Update an alert source

curl -X PUT http://localhost:5080/api/v1/alerts/sources/$SOURCE_ID \
  -H "authorization: Bearer $MS_TOKEN" \
  -H "content-type: application/json" \
  -d '{"name": "Production Prometheus", "enabled": false, "escalation_policy_id": "default", "severity": "error"}'

curl -X PUT http://localhost:5080/api/v1/alerts/sources/$SOURCE_ID \
  -H "authorization: Bearer $MS_TOKEN" \
  -H "content-type: application/json" \
  -d '{"name": "Production Prometheus", "enabled": false, "escalation_policy_id": "default", "severity": "error"}'

PUT /api/v1/alerts/sources/{id}

Writes back the settings of an alert source as a whole. It requires alerts.sources.manage. The fields are those of Create an alert source; the kind cannot change, so a kind given must be the current one. The token stays; Rotate a token changes it. Without home_cluster, the receiving cluster stays. Incidents already open keep their escalation policy and labels.

curl -X PUT http://localhost:5080/api/v1/alerts/sources/$SOURCE_ID \
  -H "authorization: Bearer $MS_TOKEN" \
  -H "content-type: application/json" \
  -d '{"name": "Production Prometheus", "enabled": false, "escalation_policy_id": "default", "severity": "error"}'

The response is the updated source, without a token. Errors

Status	Cause
`400`	A field is wrong, or the kind changed.
`403`	The token lacks `alerts.sources.manage`.
`404`	The source does not exist.

Last modified on October 31, 2026

Overview

Authentication

Intake

Query

APM

RUM

Streams

Alerting

Correlation & Web

Platform & Administration