elastic · adcoelho · Mar 6, 2026 · Mar 3, 2026 · Mar 3, 2026 · Mar 3, 2026
diff --git a/x-pack/platform/packages/shared/response-ops/alerting-v2-schemas/src/alert_action_schema.ts b/x-pack/platform/packages/shared/response-ops/alerting-v2-schemas/src/alert_action_schema.ts
@@ -0,0 +1,89 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { z } from '@kbn/zod';
+
+const ackActionSchema = z.object({
+  action_type: z.literal('ack').describe('Acknowledges an alert.'),
+  episode_id: z.string().describe('The episode identifier for the alert to acknowledge.'),
+});
+
+const unackActionSchema = z.object({
+  action_type: z.literal('unack').describe('Removes acknowledgement from an alert.'),
+  episode_id: z.string().describe('The episode identifier for the alert to unacknowledge.'),
+});
+
+const tagActionSchema = z.object({
+  action_type: z.literal('tag').describe('Adds tags to an alert.'),
+  tags: z.array(z.string()).describe('List of tags to add to the alert.'),
+});
+
+const untagActionSchema = z.object({
+  action_type: z.literal('untag').describe('Removes tags from an alert.'),
+  tags: z.array(z.string()).describe('List of tags to remove from the alert.'),
+});
+
+const snoozeActionSchema = z.object({
+  action_type: z.literal('snooze').describe('Snoozes an alert.'),
+});
+
+const unsnoozeActionSchema = z.object({
+  action_type: z.literal('unsnooze').describe('Removes snooze from an alert.'),
+});
+
+const activateActionSchema = z.object({
+  action_type: z.literal('activate').describe('Activates an alert.'),
+  reason: z.string().describe('Reason for activating the alert.'),
+});
+
+const deactivateActionSchema = z.object({
+  action_type: z.literal('deactivate').describe('Deactivates an alert.'),
+  reason: z.string().describe('Reason for deactivating the alert.'),
+});
+
+export const createAlertActionBodySchema = z
+  .discriminatedUnion('action_type', [
+    ackActionSchema,
+    unackActionSchema,
+    tagActionSchema,
+    untagActionSchema,
+    snoozeActionSchema,
+    unsnoozeActionSchema,
+    activateActionSchema,
+    deactivateActionSchema,
+  ])
+  .describe(
+    'Request body for creating a single alert action. One of: ack, unack, tag, untag, snooze, unsnooze, activate, deactivate.'
+  );
+
+export type CreateAlertActionBody = z.infer<typeof createAlertActionBodySchema>;
+
+export const createAlertActionParamsSchema = z
+  .object({
+    group_hash: z.string().describe('Hash identifying the alert group to apply the action to.'),
+  })
+  .describe('Path parameters for the create alert action endpoint.');
+
+export type CreateAlertActionParams = z.infer<typeof createAlertActionParamsSchema>;
+
+export const bulkCreateAlertActionItemBodySchema = createAlertActionBodySchema.and(
+  z
+    .object({
+      group_hash: z.string().describe('Hash identifying the alert group to apply the action to.'),
+    })
+    .describe('Alert action payload with group identifier for bulk requests.')
+);
+export type BulkCreateAlertActionItemBody = z.infer<typeof bulkCreateAlertActionItemBodySchema>;
+
+export const bulkCreateAlertActionBodySchema = z
+  .array(bulkCreateAlertActionItemBodySchema)
+  .min(1, 'At least one action must be provided')
+  .max(100, 'Cannot process more than 100 actions in a single request')
+  .describe(
+    'Request body for bulk create alert actions. Array of 1 to 100 actions, each with group_hash and action payload.'
+  );
+export type BulkCreateAlertActionBody = z.infer<typeof bulkCreateAlertActionBodySchema>;
diff --git a/x-pack/platform/packages/shared/response-ops/alerting-v2-schemas/src/index.ts b/x-pack/platform/packages/shared/response-ops/alerting-v2-schemas/src/index.ts
@@ -10,3 +10,4 @@ export type { RuleResponse } from './rule_response';
 export { validateDuration, validateEsqlQuery } from './validation';
 export * from './notification_policy_data_schema';
 export type { NotificationPolicyResponse } from './notification_policy_response';
+export * from './alert_action_schema';
diff --git a/...m/plugins/shared/alerting_v2/server/lib/alert_actions_client/alert_actions_client.test.ts b/...m/plugins/shared/alerting_v2/server/lib/alert_actions_client/alert_actions_client.test.ts
@@ -7,7 +7,7 @@
 
