[8.x] [ResponseOps][Rules] Migrate alerting APIs without access tags. (…

…#204003) (#204190)

# Backport

This will backport the following commits from `main` to `8.x`:
- [[ResponseOps][Rules] Migrate alerting APIs without access tags.
(#204003)](#204003)

<!--- Backport version: 9.4.3 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sqren/backport)

<!--BACKPORT
[{"author":{"name":"Antonio","email":"[email protected]"},"sourceCommit":{"committedDate":"2024-12-13T10:51:27Z","message":"[ResponseOps][Rules]
Migrate alerting APIs without access tags. (#204003)\n\nConnected with
https://github.com/elastic/kibana-team/issues/1322\r\n\r\n##
Summary\r\n\r\nSince most rule routes do not use access tags they need
to be migrated\r\nto include a reason in the security
params.\r\n\r\n\r\n[Documentation.](https://docs.elastic.dev/kibana-dev-docs/key-concepts/security-api-authorization#opting-out-of-authorization-for-specific-routes)\r\n\r\nSome
routes **use** access tags and have already been migrated.
These\r\nare:\r\n\r\n-`getFlappingSettingsRoute`\r\n-`updateFlappingSettingsRoute`\r\n-`createMaintenanceWindowRoute`\r\n-`getMaintenanceWindowRoute`\r\n-`updateMaintenanceWindowRoute`\r\n-`deleteMaintenanceWindowRoute`\r\n-`findMaintenanceWindowsRoute`\r\n-`archiveMaintenanceWindowRoute`\r\n-`finishMaintenanceWindowRoute`\r\n-`getActiveMaintenanceWindowsRoute`\r\n-`bulkGetMaintenanceWindowRoute`\r\n-`getQueryDelaySettingsRoute`\r\n-`updateQueryDelaySettingsRoute`\r\n\r\nAll
other were assigned the default reason for opting
out.","sha":"42704af65d32abe3824643dcf4cc37221cfe11fb","branchLabelMapping":{"^v9.0.0$":"main","^v8.18.0$":"8.x","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","Team:Endpoint
Response","v9.0.0","Feature:Alerting/RulesFramework","backport:prev-minor","v8.18.0"],"title":"[ResponseOps][Rules]
Migrate alerting APIs without access
tags.","number":204003,"url":"https://github.com/elastic/kibana/pull/204003","mergeCommit":{"message":"[ResponseOps][Rules]
Migrate alerting APIs without access tags. (#204003)\n\nConnected with
https://github.com/elastic/kibana-team/issues/1322\r\n\r\n##
Summary\r\n\r\nSince most rule routes do not use access tags they need
to be migrated\r\nto include a reason in the security
params.\r\n\r\n\r\n[Documentation.](https://docs.elastic.dev/kibana-dev-docs/key-concepts/security-api-authorization#opting-out-of-authorization-for-specific-routes)\r\n\r\nSome
routes **use** access tags and have already been migrated.
These\r\nare:\r\n\r\n-`getFlappingSettingsRoute`\r\n-`updateFlappingSettingsRoute`\r\n-`createMaintenanceWindowRoute`\r\n-`getMaintenanceWindowRoute`\r\n-`updateMaintenanceWindowRoute`\r\n-`deleteMaintenanceWindowRoute`\r\n-`findMaintenanceWindowsRoute`\r\n-`archiveMaintenanceWindowRoute`\r\n-`finishMaintenanceWindowRoute`\r\n-`getActiveMaintenanceWindowsRoute`\r\n-`bulkGetMaintenanceWindowRoute`\r\n-`getQueryDelaySettingsRoute`\r\n-`updateQueryDelaySettingsRoute`\r\n\r\nAll
other were assigned the default reason for opting
out.","sha":"42704af65d32abe3824643dcf4cc37221cfe11fb"}},"sourceBranch":"main","suggestedTargetBranches":["8.x"],"targetPullRequestStates":[{"branch":"main","label":"v9.0.0","branchLabelMappingKey":"^v9.0.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/204003","number":204003,"mergeCommit":{"message":"[ResponseOps][Rules]
Migrate alerting APIs without access tags. (#204003)\n\nConnected with
https://github.com/elastic/kibana-team/issues/1322\r\n\r\n##
Summary\r\n\r\nSince most rule routes do not use access tags they need
to be migrated\r\nto include a reason in the security
params.\r\n\r\n\r\n[Documentation.](https://docs.elastic.dev/kibana-dev-docs/key-concepts/security-api-authorization#opting-out-of-authorization-for-specific-routes)\r\n\r\nSome
routes **use** access tags and have already been migrated.
These\r\nare:\r\n\r\n-`getFlappingSettingsRoute`\r\n-`updateFlappingSettingsRoute`\r\n-`createMaintenanceWindowRoute`\r\n-`getMaintenanceWindowRoute`\r\n-`updateMaintenanceWindowRoute`\r\n-`deleteMaintenanceWindowRoute`\r\n-`findMaintenanceWindowsRoute`\r\n-`archiveMaintenanceWindowRoute`\r\n-`finishMaintenanceWindowRoute`\r\n-`getActiveMaintenanceWindowsRoute`\r\n-`bulkGetMaintenanceWindowRoute`\r\n-`getQueryDelaySettingsRoute`\r\n-`updateQueryDelaySettingsRoute`\r\n\r\nAll
other were assigned the default reason for opting
out.","sha":"42704af65d32abe3824643dcf4cc37221cfe11fb"}},{"branch":"8.x","label":"v8.18.0","branchLabelMappingKey":"^v8.18.0$","isSourceBranch":false,"state":"NOT_CREATED"}]}]
BACKPORT-->

