Api key auth (http_api_key)
You must create an API key and use the encoded value in the request header. To learn about creating keys, go to API keys.
Kibana Serverless APIs
1.0.2
Base URL
http://api.example.com
http://api.example.comThe Kibana REST APIs for Elastic serverless enable you to manage resources such as connectors, data views, and saved objects. The API calls are stateless. Each request that you make happens in isolation from other calls and must include all of the necessary information for Kibana to fulfill the request. API requests return JSON output, which is a format that is machine-readable and works well for automation.
To interact with Kibana APIs, use the following operations:
- GET: Fetches the information.
- POST: Adds new information.
- PUT: Updates the existing information.
- DELETE: Removes the information.
You can prepend any Kibana API endpoint with kbn: and run the request in
Dev Tools → Console. For example:
GET kbn:/api/data_views
Documentation source and versions
This documentation is derived from the main branch of the kibana repository.
It is provided under license Attribution-NonCommercial-NoDerivatives 4.0 International.
This is version 1.0.2 of this API documentation.
Last update on Apr 22, 2025.
Servers
| Base URL | Description |
|---|---|
| http://localhost:5622 | |
| http://api.example.com | |
| https://<KIBANA_URL> |
Authentication
Alerting
Alerting enables you to define rules, which detect complex conditions within your data. When a condition is met, the rule tracks it as an alert and runs the actions that are defined in the rule. Actions typically involve the use of connectors to interact with Kibana services or third party integrations.
Path parameters
-
id
string Required The identifier for the rule.
GET
/api/alerting/rule/{id}
curl \
--request GET 'http://api.example.com/api/alerting/rule/{id}' \
--header "Authorization: $API_KEY"
Response examples (200)
{
"actions": [
{
"alerts_filter": {
"query": {
"dsl": "string",
"filters": [
{
"$state": {
"store": "appState"
},
"meta": {},
"query": {}
}
],
"kql": "string"
},
"timeframe": {
"days": [
1
],
"hours": {
"end": "string",
"start": "string"
},
"timezone": "string"
}
},
"connector_type_id": "string",
"frequency": {
"notify_when": "onActionGroupChange",
"summary": true,
"throttle": "string"
},
"group": "string",
"id": "string",
"params": {},
"use_alert_data_for_template": true,
"uuid": "string"
}
],
"active_snoozes": [
"string"
],
"alert_delay": {
"active": 42.0
},
"api_key_created_by_user": true,
"api_key_owner": "string",
"consumer": "string",
"created_at": "string",
"created_by": "string",
"enabled": true,
"execution_status": {
"error": {
"message": "string",
"reason": "read"
},
"last_duration": 42.0,
"last_execution_date": "string",
"status": "ok",
"warning": {
"message": "string",
"reason": "maxExecutableActions"
}
},
"flapping": {
"look_back_window": 42.0,
"status_change_threshold": 42.0
},
"id": "string",
"is_snoozed_until": "string",
"last_run": {
"alerts_count": {
"active": 42.0,
"ignored": 42.0,
"new": 42.0,
"recovered": 42.0
},
"outcome": "succeeded",
"outcome_msg": [
"string"
],
"outcome_order": 42.0,
"warning": "read"
},
"mapped_params": {},
"monitoring": {
"run": {
"calculated_metrics": {
"p50": 42.0,
"p95": 42.0,
"p99": 42.0,
"success_ratio": 42.0
},
"history": [
{
"duration": 42.0,
"outcome": "succeeded",
"success": true,
"timestamp": 42.0
}
],
"last_run": {
"metrics": {
"duration": 42.0,
"gap_duration_s": 42.0,
"gap_range": {
"gte": "string",
"lte": "string"
},
"total_alerts_created": 42.0,
"total_alerts_detected": 42.0,
"total_indexing_duration_ms": 42.0,
"total_search_duration_ms": 42.0
},
"timestamp": "string"
}
}
},
"mute_all": true,
"muted_alert_ids": [
"string"
],
"name": "string",
"next_run": "string",
"notify_when": "onActionGroupChange",
"params": {},
"revision": 42.0,
"rule_type_id": "string",
"running": true,
"schedule": {
"interval": "string"
},
"scheduled_task_id": "string",
"snooze_schedule": [
{
"duration": 42.0,
"id": "string",
"rRule": {
"byhour": [
42.0
],
"byminute": [
42.0
],
"bymonth": [
42.0
],
"bymonthday": [
42.0
],
"bysecond": [
42.0
],
"bysetpos": [
42.0
],
"byweekday": [
"string"
],
"byweekno": [
42.0
],
"byyearday": [
42.0
],
"count": 42.0,
"dtstart": "string",
"freq": 0,
"interval": 42.0,
"tzid": "string",
"until": "string",
"wkst": "MO"
},
"skipRecurrences": [
"string"
]
}
],
"tags": [
"string"
],
"throttle": "string",
"updated_at": "string",
"updated_by": "string",
"view_in_app_relative_url": "string"
}Path parameters
-
id
string Required The identifier for the rule.
Body
-
actions
array[object] An action that runs under defined conditions.
Default value is
[](empty). -
alert_delay
object Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
Additional properties are NOT allowed.
-
flapping
object | null When flapping detection is turned on, alerts that switch quickly between active and recovered states are identified as “flapping” and notifications are reduced.
Additional properties are NOT allowed.
-
name
string Required The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
-
notify_when
string | null Indicates how often alerts generate actions. Valid values include:
onActionGroupChange: Actions run when the alert status changes;onActiveAlert: Actions run when the alert becomes active and at each check interval while the rule conditions are met;onThrottleInterval: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. NOTE: You cannot specifynotify_whenat both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values.Values are
onActionGroupChange,onActiveAlert, oronThrottleInterval. -
params
object The parameters for the rule.
Default value is
{}(empty). Additional properties are allowed. -
schedule
object Required Additional properties are NOT allowed.
-
throttle
string | null Use the
throttleproperty in the actionfrequencyobject instead. The throttle interval, which defines how often an alert generates repeated actions. NOTE: You cannot specify the throttle interval at both the rule and action level. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values.
PUT
/api/alerting/rule/{id}
curl \
--request PUT 'http://api.example.com/api/alerting/rule/{id}' \
--header "Authorization: $API_KEY" \
--header "Content-Type: application/json" \
--header "kbn-xsrf: true" \
--data '{"name":"new name","tags":[],"params":{"index":[".updated-index"],"aggType":"avg","groupBy":"top","aggField":"sheet.version","termSize":6,"termField":"name.keyword","threshold":[1000],"timeField":"@timestamp","timeWindowSize":5,"timeWindowUnit":"m","thresholdComparator":"\u003e"},"actions":[{"id":"96b668d0-a1b6-11ed-afdf-d39a49596974","group":"threshold met","params":{"level":"info","message":"Rule {{rule.name}} is active for group {{context.group}}:\n\n- Value: {{context.value}}\n- Conditions Met: {{context.conditions}} over {{rule.params.timeWindowSize}}{{rule.params.timeWindowUnit}}\n- Timestamp: {{context.date}}"},"frequency":{"summary":false,"notify_when":"onActionGroupChange"}}],"schedule":{"interval":"1m"}}'
Request example
Update an index threshold rule that uses a server log connector to send notifications when the threshold is met.
{
"name": "new name",
"tags": [],
"params": {
"index": [
".updated-index"
],
"aggType": "avg",
"groupBy": "top",
"aggField": "sheet.version",
"termSize": 6,
"termField": "name.keyword",
"threshold": [
1000
],
"timeField": "@timestamp",
"timeWindowSize": 5,
"timeWindowUnit": "m",
"thresholdComparator": ">"
},
"actions": [
{
"id": "96b668d0-a1b6-11ed-afdf-d39a49596974",
"group": "threshold met",
"params": {
"level": "info",
"message": "Rule {{rule.name}} is active for group {{context.group}}:\n\n- Value: {{context.value}}\n- Conditions Met: {{context.conditions}} over {{rule.params.timeWindowSize}}{{rule.params.timeWindowUnit}}\n- Timestamp: {{context.date}}"
},
"frequency": {
"summary": false,
"notify_when": "onActionGroupChange"
}
}
],
"schedule": {
"interval": "1m"
}
}
Response examples (200)
The response for successfully updating an index threshold rule.
{
"id": "ac4e6b90-6be7-11eb-ba0d-9b1c1f912d74",
"name": "new name",
"tags": [],
"params": {
"index": [
".updated-index"
],
"aggType": "avg",
"groupBy": "top",
"aggField": "sheet.version",
"termSize": 6,
"termField": "name.keyword",
"threshold": [
1000
],
"timeField": "@timestamp",
"timeWindowSize": 5,
"timeWindowUnit": "m",
"thresholdComparator": ">"
},
"actions": [
{
"id": "96b668d0-a1b6-11ed-afdf-d39a49596974",
"uuid": "07aef2a0-9eed-4ef9-94ec-39ba58eb609d",
"group": "threshold met",
"params": {
"level": "info",
"message": "Rule {{rule.name}} is active for group {{context.group}}:\n\n- Value: {{context.value}}\n- Conditions Met: {{context.conditions}} over {{rule.params.timeWindowSize}}{{rule.params.timeWindowUnit}}\n- Timestamp: {{context.date}"
},
"frequency": {
"summary": false,
"throttle": null,
"notify_when": "onActionGroupChange"
},
"connector_type_id": ".server-log"
}
],
"enabled": true,
"running": false,
"consumer": "alerts",
"last_run": {
"outcome": "succeeded",
"warning": null,
"outcome_msg": null,
"alerts_count": {
"new": 0,
"active": 0,
"ignored": 0,
"recovered": 0
}
},
"mute_all": false,
"next_run": "2024-03-26T23:23:51.316Z",
"revision": 1,
"schedule": {
"interval": "1m"
},
"throttle": null,
"created_at": "2024-03-26T23:13:20.985Z",
"created_by": "elastic",
"updated_at": "2024-03-26T23:22:59.949Z",
"updated_by": "elastic",
"rule_type_id": ".index-threshold",
"api_key_owner": "elastic",
"muted_alert_ids": [],
"execution_status": {
"status": "ok",
"last_duration": 52,
"last_execution_date": "2024-03-26T23:22:51.390Z"
},
"scheduled_task_id": "4c5eda00-e74f-11ec-b72f-5b18752ff9ea",
"api_key_created_by_user": false
}Path parameters
-
id
string Required The identifier for the rule. If it is omitted, an ID is randomly generated.
Body
-
actions
array[object] An action that runs under defined conditions.
Default value is
[](empty). -
alert_delay
object Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
Additional properties are NOT allowed.
-
consumer
string Required The name of the application or feature that owns the rule. For example:
alerts,apm,discover,infrastructure,logs,metrics,ml,monitoring,securitySolution,siem,stackAlerts, oruptime. -
enabled
boolean Indicates whether you want to run the rule on an interval basis after it is created.
Default value is
true. -
flapping
object | null When flapping detection is turned on, alerts that switch quickly between active and recovered states are identified as “flapping” and notifications are reduced.
Additional properties are NOT allowed.
-
name
string Required The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.
-
notify_when
string | null Indicates how often alerts generate actions. Valid values include:
onActionGroupChange: Actions run when the alert status changes;onActiveAlert: Actions run when the alert becomes active and at each check interval while the rule conditions are met;onThrottleInterval: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. NOTE: You cannot specifynotify_whenat both the rule and action level. The recommended method is to set it for each action. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values.Values are
onActionGroupChange,onActiveAlert, oronThrottleInterval. -
rule_type_id
string Required The rule type identifier.
-
schedule
object Required The check interval, which specifies how frequently the rule conditions are checked.
Additional properties are NOT allowed.
-
throttle
string | null Use the
throttleproperty in the actionfrequencyobject instead. The throttle interval, which defines how often an alert generates repeated actions. NOTE: You cannot specify the throttle interval at both the rule and action level. If you set it at the rule level then update the rule in Kibana, it is automatically changed to use action-specific values. params
object The parameters for the rule.
Any of: params_property_apm_anomalyobject params_property_apm_error_countobject params_property_apm_transaction_durationobject params_property_apm_transaction_error_rateobject params_es_query_dsl_ruleobject params_es_query_esql_ruleobject params_es_query_kql_ruleobject params_index_threshold_ruleobject params_property_infra_inventoryobject Countobject Ratioobject params_property_infra_metric_thresholdobject params_property_slo_burn_rateobject params_property_synthetics_uptime_tlsobject params_property_synthetics_monitor_statusobject
POST
/api/alerting/rule/{id}
curl \
--request POST 'http://api.example.com/api/alerting/rule/{id}' \
--header "Authorization: $API_KEY" \
--header "Content-Type: application/json" \
--header "kbn-xsrf: true" \
--data '{"name":"my Elasticsearch query ESQL rule","params":{"size":0,"esqlQuery":{"esql":"FROM kibana_sample_data_logs | KEEP bytes, clientip, host, geo.dest | where geo.dest != \"GB\" | STATS sumbytes = sum(bytes) by clientip, host | WHERE sumbytes \u003e 5000 | SORT sumbytes desc | LIMIT 10"},"threshold":[0],"timeField":"@timestamp","searchType":"esqlQuery","timeWindowSize":1,"timeWindowUnit":"d","thresholdComparator":"\u003e"},"actions":[{"id":"d0db1fe0-78d6-11ee-9177-f7d404c8c945","group":"query matched","params":{"level":"info","message":"Elasticsearch query rule '{{rule.name}}' is active:\n- Value: {{context.value}} - Conditions Met: {{context.conditions}} over {{rule.params.timeWindowSize}}{{rule.params.timeWindowUnit}} - Timestamp: {{context.date}} - Link: {{context.link}}"},"frequency":{"summary":false,"notify_when":"onActiveAlert"}}],"consumer":"stackAlerts","schedule":{"interval":"1d"},"rule_type_id":".es-query"}'
Request examples
Elasticsearch query rule (ES|QL)
Create an Elasticsearch query rule that uses Elasticsearch Query Language (ES|QL) to define its query and a server log connector to send notifications.
{
"name": "my Elasticsearch query ESQL rule",
"params": {
"size": 0,
"esqlQuery": {
"esql": "FROM kibana_sample_data_logs | KEEP bytes, clientip, host, geo.dest | where geo.dest != \"GB\" | STATS sumbytes = sum(bytes) by clientip, host | WHERE sumbytes > 5000 | SORT sumbytes desc | LIMIT 10"
},
"threshold": [
0
],
"timeField": "@timestamp",
"searchType": "esqlQuery",
"timeWindowSize": 1,
"timeWindowUnit": "d",
"thresholdComparator": ">"
},
"actions": [
{
"id": "d0db1fe0-78d6-11ee-9177-f7d404c8c945",
"group": "query matched",
"params": {
"level": "info",
"message": "Elasticsearch query rule '{{rule.name}}' is active:\n- Value: {{context.value}} - Conditions Met: {{context.conditions}} over {{rule.params.timeWindowSize}}{{rule.params.timeWindowUnit}} - Timestamp: {{context.date}} - Link: {{context.link}}"
},
"frequency": {
"summary": false,
"notify_when": "onActiveAlert"
}
}
],
"consumer": "stackAlerts",
"schedule": {
"interval": "1d"
},
"rule_type_id": ".es-query"
}
Create an Elasticsearch query rule that uses Kibana query language (KQL).
{
"name": "my Elasticsearch query KQL rule",
"params": {
"size": 100,
"aggType": "count",
"groupBy": "all",
"threshold": [
1000
],
"searchType": "searchSource",
"timeWindowSize": 5,
"timeWindowUnit": "m",
"searchConfiguration": {
"index": "90943e30-9a47-11e8-b64d-95841ca0b247",
"query": {
"query": "\"\"geo.src : \"US\" \"\"",
"language": "kuery"
}
},
"thresholdComparator": ">",
"excludeHitsFromPreviousRun": true
},
"consumer": "alerts",
"schedule": {
"interval": "1m"
},
"rule_type_id": ".es-query"
}
Create an Elasticsearch query rule that uses Elasticsearch query domain specific language (DSL) to define its query and a server log connector to send notifications.
