Update a rule

curl -X PUT http://localhost:5080/api/v1/alerts/rules/$RULE_ID \
  -H "authorization: Bearer $MS_JWT" \
  -H 'content-type: application/json' \
  --data-binary @- <<'EOF'
{
  "name": "High error rate",
  "description": "More than 200 errors in five minutes",
  "enabled": true,
  "kind": "scheduled",
  "query": {
    "language": "sql",
    "statement": "SELECT count(*) AS c FROM app WHERE level = 'error'",
    "period_secs": 300,
    "stream": { "name": "app", "stream_type": "logs" }
  },
  "trigger": { "operator": "gt", "threshold": 200, "for_periods": 2, "silence_secs": 0 },
  "severity": "critical",
  "labels": { "team": "checkout" }
}
EOF

curl -X PUT http://localhost:5080/api/v1/alerts/rules/$RULE_ID \
  -H "authorization: Bearer $MS_JWT" \
  -H 'content-type: application/json' \
  --data-binary @- <<'EOF'
{
  "name": "High error rate",
  "description": "More than 200 errors in five minutes",
  "enabled": true,
  "kind": "scheduled",
  "query": {
    "language": "sql",
    "statement": "SELECT count(*) AS c FROM app WHERE level = 'error'",
    "period_secs": 300,
    "stream": { "name": "app", "stream_type": "logs" }
  },
  "trigger": { "operator": "gt", "threshold": 200, "for_periods": 2, "silence_secs": 0 },
  "severity": "critical",
  "labels": { "team": "checkout" }
}
EOF

PUT /api/v1/alerts/rules/{id}

Replaces the configuration of a rule. The body is the full body of Create a rule. The call keeps the rule id, organization, created_at, last_eval_at, and last_state. A changed escalation_policy_id must name a policy of the organization, or be default. The call requires alerts.manage.

The call replaces the rule and does not merge fields. An omitted field falls back to its default, including enabled, which becomes true, and kind, which becomes scheduled. Omitted labels, annotations, and thresholds become empty. Only an omitted escalation_policy_id keeps the current policy. Read the rule first and send the complete body back with the change.

The fingerprint of an incident derives from the rule id and the rule labels. After a change to labels, an incident that is already open keeps its old fingerprint and no longer resolves automatically. Resolve it with Resolve an incident.

curl -X PUT http://localhost:5080/api/v1/alerts/rules/$RULE_ID \
  -H "authorization: Bearer $MS_JWT" \
  -H 'content-type: application/json' \
  --data-binary @- <<'EOF'
{
  "name": "High error rate",
  "description": "More than 200 errors in five minutes",
  "enabled": true,
  "kind": "scheduled",
  "query": {
    "language": "sql",
    "statement": "SELECT count(*) AS c FROM app WHERE level = 'error'",
    "period_secs": 300,
    "stream": { "name": "app", "stream_type": "logs" }
  },
  "trigger": { "operator": "gt", "threshold": 200, "for_periods": 2, "silence_secs": 0 },
  "severity": "critical",
  "labels": { "team": "checkout" }
}
EOF

The response is the updated rule, in the shape shown in List rules. Errors

Status	Cause
`400`	The body fails the same checks as Create a rule, or a changed `escalation_policy_id` names no policy of the organization.
`404`	The rule does not exist.
`422`	A required field is missing or a value has the wrong type. The response is plain text.

Last modified on October 9, 2026

Overview

Authentication

Intake

Query

APM

RUM

Streams

Alerting

Correlation & Web

Platform & Administration