Version: 7.x-52.5.0
This is an older version of Search Guard. Switch to Latest version

Activate/Deactivate Watch API


PUT /_signals/watch/{tenant}/{watch_id}/_active
DELETE /_signals/watch/{tenant}/{watch_id}/_active

These endpoints can be used to activate and deactivate watches. Inactive watches are not automatically executed.

Using the PUT verb activates a watch, using the DELETE verb deactivates a watch.

Path Parameters

{tenant}: The name of the tenant which contains the watch to be activated or deactivated. _main refers to the default tenant. Users of the community edition will can only use _main here.

{watch_id}: The id of the watch to be activated or deactivated. Required.

Request Body

No request body is required for this endpoint.


200 OK

A watch identified by the given id exists and was successfully activated or deactivated.

403 Forbidden

The user does not have the permission to activate or deactivate watches for the currently selected tenant.

404 Not found

A watch with the given id does not exist for the current tenant.


For being able to access the endpoint, the user needs to have the privilege cluster:admin:searchguard:tenant:signals:watch/activate_deactivate for the currently selected tenant.

This permission is distinct for the permission required to create or updated watches. Thus, a user may be allowed to activate or deactivate watches without being allowed to create or update watches.

This permission is included in the following built-in action groups:



Deactivate a Watch

DELETE /_signals/watch/_main/bad_weather/_active


200 OK

Not what you were looking for? Try the search.