{
"name": "my Elasticsearch query rule",
"params": {
"size": 100,
"index": [
"kibana_sample_data_logs"
],
"esQuery": "\"\"\"{\"query\":{\"match_all\" : {}}}\"\"\"",
"threshold": [
100
],
"timeField": "@timestamp",
"timeWindowSize": 1,
"timeWindowUnit": "d",
"thresholdComparator": ">"
},
"actions": [
{
"id": "fdbece50-406c-11ee-850e-c71febc4ca7f",
"group": "query matched",
"params": {
"level": "info",
"message": "The system has detected {{alerts.new.count}} new, {{alerts.ongoing.count}} ongoing, and {{alerts.recovered.count}} recovered alerts."
},
"frequency": {
"summary": true,
"throttle": "1d",
"notify_when": "onThrottleInterval"
}
},
{
"id": "fdbece50-406c-11ee-850e-c71febc4ca7f",
"group": "recovered",
"params": {
"level": "info",
"message": "Recovered"
},
"frequency": {
"summary": false,
"notify_when": "onActionGroupChange"
}
}
],
"consumer": "alerts",
"schedule": {
"interval": "1d"
},
"rule_type_id": ".es-query"
}
Create an index threshold rule that uses a server log connector to send notifications when the threshold is met.
{
"name": "my rule",
"tags": [
"cpu"
],
"params": {
"index": [
".test-index"
],
"aggType": "avg",
"groupBy": "top",
"aggField": "sheet.version",
"termSize": 6,
"termField": "name.keyword",
"threshold": [
1000
],
"timeField": "@timestamp",
"timeWindowSize": 5,
"timeWindowUnit": "m",
"thresholdComparator": ">"
},
"actions": [
{
"id": "48de3460-f401-11ed-9f8e-399c75a2deeb",
"group": "threshold met",
"params": {
"level": "info",
"message": "Rule '{{rule.name}}' is active for group '{{context.group}}':\n\n- Value: {{context.value}}\n- Conditions Met: {{context.conditions}} over {{rule.params.timeWindowSize}}{{rule.params.timeWindowUnit}}\n- Timestamp: {{context.date}}"
},
"frequency": {
"summary": false,
"notify_when": "onActionGroupChange"
}
}
],
"consumer": "alerts",
"schedule": {
"interval": "1m"
},
"alert_delay": {
"active": 3
},
"rule_type_id": ".index-threshold"
}
Create a tracking containment rule that checks when an entity is contained or no longer contained within a boundary.
{
"name": "my tracking rule",
"params": {
"index": "kibana_sample_data_logs",
"entity": "agent.keyword",
"indexId": "90943e30-9a47-11e8-b64d-95841ca0b247",
"geoField": "geo.coordinates",
"dateField\"": "@timestamp",
"boundaryType": "entireIndex",
"boundaryIndexId": "0cd90abf-abe7-44c7-909a-f621bbbcfefc",
"boundaryGeoField": "location",
"boundaryNameField": "name",
"boundaryIndexTitle": "boundary*"
},
"consumer": "alerts",
"schedule": {
"interval": "1h"
},
"rule_type_id": ".geo-containment"
}
Response examples (200)
Elasticsearch query rule (ES|QL)
The response for successfully creating an Elasticsearch query rule that uses Elasticsearch Query Language (ES|QL).
{
"id": "e0d62360-78e8-11ee-9177-f7d404c8c945",
"name": "my Elasticsearch query ESQL rule",
"tags": [],
"params": {
"size": 0,
"aggType": "count",
"groupBy": "all",
"esqlQuery": {
"esql": "FROM kibana_sample_data_logs | keep bytes, clientip, host, geo.dest | WHERE geo.dest != \"GB\" | stats sumbytes = sum(bytes) by clientip, host | WHERE sumbytes > 5000 | sort sumbytes desc | limit 10"
},
"threshold": [
0
],
"timeField": "@timestamp",
"searchType": "esqlQuery",
"timeWindowSize": 1,
"timeWindowUnit": "d",
"thresholdComparator": ">",
"excludeHitsFromPreviousRun\"": "true,"
},
"actions": [
{
"id": "d0db1fe0-78d6-11ee-9177-f7d404c8c945",
"uuid": "bfe370a3-531b-4855-bbe6-ad739f578844",
"group": "query matched",
"params": {
"level": "info",
"message": "Elasticsearch query rule '{{rule.name}}' is active:\n- Value: {{context.value}} - Conditions Met: {{context.conditions}} over {{rule.params.timeWindowSize}}{{rule.params.timeWindowUnit}} - Timestamp: {{context.date}} - Link: {{context.link}}"
},
"frequency": {
"summary": false,
"throttle": null,
"notify_when": "onActiveAlert"
},
"connector_type_id": ".server-log"
}
],
"enabled": true,
"running": false,
"consumer": "stackAlerts",
"mute_all": false,
"revision": 0,
"schedule": {
"interval": "1d"
},
"throttle": null,
"created_at": "2023-11-01T19:00:10.453Z",
"created_by": "elastic",
"updated_at": "2023-11-01T19:00:10.453Z",
"updated_by": "elastic\",",
"notify_when": null,
"rule_type_id": ".es-query",
"api_key_owner": "elastic",
"muted_alert_ids": [],
"execution_status": {
"status": "pending",
"last_execution_date": "2023-11-01T19:00:10.453Z"
},
"scheduled_task_id": "e0d62360-78e8-11ee-9177-f7d404c8c945",
"api_key_created_by_user": false
}
The response for successfully creating an Elasticsearch query rule that uses Kibana query language (KQL).
{
"id": "7bd506d0-2284-11ee-8fad-6101956ced88",
"name": "my Elasticsearch query KQL rule\"",
"tags": [],
"params": {
"size": 100,
"aggType": "count",
"groupBy": "all",
"threshold": [
1000
],
"searchType": "searchSource",
"timeWindowSize": 5,
"timeWindowUnit": "m",
"searchConfiguration": {
"index": "90943e30-9a47-11e8-b64d-95841ca0b247",
"query": {
"query": "\"\"geo.src : \"US\" \"\"",
"language": "kuery"
}
},
"thresholdComparator": ">",
"excludeHitsFromPreviousRun": true
},
"actions": [],
"enabled": true,
"running": false,
"consumer": "alerts",
"mute_all": false,
"revision": 0,
"schedule": {
"interval": "1m"
},
"throttle": null,
"created_at": "2023-07-14T20:24:50.729Z",
"created_by": "elastic",
"updated_at": "2023-07-14T20:24:50.729Z",
"updated_by": "elastic",
"notify_when": null,
"rule_type_id": ".es-query",
"api_key_owner": "elastic",
"muted_alert_ids": [],
"execution_status": {
"status": "pending",
"last_execution_date": "2023-07-14T20:24:50.729Z"
},
"scheduled_task_id": "7bd506d0-2284-11ee-8fad-6101956ced88",
"api_key_created_by_user": false
}
The response for successfully creating an Elasticsearch query rule that uses Elasticsearch query domain specific language (DSL).
{
"id": "58148c70-407f-11ee-850e-c71febc4ca7f",
"name": "my Elasticsearch query rule",
"tags": [],
"params": {
"size": 100,
"index": [
"kibana_sample_data_logs"
],
"aggType": "count",
"esQuery": "\"\"\"{\"query\":{\"match_all\" : {}}}\"\"\"",
"groupBy": "all",
"threshold": [
100
],
"timeField": "@timestamp",
"searchType": "esQuery",
"timeWindowSize": 1,
"timeWindowUnit": "d",
"thresholdComparator": ">",
"excludeHitsFromPreviousRun": true
},
"actions": [
{
"id": "fdbece50-406c-11ee-850e-c71febc4ca7f",
"uuid": "53f3c2a3-e5d0-4cfa-af3b-6f0881385e78",
"group": "query matched",
"params": {
"level": "info",
"message": "The system has detected {{alerts.new.count}} new, {{alerts.ongoing.count}} ongoing, and {{alerts.recovered.count}} recovered alerts."
},
"frequency": {
"summary": true,
"throttle": "1d",
"notify_when": "onThrottleInterval"
},
"connector_type_id": ".server-log"
},
{
"id": "fdbece50-406c-11ee-850e-c71febc4ca7f",
"uuid": "2324e45b-c0df-45c7-9d70-4993e30be758",
"group": "recovered",
"params": {
"level": "info",
"message": "Recovered"
},
"frequency": {
"summary": false,
"throttle": null,
"notify_when": "onActionGroupChange"
},
"connector_type_id": ".server-log"
}
],
"enabled": true,
"running": false,
"consumer": "alerts",
"mute_all": false,
"revision": 0,
"schedule": {
"interval": "1d"
},
"throttle": null,
"created_at": "2023-08-22T00:03:38.263Z",
"created_by": "elastic",
"updated_at": "2023-08-22T00:03:38.263Z",
"updated_by": "elastic",
"notify_when": null,
"rule_type_id": ".es-query",
"api_key_owner": "elastic",
"muted_alert_ids": [],
"execution_status": {
"status": "pending",
"last_execution_date": "2023-08-22T00:03:38.263Z"
},
"scheduled_task_id": "58148c70-407f-11ee-850e-c71febc4ca7f",
"api_key_created_by_user": false
}
The response for successfully creating an index threshold rule.
{
"id": "41893910-6bca-11eb-9e0d-85d233e3ee35",
"name": "my rule",
"tags": [
"cpu"
],
"params": {
"index": [
".test-index"
],
"aggType": "avg",
"groupBy": "top",
"aggField": "sheet.version",
"termSize": 6,
"termField": "name.keyword",
"threshold": [
1000
],
"timeField": "@timestamp",
"timeWindowSize": 5,
"timeWindowUnit": "m",
"thresholdComparator": ">"
},
"actions": [
{
"id": "dceeb5d0-6b41-11eb-802b-85b0c1bc8ba2",
"uuid": "07aef2a0-9eed-4ef9-94ec-39ba58eb609d",
"group": "threshold met",
"params": {
"level": "info",
"message": "Rule {{rule.name}} is active for group {{context.group} :\n\n- Value: {{context.value}}\n- Conditions Met: {{context.conditions}} over {{rule.params.timeWindowSize}}{{rule.params.timeWindowUnit}}\n- Timestamp: {{context.date}}"
},
"frequency": {
"summary": false,
"throttle": null,
"notify_when": "onActionGroupChange"
},
"connector_type_id": ".server-log"
}
],
"enabled": true,
"running": false,
"consumer": "alerts",
"mute_all": false,
"revision": 0,
"schedule": {
"interval": "1m"
},
"throttle": null,
"created_at": "2022-06-08T17:20:31.632Z",
"created_by": "elastic",
"updated_at": "2022-06-08T17:20:31.632Z",
"updated_by": "elastic",
"alert_delay": {
"active": 3
},
"notify_when": null,
"rule_type_id": ".index-threshold",
"api_key_owner": "elastic",
"muted_alert_ids": [],
"execution_status": {
"status": "pending",
"last_execution_date": "2022-06-08T17:20:31.632Z"
},
"scheduled_task_id": "425b0800-6bca-11eb-9e0d-85d233e3ee35",
"api_key_created_by_user": false
}
The response for successfully creating a tracking containment rule.
{
"id": "b6883f9d-5f70-4758-a66e-369d7c26012f",
"name": "my tracking rule",
"tags": [],
"params": {
"index": "kibana_sample_data_logs",
"entity": "agent.keyword",
"indexId": "90943e30-9a47-11e8-b64d-95841ca0b247",
"geoField": "geo.coordinates",
"dateField": "@timestamp",
"boundaryType": "entireIndex",
"boundaryIndexId": "0cd90abf-abe7-44c7-909a-f621bbbcfefc",
"boundaryGeoField": "location",
"boundaryNameField": "name",
"boundaryIndexTitle": "boundary*"
},
"actions": [],
"enabled": true,
"running": false,
"consumer": "alerts",
"last_run": {
"outcome": "succeeded",
"warning": null,
"outcome_msg": null,
"alerts_count": {
"new": 0,
"active": 0,
"ignored": 0,
"recovered": 0
},
"outcome_order": 0
},
"mute_all": false,
"next_run": "2024-02-15T03:26:38.033Z",
"revision": 1,
"schedule": {
"interval": "1h"
},
"throttle": null,
"created_at": "2024-02-14T19:52:55.920Z",
"created_by": "elastic",
"updated_at": "2024-02-15T03:24:32.574Z",
"updated_by": "elastic",
"notify_when": null,
"rule_type_id": ".geo-containment",
"api_key_owner": "elastic",
"muted_alert_ids": [],
"execution_status": {
"status": "ok",
"last_duration": 74,
"last_execution_date": "2024-02-15T03:25:38.125Z"
},
"scheduled_task_id": "b6883f9d-5f70-4758-a66e-369d7c26012f",
"api_key_created_by_user": false
}Path parameters
-
id
string Required The identifier for the rule.
DELETE
/api/alerting/rule/{id}
curl \
--request DELETE 'http://api.example.com/api/alerting/rule/{id}' \
--header "Authorization: $API_KEY" \
--header "kbn-xsrf: true"Path parameters
-
id
string Required The identifier for the rule.
POST
/api/alerting/rule/{id}/_disable
curl \
--request POST 'http://api.example.com/api/alerting/rule/{id}/_disable' \
--header "Authorization: $API_KEY" \
--header "Content-Type: application/json" \
--header "kbn-xsrf: true" \
--data '{"untrack":true}'
Request examples
# Headers
kbn-xsrf: true
# Payload
{
"untrack": true
}Path parameters
-
id
string Required The identifier for the rule.
POST
/api/alerting/rule/{id}/_enable
curl \
--request POST 'http://api.example.com/api/alerting/rule/{id}/_enable' \
--header "Authorization: $API_KEY" \
--header "kbn-xsrf: true"Path parameters
-
id
string Required The identifier for the rule.
POST
/api/alerting/rule/{id}/_mute_all
curl \
--request POST 'http://api.example.com/api/alerting/rule/{id}/_mute_all' \
--header "Authorization: $API_KEY" \
--header "kbn-xsrf: true"Path parameters
-
id
string Required The identifier for the rule.
POST
/api/alerting/rule/{id}/_unmute_all
curl \
--request POST 'http://api.example.com/api/alerting/rule/{id}/_unmute_all' \
--header "Authorization: $API_KEY" \
--header "kbn-xsrf: true"Path parameters
-
id
string Required The identifier for the rule.
POST
/api/alerting/rule/{id}/_update_api_key
curl \
--request POST 'http://api.example.com/api/alerting/rule/{id}/_update_api_key' \
--header "Authorization: $API_KEY" \
--header "kbn-xsrf: true"Schedule a snooze for the rule
When you snooze a rule, the rule checks continue to run but alerts will not generate actions. You can snooze for a specified period of time and schedule single or recurring downtimes.
Path parameters
-
id
string Required Identifier of the rule.
POST
/api/alerting/rule/{id}/snooze_schedule
curl \
--request POST 'http://api.example.com/api/alerting/rule/{id}/snooze_schedule' \
--header "Authorization: $API_KEY" \
--header "Content-Type: application/json" \
--header "kbn-xsrf: true" \
--data '{"schedule":{"custom":{"duration":"string","recurring":{"end":"string","every":"string","occurrences":42.0,"onMonth":[42.0],"onMonthDay":[42.0],"onWeekDay":["string"]},"start":"string","timezone":"string"}}}'
Request examples
# Headers
kbn-xsrf: true
# Payload
{
"schedule": {
"custom": {
"duration": "string",
"recurring": {
"end": "string",
"every": "string",
"occurrences": 42.0,
"onMonth": [
42.0
],
"onMonthDay": [
42.0
],
"onWeekDay": [
"string"
]
},
"start": "string",
"timezone": "string"
}
}
}
Response examples (200)
{
"body": {
"schedule": {
"custom": {
"duration": "string",
"recurring": {
"end": "string",
"every": "string",
"occurrences": 42.0,
"onMonth": [
42.0
],
"onMonthDay": [
42.0
],
"onWeekDay": [
"string"
]
},
"start": "string",
"timezone": "string"
},
"id": "string"
}
}
}
POST
/api/alerting/rule/{rule_id}/alert/{alert_id}/_mute
curl \
--request POST 'http://api.example.com/api/alerting/rule/{rule_id}/alert/{alert_id}/_mute' \
--header "Authorization: $API_KEY" \
--header "kbn-xsrf: true"
POST
/api/alerting/rule/{rule_id}/alert/{alert_id}/_unmute
curl \
--request POST 'http://api.example.com/api/alerting/rule/{rule_id}/alert/{alert_id}/_unmute' \
--header "Authorization: $API_KEY" \
--header "kbn-xsrf: true"Delete a snooze schedule for a rule
Path parameters
-
ruleId
string Required The identifier for the rule.
