `rule_task_timeout` (string)
#### `401`

Authorization information is missing or invalid.

`application/json`

- `error` (enum)
  Values: `Unauthorized`
- `message` (string)
- `statusCode` (enum)
  Values: `401`
## Code examples

#### Console

```console
GET kbn:/api/alerting/rule_types
```

#### curl

```curl
curl -X GET "${KIBANA_URL}/api/alerting/rule_types" \
  -H "Authorization: ApiKey ${API_KEY}"
```

## Response examples

#### Retrieve rule types associated with Kibana machine learning features

`application/json`

```json
[
  {
    "action_groups": [
      {
        "id": "anomaly_score_match",
        "name": "Anomaly score matched the condition"
      },
      {
        "id": "recovered",
        "name": "Recovered"
      }
    ],
    "action_variables": {
      "context": [
        {
          "description": "The bucket timestamp of the anomaly",
          "name": "timestamp"
        },
        {
          "description": "The bucket time of the anomaly in ISO8601 format",
          "name": "timestampIso8601"
        },
        {
          "description": "List of job IDs that triggered the alert",
          "name": "jobIds"
        },
        {
          "description": "Alert info message",
          "name": "message"
        },
        {
          "description": "Indicate if top hits contain interim results",
          "name": "isInterim"
        },
        {
          "description": "Anomaly score at the time of the notification action",
          "name": "score"
        },
        {
          "description": "Top records",
          "name": "topRecords"
        },
        {
          "description": "Top influencers",
          "name": "topInfluencers"
        },
        {
          "description": "URL to open in the Anomaly Explorer",
          "name": "anomalyExplorerUrl",
          "useWithTripleBracesInTemplates": true
        }
      ],
      "params": [],
      "state": []
    },
    "alerts": {
      "context": "ml.anomaly-detection",
      "mappings": {
        "fieldMap": {
          "kibana.alert.anomaly_score": {
            "array": false,
            "type": "double",
            "required": false
          },
          "kibana.alert.anomaly_timestamp": {
            "array": false,
            "type": "date",
            "required": false
          },
          "kibana.alert.is_interim": {
            "array": false,
            "type": "boolean",
            "required": false
          },
          "kibana.alert.job_id": {
            "array": false,
            "type": "keyword",
            "required": true
          },
          "kibana.alert.top_influencers": {
            "array": true,
            "dynamic": false,
            "type": "object",
            "properties": {
              "influencer_field_name": {
                "type": "keyword"
              },
              "influencer_field_value": {
                "type": "keyword"
              },
              "influencer_score": {
                "type": "double"
              },
              "initial_influencer_score": {
                "type": "double"
              },
              "is_interim": {
                "type": "boolean"
              },
              "job_id": {
                "type": "keyword"
              },
              "timestamp": {
                "type": "date"
              }
            },
            "required": false
          },
          "kibana.alert.top_records": {
            "array": true,
            "dynamic": false,
            "type": "object",
            "properties": {
              "actual": {
                "type": "double"
              },
              "by_field_name": {
                "type": "keyword"
              },
              "by_field_value": {
                "type": "keyword"
              },
              "detector_index": {
                "type": "integer"
              },
              "field_name": {
                "type": "keyword"
              },
              "function": {
                "type": "keyword"
              },
              "initial_record_score": {
                "type": "double"
              },
              "is_interim": {
                "type": "boolean"
              },
              "job_id": {
                "type": "keyword"
              },
              "over_field_name": {
                "type": "keyword"
              },
              "over_field_value": {
                "type": "keyword"
              },
              "partition_field_name": {
                "type": "keyword"
              },
              "partition_field_value": {
                "type": "keyword"
              },
              "record_score": {
                "type": "double"
              },
              "timestamp": {
                "type": "date"
              },
              "typical": {
                "type": "double"
              }
            },
            "required": false
          }
        }
      },
      "shouldWrite": true
    },
    "authorized_consumers": {
      "alerts": {
        "all": true,
        "read": true
      },
      "apm": {
        "all": true,
        "read": true
      },
      "discover": {
        "all": true,
        "read": true
      },
      "infrastructure": {
        "all": true,
        "read": true
      },
      "logs": {
        "all": true,
        "read": true
      },
      "ml": {
        "all": true,
        "read": true
      },
      "monitoring": {
        "all": true,
        "read": true
      },
      "siem": {
        "all": true,
        "read": true
      },
      "slo": {
        "all": true,
        "read": true
      },
      "stackAlerts": {
        "all": true,
        "read": true
      },
      "uptime": {
        "all": true,
        "read": true
      }
    },
    "category": "management",
    "default_action_group_id": "anomaly_score_match",
    "does_set_recovery_context": true,
    "enabled_in_license": true,
    "has_alerts_mappings": true,
    "has_fields_for_a_a_d": true,
    "id": "xpack.ml.anomaly_detection_alert",
    "is_exportable": true,
    "minimum_license_required": "platinum",
    "name": "Anomaly detection alert",
    "producer": "ml",
    "recovery_action_group": {
      "id": "recovered",
      "name": "Recovered"
    },
    "rule_task_timeout": "5m"
  },
  {
    "action_groups": [
      {
        "id": "anomaly_detection_realtime_issue",
        "name": "Issue detected"
      },
      {
        "id": "recovered",
        "name": "Recovered"
      }
    ],
    "action_variables": {
      "context": [
        {
          "description": "Results of the rule execution",
          "name": "results"
        },
        {
          "description": "Alert info message",
          "name": "message"
        }
      ],
      "params": [],
      "state": []
    },
    "authorized_consumers": {
      "alerts": {
        "all": true,
        "read": true
      },
      "apm": {
        "all": true,
        "read": true
      },
      "discover": {
        "all": true,
        "read": true
      },
      "infrastructure": {
        "all": true,
        "read": true
      },
      "logs": {
        "all": true,
        "read": true
      },
      "ml": {
        "all": true,
        "read": true
      },
      "monitoring": {
        "all": true,
        "read": true
      },
      "siem": {
        "all": true,
        "read": true
      },
      "slo": {
        "all": true,
        "read": true
      },
      "stackAlerts": {
        "all": true,
        "read": true
      },
      "uptime": {
        "all": true,
        "read": true
      }
    },
    "category": "management",
    "default_action_group_id": "anomaly_detection_realtime_issue",
    "does_set_recovery_context": true,
    "enabled_in_license": true,
    "has_alerts_mappings": false,
    "has_fields_for_a_a_d": false,
    "id": "xpack.ml.anomaly_detection_jobs_health",
    "is_exportable": true,
    "minimum_license_required": "platinum",
    "name": "Anomaly detection jobs health",
    "producer": "ml",
    "recovery_action_group": {
      "id": "recovered",
      "name": "Recovered"
    },
    "rule_task_timeout": "5m"
  }
]
```

#### Unauthorized response for the get rule types API.

`application/json`

```json
{
  "error": "Unauthorized",
  "message": "[security_exception] missing authentication credentials for REST request",
  "statusCode": 401
}
```