Co-authored-by: Antonio <[email protected]>

x-pack/plugins/alerting/server/routes/backfill/apis/delete/delete_backfill_route.ts

@@ -12,6 +12,7 @@ import {
 import { ILicenseState } from '../../../../lib';
 import { verifyAccessAndContext } from '../../../lib';
 import { AlertingRequestHandlerContext, INTERNAL_BASE_ALERTING_API_PATH } from '../../../../types';
+import { DEFAULT_ALERTING_ROUTE_SECURITY } from '../../../constants';
 
 export const deleteBackfillRoute = (
   router: IRouter<AlertingRequestHandlerContext>,
@@ -20,6 +21,7 @@ export const deleteBackfillRoute = (
   router.delete(
     {
       path: `${INTERNAL_BASE_ALERTING_API_PATH}/rules/backfill/{id}`,
+      security: DEFAULT_ALERTING_ROUTE_SECURITY,
       options: {
         access: 'internal',
       },

x-pack/plugins/alerting/server/routes/backfill/apis/find/find_backfill_route.ts

@@ -17,6 +17,7 @@ import {
   INTERNAL_ALERTING_BACKFILL_FIND_API_PATH,
 } from '../../../../types';
 import { transformRequestV1, transformResponseV1 } from './transforms';
+import { DEFAULT_ALERTING_ROUTE_SECURITY } from '../../../constants';
 
 export const findBackfillRoute = (
   router: IRouter<AlertingRequestHandlerContext>,
@@ -25,6 +26,7 @@ export const findBackfillRoute = (
   router.post(
     {
       path: `${INTERNAL_ALERTING_BACKFILL_FIND_API_PATH}`,
+      security: DEFAULT_ALERTING_ROUTE_SECURITY,
       validate: {
         query: findQuerySchemaV1,
       },

x-pack/plugins/alerting/server/routes/backfill/apis/get/get_backfill_route.ts

@@ -14,6 +14,7 @@ import { ILicenseState } from '../../../../lib';
 import { verifyAccessAndContext } from '../../../lib';
 import { AlertingRequestHandlerContext, INTERNAL_BASE_ALERTING_API_PATH } from '../../../../types';
 import { transformBackfillToBackfillResponseV1 } from '../../transforms';
+import { DEFAULT_ALERTING_ROUTE_SECURITY } from '../../../constants';
 
 export const getBackfillRoute = (
   router: IRouter<AlertingRequestHandlerContext>,
@@ -22,6 +23,7 @@ export const getBackfillRoute = (
   router.get(
     {
       path: `${INTERNAL_BASE_ALERTING_API_PATH}/rules/backfill/{id}`,
+      security: DEFAULT_ALERTING_ROUTE_SECURITY,
       options: {
         access: 'internal',
       },

x-pack/plugins/alerting/server/routes/backfill/apis/schedule/schedule_backfill_route.ts