-
scheduleId
string Required The identifier for the snooze schedule.
DELETE
/api/alerting/rule/{ruleId}/snooze_schedule/{scheduleId}
curl \
--request DELETE 'http://api.example.com/api/alerting/rule/{ruleId}/snooze_schedule/{scheduleId}' \
--header "Authorization: $API_KEY" \
--header "kbn-xsrf: true"Query parameters
-
per_page
number The number of rules to return per page.
Minimum value is
0. Default value is10. -
page
number The page number to return.
Minimum value is
1. Default value is1. -
search
string An Elasticsearch simple_query_string query that filters the objects in the response.
-
default_search_operator
string The default operator to use for the simple_query_string.
Values are
ORorAND. Default value isOR. -
search_fields
array[string] | string The fields to perform the simple_query_string parsed query against.
-
sort_field
string Determines which field is used to sort the results. The field must exist in the
attributeskey of the response. -
sort_order
string Determines the sort order.
Values are
ascordesc. -
has_reference
object | null Filters the rules that have a relation with the reference objects with a specific type and identifier.
Additional properties are NOT allowed.
-
fields
array[string] The fields to return in the
attributeskey of the response. -
filter
string A KQL string that you filter with an attribute from your saved object. It should look like
savedObjectType.attributes.title: "myTitle". However, if you used a direct attribute of a saved object, such asupdatedAt, you must define your filter, for example,savedObjectType.updatedAt > 2018-12-22. -
filter_consumers
array[string] List of consumers to filter.
GET
/api/alerting/rules/_find
curl \
--request GET 'http://api.example.com/api/alerting/rules/_find' \
--header "Authorization: $API_KEY"
Response examples (200)
Index threshold rule
A response that contains information about an index threshold rule.
{
"data": [
{
"id": "3583a470-74f6-11ed-9801-35303b735aef",
"name": "my alert",
"tags": [
"cpu"
],
"params": {
"index": [
"test-index"
],
"aggType": "avg",
"groupBy": "top",
"aggField": "sheet.version",
"termSize": 6,
"termField": "name.keyword",
"threshold": [
1000
],
"timeField": "@timestamp",
"timeWindowSize": 5,
"timeWindowUnit": "m",
"thresholdComparator": ">"
},
"actions": [
{
"id": "9dca3e00-74f5-11ed-9801-35303b735aef",
"uuid": "1c7a1280-f28c-4e06-96b2-e4e5f05d1d61",
"group": "threshold met",
"params": {
"level": "info",
"message": "Rule {{rule.name}} is active for group {{context.group}}:\n\n- Value: {{context.value}}\n- Conditions Met: {{context.conditions}} over {{rule.params.timeWindowSize}}{{rule.params.timeWindowUnit}}\n- Timestamp: {{context.date}}",
"connector_type_id": ".server-log"
},
"frequency": {
"summary": false,
"throttle": null,
"notify_when": "onActionGroupChange"
}
}
],
"enabled": true,
"consumer": "alerts",
"last_run": {
"outcome": "succeeded",
"warning": null,
"outcome_msg": null,
"alerts_count": {
"new": 0,
"active": 0,
"ignored": 0,
"recovered": 0
}
},
"mute_all": false,
"next_run": "2022-12-06T01:45:23.912Z",
"revision": 1,
"schedule": {
"interval": "1m"
},
"throttle": null,
"created_at": "2022-12-05T23:40:33.132Z",
"created_by": "elastic",
"updated_at": "2022-12-05T23:40:33.132Z",
"updated_by": "elastic",
"rule_type_id": ".index-threshold",
"api_key_owner": "elastic",
"muted_alert_ids": [],
"execution_status": {
"status": "ok",
"last_duration": 48,
"last_execution_date": "2022-12-06T01:44:23.983Z"
},
"scheduled_task_id": "3583a470-74f6-11ed-9801-35303b735aef",
"api_key_created_by_user": false
}
],
"page": 1,
"total": 1,
"per_page": 10
}
A response that contains information about a security rule that has conditional actions.
{
"data": [
{
"id": "6107a8f0-f401-11ed-9f8e-399c75a2deeb",
"name": "security_rule",
"tags": [],
"params": {
"to": "now",
"from": "now-3660s",
"meta": {
"from": "1h",
"kibana_siem_app_url": "https://localhost:5601/app/security"
},
"type": "threshold",
"index": [
"kibana_sample_data_logs"
],
"query": "*",
"author": [],
"ruleId": "an_internal_rule_id",
"threat": [],
"filters": [],
"license": "",
"version": 1,
"language": "kuery",
"severity": "low",
"immutable": false,
"riskScore": 21,
"threshold": {
"field": [
"bytes"
],
"value": 1,
"cardinality": []
},
"maxSignals": 100,
"references": [],
"description": "A security threshold rule.",
"outputIndex": "",
"exceptionsList": [],
"falsePositives": [],
"severityMapping": [],
"riskScoreMapping": []
},
"actions": [
{
"id": "49eae970-f401-11ed-9f8e-399c75a2deeb",
"uuid": "1c7a1280-f28c-4e06-96b2-e4e5f05d1d61",
"group": "default",
"params": {
"documents": [
{
"rule_id": {
"[object Object]": null
},
"alert_id": {
"[object Object]": null
},
"rule_name": {
"[object Object]": null
},
"context_message": {
"[object Object]": null
}
}
]
},
"frequency": {
"summary": true,
"throttle": null,
"notify_when": "onActiveAlert"
},
"alerts_filter": {
"query": {
"kql": "",
"filters": [
{
"meta": {
"key": "client.geo.region_iso_code",
"alias": null,
"field": "client.geo.region_iso_code",
"index": "c4bdca79-e69e-4d80-82a1-e5192c621bea",
"negate": false,
"params": {
"type": "phrase",
"query": "CA-QC"
},
"disabled": false
},
"query": {
"match_phrase": {
"client.geo.region_iso_code": "CA-QC"
}
},
"$state": {
"store": "appState"
}
}
]
},
"timeframe": {
"days": [
7
],
"hours": {
"end": "17:00",
"start": "08:00"
},
"timezone": "UTC"
}
},
"connector_type_id": ".index"
}
],
"enabled": true,
"running": false,
"consumer": "siem",
"last_run": {
"outcome": "succeeded",
"warning": null,
"outcome_msg": [
"Rule execution completed successfully"
],
"alerts_count": {
"new": 0,
"active": 0,
"ignored": 0,
"recovered": 0
},
"outcome_order": 0
},
"mute_all": false,
"next_run": "2023-05-16T20:27:49.507Z",
"revision": 1,
"schedule": {
"interval": "1m"
},
"throttle": null,
"created_at": "2023-05-16T15:50:28.358Z",
"created_by": "elastic",
"updated_at": "2023-05-16T20:25:42.559Z",
"updated_by": "elastic",
"notify_when": null,
"rule_type_id": "siem.thresholdRule",
"api_key_owner": "elastic",
"muted_alert_ids": [],
"execution_status": {
"status": "ok",
"last_duration": 166,
"last_execution_date": "2023-05-16T20:26:49.590Z"
},
"scheduled_task_id": "6107a8f0-f401-11ed-9f8e-399c75a2deeb",
"api_key_created_by_user": false
}
],
"page": 1,
"total": 1,
"per_page": 10
}APM agent configuration
Adjust APM agent configuration without need to redeploy your application.
Headers
-
elastic-api-version
string Required The version of the API to use
Value is
2023-10-31. Default value is2023-10-31.
GET
/api/apm/settings/agent-configuration
curl \
--request GET 'http://api.example.com/api/apm/settings/agent-configuration' \
--header "Authorization: $API_KEY" \
--header "elastic-api-version: 2023-10-31"
Response examples (200)
An example of a successful response from `GET /api/apm/settings/agent-configuration`.
[
{
"agent_name": "go",
"service": {
"name": "opbeans-go",
"environment": "production"
},
"settings": {
"transaction_sample_rate": "1",
"capture_body": "off",
"transaction_max_spans": "200"
},
"@timestamp": 1581934104843,
"applied_by_agent": false,
"etag": "1e58c178efeebae15c25c539da740d21dee422fc"
},
{
"agent_name": "go",
"service": {
"name": "opbeans-go"
},
"settings": {
"transaction_sample_rate": "1",
"capture_body": "off",
"transaction_max_spans": "300"
},
"@timestamp": 1581934111727,
"applied_by_agent": false,
"etag": "3eed916d3db434d9fb7f039daa681c7a04539a64"
},
{
"agent_name": "nodejs",
"service": {
"name": "frontend"
},
"settings": {
"transaction_sample_rate": "1",
},
"@timestamp": 1582031336265,
"applied_by_agent": false,
"etag": "5080ed25785b7b19f32713681e79f46996801a5b"
}
]
Response examples (400)
{
"error": "Not Found",
"message": "Not Found",
"statusCode": 400
}
Response examples (401)
{
"error": "Unauthorized",
"message": "string",
"statusCode": 401
}
Response examples (404)
{
"error": "Not Found",
"message": "Not Found",
"statusCode": 404
}Headers
-
elastic-api-version
string Required The version of the API to use
Value is
2023-10-31. Default value is2023-10-31. -
kbn-xsrf
string Required A required header to protect against CSRF attacks
Query parameters
-
overwrite
boolean If the config exists ?overwrite=true is required
Body
Required
-
agent_name
string The agent name is used by the UI to determine which settings to display.
-
service
object Required Service
-
settings
object Required Agent configuration settings
PUT
/api/apm/settings/agent-configuration
curl \
--request PUT 'http://api.example.com/api/apm/settings/agent-configuration' \
--header "Authorization: $API_KEY" \
--header "Content-Type: application/json" \
--header "elastic-api-version: 2023-10-31" \
--header "kbn-xsrf: true" \
--data '"{\n \"service\": {\n \"name\": \"frontend\",\n \"environment\": \"production\"\n },\n \"settings\": {\n \"transaction_sample_rate\": \"0.4\",\n \"capture_body\": \"off\",\n \"transaction_max_spans\": \"500\"\n },\n \"agent_name\": \"nodejs\"\n}\n"'
Request example
Run `PUT /api/apm/settings/agent-configuration` to create or update configuration details.
{
"service": {
"name": "frontend",
"environment": "production"
},
"settings": {
"transaction_sample_rate": "0.4",
"capture_body": "off",
"transaction_max_spans": "500"
},
"agent_name": "nodejs"
}
Response examples (200)
{}
Response examples (400)
{
"error": "Not Found",
"message": "Not Found",
"statusCode": 400
}
Response examples (401)
{
"error": "Unauthorized",
"message": "string",
"statusCode": 401
}
Response examples (403)
{
"error": "Forbidden",
"message": "string",
"statusCode": 403
}
Response examples (404)
{
"error": "Not Found",
"message": "Not Found",
"statusCode": 404
}Headers
-
elastic-api-version
string Required The version of the API to use
Value is
2023-10-31. Default value is2023-10-31. -
kbn-xsrf
string Required A required header to protect against CSRF attacks
Body
Required
-
environment
string The environment of the service.
-
name
string The name of the service.
DELETE
/api/apm/settings/agent-configuration
curl \
--request DELETE 'http://api.example.com/api/apm/settings/agent-configuration' \
--header "Authorization: $API_KEY" \
--header "Content-Type: application/json" \
--header "elastic-api-version: 2023-10-31" \
--header "kbn-xsrf: true" \
--data '"{\n \"service\" : {\n \"name\": \"frontend\",\n \"environment\": \"production\"\n }\n}\n"'
Request example
Run `DELETE /api/apm/settings/agent-configuration` to delete a configuration.
{
"service" : {
"name": "frontend",
"environment": "production"
}
}
Response examples (200)
{
"result": "string"
}
Response examples (400)
{
"error": "Not Found",
"message": "Not Found",
"statusCode": 400
}
Response examples (401)
{
"error": "Unauthorized",
"message": "string",
"statusCode": 401
}
Response examples (403)
{
"error": "Forbidden",
"message": "string",
"statusCode": 403
}
Response examples (404)
{
"error": "Not Found",
"message": "Not Found",
"statusCode": 404
}Get agent name for service
Retrieve agentName for a service.
Headers
-
elastic-api-version
string Required The version of the API to use
Value is
2023-10-31. Default value is2023-10-31.
Query parameters
-
serviceName
string Required The name of the service
GET
/api/apm/settings/agent-configuration/agent_name
curl \
--request GET 'http://api.example.com/api/apm/settings/agent-configuration/agent_name?serviceName=node' \
--header "Authorization: $API_KEY" \
--header "elastic-api-version: 2023-10-31"
Response examples (200)
{
"agentName": "nodejs"
}
Response examples (400)
{
"error": "Not Found",
"message": "Not Found",
"statusCode": 400
}
Response examples (401)
{
"error": "Unauthorized",
"message": "string",
"statusCode": 401
}
Response examples (404)
{
"error": "Not Found",
"message": "Not Found",
"statusCode": 404
}Headers
-
elastic-api-version
string Required The version of the API to use
Value is
2023-10-31. Default value is2023-10-31.
Query parameters
-
serviceName
string The name of the service
GET
/api/apm/settings/agent-configuration/environments
curl \
--request GET 'http://api.example.com/api/apm/settings/agent-configuration/environments' \
--header "Authorization: $API_KEY" \
--header "elastic-api-version: 2023-10-31"
Response examples (200)
{
"environments": [
{
"alreadyConfigured": true,
"name": "ALL_OPTION_VALUE"
}
]
}
Response examples (400)
{
"error": "Not Found",
"message": "Not Found",
"statusCode": 400
}
Response examples (401)
{
"error": "Unauthorized",
"message": "string",
"statusCode": 401
}
Response examples (404)
{
"error": "Not Found",
"message": "Not Found",
"statusCode": 404
}Lookup single agent configuration
This endpoint enables you to search for a single agent configuration and update the 'applied_by_agent' field.
Headers
-
elastic-api-version
string Required The version of the API to use
Value is
2023-10-31. Default value is2023-10-31. -
kbn-xsrf
string Required A required header to protect against CSRF attacks
Body
Required
-
etag
string If etags match then
applied_by_agentfield will be set totrue -
mark_as_applied_by_agent
boolean markAsAppliedByAgent=truemeans "force setting it to true regardless of etag". This is needed for Jaeger agent that doesn't have etags -
service
object Required Service
POST
/api/apm/settings/agent-configuration/search
curl \
--request POST 'http://api.example.com/api/apm/settings/agent-configuration/search' \
--header "Authorization: $API_KEY" \
--header "Content-Type: application/json" \
--header "elastic-api-version: 2023-10-31" \
--header "kbn-xsrf: true" \
--data '"{\n \"etag\": \"1e58c178efeebae15c25c539da740d21dee422fc\",\n \"service\" : {\n \"name\": \"frontend\",\n \"environment\": \"production\"\n }\n}\n"'
Request example
Run `POST /api/apm/settings/agent-configuration/search` to search configuration details.
{
"etag": "1e58c178efeebae15c25c539da740d21dee422fc",
"service" : {
"name": "frontend",
"environment": "production"
}
}
Response examples (200)
An example of a successful response from `POST /api/apm/settings/agent-configuration/search`.
{
"_index": ".apm-agent-configuration",
"_id": "CIaqXXABmQCdPphWj8EJ",
"_score": 2,
"_source": {
"agent_name": "nodejs",
"service": {
"name": "frontend"
},
"settings": {
"transaction_sample_rate": "1",
},
"@timestamp": 1582031336265,
"applied_by_agent": false,
"etag": "5080ed25785b7b19f32713681e79f46996801a5b"
}
}
Response examples (400)
{
"error": "Not Found",
"message": "Not Found",
"statusCode": 400
}
Response examples (401)
{
"error": "Unauthorized",
"message": "string",
"statusCode": 401
}
Response examples (404)
{
"error": "Not Found",
"message": "Not Found",
"statusCode": 404
}Headers
-
elastic-api-version
string Required The version of the API to use
Value is
2023-10-31. Default value is2023-10-31.
