# Apply a bulk action to detection rules

**POST /api/detection_engine/rules/_bulk_action**

Apply a bulk action, such as bulk edit, duplicate, or delete, to multiple detection rules. The bulk action is applied to all rules that match the query or to the rules listed by their IDs.
> warn
> When used with  [API key](https://www.elastic.co/guide/en/kibana/current/api-keys.html) authentication, the user's key gets assigned to the affected rules. If the user's key gets deleted or the user becomes inactive, the rules will stop running.

> If the API key that is used for authorization has different privileges than the key that created or most recently updated the rule, the rule behavior might change.



## Servers
- http://localhost:5601: http://localhost:5601 ()


## Authentication methods
- Basic auth


## Parameters


### Query parameters
- **dry_run** (boolean)
  Enables dry run mode for the request call.

  Enable dry run mode to verify that bulk actions can be applied to specified rules. Certain rules, such as prebuilt Elastic rules on a Basic subscription, can’t be edited and will return errors in the request response. Error details will contain an explanation, the rule name and/or ID, and additional troubleshooting information.

  To enable dry run mode on a request, add the query parameter `dry_run=true` to the end of the request URL. Rules specified in the request will be temporarily updated. These updates won’t be written to Elasticsearch.
  > info
  > Dry run mode is not supported for the `export` bulk action. A 400 error will be returned in the request response.

### Body: application/json (object)

- **action** (string)

- **ids** (array[string])
  Array of rule IDs. Array of rule IDs to which a bulk action will be applied. Only valid when query property is undefined.
- **query** (string)
  Query to filter rules.


## Responses
### 200
OK

#### Body: application/json (object)
- **attributes** (object)

- **message** (string)

- **rules_count** (integer)

- **status_code** (integer)

- **success** (boolean)



[Powered by Bump.sh](https://bump.sh)