@@ -14,6 +14,7 @@ import { ILicenseState } from '../../../../lib';
 import { verifyAccessAndContext } from '../../../lib';
 import { AlertingRequestHandlerContext, INTERNAL_BASE_ALERTING_API_PATH } from '../../../../types';
 import { transformRequestV1, transformResponseV1 } from './transforms';
+import { DEFAULT_ALERTING_ROUTE_SECURITY } from '../../../constants';
 
 export const scheduleBackfillRoute = (
   router: IRouter<AlertingRequestHandlerContext>,
@@ -22,6 +23,7 @@ export const scheduleBackfillRoute = (
   router.post(
     {
       path: `${INTERNAL_BASE_ALERTING_API_PATH}/rules/backfill/_schedule`,
+      security: DEFAULT_ALERTING_ROUTE_SECURITY,
       options: { access: 'internal' },
       validate: {
         body: scheduleBodySchemaV1,

x-pack/plugins/alerting/server/routes/constants.ts

@@ -0,0 +1,20 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { RouteSecurity } from '@kbn/core-http-server';
+
+/**
+ * This constant is used as the default value for the security object in routes
+ * where a reason for opting out needs to be provided.
+ */
+export const DEFAULT_ALERTING_ROUTE_SECURITY: RouteSecurity = {
+  authz: {
+    enabled: false,
+    reason:
+      "This route is opted out from authorization because alerting uses it's own authorization model inside the alerts client.",
+  },
+};

x-pack/plugins/alerting/server/routes/framework/apis/health/health.ts

@@ -17,6 +17,7 @@ import {
 } from '../../../../types';
 import { getSecurityHealth } from '../../../../lib/get_security_health';
 import { transformHealthBodyResponse } from './transforms/transform_health_response/v1';
+import { DEFAULT_ALERTING_ROUTE_SECURITY } from '../../../constants';
 
 export const healthRoute = (
   router: IRouter<AlertingRequestHandlerContext>,
@@ -26,6 +27,7 @@ export const healthRoute = (
   router.get(
     {
       path: `${BASE_ALERTING_API_PATH}/_health`,
+      security: DEFAULT_ALERTING_ROUTE_SECURITY,
       options: {
         access: 'public',
         summary: `Get the alerting framework health`,

x-pack/plugins/alerting/server/routes/get_action_error_log.ts

@@ -11,6 +11,7 @@ import { ILicenseState } from '../lib';
 import { GetActionErrorLogByIdParams } from '../rules_client';
 import { RewriteRequestCase, verifyAccessAndContext } from './lib';
 import { AlertingRequestHandlerContext, INTERNAL_BASE_ALERTING_API_PATH } from '../types';
+import { DEFAULT_ALERTING_ROUTE_SECURITY } from './constants';
 
 const paramSchema = schema.object({
   id: schema.string(),
@@ -59,6 +60,7 @@ export const getActionErrorLogRoute = (
   router.get(
     {
       path: `${INTERNAL_BASE_ALERTING_API_PATH}/rule/{id}/_action_error_log`,
+      security: DEFAULT_ALERTING_ROUTE_SECURITY,
       validate: {
         params: paramSchema,
         query: querySchema,

x-pack/plugins/alerting/server/routes/get_global_execution_kpi.ts

@@ -10,6 +10,7 @@ import { AlertingRequestHandlerContext, INTERNAL_BASE_ALERTING_API_PATH } from '
 import { RewriteRequestCase, verifyAccessAndContext, rewriteNamespaces } from './lib';
 import { GetGlobalExecutionKPIParams } from '../rules_client';
 import { ILicenseState } from '../lib';
+import { DEFAULT_ALERTING_ROUTE_SECURITY } from './constants';
 
 const querySchema = schema.object({
   date_start: schema.string(),
@@ -37,6 +38,7 @@ export const getGlobalExecutionKPIRoute = (
   router.get(
     {
       path: `${INTERNAL_BASE_ALERTING_API_PATH}/_global_execution_kpi`,
+      security: DEFAULT_ALERTING_ROUTE_SECURITY,
       options: {
         access: 'internal',
       },

x-pack/plugins/alerting/server/routes/get_global_execution_logs.ts

@@ -11,6 +11,7 @@ import { ILicenseState } from '../lib';
 import { GetGlobalExecutionLogParams } from '../rules_client';
 import { RewriteRequestCase, verifyAccessAndContext, rewriteNamespaces } from './lib';
 import { AlertingRequestHandlerContext, INTERNAL_BASE_ALERTING_API_PATH } from '../types';
+import { DEFAULT_ALERTING_ROUTE_SECURITY } from './constants';
 
 const sortOrderSchema = schema.oneOf([schema.literal('asc'), schema.literal('desc')]);
 