Query parameters
-
name
string Service name
-
environment
string Service environment
GET
/api/apm/settings/agent-configuration/view
curl \
--request GET 'http://api.example.com/api/apm/settings/agent-configuration/view' \
--header "Authorization: $API_KEY" \
--header "elastic-api-version: 2023-10-31"
Response examples (200)
{
"id": "string",
"@timestamp": 1730194190636,
"agent_name": "string",
"applied_by_agent": true,
"etag": "0bc3b5ebf18fba8163fe4c96f491e3767a358f85",
"service": {
"environment": "prod",
"name": "node"
},
"settings": {
"additionalProperty1": "string",
"additionalProperty2": "string"
}
}
Response examples (400)
{
"error": "Not Found",
"message": "Not Found",
"statusCode": 400
}
Response examples (401)
{
"error": "Unauthorized",
"message": "string",
"statusCode": 401
}
Response examples (404)
{
"error": "Not Found",
"message": "Not Found",
"statusCode": 404
}APM agent keys
Configure APM agent keys to authorize requests from APM agents to the APM Server.
Create an APM agent key
Create a new agent key for APM.
The user creating an APM agent API key must have at least the manage_own_api_key cluster privilege and the APM application-level privileges that it wishes to grant.
After it is created, you can copy the API key (Base64 encoded) and use it to to authorize requests from APM agents to the APM Server.
Headers
-
elastic-api-version
string Required The version of the API to use
Value is
2023-10-31. Default value is2023-10-31. -
kbn-xsrf
string Required A required header to protect against CSRF attacks
Body
Required
-
name
string Required The name of the APM agent key.
-
privileges
array[string] Required The APM agent key privileges. It can take one or more of the following values:
event:write, which is required for ingesting APM agent events. *config_agent:read, which is required for APM agents to read agent configuration remotely.
Values are
event:writeorconfig_agent:read.
POST
/api/apm/agent_keys
curl \
--request POST 'http://api.example.com/api/apm/agent_keys' \
--header "Authorization: $API_KEY" \
--header "Content-Type: application/json" \
--header "elastic-api-version: 2023-10-31" \
--header "kbn-xsrf: true" \
--data '"{\n \"name\": \"apm-key\",\n \"privileges\": [\"event:write\", \"config_agent:read\"]\n}\n"'
Request example
Run `POST /api/apm/agent_keys` to create an APM agent API key with the specified privileges.
{
"name": "apm-key",
"privileges": ["event:write", "config_agent:read"]
}
Response examples (200)
An example of a successful response from `POST /api/apm/agent_keys`, which creates an APM agent API key.
{
"agentKey": {
"id": "3DCLmn0B3ZMhLUa7WBG9",
"name": "apm-key",
"api_key": "PjGloCGOTzaZr8ilUPvkjA",
"encoded": "M0RDTG1uMEIzWk1oTFVhN1dCRzk6UGpHbG9DR09UemFacjhpbFVQdmtqQQ=="
}
}
Response examples (400)
{
"error": "Not Found",
"message": "Not Found",
"statusCode": 400
}
Response examples (401)
{
"error": "Unauthorized",
"message": "string",
"statusCode": 401
}
Response examples (403)
{
"error": "Forbidden",
"message": "string",
"statusCode": 403
}
Response examples (500)
{
"error": "Internal Server Error",
"message": "string",
"statusCode": 500
}APM annotations
Annotate visualizations in the APM app with significant events. Annotations enable you to easily see how events are impacting the performance of your applications.
Create a service annotation
Create a new annotation for a specific service.
Headers
-
elastic-api-version
string Required The version of the API to use
Value is
2023-10-31. Default value is2023-10-31. -
kbn-xsrf
string Required A required header to protect against CSRF attacks
Path parameters
-
serviceName
string Required The name of the service
Body
Required
-
@timestamp
string Required The date and time of the annotation. It must be in ISO 8601 format.
-
message
string The message displayed in the annotation. It defaults to
service.version. -
service
object Required The service that identifies the configuration to create or update.
POST
/api/apm/services/{serviceName}/annotation
curl -X POST \
http://localhost:5601/api/apm/services/opbeans-java/annotation \
-H 'Content-Type: application/json' \
-H 'kbn-xsrf: true' \
-H 'Authorization: Basic YhUlubWZhM0FDbnlQeE6WRtaW49FQmSGZ4RUWXdX' \
-d '{
"@timestamp": "2020-05-08T10:31:30.452Z",
"service": {
"version": "1.2"
},
"message": "Deployment 1.2"
}'
Request examples
# Headers
elastic-api-version: 2023-10-31
kbn-xsrf: true
# Payload
{
"@timestamp": "string",
"message": "string",
"service": {
"environment": "string",
"version": "string"
},
"tags": [
"string"
]
}
Response examples (200)
An example of a successful response from `POST /api/apm/services/opbeans-java/annotation`, which creates an annotation for a service named `opbeans-java`.
{
"_index": "observability-annotations",
"_id": "Lc9I93EBh6DbmkeV7nFX",
"_version": 1,
"_seq_no": 12,
"_primary_term": 1,
"found": true,
"_source": {
"message": "Deployment 1.2",
"@timestamp": "2020-05-08T10:31:30.452Z",
"service": {
"version": "1.2",
"name": "opbeans-java"
},
"tags": [
"apm",
"elastic.co",
"customer"
],
"annotation": {
"type": "deployment"
},
"event": {
"created": "2020-05-09T02:34:43.937Z"
}
}
}
Response examples (400)
{
"error": "Not Found",
"message": "Not Found",
"statusCode": 400
}
Response examples (401)
{
"error": "Unauthorized",
"message": "string",
"statusCode": 401
}
Response examples (403)
{
"error": "Forbidden",
"message": "string",
"statusCode": 403
}
Response examples (404)
{
"error": "Not Found",
"message": "Not Found",
"statusCode": 404
}Search for annotations
Search for annotations related to a specific service.
Headers
-
elastic-api-version
string Required The version of the API to use
Value is
2023-10-31. Default value is2023-10-31.
Path parameters
-
serviceName
string Required The name of the service
Query parameters
-
environment
string The environment to filter annotations by
-
start
string The start date for the search
-
end
string The end date for the search
GET
/api/apm/services/{serviceName}/annotation/search
curl \
--request GET 'http://api.example.com/api/apm/services/{serviceName}/annotation/search' \
--header "Authorization: $API_KEY" \
--header "elastic-api-version: 2023-10-31"
Response examples (200)
{
"annotations": [
{
"@timestamp": 42.0,
"id": "string",
"text": "string",
"type": "version"
}
]
}
Response examples (400)
{
"error": "Not Found",
"message": "Not Found",
"statusCode": 400
}
Response examples (401)
{
"error": "Unauthorized",
"message": "string",
"statusCode": 401
}
Response examples (500)
{
"error": "Internal Server Error",
"message": "string",
"statusCode": 500
}APM server schema
Create APM fleet server schema.
Headers
-
elastic-api-version
string Required The version of the API to use
Value is
2023-10-31. Default value is2023-10-31. -
kbn-xsrf
string Required A required header to protect against CSRF attacks
POST
/api/apm/fleet/apm_server_schema
curl \
--request POST 'http://api.example.com/api/apm/fleet/apm_server_schema' \
--header "Authorization: $API_KEY" \
--header "Content-Type: application/json" \
--header "elastic-api-version: 2023-10-31" \
--header "kbn-xsrf: true" \
--data '{"schema":{"foo":"bar"}}'
Request examples
# Headers
elastic-api-version: 2023-10-31
kbn-xsrf: true
# Payload
{
"schema": {
"foo": "bar"
}
}
Response examples (200)
{}
Response examples (400)
{
"error": "Not Found",
"message": "Not Found",
"statusCode": 400
}
Response examples (401)
{
"error": "Unauthorized",
"message": "string",
"statusCode": 401
}
Response examples (403)
{
"error": "Forbidden",
"message": "string",
"statusCode": 403
}
Response examples (404)
{
"error": "Not Found",
"message": "Not Found",
"statusCode": 404
}APM sourcemaps
Configure APM source maps. A source map allows minified files to be mapped back to original source code--allowing you to maintain the speed advantage of minified code, without losing the ability to quickly and easily debug your application. For best results, uploading source maps should become a part of your deployment procedure, and not something you only do when you see unhelpful errors. That's because uploading source maps after errors happen won't make old errors magically readable--errors must occur again for source mapping to occur.
Get source maps
Get an array of Fleet artifacts, including source map uploads. You must have read or all Kibana privileges for the APM and User Experience feature.
Headers
-
elastic-api-version
string Required The version of the API to use
Value is
2023-10-31. Default value is2023-10-31.
GET
/api/apm/sourcemaps
curl -X GET "http://localhost:5601/api/apm/sourcemaps" \
-H 'Content-Type: application/json' \
-H 'kbn-xsrf: true' \
-H 'Authorization: ApiKey ${YOUR_API_KEY}'
Response examples (200)
A successful response from `GET /api/apm/sourcemaps`.
{
"artifacts": [
{
"type": "sourcemap",
"identifier": "foo-1.0.0",
"relative_url": "/api/fleet/artifacts/foo-1.0.0/644fd5a997d1ddd90ee131ba18e2b3d03931d89dd1fe4599143c0b3264b3e456",
"body": {
"serviceName": "foo",
"serviceVersion": "1.0.0",
"bundleFilepath": "/test/e2e/general-usecase/bundle.js",
"sourceMap": {
"version": 3,
"file": "static/js/main.chunk.js",
"sources": [
"fleet-source-map-client/src/index.css",
"fleet-source-map-client/src/App.js",
"webpack:///./src/index.css?bb0a",
"fleet-source-map-client/src/index.js",
"fleet-source-map-client/src/reportWebVitals.js"
],
"sourcesContent": [
"content"
],
"mappings": "mapping",
"sourceRoot": ""
}
},
"created": "2021-07-09T20:47:44.812Z",
"id": "apm:foo-1.0.0-644fd5a997d1ddd90ee131ba18e2b3d03931d89dd1fe4599143c0b3264b3e456",
"compressionAlgorithm": "zlib",
"decodedSha256": "644fd5a997d1ddd90ee131ba18e2b3d03931d89dd1fe4599143c0b3264b3e456",
"decodedSize": 441,
"encodedSha256": "024c72749c3e3dd411b103f7040ae62633558608f480bce4b108cf5b2275bd24",
"encodedSize": 237,
"encryptionAlgorithm": "none",
"packageName": "apm"
}
]
}
Response examples (400)
{
"error": "Not Found",
"message": "Not Found",
"statusCode": 400
}
Response examples (401)
{
"error": "Unauthorized",
"message": "string",
"statusCode": 401
}
Response examples (500)
{
"error": "Internal Server Error",
"message": "string",
"statusCode": 500
}
Response examples (501)
{
"error": "Not Implemented",
"message": "Not Implemented",
"statusCode": 501
}Upload a source map
Upload a source map for a specific service and version. You must have all Kibana privileges for the APM and User Experience feature.
The maximum payload size is 1mb. If you attempt to upload a source map that exceeds the maximum payload size, you will get a 413 error. Before uploading source maps that exceed this default, change the maximum payload size allowed by Kibana with the server.maxPayload variable.
Headers
-
elastic-api-version
string Required The version of the API to use
Value is
2023-10-31. Default value is2023-10-31. -
kbn-xsrf
string Required A required header to protect against CSRF attacks
Body
Required
-
bundle_filepath
string Required The absolute path of the final bundle as used in the web application.
-
service_name
string Required The name of the service that the service map should apply to.
-
service_version
string Required The version of the service that the service map should apply to.
-
sourcemap
string(binary) Required The source map. It can be a string or file upload. It must follow the source map format specification.
POST
/api/apm/sourcemaps
curl -X POST "http://localhost:5601/api/apm/sourcemaps" \
-H 'Content-Type: multipart/form-data' \
-H 'kbn-xsrf: true' \
-H 'Authorization: ApiKey ${YOUR_API_KEY}' \
-F 'service_name="foo"' \
-F 'service_version="1.0.0"' \
-F 'bundle_filepath="/test/e2e/general-usecase/bundle.js"' \
-F 'sourcemap="{\"version\":3,\"file\":\"static/js/main.chunk.js\",\"sources\":[\"fleet-source-map-client/src/index.css\",\"fleet-source-map-client/src/App.js\",\"webpack:///./src/index.css?bb0a\",\"fleet-source-map-client/src/index.js\",\"fleet-source-map-client/src/reportWebVitals.js\"],\"sourcesContent\":[\"content\"],\"mappings\":\"mapping\",\"sourceRoot\":\"\"}"'
Response examples (200)
A successful response from `POST /api/apm/sourcemaps`.
{
"id": "apm:foo-1.0.0-644fd5a997d1ddd90ee131ba18e2b3d03931d89dd1fe4599143c0b3264b3e456",
"body": "eJyFkL1OwzAUhd/Fc+MbYMuCEBIbHRjKgBgc96R16tiWr1OQqr47NwqJxEK3q/PzWccXxchnZ7E1A1SjuhjVZtF2yOxiEPlO17oWox3D3uPFeSRTjmJQARfCPeiAgGx8NTKsYdAc1T3rwaSJGcds8Sp3c1HnhfywUZ3QhMTFFGepZxqMC9oex3CS9tpk1XyozgOlmoVKuJX1DqEQZ0su7PGtLU+V/3JPKc3cL7TJ2FNDRPov4bFta3MDM4f7W69lpJjLO9qdK8bzVPhcJz3HUCQ4LbO/p5hCSC4cZPByrp/wFqOklbpefwAhzpqI",
"type": "sourcemap",
"created": "2021-07-09T20:47:44.812Z",
"identifier": "foo-1.0.0",
"decodedSize": 441,
"encodedSize": 237,
"packageName": "apm",
"relative_url": "/api/fleet/artifacts/foo-1.0.0/644fd5a997d1ddd90ee131ba18e2b3d03931d89dd1fe4599143c0b3264b3e456",
"decodedSha256": "644fd5a997d1ddd90ee131ba18e2b3d03931d89dd1fe4599143c0b3264b3e456",
"encodedSha256": "024c72749c3e3dd411b103f7040ae62633558608f480bce4b108cf5b2275bd24",
"encryptionAlgorithm": "none",
"compressionAlgorithm": "zlib"
}
Response examples (400)
{
"error": "Not Found",
"message": "Not Found",
"statusCode": 400
}
Response examples (401)
{
"error": "Unauthorized",
"message": "string",
"statusCode": 401
}
Response examples (403)
{
"error": "Forbidden",
"message": "string",
"statusCode": 403
}
Response examples (500)
{
"error": "Internal Server Error",
"message": "string",
"statusCode": 500
}
Response examples (501)
{
"error": "Not Implemented",
"message": "Not Implemented",
"statusCode": 501
}Delete source map
Delete a previously uploaded source map. You must have all Kibana privileges for the APM and User Experience feature.
Headers
-
elastic-api-version
string Required The version of the API to use
Value is
2023-10-31. Default value is2023-10-31. -
kbn-xsrf
string Required A required header to protect against CSRF attacks
Path parameters
-
id
string Required Source map identifier
Responses
-
200 application/json
Successful response
Additional properties are NOT allowed.
-
400 application/json
Bad Request response
-
401 application/json
Unauthorized response
-
403 application/json
Forbidden response
-
500 application/json
Internal Server Error response
-
501 application/json
Not Implemented response
DELETE
/api/apm/sourcemaps/{id}
curl -X DELETE "http://localhost:5601/api/apm/sourcemaps/apm:foo-1.0.0-644fd5a9" \
-H 'Content-Type: application/json' \
-H 'kbn-xsrf: true' \
-H 'Authorization: ApiKey ${YOUR_API_KEY}'
Response examples (200)
{}
Response examples (400)
{
"error": "Not Found",
"message": "Not Found",
"statusCode": 400
}
Response examples (401)
{
"error": "Unauthorized",
"message": "string",
"statusCode": 401
}
Response examples (403)
{
"error": "Forbidden",
"message": "string",
"statusCode": 403
}
Response examples (500)
{
"error": "Internal Server Error",
"message": "string",
"statusCode": 500
}
Response examples (501)
{
"error": "Not Implemented",
"message": "Not Implemented",
"statusCode": 501
}Get CCR Remote synced integrations status by outputId
[Required authorization] Route required privileges: fleet-settings-read AND integrations-read.