 import type { UserProfileServiceStart } from '@kbn/core-user-profile-server';
 import type { UserService } from '../services/user_service/user_service';
-import type { CreateAlertActionBody } from '../../routes/schemas/alert_action_schema';
+import type { CreateAlertActionBody } from '@kbn/alerting-v2-schemas';
 import { createQueryService } from '../services/query_service/query_service.mock';
 import { createStorageService } from '../services/storage_service/storage_service.mock';
 import { createUserProfile, createUserService } from '../services/user_service/user_service.mock';

diff --git a/...atform/plugins/shared/alerting_v2/server/lib/alert_actions_client/alert_actions_client.ts b/...atform/plugins/shared/alerting_v2/server/lib/alert_actions_client/alert_actions_client.ts
@@ -9,12 +9,12 @@ import { esql } from '@elastic/esql';
 import Boom from '@hapi/boom';
 import { inject, injectable } from 'inversify';
 import { groupBy, omit } from 'lodash';
-import { ALERT_ACTIONS_DATA_STREAM, type AlertAction } from '../../resources/alert_actions';
-import { ALERT_EVENTS_DATA_STREAM } from '../../resources/alert_events';
 import type {
   BulkCreateAlertActionItemBody,
   CreateAlertActionBody,
-} from '../../routes/schemas/alert_action_schema';
+} from '@kbn/alerting-v2-schemas';
+import { ALERT_ACTIONS_DATA_STREAM, type AlertAction } from '../../resources/alert_actions';
+import { ALERT_EVENTS_DATA_STREAM } from '../../resources/alert_events';
 import { queryResponseToRecords } from '../services/query_service/query_response_to_records';
 import { type QueryServiceContract } from '../services/query_service/query_service';
 import { QueryServiceInternalToken } from '../services/query_service/tokens';

diff --git a/.../routes/bulk_create_alert_action_route.ts → ...actions/bulk_create_alert_action_route.ts b/.../routes/bulk_create_alert_action_route.ts → ...actions/bulk_create_alert_action_route.ts
@@ -10,13 +10,13 @@ import { Request, Response, type RouteHandler } from '@kbn/core-di-server';
 import type { KibanaRequest, KibanaResponseFactory, RouteSecurity } from '@kbn/core-http-server';
 import { buildRouteValidationWithZod } from '@kbn/zod-helpers';
 import { inject, injectable } from 'inversify';
-import { AlertActionsClient } from '../lib/alert_actions_client';
-import { ALERTING_V2_API_PRIVILEGES } from '../lib/security/privileges';
-import { INTERNAL_ALERTING_V2_ALERT_API_PATH } from './constants';
 import {
   bulkCreateAlertActionBodySchema,
   type BulkCreateAlertActionBody,
-} from './schemas/alert_action_schema';
+} from '@kbn/alerting-v2-schemas';
+import { AlertActionsClient } from '../../lib/alert_actions_client';
+import { ALERTING_V2_API_PRIVILEGES } from '../../lib/security/privileges';
+import { INTERNAL_ALERTING_V2_ALERT_API_PATH } from '../constants';
 
 @injectable()
 export class BulkCreateAlertActionRoute implements RouteHandler {

diff --git a/...erver/routes/create_alert_action_route.ts → ...lert_actions/create_alert_action_route.ts b/...erver/routes/create_alert_action_route.ts → ...lert_actions/create_alert_action_route.ts
@@ -6,19 +6,19 @@
  */
 