@@ -62,6 +63,7 @@ export const getGlobalExecutionLogRoute = (
   router.get(
     {
       path: `${INTERNAL_BASE_ALERTING_API_PATH}/_global_execution_logs`,
+      security: DEFAULT_ALERTING_ROUTE_SECURITY,
       options: {
         access: 'internal',
       },

x-pack/plugins/alerting/server/routes/get_rule_alert_summary.ts

@@ -15,6 +15,7 @@ import {
   INTERNAL_BASE_ALERTING_API_PATH,
   AlertSummary,
 } from '../types';
+import { DEFAULT_ALERTING_ROUTE_SECURITY } from './constants';
 
 const paramSchema = schema.object({
   id: schema.string(),
@@ -65,6 +66,7 @@ export const getRuleAlertSummaryRoute = (
   router.get(
     {
       path: `${INTERNAL_BASE_ALERTING_API_PATH}/rule/{id}/_alert_summary`,
+      security: DEFAULT_ALERTING_ROUTE_SECURITY,
       options: {
         access: 'internal',
       },

x-pack/plugins/alerting/server/routes/get_rule_execution_kpi.ts

@@ -10,6 +10,7 @@ import { AlertingRequestHandlerContext, INTERNAL_BASE_ALERTING_API_PATH } from '
 import { RewriteRequestCase, verifyAccessAndContext } from './lib';
 import { GetRuleExecutionKPIParams } from '../rules_client';
 import { ILicenseState } from '../lib';
+import { DEFAULT_ALERTING_ROUTE_SECURITY } from './constants';
 
 const paramSchema = schema.object({
   id: schema.string(),
@@ -38,6 +39,7 @@ export const getRuleExecutionKPIRoute = (
   router.get(
     {
       path: `${INTERNAL_BASE_ALERTING_API_PATH}/rule/{id}/_execution_kpi`,
+      security: DEFAULT_ALERTING_ROUTE_SECURITY,
       options: {
         access: 'internal',
       },

x-pack/plugins/alerting/server/routes/get_rule_execution_log.ts

@@ -11,6 +11,7 @@ import { ILicenseState } from '../lib';
 import { GetExecutionLogByIdParams } from '../rules_client';
 import { RewriteRequestCase, verifyAccessAndContext } from './lib';
 import { AlertingRequestHandlerContext, INTERNAL_BASE_ALERTING_API_PATH } from '../types';
+import { DEFAULT_ALERTING_ROUTE_SECURITY } from './constants';
 
 const paramSchema = schema.object({
   id: schema.string(),
@@ -63,6 +64,7 @@ export const getRuleExecutionLogRoute = (
   router.get(
     {
       path: `${INTERNAL_BASE_ALERTING_API_PATH}/rule/{id}/_execution_log`,
+      security: DEFAULT_ALERTING_ROUTE_SECURITY,
       options: {
         access: 'internal',
       },

x-pack/plugins/alerting/server/routes/get_rule_state.ts

@@ -14,6 +14,7 @@ import {
   INTERNAL_BASE_ALERTING_API_PATH,
   RuleTaskState,
 } from '../types';
+import { DEFAULT_ALERTING_ROUTE_SECURITY } from './constants';
 
 const paramSchema = schema.object({
   id: schema.string(),
@@ -38,6 +39,7 @@ export const getRuleStateRoute = (
   router.get(
     {
       path: `${INTERNAL_BASE_ALERTING_API_PATH}/rule/{id}/state`,
+      security: DEFAULT_ALERTING_ROUTE_SECURITY,
       options: {
         access: 'internal',
       },

x-pack/plugins/alerting/server/routes/index.ts

@@ -94,7 +94,10 @@ export function defineRoutes(opts: RouteOptions) {
     getAlertIndicesAlias,
   } = opts;
 