Path parameters
-
outputId
string Required
GET
/api/fleet/remote_synced_integrations/{outputId}/remote_status
curl \
--request GET 'http://api.example.com/api/fleet/remote_synced_integrations/{outputId}/remote_status' \
--header "Authorization: $API_KEY"
Response examples (200)
{
"custom_assets": {
"additionalProperty1": {
"name": "string",
"package_name": "string",
"package_version": "string",
"sync_status": "completed",
"type": "string"
},
"additionalProperty2": {
"name": "string",
"package_name": "string",
"package_version": "string",
"sync_status": "completed",
"type": "string"
}
},
"error": "string",
"integrations": [
{
"error": "string",
"id": "string",
"package_name": "string",
"package_version": "string",
"sync_status": "completed",
"updated_at": "string"
}
]
}
Response examples (400)
{
"error": "string",
"errorType": "string",
"message": "string",
"statusCode": 42.0
}Get CCR Remote synced integrations status
[Required authorization] Route required privileges: fleet-settings-read AND integrations-read.
GET
/api/fleet/remote_synced_integrations/status
curl \
--request GET 'http://api.example.com/api/fleet/remote_synced_integrations/status' \
--header "Authorization: $API_KEY"
Response examples (200)
{
"custom_assets": {
"additionalProperty1": {
"name": "string",
"package_name": "string",
"package_version": "string",
"sync_status": "completed",
"type": "string"
},
"additionalProperty2": {
"name": "string",
"package_name": "string",
"package_version": "string",
"sync_status": "completed",
"type": "string"
}
},
"error": "string",
"integrations": [
{
"error": "string",
"id": "string",
"package_name": "string",
"package_version": "string",
"sync_status": "completed",
"updated_at": "string"
}
]
}
Response examples (400)
{
"error": "string",
"errorType": "string",
"message": "string",
"statusCode": 42.0
}Connectors
Connectors provide a central place to store connection information for services and integrations with Elastic or third party systems. Alerting rules can use connectors to run actions when rule conditions are met.
Get connector types
You do not need any Kibana feature privileges to run this API.
Query parameters
-
feature_id
string A filter to limit the retrieved connector types to those that support a specific feature (such as alerting or cases).
GET
/api/actions/connector_types
curl \
--request GET 'http://api.example.com/api/actions/connector_types' \
--header "Authorization: $API_KEY"
Response examples (200)
[
{
"id": ".gen-ai",
"name": "OpenAI",
"enabled": true,
"enabled_in_config": true,
"enabled_in_license": true,
"is_system_action_type": false,
"supported_feature_ids": [
"generativeAIForSecurity",
"generativeAIForObservability",
"generativeAIForSearchPlayground"
],
"minimum_license_required": "enterprise"
},
{
"id": ".bedrock",
"name": "AWS Bedrock",
"enabled": true,
"enabled_in_config": true,
"enabled_in_license": true,
"is_system_action_type": false,
"supported_feature_ids": [
"generativeAIForSecurity",
"generativeAIForObservability",
"generativeAIForSearchPlayground"
],
"minimum_license_required": "enterprise"
},
{
"id": ".gemini",
"name": "Google Gemini",
"enabled": true,
"enabled_in_config": true,
"enabled_in_license": true,
"is_system_action_type": false,
"supported_feature_ids": [
"generativeAIForSecurity"
],
"minimum_license_required": "enterprise"
}
]Path parameters
-
id
string Required An identifier for the connector.
GET
/api/actions/connector/{id}
curl \
--request GET 'http://api.example.com/api/actions/connector/{id}' \
--header "Authorization: $API_KEY"
Response examples (200)
{
"id": "df770e30-8b8b-11ed-a780-3b746c987a81",
"name": "my_server_log_connector",
"config": {},
"is_deprecated": false,
"is_preconfigured": false,
"is_system_action": false,
"connector_type_id": ".server-log",
"is_missing_secrets": false
}Path parameters
-
id
string Required An identifier for the connector.
Body
-
name
string Required The display name for the connector.
config
object The connector configuration details.
One of: bedrock_configobject crowdstrike_configobject d3security_configobject email_configobject gemini_configobject resilient_configobject index_configobject jira_configobject genai_azure_configobject genai_openai_configobject opsgenie_configobject pagerduty_configobject sentinelone_configobject servicenow_configobject servicenow_itom_configobject slack_api_configobject swimlane_configobject thehive_configobject tines_configobject torq_configobject webhook_configobject cases_webhook_configobject xmatters_configobject Defines properties for connectors when type is
.bedrock.secrets
object One of: bedrock_secretsobject crowdstrike_secretsobject d3security_secretsobject email_secretsobject gemini_secretsobject resilient_secretsobject jira_secretsobject teams_secretsobject genai_secretsobject opsgenie_secretsobject pagerduty_secretsobject sentinelone_secretsobject servicenow_secretsobject slack_api_secretsobject swimlane_secretsobject thehive_secretsobject tines_secretsobject torq_secretsobject webhook_secretsobject cases_webhook_secretsobject xmatters_secretsobject Defines secrets for connectors when type is
.bedrock.
PUT
/api/actions/connector/{id}
curl \
--request PUT 'http://api.example.com/api/actions/connector/{id}' \
--header "Authorization: $API_KEY" \
--header "Content-Type: application/json" \
--header "kbn-xsrf: true" \
--data '{"name":"updated-connector","config":{"index":"updated-index"}}'
Request example
{
"name": "updated-connector",
"config": {
"index": "updated-index"
}
}
Response examples (200)
{
"config": {},
"connector_type_id": "string",
"id": "string",
"is_deprecated": true,
"is_missing_secrets": true,
"is_preconfigured": true,
"is_system_action": true,
"name": "string"
}Path parameters
-
id
string Required An identifier for the connector.
Body
-
connector_type_id
string Required The type of connector.
-
name
string Required The display name for the connector.
config
object The connector configuration details.
One of: bedrock_configobject crowdstrike_configobject d3security_configobject email_configobject gemini_configobject resilient_configobject index_configobject jira_configobject genai_azure_configobject genai_openai_configobject opsgenie_configobject pagerduty_configobject sentinelone_configobject servicenow_configobject servicenow_itom_configobject slack_api_configobject swimlane_configobject thehive_configobject tines_configobject torq_configobject webhook_configobject cases_webhook_configobject xmatters_configobject Defines properties for connectors when type is
.bedrock.secrets
object One of: bedrock_secretsobject crowdstrike_secretsobject d3security_secretsobject email_secretsobject gemini_secretsobject resilient_secretsobject jira_secretsobject teams_secretsobject genai_secretsobject opsgenie_secretsobject pagerduty_secretsobject sentinelone_secretsobject servicenow_secretsobject slack_api_secretsobject swimlane_secretsobject thehive_secretsobject tines_secretsobject torq_secretsobject webhook_secretsobject cases_webhook_secretsobject xmatters_secretsobject Defines secrets for connectors when type is
.bedrock.
POST
/api/actions/connector/{id}
curl \
--request POST 'http://api.example.com/api/actions/connector/{id}' \
--header "Authorization: $API_KEY" \
--header "Content-Type: application/json" \
--header "kbn-xsrf: true" \
--data '{"name":"email-connector-1","config":{"from":"tester@example.com","host":"https://example.com","port":1025,"secure":false,"hasAuth":true,"service":"other"},"secrets":{"user":"username","password":"password"},"connector_type_id":".email"}'
Request examples
Create an email connector.
{
"name": "email-connector-1",
"config": {
"from": "tester@example.com",
"host": "https://example.com",
"port": 1025,
"secure": false,
"hasAuth": true,
"service": "other"
},
"secrets": {
"user": "username",
"password": "password"
},
"connector_type_id": ".email"
}{
"name": "my-connector",
"config": {
"index": "test-index"
},
"connector_type_id": ".index"
}{
"name": "my-webhook-connector",
"config": {
"url": "https://example.com",
"method": "post",
"authType": "webhook-authentication-ssl",
"certType": "ssl-crt-key"
},
"secrets": {
"crt": "QmFnIEF0dH...",
"key": "LS0tLS1CRUdJ...",
"password": "my-passphrase"
},
"connector_type_id": ".webhook"
}{
"name": "my-xmatters-connector",
"config": {
"usesBasic": false
},
"secrets": {
"secretsUrl": "https://example.com?apiKey=xxxxx"
},
"connector_type_id": ".xmatters"
}
Response examples (200)
A new email connector.
{
"id": "90a82c60-478f-11ee-a343-f98a117c727f",
"name": "email-connector-1",
"config": {
"from": "tester@example.com",
"host": "https://example.com",
"port": 1025,
"secure": false,
"hasAuth": true,
"service": "other",
"clientId": null,
"tenantId": null,
"oauthTokenUrl": null
},
"is_deprecated": false,
"is_preconfigured": false,
"is_system_action": false,
"connector_type_id": ".email",
"is_missing_secrets": false
}{
"id": "c55b6eb0-6bad-11eb-9f3b-611eebc6c3ad",
"name": "my-connector",
"config": {
"index": "test-index",
"refresh": false,
"executionTimeField": null
},
"is_deprecated": false,
"is_preconfigured": false,
"is_system_action": false,
"connector_type_id": ".index",
"is_missing_secrets": false
}{
"id": "900eb010-3b9d-11ee-a642-8ffbb94e38bd",
"name": "my-webhook-connector",
"config": {
"url": "https://example.com",
"method": "post",
"hasAuth": true,
"headers": null,
"authType": "webhook-authentication-ssl",
"certType": "ssl-crt-key",
"verificationMode": "full"
},
"is_deprecated": false,
"is_preconfigured": false,
"is_system_action": false,
"connector_type_id": ".webhook",
"is_missing_secrets": false
}{
"id": "df770e30-8b8b-11ed-a780-3b746c987a81",
"name": "my_server_log_connector",
"config": {},
"is_deprecated": false,
"is_preconfigured": false,
"is_system_action": false,
"connector_type_id": ".server-log",
"is_missing_secrets": false
}Delete a connector
WARNING: When you delete a connector, it cannot be recovered.
Path parameters
-
id
string Required An identifier for the connector.
DELETE
/api/actions/connector/{id}
curl \
--request DELETE 'http://api.example.com/api/actions/connector/{id}' \
--header "Authorization: $API_KEY" \
--header "kbn-xsrf: true"Run a connector
You can use this API to test an action that involves interaction with Kibana services or integrations with third-party systems.
Path parameters
-
id
string Required An identifier for the connector.
Body
params
object Required One of: run_acknowledge_resolve_pagerdutyobject run_documentsobject run_message_emailobject run_message_serverlogobject run_message_slackobject run_trigger_pagerdutyobject run_addeventobject run_closealertobject run_closeincidentobject run_createalertobject run_fieldsbyissuetypeobject run_getchoicesobject run_getfieldsobject run_getincidentobject run_issueobject run_issuesobject run_issuetypesobject run_postmessageobject run_pushtoserviceobject run_validchannelidobject Test an action that acknowledges or resolves a PagerDuty alert.
POST
/api/actions/connector/{id}/_execute
curl \
--request POST 'http://api.example.com/api/actions/connector/{id}/_execute' \
--header "Authorization: $API_KEY" \
--header "Content-Type: application/json" \
--header "kbn-xsrf: true" \
--data '{"params":{"documents":[{"id":"my_doc_id","name":"my_doc_name","message":"hello, world"}]}}'
Request examples
Run an index connector.
{
"params": {
"documents": [
{
"id": "my_doc_id",
"name": "my_doc_name",
"message": "hello, world"
}
]
}
}{
"params": {
"subAction": "issueTypes"
}
}{
"params": {
"subAction": "getChoices",
"subActionParams": {
"fields": [
"severity",
"urgency"
]
}
}
}{
"params": {
"subAction": "postMessage",
"subActionParams": {
"text": "A test message.",
"channelIds": [
"C123ABC456"
]
}
}
}{
"params": {
"subAction": "pushToService",
"subActionParams": {
"comments": [
{
"comment": "A comment about the incident.",
"commentId": 1
}
],
"incident": {
"caseId": "1000",
"caseName": "Case name",
"description": "Description of the incident."
}
}
}
}
Response examples (200)
Response from running an index connector.
{
"data": {
"took": 135,
"items": [
{
"create": {
"_id": "4JtvwYUBrcyxt2NnfW3y",
"_index": "my-index",
"result": "created",
"status": 201,
"_seq_no": 0,
"_shards": {
"total": 2,
"failed": 0,
"successful": 1
},
"_version": 1,
"_primary_term": 1
}
}
],
"errors": false
},
"status": "ok",
"connector_id": "fd38c600-96a5-11ed-bb79-353b74189cba"
}{
"data": [
{
"id": 10024,
"name": "Improvement"
},
{
"id": 10006,
"name": "Task"
},
{
"id": 10007,
"name": "Sub-task"
},
{
"id": 10025,
"name": "New Feature"
},
{
"id": 10023,
"name": "Bug"
},
{
"id": 10000,
"name": "Epic"
}
],
"status": "ok",
"connector_id": "b3aad810-edbe-11ec-82d1-11348ecbf4a6"
}{
"status": "ok",
"connector_id": "7fc7b9a0-ecc9-11ec-8736-e7d63118c907"
}{
"data": [
{
"label": "Critical",
"value": 1,
"element": "severity",
"dependent_value": ""
},
{
"label": "Major",
"value": 2,
"element": "severity",
"dependent_value": ""
},
{
"label": "Minor",
"value": 3,
"element": "severity",
"dependent_value": ""
},
{
"label": "Warning",
"value": 4,
"element": "severity",
"dependent_value": ""
},
{
"label": "OK",
"value": 5,
"element": "severity",
"dependent_value": ""
},
{
"label": "Clear",
"value": 0,
"element": "severity",
"dependent_value": ""
},
{
"label": "1 - High",
"value": 1,
"element": "urgency",
"dependent_value": ""
},
{
"label": "2 - Medium",
"value": 2,
"element": "urgency",
"dependent_value": ""
},
{
"label": "3 - Low",
"value": 3,
"element": "urgency",
"dependent_value": ""
}
],
"status": "ok",
"connector_id": "9d9be270-2fd2-11ed-b0e0-87533c532698"
}{
"data": {
"ok": true,
"ts": "1234567890.123456",
"channel": "C123ABC456",
"message": {
"ts": "1234567890.123456",
"team": "T01ABCDE2F",
"text": "A test message",
"type": "message",
"user": "U12A345BC6D",
"app_id": "A01BC2D34EF",
"blocks": [
{
"type": "rich_text",
"block_id": "/NXe",
"elements": [
{
"type": "rich_text_section",
"elements": [
{
"text": "A test message.",
"type": "text"
}
]
}
]
}
],
"bot_id": "B12BCDEFGHI",
"bot_profile": {
"id": "B12BCDEFGHI",
"name": "test",
"icons": {
"image_36": "https://a.slack-edge.com/80588/img/plugins/app/bot_36.png"
},
"app_id": "A01BC2D34EF",
"deleted": false,
"team_id": "T01ABCDE2F",
"updated": 1672169705
}
}
},
"status": "ok",
"connector_id": ".slack_api"
}{
"data": {
"id": "aKPmBHWzmdRQtx6Mx",
"url": "https://elastic.swimlane.url.us/record/aNcL2xniGHGpa2AHb/aKPmBHWzmdRQtx6Mx",
"title": "TEST-457",
"comments": [
{
"commentId": 1,
"pushedDate": "2022-09-08T16:52:27.865Z"
}
],
"pushedDate": "2022-09-08T16:52:27.866Z"
},
"status": "ok",
"connector_id": "a4746470-2f94-11ed-b0e0-87533c532698"
}
GET
/api/actions/connectors
curl \
--request GET 'http://api.example.com/api/actions/connectors' \
--header "Authorization: $API_KEY"
Response examples (200)
[
{
"id": "preconfigured-email-connector",
"name": "my-preconfigured-email-notification",
"is_deprecated": false,
"is_preconfigured": true,
"is_system_action": false,
"connector_type_id": ".email",
"referenced_by_count": 0
},
{
"id": "e07d0c80-8b8b-11ed-a780-3b746c987a81",
"name": "my-index-connector",
"config": {
"index": "test-index",
"refresh": false,
"executionTimeField": null
},
"is_deprecated": false,
"is_preconfigured": false,
"is_system_action": false,
"connector_type_id": ".index",
"is_missing_secrets": false,
"referenced_by_count": 2
}
]
Get a list of dashboards
Technical Preview
This functionality is in technical preview and may be changed or removed in a future release. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features.