 import Boom from '@hapi/boom';
-import { Request, Response, type RouteHandler } from '@kbn/core-di-server';
-import type { KibanaRequest, KibanaResponseFactory, RouteSecurity } from '@kbn/core-http-server';
-import { buildRouteValidationWithZod } from '@kbn/zod-helpers';
-import { inject, injectable } from 'inversify';
-import { AlertActionsClient } from '../lib/alert_actions_client';
-import { ALERTING_V2_API_PRIVILEGES } from '../lib/security/privileges';
-import { INTERNAL_ALERTING_V2_ALERT_API_PATH } from './constants';
 import {
   createAlertActionBodySchema,
   createAlertActionParamsSchema,
   type CreateAlertActionBody,
   type CreateAlertActionParams,
-} from './schemas/alert_action_schema';
+} from '@kbn/alerting-v2-schemas';
+import { Request, Response, type RouteHandler } from '@kbn/core-di-server';
+import type { KibanaRequest, KibanaResponseFactory, RouteSecurity } from '@kbn/core-http-server';
+import { buildRouteValidationWithZod } from '@kbn/zod-helpers';
+import { inject, injectable } from 'inversify';
+import { AlertActionsClient } from '../../lib/alert_actions_client';
+import { ALERTING_V2_API_PRIVILEGES } from '../../lib/security/privileges';
+import { INTERNAL_ALERTING_V2_ALERT_API_PATH } from '../constants';
 
 @injectable()
 export class CreateAlertActionRoute implements RouteHandler {

diff --git a/...ing_v2/server/routes/create_rule_route.ts → .../server/routes/rules/create_rule_route.ts b/...ing_v2/server/routes/create_rule_route.ts → .../server/routes/rules/create_rule_route.ts
@@ -18,9 +18,9 @@ import type { RouteSecurity } from '@kbn/core-http-server';
 import { buildRouteValidationWithZod } from '@kbn/zod-helpers';
 import { createRuleDataSchema } from '@kbn/alerting-v2-schemas';
 import type { CreateRuleData, RuleResponse } from '@kbn/alerting-v2-schemas';
-import { RulesClient } from '../lib/rules_client';
-import { ALERTING_V2_API_PRIVILEGES } from '../lib/security/privileges';
-import { INTERNAL_ALERTING_V2_RULE_API_PATH } from './constants';
+import { RulesClient } from '../../lib/rules_client';
+import { ALERTING_V2_API_PRIVILEGES } from '../../lib/security/privileges';
+import { INTERNAL_ALERTING_V2_RULE_API_PATH } from '../constants';
 
 const createRuleParamsSchema = schema.object({
   id: schema.maybe(schema.string()),

diff --git a/...ing_v2/server/routes/delete_rule_route.ts → .../server/routes/rules/delete_rule_route.ts b/...ing_v2/server/routes/delete_rule_route.ts → .../server/routes/rules/delete_rule_route.ts
@@ -13,9 +13,9 @@ import { Request, Response } from '@kbn/core-di-server';
 import type { TypeOf } from '@kbn/config-schema';
 import type { RouteSecurity } from '@kbn/core-http-server';
 
-import { RulesClient } from '../lib/rules_client';
-import { ALERTING_V2_API_PRIVILEGES } from '../lib/security/privileges';
-import { INTERNAL_ALERTING_V2_RULE_API_PATH } from './constants';
+import { RulesClient } from '../../lib/rules_client';
+import { ALERTING_V2_API_PRIVILEGES } from '../../lib/security/privileges';
+import { INTERNAL_ALERTING_V2_RULE_API_PATH } from '../constants';
 
 const deleteRuleParamsSchema = schema.object({
   id: schema.string(),

diff --git a/...erting_v2/server/routes/get_rule_route.ts → ..._v2/server/routes/rules/get_rule_route.ts b/...erting_v2/server/routes/get_rule_route.ts → ..._v2/server/routes/rules/get_rule_route.ts
@@ -13,9 +13,9 @@ import { Request, Response } from '@kbn/core-di-server';
 import type { TypeOf } from '@kbn/config-schema';
 import type { RouteSecurity } from '@kbn/core-http-server';
 
-import { RulesClient } from '../lib/rules_client';
-import { ALERTING_V2_API_PRIVILEGES } from '../lib/security/privileges';
-import { INTERNAL_ALERTING_V2_RULE_API_PATH } from './constants';
+import { RulesClient } from '../../lib/rules_client';
+import { ALERTING_V2_API_PRIVILEGES } from '../../lib/security/privileges';
+import { INTERNAL_ALERTING_V2_RULE_API_PATH } from '../constants';
 
 const getRuleParamsSchema = schema.object({
   id: schema.string(),

diff --git a/...rting_v2/server/routes/get_rules_route.ts → ...v2/server/routes/rules/get_rules_route.ts b/...rting_v2/server/routes/get_rules_route.ts → ...v2/server/routes/rules/get_rules_route.ts
@@ -13,9 +13,9 @@ import { Request, Response } from '@kbn/core-di-server';
 import type { TypeOf } from '@kbn/config-schema';
 import type { RouteSecurity } from '@kbn/core-http-server';
 