+  // Legacy APIs
   defineLegacyRoutes(opts);
+
+  // Rule APIs
   createRuleRoute(opts);
   getRuleRoute(router, licenseState);
   getInternalRuleRoute(router, licenseState);
@@ -108,29 +111,30 @@ export function defineRoutes(opts: RouteOptions) {
   findInternalRulesRoute(router, licenseState, usageCounter);
   getRuleAlertSummaryRoute(router, licenseState);
   getRuleExecutionLogRoute(router, licenseState);
-  getGlobalExecutionLogRoute(router, licenseState);
-  getActionErrorLogRoute(router, licenseState);
   getRuleExecutionKPIRoute(router, licenseState);
-  getGlobalExecutionKPIRoute(router, licenseState);
   getRuleStateRoute(router, licenseState);
-  healthRoute(router, licenseState, encryptedSavedObjects);
   ruleTypesRoute(router, licenseState);
   muteAllRuleRoute(router, licenseState, usageCounter);
-  muteAlertRoute(router, licenseState);
   unmuteAllRuleRoute(router, licenseState);
-  unmuteAlertRoute(router, licenseState);
   updateRuleApiKeyRoute(router, licenseState);
   bulkEditInternalRulesRoute(router, licenseState);
   bulkDeleteRulesRoute({ router, licenseState });
   bulkEnableRulesRoute({ router, licenseState });
   bulkDisableRulesRoute({ router, licenseState });
   snoozeRuleRoute(router, licenseState);
   unsnoozeRuleRoute(router, licenseState);
-  runSoonRoute(router, licenseState);
   cloneRuleRoute(router, licenseState);
-  getFlappingSettingsRoute(router, licenseState);
-  updateFlappingSettingsRoute(router, licenseState);
   getRuleTagsRoute(router, licenseState);
+  registerRulesValueSuggestionsRoute(router, licenseState, config$!);
+
+  // Alert APIs
+  registerAlertsValueSuggestionsRoute(router, licenseState, config$!, getAlertIndicesAlias);
+  bulkUntrackAlertsRoute(router, licenseState);
+  bulkUntrackAlertsByQueryRoute(router, licenseState);
+  muteAlertRoute(router, licenseState);
+  unmuteAlertRoute(router, licenseState);
+
+  // Maintenance Window APIs
   createMaintenanceWindowRoute(router, licenseState);
   getMaintenanceWindowRoute(router, licenseState);
   updateMaintenanceWindowRoute(router, licenseState);
@@ -139,19 +143,24 @@ export function defineRoutes(opts: RouteOptions) {
   archiveMaintenanceWindowRoute(router, licenseState);
   finishMaintenanceWindowRoute(router, licenseState);
   getActiveMaintenanceWindowsRoute(router, licenseState);
-  registerAlertsValueSuggestionsRoute(router, licenseState, config$!, getAlertIndicesAlias);
-  registerRulesValueSuggestionsRoute(router, licenseState, config$!);
-  registerFieldsRoute(router, licenseState);
   bulkGetMaintenanceWindowRoute(router, licenseState);
-  getScheduleFrequencyRoute(router, licenseState);
-  bulkUntrackAlertsRoute(router, licenseState);
-  bulkUntrackAlertsByQueryRoute(router, licenseState);
-  getQueryDelaySettingsRoute(router, licenseState);
-  updateQueryDelaySettingsRoute(router, licenseState);
 
   // backfill APIs
   scheduleBackfillRoute(router, licenseState);
   getBackfillRoute(router, licenseState);
   findBackfillRoute(router, licenseState);
   deleteBackfillRoute(router, licenseState);
+
+  // Other APIs
+  registerFieldsRoute(router, licenseState);
+  getScheduleFrequencyRoute(router, licenseState);
+  getQueryDelaySettingsRoute(router, licenseState);
+  updateQueryDelaySettingsRoute(router, licenseState);
+  getGlobalExecutionLogRoute(router, licenseState);
+  getActionErrorLogRoute(router, licenseState);
+  getFlappingSettingsRoute(router, licenseState);
+  updateFlappingSettingsRoute(router, licenseState);
+  runSoonRoute(router, licenseState);
+  healthRoute(router, licenseState, encryptedSavedObjects);
+  getGlobalExecutionKPIRoute(router, licenseState);
 }

x-pack/plugins/alerting/server/routes/legacy/create.ts

@@ -20,6 +20,7 @@ import { RuleTypeDisabledError } from '../../lib/errors/rule_type_disabled';
 import { RouteOptions } from '..';
 import { countUsageOfPredefinedIds } from '../lib';
 import { trackLegacyRouteUsage } from '../../lib/track_legacy_route_usage';
+import { DEFAULT_ALERTING_ROUTE_SECURITY } from '../constants';
 
 export const bodySchema = schema.object({
   name: schema.string(),
@@ -62,6 +63,7 @@ export const createAlertRoute = ({
         ),
         body: bodySchema,
       },
+      security: DEFAULT_ALERTING_ROUTE_SECURITY,
       options: {
         access: isServerless ? 'internal' : 'public',
         summary: 'Create an alert',