GET
/api/dashboards/dashboard
curl \
--request GET 'http://api.example.com/api/dashboards/dashboard' \
--header "Authorization: $API_KEY"
Response examples (200)
{
"items": [
{
"attributes": {
"description": "",
"tags": [
"string"
],
"timeRestore": false,
"title": "string"
},
"createdAt": "string",
"createdBy": "string",
"error": {
"error": "string",
"message": "string",
"metadata": {},
"statusCode": 42.0
},
"id": "string",
"managed": true,
"namespaces": [
"string"
],
"originId": "string",
"references": [
{
"id": "string",
"name": "string",
"type": "string"
}
],
"type": "string",
"updatedAt": "string",
"updatedBy": "string",
"version": "string"
}
],
"total": 42.0
}
Get a dashboard
Technical Preview
This functionality is in technical preview and may be changed or removed in a future release. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features.
Path parameters
-
id
string Required A unique identifier for the dashboard.
GET
/api/dashboards/dashboard/{id}
curl \
--request GET 'http://api.example.com/api/dashboards/dashboard/{id}' \
--header "Authorization: $API_KEY"
Response examples (200)
{
"item": {
"attributes": {
"controlGroupInput": {
"autoApplySelections": true,
"chainingSystem": "HIERARCHICAL",
"controls": [
{
"controlConfig": {},
"grow": false,
"id": "string",
"order": 42.0,
"type": "string",
"width": "medium"
}
],
"enhancements": {},
"ignoreParentSettings": {
"ignoreFilters": false,
"ignoreQuery": false,
"ignoreTimerange": false,
"ignoreValidations": false
},
"labelPosition": "oneLine"
},
"description": "",
"kibanaSavedObjectMeta": {
"searchSource": {
"filter": [
{
"$state": {
"store": "appState"
},
"meta": {
"alias": "string",
"controlledBy": "string",
"disabled": true,
"field": "string",
"group": "string",
"index": "string",
"isMultiIndex": true,
"key": "string",
"negate": true,
"type": "string",
"value": "string"
},
"query": {}
}
],
"query": {
"language": "string",
"query": "string"
},
"sort": [
{}
],
"type": "string"
}
},
"options": {
"hidePanelTitles": false,
"syncColors": true,
"syncCursor": true,
"syncTooltips": true,
"useMargins": true
},
"panels": [
{
"gridData": {
"h": 15,
"i": "string",
"w": 24,
"x": 42.0,
"y": 42.0
},
"id": "string",
"panelConfig": {
"description": "string",
"enhancements": {},
"hidePanelTitles": true,
"savedObjectId": "string",
"title": "string",
"version": "string"
},
"panelIndex": "string",
"panelRefName": "string",
"title": "string",
"type": "string",
"version": "string"
}
],
"refreshInterval": {
"display": "string",
"pause": true,
"section": 42.0,
"value": 42.0
},
"tags": [
"string"
],
"timeFrom": "string",
"timeRestore": false,
"timeTo": "string",
"title": "string",
"version": 42.0
},
"createdAt": "string",
"createdBy": "string",
"error": {
"error": "string",
"message": "string",
"metadata": {},
"statusCode": 42.0
},
"id": "string",
"managed": true,
"namespaces": [
"string"
],
"originId": "string",
"references": [
{
"id": "string",
"name": "string",
"type": "string"
}
],
"type": "string",
"updatedAt": "string",
"updatedBy": "string",
"version": "string"
},
"meta": {
"aliasPurpose": "savedObjectConversion",
"aliasTargetId": "string",
"outcome": "exactMatch"
}
}
Update an existing dashboard
Technical Preview
This functionality is in technical preview and may be changed or removed in a future release. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features.
Path parameters
-
id
string Required A unique identifier for the dashboard.
Body
-
attributes
object Required Additional properties are NOT allowed.
-
references
array[object]
PUT
/api/dashboards/dashboard/{id}
curl \
--request PUT 'http://api.example.com/api/dashboards/dashboard/{id}' \
--header "Authorization: $API_KEY" \
--header "Content-Type: application/json" \
--header "kbn-xsrf: true" \
--data '{"attributes":{"controlGroupInput":{"autoApplySelections":true,"chainingSystem":"HIERARCHICAL","controls":[{"controlConfig":{},"grow":false,"id":"string","order":42.0,"type":"string","width":"medium"}],"enhancements":{},"ignoreParentSettings":{"ignoreFilters":false,"ignoreQuery":false,"ignoreTimerange":false,"ignoreValidations":false},"labelPosition":"oneLine"},"description":"","kibanaSavedObjectMeta":{"searchSource":{"filter":[{"$state":{"store":"appState"},"meta":{"alias":"string","controlledBy":"string","disabled":true,"field":"string","group":"string","index":"string","isMultiIndex":true,"key":"string","negate":true,"type":"string","value":"string"},"query":{}}],"query":{"language":"string","query":"string"},"sort":[{}],"type":"string"}},"options":{"hidePanelTitles":false,"syncColors":true,"syncCursor":true,"syncTooltips":true,"useMargins":true},"panels":[{"gridData":{"h":15,"i":"string","w":24,"x":42.0,"y":42.0},"id":"string","panelConfig":{"description":"string","enhancements":{},"hidePanelTitles":true,"savedObjectId":"string","title":"string","version":"string"},"panelIndex":"string","panelRefName":"string","title":"string","type":"string","version":"string"}],"refreshInterval":{"display":"string","pause":true,"section":42.0,"value":42.0},"tags":["string"],"timeFrom":"string","timeRestore":false,"timeTo":"string","title":"string","version":42.0},"references":[{"id":"string","name":"string","type":"string"}]}'
Request examples
# Headers
kbn-xsrf: true
# Payload
{
"attributes": {
"controlGroupInput": {
"autoApplySelections": true,
"chainingSystem": "HIERARCHICAL",
"controls": [
{
"controlConfig": {},
"grow": false,
"id": "string",
"order": 42.0,
"type": "string",
"width": "medium"
}
],
"enhancements": {},
"ignoreParentSettings": {
"ignoreFilters": false,
"ignoreQuery": false,
"ignoreTimerange": false,
"ignoreValidations": false
},
"labelPosition": "oneLine"
},
"description": "",
"kibanaSavedObjectMeta": {
"searchSource": {
"filter": [
{
"$state": {
"store": "appState"
},
"meta": {
"alias": "string",
"controlledBy": "string",
"disabled": true,
"field": "string",
"group": "string",
"index": "string",
"isMultiIndex": true,
"key": "string",
"negate": true,
"type": "string",
"value": "string"
},
"query": {}
}
],
"query": {
"language": "string",
"query": "string"
},
"sort": [
{}
],
"type": "string"
}
},
"options": {
"hidePanelTitles": false,
"syncColors": true,
"syncCursor": true,
"syncTooltips": true,
"useMargins": true
},
"panels": [
{
"gridData": {
"h": 15,
"i": "string",
"w": 24,
"x": 42.0,
"y": 42.0
},
"id": "string",
"panelConfig": {
"description": "string",
"enhancements": {},
"hidePanelTitles": true,
"savedObjectId": "string",
"title": "string",
"version": "string"
},
"panelIndex": "string",
"panelRefName": "string",
"title": "string",
"type": "string",
"version": "string"
}
],
"refreshInterval": {
"display": "string",
"pause": true,
"section": 42.0,
"value": 42.0
},
"tags": [
"string"
],
"timeFrom": "string",
"timeRestore": false,
"timeTo": "string",
"title": "string",
"version": 42.0
},
"references": [
{
"id": "string",
"name": "string",
"type": "string"
}
]
}
Response examples (200)
{
"item": {
"attributes": {
"controlGroupInput": {
"autoApplySelections": true,
"chainingSystem": "HIERARCHICAL",
"controls": [
{
"controlConfig": {},
"grow": false,
"id": "string",
"order": 42.0,
"type": "string",
"width": "medium"
}
],
"enhancements": {},
"ignoreParentSettings": {
"ignoreFilters": false,
"ignoreQuery": false,
"ignoreTimerange": false,
"ignoreValidations": false
},
"labelPosition": "oneLine"
},
"description": "",
"kibanaSavedObjectMeta": {
"searchSource": {
"filter": [
{
"$state": {
"store": "appState"
},
"meta": {
"alias": "string",
"controlledBy": "string",
"disabled": true,
"field": "string",
"group": "string",
"index": "string",
"isMultiIndex": true,
"key": "string",
"negate": true,
"type": "string",
"value": "string"
},
"query": {}
}
],
"query": {
"language": "string",
"query": "string"
},
"sort": [
{}
],
"type": "string"
}
},
"options": {
"hidePanelTitles": false,
"syncColors": true,
"syncCursor": true,
"syncTooltips": true,
"useMargins": true
},
"panels": [
{
"gridData": {
"h": 15,
"i": "string",
"w": 24,
"x": 42.0,
"y": 42.0
},
"id": "string",
"panelConfig": {
"description": "string",
"enhancements": {},
"hidePanelTitles": true,
"savedObjectId": "string",
"title": "string",
"version": "string"
},
"panelIndex": "string",
"panelRefName": "string",
"title": "string",
"type": "string",
"version": "string"
}
],
"refreshInterval": {
"display": "string",
"pause": true,
"section": 42.0,
"value": 42.0
},
"tags": [
"string"
],
"timeFrom": "string",
"timeRestore": false,
"timeTo": "string",
"title": "string",
"version": 42.0
},
"createdAt": "string",
"createdBy": "string",
"error": {
"error": "string",
"message": "string",
"metadata": {},
"statusCode": 42.0
},
"id": "string",
"managed": true,
"namespaces": [
"string"
],
"originId": "string",
"references": [
{
"id": "string",
"name": "string",
"type": "string"
}
],
"type": "string",
"updatedAt": "string",
"updatedBy": "string",
"version": "string"
}
}
Create a dashboard
Technical Preview
This functionality is in technical preview and may be changed or removed in a future release. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features.
Path parameters
-
id
string A unique identifier for the dashboard.
Body
-
attributes
object Required Additional properties are NOT allowed.
-
references
array[object] -
spaces
array[string]
POST
/api/dashboards/dashboard/{id}
curl \
--request POST 'http://api.example.com/api/dashboards/dashboard/{id}' \
--header "Authorization: $API_KEY" \
--header "Content-Type: application/json" \
--header "kbn-xsrf: true" \
--data '{"attributes":{"controlGroupInput":{"autoApplySelections":true,"chainingSystem":"HIERARCHICAL","controls":[{"controlConfig":{},"grow":false,"id":"string","order":42.0,"type":"string","width":"medium"}],"enhancements":{},"ignoreParentSettings":{"ignoreFilters":false,"ignoreQuery":false,"ignoreTimerange":false,"ignoreValidations":false},"labelPosition":"oneLine"},"description":"","kibanaSavedObjectMeta":{"searchSource":{"filter":[{"$state":{"store":"appState"},"meta":{"alias":"string","controlledBy":"string","disabled":true,"field":"string","group":"string","index":"string","isMultiIndex":true,"key":"string","negate":true,"type":"string","value":"string"},"query":{}}],"query":{"language":"string","query":"string"},"sort":[{}],"type":"string"}},"options":{"hidePanelTitles":false,"syncColors":true,"syncCursor":true,"syncTooltips":true,"useMargins":true},"panels":[{"gridData":{"h":15,"i":"string","w":24,"x":42.0,"y":42.0},"id":"string","panelConfig":{"description":"string","enhancements":{},"hidePanelTitles":true,"savedObjectId":"string","title":"string","version":"string"},"panelIndex":"string","panelRefName":"string","title":"string","type":"string","version":"string"}],"refreshInterval":{"display":"string","pause":true,"section":42.0,"value":42.0},"tags":["string"],"timeFrom":"string","timeRestore":false,"timeTo":"string","title":"string","version":42.0},"references":[{"id":"string","name":"string","type":"string"}],"spaces":["string"]}'
Request examples
# Headers
kbn-xsrf: true
# Payload
{
"attributes": {
"controlGroupInput": {
"autoApplySelections": true,
"chainingSystem": "HIERARCHICAL",
"controls": [
{
"controlConfig": {},
"grow": false,
"id": "string",
"order": 42.0,
"type": "string",
"width": "medium"
}
],
"enhancements": {},
"ignoreParentSettings": {
"ignoreFilters": false,
"ignoreQuery": false,
"ignoreTimerange": false,
"ignoreValidations": false
},
"labelPosition": "oneLine"
},
"description": "",
"kibanaSavedObjectMeta": {
"searchSource": {
"filter": [
{
"$state": {
"store": "appState"
},
"meta": {
"alias": "string",
"controlledBy": "string",
"disabled": true,
"field": "string",
"group": "string",
"index": "string",
"isMultiIndex": true,
"key": "string",
"negate": true,
"type": "string",
"value": "string"
},
"query": {}
}
],
"query": {
"language": "string",
"query": "string"
},
"sort": [
{}
],
"type": "string"
}
},
"options": {
"hidePanelTitles": false,
"syncColors": true,
"syncCursor": true,
"syncTooltips": true,
"useMargins": true
},
"panels": [
{
"gridData": {
"h": 15,
"i": "string",
"w": 24,
"x": 42.0,
"y": 42.0
},
"id": "string",
"panelConfig": {
"description": "string",
"enhancements": {},
"hidePanelTitles": true,
"savedObjectId": "string",
"title": "string",
"version": "string"
},
"panelIndex": "string",
"panelRefName": "string",
"title": "string",
"type": "string",
"version": "string"
}
],
"refreshInterval": {
"display": "string",
"pause": true,
"section": 42.0,
"value": 42.0
},
"tags": [
"string"
],
"timeFrom": "string",
"timeRestore": false,
"timeTo": "string",
"title": "string",
"version": 42.0
},
"references": [
{
"id": "string",
"name": "string",
"type": "string"
}
],
"spaces": [
"string"
]
}
Response examples (200)
{
"item": {
"attributes": {
"controlGroupInput": {
"autoApplySelections": true,
"chainingSystem": "HIERARCHICAL",
"controls": [
{
"controlConfig": {},
"grow": false,
"id": "string",
"order": 42.0,
"type": "string",
"width": "medium"
}
],
"enhancements": {},
"ignoreParentSettings": {
"ignoreFilters": false,
"ignoreQuery": false,
"ignoreTimerange": false,
"ignoreValidations": false
},
"labelPosition": "oneLine"
},
"description": "",
"kibanaSavedObjectMeta": {
"searchSource": {
"filter": [
{
"$state": {
"store": "appState"
},
"meta": {
"alias": "string",
"controlledBy": "string",
"disabled": true,
"field": "string",
"group": "string",
"index": "string",
"isMultiIndex": true,
"key": "string",
"negate": true,
"type": "string",
"value": "string"
},
"query": {}
}
],
"query": {
"language": "string",
"query": "string"
},
"sort": [
{}
],
"type": "string"
}
},
"options": {
"hidePanelTitles": false,
"syncColors": true,
"syncCursor": true,
"syncTooltips": true,
"useMargins": true
},
"panels": [
{
"gridData": {
"h": 15,
"i": "string",
"w": 24,
"x": 42.0,
"y": 42.0
},
"id": "string",
"panelConfig": {
"description": "string",
"enhancements": {},
"hidePanelTitles": true,
"savedObjectId": "string",
"title": "string",
"version": "string"
},
"panelIndex": "string",
"panelRefName": "string",
"title": "string",
"type": "string",
"version": "string"
}
],
"refreshInterval": {
"display": "string",
"pause": true,
"section": 42.0,
"value": 42.0
},
"tags": [
"string"
],
"timeFrom": "string",
"timeRestore": false,
"timeTo": "string",
"title": "string",
"version": 42.0
},
"createdAt": "string",
"createdBy": "string",
"error": {
"error": "string",
"message": "string",
"metadata": {},
"statusCode": 42.0
},
"id": "string",
"managed": true,
"namespaces": [
"string"
],
"originId": "string",
"references": [
{
"id": "string",
"name": "string",
"type": "string"
}
],
"type": "string",
"updatedAt": "string",
"updatedBy": "string",
"version": "string"
}
}
Delete a dashboard
Technical Preview
This functionality is in technical preview and may be changed or removed in a future release. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features.