-import { RulesClient } from '../lib/rules_client';
-import { ALERTING_V2_API_PRIVILEGES } from '../lib/security/privileges';
-import { INTERNAL_ALERTING_V2_RULE_API_PATH } from './constants';
+import { RulesClient } from '../../lib/rules_client';
+import { ALERTING_V2_API_PRIVILEGES } from '../../lib/security/privileges';
+import { INTERNAL_ALERTING_V2_RULE_API_PATH } from '../constants';
 
 const getRulesQuerySchema = schema.object({
   page: schema.maybe(schema.number({ min: 1 })),

diff --git a/...ing_v2/server/routes/update_rule_route.ts → .../server/routes/rules/update_rule_route.ts b/...ing_v2/server/routes/update_rule_route.ts → .../server/routes/rules/update_rule_route.ts
@@ -14,10 +14,10 @@ import type { TypeOf } from '@kbn/config-schema';
 import type { RouteSecurity } from '@kbn/core-http-server';
 import { buildRouteValidationWithZod } from '@kbn/zod-helpers';
 
-import { updateRuleDataSchema, type UpdateRuleData } from '../lib/rules_client';
-import { RulesClient } from '../lib/rules_client/rules_client';
-import { ALERTING_V2_API_PRIVILEGES } from '../lib/security/privileges';
-import { INTERNAL_ALERTING_V2_RULE_API_PATH } from './constants';
+import { updateRuleDataSchema, type UpdateRuleData } from '../../lib/rules_client';
+import { RulesClient } from '../../lib/rules_client/rules_client';
+import { ALERTING_V2_API_PRIVILEGES } from '../../lib/security/privileges';
+import { INTERNAL_ALERTING_V2_RULE_API_PATH } from '../constants';
 
 const updateRuleParamsSchema = schema.object({
   id: schema.string(),

diff --git a/x-pack/platform/plugins/shared/alerting_v2/server/routes/schemas/alert_action_schema.ts b/x-pack/platform/plugins/shared/alerting_v2/server/routes/schemas/alert_action_schema.ts
diff --git a/x-pack/platform/plugins/shared/alerting_v2/server/setup/bind_routes.ts b/x-pack/platform/plugins/shared/alerting_v2/server/setup/bind_routes.ts
@@ -7,13 +7,13 @@
 
 import type { ContainerModuleLoadOptions } from 'inversify';
 import { Route } from '@kbn/core-di-server';
-import { CreateRuleRoute } from '../routes/create_rule_route';
-import { UpdateRuleRoute } from '../routes/update_rule_route';
-import { GetRulesRoute } from '../routes/get_rules_route';
-import { GetRuleRoute } from '../routes/get_rule_route';
-import { DeleteRuleRoute } from '../routes/delete_rule_route';
-import { CreateAlertActionRoute } from '../routes/create_alert_action_route';
-import { BulkCreateAlertActionRoute } from '../routes/bulk_create_alert_action_route';
+import { CreateRuleRoute } from '../routes/rules/create_rule_route';
+import { UpdateRuleRoute } from '../routes/rules/update_rule_route';
+import { GetRulesRoute } from '../routes/rules/get_rules_route';
+import { GetRuleRoute } from '../routes/rules/get_rule_route';
+import { DeleteRuleRoute } from '../routes/rules/delete_rule_route';
+import { CreateAlertActionRoute } from '../routes/alert_actions/create_alert_action_route';
+import { BulkCreateAlertActionRoute } from '../routes/alert_actions/bulk_create_alert_action_route';
 import { CreateNotificationPolicyRoute } from '../routes/notification_policies/create_notification_policy_route';
 import { GetNotificationPolicyRoute } from '../routes/notification_policies/get_notification_policy_route';
 import { UpdateNotificationPolicyRoute } from '../routes/notification_policies/update_notification_policy_route';