x-pack/plugins/alerting/server/routes/legacy/delete.ts

@@ -13,6 +13,7 @@ import { ILicenseState } from '../../lib/license_state';
 import { verifyApiAccess } from '../../lib/license_api_access';
 import { LEGACY_BASE_ALERT_API_PATH } from '../../../common';
 import { trackLegacyRouteUsage } from '../../lib/track_legacy_route_usage';
+import { DEFAULT_ALERTING_ROUTE_SECURITY } from '../constants';
 
 const paramSchema = schema.object({
   id: schema.string(),
@@ -31,6 +32,7 @@ export const deleteAlertRoute = (
       validate: {
         params: paramSchema,
       },
+      security: DEFAULT_ALERTING_ROUTE_SECURITY,
       options: {
         access: isServerless ? 'internal' : 'public',
         summary: 'Delete an alert',

x-pack/plugins/alerting/server/routes/legacy/disable.ts

@@ -14,6 +14,7 @@ import { verifyApiAccess } from '../../lib/license_api_access';
 import { LEGACY_BASE_ALERT_API_PATH } from '../../../common';
 import { RuleTypeDisabledError } from '../../lib/errors/rule_type_disabled';
 import { trackLegacyRouteUsage } from '../../lib/track_legacy_route_usage';
+import { DEFAULT_ALERTING_ROUTE_SECURITY } from '../constants';
 
 const paramSchema = schema.object({
   id: schema.string(),
@@ -32,6 +33,7 @@ export const disableAlertRoute = (
       validate: {
         params: paramSchema,
       },
+      security: DEFAULT_ALERTING_ROUTE_SECURITY,
       options: {
         access: isServerless ? 'internal' : 'public',
         summary: 'Disable an alert',

x-pack/plugins/alerting/server/routes/legacy/enable.ts

@@ -15,6 +15,7 @@ import { LEGACY_BASE_ALERT_API_PATH } from '../../../common';
 import { handleDisabledApiKeysError } from '../lib/error_handler';
 import { RuleTypeDisabledError } from '../../lib/errors/rule_type_disabled';
 import { trackLegacyRouteUsage } from '../../lib/track_legacy_route_usage';
+import { DEFAULT_ALERTING_ROUTE_SECURITY } from '../constants';
 
 const paramSchema = schema.object({
   id: schema.string(),
@@ -33,6 +34,7 @@ export const enableAlertRoute = (
       validate: {
         params: paramSchema,
       },
+      security: DEFAULT_ALERTING_ROUTE_SECURITY,
       options: {
         access: isServerless ? 'internal' : 'public',
         summary: 'Enable an alert',

x-pack/plugins/alerting/server/routes/legacy/find.ts

@@ -19,6 +19,7 @@ import { renameKeys } from '../lib/rename_keys';
 import { IndexType } from '../../rules_client';
 import { trackLegacyRouteUsage } from '../../lib/track_legacy_route_usage';
 import { trackLegacyTerminology } from '../lib/track_legacy_terminology';
+import { DEFAULT_ALERTING_ROUTE_SECURITY } from '../constants';
 
 export interface FindOptions extends IndexType {
   perPage?: number;
@@ -75,6 +76,7 @@ export const findAlertRoute = (
       validate: {
         query: querySchema,
       },
+      security: DEFAULT_ALERTING_ROUTE_SECURITY,
       options: {
         access: isServerless ? 'internal' : 'public',
         summary: 'Find alerts',

x-pack/plugins/alerting/server/routes/legacy/get.ts

@@ -13,6 +13,7 @@ import { verifyApiAccess } from '../../lib/license_api_access';
 import { LEGACY_BASE_ALERT_API_PATH } from '../../../common';
 import type { AlertingRouter } from '../../types';
 import { trackLegacyRouteUsage } from '../../lib/track_legacy_route_usage';
+import { DEFAULT_ALERTING_ROUTE_SECURITY } from '../constants';
 
 const paramSchema = schema.object({
   id: schema.string(),
@@ -31,6 +32,7 @@ export const getAlertRoute = (
       validate: {
         params: paramSchema,
       },
+      security: DEFAULT_ALERTING_ROUTE_SECURITY,
       options: {
         access: isServerless ? 'internal' : 'public',
         summary: 'Get an alert',