Path parameters
-
id
string Required A unique identifier for the dashboard.
DELETE
/api/dashboards/dashboard/{id}
curl \
--request DELETE 'http://api.example.com/api/dashboards/dashboard/{id}' \
--header "Authorization: $API_KEY" \
--header "kbn-xsrf: true"Get data streams
[Required authorization] Route required privileges: fleet-agents-all AND fleet-agent-policies-all AND fleet-settings-all.
GET
/api/fleet/data_streams
curl \
--request GET 'http://api.example.com/api/fleet/data_streams' \
--header "Authorization: $API_KEY"
Response examples (200)
{
"data_streams": [
{
"dashboards": [
{
"id": "string",
"title": "string"
}
],
"dataset": "string",
"index": "string",
"last_activity_ms": 42.0,
"namespace": "string",
"package": "string",
"package_version": "string",
"serviceDetails": {
"environment": "string",
"serviceName": "string"
},
"size_in_bytes": 42.0,
"size_in_bytes_formatted": 42.0,
"type": "string"
}
]
}
Response examples (400)
{
"error": "string",
"errorType": "string",
"message": "string",
"statusCode": 42.0
}Get data streams
[Required authorization] Route required privileges: integrations-read OR fleet-setup OR fleet-all.
Query parameters
-
type
string Values are
logs,metrics,traces,synthetics, orprofiling. -
datasetQuery
string -
sortOrder
string Values are
ascordesc. Default value isasc. -
uncategorisedOnly
boolean Default value is
false.
GET
/api/fleet/epm/data_streams
curl \
--request GET 'http://api.example.com/api/fleet/epm/data_streams' \
--header "Authorization: $API_KEY"
Response examples (200)
{
"items": [
{
"name": "string"
}
]
}
Response examples (400)
{
"error": "string",
"errorType": "string",
"message": "string",
"statusCode": 42.0
}Data views
Data view APIs enable you to manage data views, formerly known as Kibana index patterns.
GET
/api/data_views
curl \
--request GET 'http://api.example.com/api/data_views' \
--header "Authorization: $API_KEY"
Response examples (200)
{
"data_view": [
{
"id": "ff959d40-b880-11e8-a6d9-e546fe2bba5f",
"name": "Kibana Sample Data eCommerce",
"title": "kibana_sample_data_ecommerce",
"typeMeta": {},
"namespaces": [
"default"
]
},
{
"id": "d3d7af60-4c81-11e8-b3d7-01146121b73d",
"name": "Kibana Sample Data Flights",
"title": "kibana_sample_data_flights",
"namespaces": [
"default"
]
},
{
"id": "90943e30-9a47-11e8-b64d-95841ca0b247",
"name": "Kibana Sample Data Logs",
"title": "kibana_sample_data_logs",
"namespaces": [
"default"
]
}
]
}
Response examples (400)
{
"error": "Bad Request",
"message": "string",
"statusCode": 400
}
POST
/api/data_views/data_view
curl \
--request POST 'http://api.example.com/api/data_views/data_view' \
--header "Authorization: $API_KEY" \
--header "Content-Type: application/json" \
--header "kbn-xsrf: string" \
--data '{"data_view":{"name":"My Logstash data view","title":"logstash-*","runtimeFieldMap":{"runtime_shape_name":{"type":"keyword","script":{"source":"emit(doc['shape_name'].value)"}}}}}'
Request example
{
"data_view": {
"name": "My Logstash data view",
"title": "logstash-*",
"runtimeFieldMap": {
"runtime_shape_name": {
"type": "keyword",
"script": {
"source": "emit(doc['shape_name'].value)"
}
}
}
}
}
Response examples (200)
{
"data_view": {
"allowNoIndex": true,
"fieldAttrs": {
"additionalProperty1": {
"count": 42,
"customDescription": "string",
"customLabel": "string"
},
"additionalProperty2": {
"count": 42,
"customDescription": "string",
"customLabel": "string"
}
},
"fieldFormats": {},
"fields": {},
"id": "ff959d40-b880-11e8-a6d9-e546fe2bba5f",
"name": "string",
"namespaces": [
"default"
],
"runtimeFieldMap": {
"additionalProperty1": {
"script": {
"source": "string"
},
"type": "string"
},
"additionalProperty2": {
"script": {
"source": "string"
},
"type": "string"
}
},
"sourceFilters": [
{
"value": "string"
}
],
"timeFieldName": "string",
"title": "string",
"typeMeta": {
"aggs": {},
"params": {}
},
"version": "WzQ2LDJd"
}
}
Response examples (400)
{
"error": "Bad Request",
"message": "string",
"statusCode": 400
}Path parameters
-
viewId
string Required An identifier for the data view.
GET
/api/data_views/data_view/{viewId}
curl \
--request GET 'http://api.example.com/api/data_views/data_view/ff959d40-b880-11e8-a6d9-e546fe2bba5f' \
--header "Authorization: $API_KEY"
Response examples (200)
{
"data_view": {
"id": "ff959d40-b880-11e8-a6d9-e546fe2bba5f",
"name": "Kibana Sample Data eCommerce",
"title": "kibana_sample_data_ecommerce",
"fields": {
"_id": {
"name": "_id",
"type": "string",
"count": 0,
"format": {
"id": "string"
},
"esTypes": [
"_id"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": false,
"shortDotsEnable": false,
"readFromDocValues": false
},
"sku": {
"name": "sku",
"type": "string",
"count": 0,
"format": {
"id": "string"
},
"esTypes": [
"keyword"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": true,
"shortDotsEnable": false,
"readFromDocValues": true
},
"type": {
"name": "type",
"type": "string",
"count": 0,
"format": {
"id": "string"
},
"esTypes": [
"keyword"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": true,
"shortDotsEnable": false,
"readFromDocValues": true
},
"user": {
"name": "user",
"type": "string",
"count": 0,
"format": {
"id": "string"
},
"esTypes": [
"keyword"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": true,
"shortDotsEnable": false,
"readFromDocValues": true
},
"email": {
"name": "email",
"type": "string",
"count": 0,
"format": {
"id": "string"
},
"esTypes": [
"keyword"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": true,
"shortDotsEnable": false,
"readFromDocValues": true
},
"_index": {
"name": "_index",
"type": "string",
"count": 0,
"format": {
"id": "string"
},
"esTypes": [
"_index"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": true,
"shortDotsEnable": false,
"readFromDocValues": false
},
"_score": {
"name": "_score",
"type": "number",
"count": 0,
"format": {
"id": "number"
},
"isMapped": true,
"scripted": false,
"searchable": false,
"aggregatable": false,
"shortDotsEnable": false,
"readFromDocValues": false
},
"_source": {
"name": "_source",
"type": "_source",
"count": 0,
"format": {
"id": "_source"
},
"esTypes": [
"_source"
],
"isMapped": true,
"scripted": false,
"searchable": false,
"aggregatable": false,
"shortDotsEnable": false,
"readFromDocValues": false
},
"category": {
"name": "category",
"type": "string",
"count": 0,
"format": {
"id": "string"
},
"esTypes": [
"text"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": false,
"shortDotsEnable": false,
"readFromDocValues": false
},
"currency": {
"name": "currency",
"type": "string",
"count": 0,
"format": {
"id": "string"
},
"esTypes": [
"keyword"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": true,
"shortDotsEnable": false,
"readFromDocValues": true
},
"order_id": {
"name": "order_id",
"type": "string",
"count": 0,
"format": {
"id": "string"
},
"esTypes": [
"keyword"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": true,
"shortDotsEnable": false,
"readFromDocValues": true
},
"order_date": {
"name": "order_date",
"type": "date",
"count": 0,
"format": {
"id": "date"
},
"esTypes": [
"date"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": true,
"shortDotsEnable": false,
"readFromDocValues": true
},
"customer_id": {
"name": "customer_id",
"type": "string",
"count": 0,
"format": {
"id": "string"
},
"esTypes": [
"keyword"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": true,
"shortDotsEnable": false,
"readFromDocValues": true
},
"day_of_week": {
"name": "day_of_week",
"type": "string",
"count": 0,
"format": {
"id": "string"
},
"esTypes": [
"keyword"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": true,
"shortDotsEnable": false,
"readFromDocValues": true
},
"manufacturer": {
"name": "manufacturer",
"type": "string",
"count": 0,
"format": {
"id": "string"
},
"esTypes": [
"text"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": false,
"shortDotsEnable": false,
"readFromDocValues": false
},
"products._id": {
"name": "products._id",
"type": "string",
"count": 0,
"format": {
"id": "string"
},
"esTypes": [
"text"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": false,
"shortDotsEnable": false,
"readFromDocValues": false
},
"products.sku": {
"name": "products.sku",
"type": "string",
"count": 0,
"format": {
"id": "string"
},
"esTypes": [
"keyword"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": true,
"shortDotsEnable": false,
"readFromDocValues": true
},
"day_of_week_i": {
"name": "day_of_week_i",
"type": "number",
"count": 0,
"format": {
"id": "number"
},
"esTypes": [
"integer"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": true,
"shortDotsEnable": false,
"readFromDocValues": true
},
"event.dataset": {
"name": "event.dataset",
"type": "string",
"count": 0,
"format": {
"id": "string"
},
"esTypes": [
"keyword"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": true,
"shortDotsEnable": false,
"readFromDocValues": true
},
"customer_phone": {
"name": "customer_phone",
"type": "string",
"count": 0,
"format": {
"id": "string"
},
"esTypes": [
"keyword"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": true,
"shortDotsEnable": false,
"readFromDocValues": true
},
"geoip.location": {
"name": "geoip.location",
"type": "geo_point",
"count": 0,
"format": {
"id": "geo_point",
"params": {
"transform": "wkt"
}
},
"esTypes": [
"geo_point"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": true,
"shortDotsEnable": false,
"readFromDocValues": true
},
"products.price": {
"name": "products.price",
"type": "number",
"count": 1,
"format": {
"id": "number",
"params": {
"pattern": "$0,0.00"
}
},
"esTypes": [
"half_float"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": true,
"shortDotsEnable": false,
"readFromDocValues": true
},
"total_quantity": {
"name": "total_quantity",
"type": "number",
"count": 1,
"format": {
"id": "number"
},
"esTypes": [
"integer"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": true,
"shortDotsEnable": false,
"readFromDocValues": true
},
"customer_gender": {
"name": "customer_gender",
"type": "string",
"count": 0,
"format": {
"id": "string"
},
"esTypes": [
"keyword"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": true,
"shortDotsEnable": false,
"readFromDocValues": true
},
"geoip.city_name": {
"name": "geoip.city_name",
"type": "string",
"count": 0,
"format": {
"id": "string"
},
"esTypes": [
"keyword"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": true,
"shortDotsEnable": false,
"readFromDocValues": true
},
"category.keyword": {
"name": "category.keyword",
"type": "string",
"count": 0,
"format": {
"id": "string"
},
"esTypes": [
"keyword"
],
"subType": {
"multi": {
"parent": "category"
}
},
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": true,
"shortDotsEnable": false,
"readFromDocValues": true
},
"geoip.region_name": {
"name": "geoip.region_name",
"type": "string",
"count": 0,
"format": {
"id": "string"
},
"esTypes": [
"keyword"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": true,
"shortDotsEnable": false,
"readFromDocValues": true
},
"products.category": {
"name": "products.category",
"type": "string",
"count": 0,
"format": {
"id": "string"
},
"esTypes": [
"text"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": false,
"shortDotsEnable": false,
"readFromDocValues": false
},
"products.quantity": {
"name": "products.quantity",
"type": "number",
"count": 0,
"format": {
"id": "number"
},
"esTypes": [
"integer"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": true,
"shortDotsEnable": false,
"readFromDocValues": true
},
"customer_full_name": {
"name": "customer_full_name",
"type": "string",
"count": 0,
"format": {
"id": "string"
},
"esTypes": [
"text"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": false,
"shortDotsEnable": false,
"readFromDocValues": false
},
"customer_last_name": {
"name": "customer_last_name",
"type": "string",
"count": 0,
"format": {
"id": "string"
},
"esTypes": [
"text"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": false,
"shortDotsEnable": false,
"readFromDocValues": false
},
"products.min_price": {
"name": "products.min_price",
"type": "number",
"count": 0,
"format": {
"id": "number",
"params": {
"pattern": "$0,0.00"
}
},
"esTypes": [
"half_float"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": true,
"shortDotsEnable": false,
"readFromDocValues": true
},
"taxful_total_price": {
"name": "taxful_total_price",
"type": "number",
"count": 0,
"format": {
"id": "number",
"params": {
"pattern": "$0,0.[00]"
}
},
"esTypes": [
"half_float"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": true,
"shortDotsEnable": false,
"readFromDocValues": true
},
"customer_birth_date": {
"name": "customer_birth_date",
"type": "date",
"count": 0,
"format": {
"id": "date"
},
"esTypes": [
"date"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": true,
"shortDotsEnable": false,
"readFromDocValues": true
},
"customer_first_name": {
"name": "customer_first_name",
"type": "string",
"count": 0,
"format": {
"id": "string"
},
"esTypes": [
"text"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": false,
"shortDotsEnable": false,
"readFromDocValues": false
},
"products.base_price": {
"name": "products.base_price",
"type": "number",
"count": 0,
"format": {
"id": "number",
"params": {
"pattern": "$0,0.00"
}
},
"esTypes": [
"half_float"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": true,
"shortDotsEnable": false,
"readFromDocValues": true
},
"products.created_on": {
"name": "products.created_on",
"type": "date",
"count": 0,
"format": {
"id": "date"
},
"esTypes": [
"date"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": true,
"shortDotsEnable": false,
"readFromDocValues": true
},
"products.product_id": {
"name": "products.product_id",
"type": "number",
"count": 0,
"format": {
"id": "number"
},
"esTypes": [
"long"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": true,
"shortDotsEnable": false,
"readFromDocValues": true
},
"products.tax_amount": {
"name": "products.tax_amount",
"type": "number",
"count": 0,
"format": {
"id": "number"
},
"esTypes": [
"half_float"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": true,
"shortDotsEnable": false,
"readFromDocValues": true
},
"taxless_total_price": {
"name": "taxless_total_price",
"type": "number",
"count": 0,
"format": {
"id": "number",
"params": {
"pattern": "$0,0.00"
}
},
"esTypes": [
"half_float"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": true,
"shortDotsEnable": false,
"readFromDocValues": true
},
"geoip.continent_name": {
"name": "geoip.continent_name",
"type": "string",
"count": 0,
"format": {
"id": "string"
},
"esTypes": [
"keyword"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": true,
"shortDotsEnable": false,
"readFromDocValues": true
},
"manufacturer.keyword": {
"name": "manufacturer.keyword",
"type": "string",
"count": 0,
"format": {
"id": "string"
},
"esTypes": [
"keyword"
],
"subType": {
"multi": {
"parent": "manufacturer"
}
},
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": true,
"shortDotsEnable": false,
"readFromDocValues": true
},
"products._id.keyword": {
"name": "products._id.keyword",
"type": "string",
"count": 0,
"format": {
"id": "string"
},
"esTypes": [
"keyword"
],
"subType": {
"multi": {
"parent": "products._id"
}
},
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": true,
"shortDotsEnable": false,
"readFromDocValues": true
},
"products.manufacturer": {
"name": "products.manufacturer",
"type": "string",
"count": 1,
"format": {
"id": "string"
},
"esTypes": [
"text"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": false,
"shortDotsEnable": false,
"readFromDocValues": false
},
"products.product_name": {
"name": "products.product_name",
"type": "string",
"count": 1,
"format": {
"id": "string"
},
"esTypes": [
"text"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": false,
"shortDotsEnable": false,
"readFromDocValues": false
},
"products.taxful_price": {
"name": "products.taxful_price",
"type": "number",
"count": 0,
"format": {
"id": "number",
"params": {
"pattern": "$0,0.00"
}
},
"esTypes": [
"half_float"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": true,
"shortDotsEnable": false,
"readFromDocValues": true
},
"total_unique_products": {
"name": "total_unique_products",
"type": "number",
"count": 0,
"format": {
"id": "number"
},
"esTypes": [
"integer"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": true,
"shortDotsEnable": false,
"readFromDocValues": true
},
"geoip.country_iso_code": {
"name": "geoip.country_iso_code",
"type": "string",
"count": 0,
"format": {
"id": "string"
},
"esTypes": [
"keyword"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": true,
"shortDotsEnable": false,
"readFromDocValues": true
},
"products.taxless_price": {
"name": "products.taxless_price",
"type": "number",
"count": 0,
"format": {
"id": "number",
"params": {
"pattern": "$0,0.00"
}
},
"esTypes": [
"half_float"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": true,
"shortDotsEnable": false,
"readFromDocValues": true
},
"products.base_unit_price": {
"name": "products.base_unit_price",
"type": "number",
"count": 0,
"format": {
"id": "number",
"params": {
"pattern": "$0,0.00"
}
},
"esTypes": [
"half_float"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": true,
"shortDotsEnable": false,
"readFromDocValues": true
},
"products.discount_amount": {
"name": "products.discount_amount",
"type": "number",
"count": 0,
"format": {
"id": "number"
},
"esTypes": [
"half_float"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": true,
"shortDotsEnable": false,
"readFromDocValues": true
},
"products.category.keyword": {
"name": "products.category.keyword",
"type": "string",
"count": 0,
"format": {
"id": "string"
},
"esTypes": [
"keyword"
],
"subType": {
"multi": {
"parent": "products.category"
}
},
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": true,
"shortDotsEnable": false,
"readFromDocValues": true
},
"customer_full_name.keyword": {
"name": "customer_full_name.keyword",
"type": "string",
"count": 0,
"format": {
"id": "string"
},
"esTypes": [
"keyword"
],
"subType": {
"multi": {
"parent": "customer_full_name"
}
},
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": true,
"shortDotsEnable": false,
"readFromDocValues": true
},
"customer_last_name.keyword": {
"name": "customer_last_name.keyword",
"type": "string",
"count": 0,
"format": {
"id": "string"
},
"esTypes": [
"keyword"
],
"subType": {
"multi": {
"parent": "customer_last_name"
}
},
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": true,
"shortDotsEnable": false,
"readFromDocValues": true
},
"customer_first_name.keyword": {
"name": "customer_first_name.keyword",
"type": "string",
"count": 0,
"format": {
"id": "string"
},
"esTypes": [
"keyword"
],
"subType": {
"multi": {
"parent": "customer_first_name"
}
},
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": true,
"shortDotsEnable": false,
"readFromDocValues": true
},
"products.discount_percentage": {
"name": "products.discount_percentage",
"type": "number",
"count": 0,
"format": {
"id": "number"
},
"esTypes": [
"half_float"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": true,
"shortDotsEnable": false,
"readFromDocValues": true
},
"products.manufacturer.keyword": {
"name": "products.manufacturer.keyword",
"type": "string",
"count": 0,
"format": {
"id": "string"
},
"esTypes": [
"keyword"
],
"subType": {
"multi": {
"parent": "products.manufacturer"
}
},
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": true,
"shortDotsEnable": false,
"readFromDocValues": true
},
"products.product_name.keyword": {
"name": "products.product_name.keyword",
"type": "string",
"count": 0,
"format": {
"id": "string"
},
"esTypes": [
"keyword"
],
"subType": {
"multi": {
"parent": "products.product_name"
}
},
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": true,
"shortDotsEnable": false,
"readFromDocValues": true
},
"products.unit_discount_amount": {
"name": "products.unit_discount_amount",
"type": "number",
"count": 0,
"format": {
"id": "number"
},
"esTypes": [
"half_float"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": true,
"shortDotsEnable": false,
"readFromDocValues": true
}
},
"version": "WzUsMV0=",
"typeMeta": {},
"fieldAttrs": {
"products.price": {
"count": 1
},
"total_quantity": {
"count": 1
},
"products.manufacturer": {
"count": 1
},
"products.product_name": {
"count": 1
}
},
"namespaces": [
"default"
],
"allowNoIndex": false,
"fieldFormats": {
"products.price": {
"id": "number",
"params": {
"pattern": "$0,0.00"
}
},
"products.min_price": {
"id": "number",
"params": {
"pattern": "$0,0.00"
}
},
"taxful_total_price": {
"id": "number",
"params": {
"pattern": "$0,0.[00]"
}
},
"products.base_price": {
"id": "number",
"params": {
"pattern": "$0,0.00"
}
},
"taxless_total_price": {
"id": "number",
"params": {
"pattern": "$0,0.00"
}
},
"products.taxful_price": {
"id": "number",
"params": {
"pattern": "$0,0.00"
}
},
"products.taxless_price": {
"id": "number",
"params": {
"pattern": "$0,0.00"
}
},
"products.base_unit_price": {
"id": "number",
"params": {
"pattern": "$0,0.00"
}
}
},
"sourceFilters": [],
"timeFieldName": "order_date",
"runtimeFieldMap": {}
}
}
Response examples (404)
{
"error": "Not Found",
"message": "Saved object [index-pattern/caaad6d0-920c-11ed-b36a-874bd1548a00] not found",
"statusCode": 404
}Path parameters
-
viewId
string Required An identifier for the data view.
Body
Required
-
data_view
object Required The data view properties you want to update. Only the specified properties are updated in the data view. Unspecified fields stay as they are persisted.
-
refresh_fields
boolean Reloads the data view fields after the data view is updated.
Default value is
false.
POST
/api/data_views/data_view/{viewId}
curl \
--request POST 'http://api.example.com/api/data_views/data_view/ff959d40-b880-11e8-a6d9-e546fe2bba5f' \
--header "Authorization: $API_KEY" \
--header "Content-Type: application/json" \
--header "kbn-xsrf: string" \
--data '{"data_view":{"name":"Kibana Sample Data eCommerce","title":"kibana_sample_data_ecommerce","allowNoIndex":false,"timeFieldName":"order_date"},"refresh_fields":true}'
Request example
{
"data_view": {
"name": "Kibana Sample Data eCommerce",
"title": "kibana_sample_data_ecommerce",
"allowNoIndex": false,
"timeFieldName": "order_date"
},
"refresh_fields": true
}
Response examples (200)
{
"data_view": {
"allowNoIndex": true,
"fieldAttrs": {
"additionalProperty1": {
"count": 42,
"customDescription": "string",
"customLabel": "string"
},
"additionalProperty2": {
"count": 42,
"customDescription": "string",
"customLabel": "string"
}
},
"fieldFormats": {},
"fields": {},
"id": "ff959d40-b880-11e8-a6d9-e546fe2bba5f",
"name": "string",
"namespaces": [
"default"
],
"runtimeFieldMap": {
"additionalProperty1": {
"script": {
"source": "string"
},
"type": "string"
},
"additionalProperty2": {
"script": {
"source": "string"
},
"type": "string"
}
},
"sourceFilters": [
{
"value": "string"
}
],
"timeFieldName": "string",
"title": "string",
"typeMeta": {
"aggs": {},
"params": {}
},
"version": "WzQ2LDJd"
}
}
Response examples (400)
{
"error": "Bad Request",
"message": "string",
"statusCode": 400
}Delete a data view
WARNING: When you delete a data view, it cannot be recovered.
Path parameters
-
viewId
string Required An identifier for the data view.
DELETE
/api/data_views/data_view/{viewId}
curl \
--request DELETE 'http://api.example.com/api/data_views/data_view/ff959d40-b880-11e8-a6d9-e546fe2bba5f' \
--header "Authorization: $API_KEY" \
--header "kbn-xsrf: string"
Response examples (404)
{
"error": "Not Found",
"message": "Saved object [index-pattern/caaad6d0-920c-11ed-b36a-874bd1548a00] not found",
"statusCode": 404
}Update data view fields metadata
Update fields presentation metadata such as count, customLabel, customDescription, and format.
Path parameters
-
viewId
string Required An identifier for the data view.
POST
/api/data_views/data_view/{viewId}/fields
curl \
--request POST 'http://api.example.com/api/data_views/data_view/ff959d40-b880-11e8-a6d9-e546fe2bba5f/fields' \
--header "Authorization: $API_KEY" \
--header "Content-Type: application/json" \
--header "kbn-xsrf: string" \
--data '{"fields":{"field1":{"count":123,"customLabel":"Field 1 label"},"field2":{"customLabel":"Field 2 label","customDescription":"Field 2 description"}}}'
Request example
{
"fields": {
"field1": {
"count": 123,
"customLabel": "Field 1 label"
},
"field2": {
"customLabel": "Field 2 label",
"customDescription": "Field 2 description"
}
}
}
Response examples (200)
{
"acknowledged": true
}
Response examples (400)
{
"error": "Bad Request",
"message": "string",
"statusCode": 400
}Path parameters
-
viewId
string Required The ID of the data view fields you want to update.
Body
Required
-
name
string Required The name for a runtime field.
-
runtimeField
object Required The runtime field definition object.
PUT
/api/data_views/data_view/{viewId}/runtime_field
curl \
--request PUT 'http://api.example.com/api/data_views/data_view/{viewId}/runtime_field' \
--header "Authorization: $API_KEY" \
--header "Content-Type: application/json" \
--header "kbn-xsrf: string" \
--data '{"name":"runtimeFoo","runtimeField":{"type":"long","script":{"source":"emit(doc[\"foo\"].value)"}}}'
Request example
{
"name": "runtimeFoo",
"runtimeField": {
"type": "long",
"script": {
"source": "emit(doc[\"foo\"].value)"
}
}
}
Response examples (200)
{
"data_view": {},
"fields": [
{}
]
}
Response examples (400)
{
"error": "Bad Request",
"message": "string",
"statusCode": 400
}Path parameters
-
viewId
string Required An identifier for the data view.
Body
Required
-
name
string Required The name for a runtime field.
-
runtimeField
object Required The runtime field definition object.
POST
/api/data_views/data_view/{viewId}/runtime_field
curl \
--request POST 'http://api.example.com/api/data_views/data_view/ff959d40-b880-11e8-a6d9-e546fe2bba5f/runtime_field' \
--header "Authorization: $API_KEY" \
--header "Content-Type: application/json" \
--header "kbn-xsrf: string" \
--data '{"name":"runtimeFoo","runtimeField":{"type":"long","script":{"source":"emit(doc[\"foo\"].value)"}}}'
Request example
{
"name": "runtimeFoo",
"runtimeField": {
"type": "long",
"script": {
"source": "emit(doc[\"foo\"].value)"
}
}
}
Response examples (200)
{}
GET
/api/data_views/data_view/{viewId}/runtime_field/{fieldName}
curl \
--request GET 'http://api.example.com/api/data_views/data_view/ff959d40-b880-11e8-a6d9-e546fe2bba5f/runtime_field/hour_of_day' \
--header "Authorization: $API_KEY"
Response examples (200)
{
"fields": [
{
"name": "hour_of_day",
"type": "number",
"count": 0,
"esTypes": [
"long"
],
"scripted": false,
"searchable": true,
"aggregatable": true,
"runtimeField": {
"type": "long",
"script": {
"source": "emit(doc['timestamp'].value.getHour());"
}
},
"shortDotsEnable": false,
"readFromDocValues": false
}
],
"data_view": {
"id": "d3d7af60-4c81-11e8-b3d7-01146121b73d",
"name": "Kibana Sample Data Flights",
"title": "kibana_sample_data_flights",
"fields": {
"_id": {
"name": "_id",
"type": "string",
"count": 0,
"format": {
"id": "string"
},
"esTypes": [
"_id"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": false,
"shortDotsEnable": false,
"readFromDocValues": false
},
"Dest": {
"name": "Dest",
"type": "string",
"count": 0,
"format": {
"id": "string"
},
"esTypes": [
"keyword"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": true,
"shortDotsEnable": false,
"readFromDocValues": true
},
"Origin": {
"name": "Origin",
"type": "string",
"count": 0,
"format": {
"id": "string"
},
"esTypes": [
"keyword"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": true,
"shortDotsEnable": false,
"readFromDocValues": true
},
"_index": {
"name": "_index",
"type": "string",
"count": 0,
"format": {
"id": "string"
},
"esTypes": [
"_index"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": true,
"shortDotsEnable": false,
"readFromDocValues": false
},
"_score": {
"name": "_score",
"type": "number",
"count": 0,
"format": {
"id": "number"
},
"isMapped": true,
"scripted": false,
"searchable": false,
"aggregatable": false,
"shortDotsEnable": false,
"readFromDocValues": false
},
"Carrier": {
"name": "Carrier",
"type": "string",
"count": 0,
"format": {
"id": "string"
},
"esTypes": [
"keyword"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": true,
"shortDotsEnable": false,
"readFromDocValues": true
},
"_source": {
"name": "_source",
"type": "_source",
"count": 0,
"format": {
"id": "_source"
},
"esTypes": [
"_source"
],
"isMapped": true,
"scripted": false,
"searchable": false,
"aggregatable": false,
"shortDotsEnable": false,
"readFromDocValues": false
},
"Cancelled": {
"name": "Cancelled",
"type": "boolean",
"count": 0,
"format": {
"id": "boolean"
},
"esTypes": [
"boolean"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": true,
"shortDotsEnable": false,
"readFromDocValues": true
},
"FlightNum": {
"name": "FlightNum",
"type": "string",
"count": 0,
"format": {
"id": "string"
},
"esTypes": [
"keyword"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": true,
"shortDotsEnable": false,
"readFromDocValues": true
},
"dayOfWeek": {
"name": "dayOfWeek",
"type": "number",
"count": 0,
"format": {
"id": "number"
},
"esTypes": [
"integer"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": true,
"shortDotsEnable": false,
"readFromDocValues": true
},
"timestamp": {
"name": "timestamp",
"type": "date",
"count": 0,
"format": {
"id": "date"
},
"esTypes": [
"date"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": true,
"shortDotsEnable": false,
"readFromDocValues": true
},
"DestRegion": {
"name": "DestRegion",
"type": "string",
"count": 0,
"format": {
"id": "string"
},
"esTypes": [
"keyword"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": true,
"shortDotsEnable": false,
"readFromDocValues": true
},
"DestCountry": {
"name": "DestCountry",
"type": "string",
"count": 0,
"format": {
"id": "string"
},
"esTypes": [
"keyword"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": true,
"shortDotsEnable": false,
"readFromDocValues": true
},
"DestWeather": {
"name": "DestWeather",
"type": "string",
"count": 0,
"format": {
"id": "string"
},
"esTypes": [
"keyword"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": true,
"shortDotsEnable": false,
"readFromDocValues": true
},
"FlightDelay": {
"name": "FlightDelay",
"type": "boolean",
"count": 0,
"format": {
"id": "boolean"
},
"esTypes": [
"boolean"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": true,
"shortDotsEnable": false,
"readFromDocValues": true
},
"hour_of_day": {
"name": "hour_of_day",
"type": "number",
"count": 0,
"format": {
"id": "number",
"params": {
"pattern": "00"
}
},
"esTypes": [
"long"
],
"scripted": false,
"searchable": true,
"aggregatable": true,
"runtimeField": {
"type": "long",
"script": {
"source": "emit(doc['timestamp'].value.getHour());"
}
},
"shortDotsEnable": false,
"readFromDocValues": false
},
"DestCityName": {
"name": "DestCityName",
"type": "string",
"count": 0,
"format": {
"id": "string"
},
"esTypes": [
"keyword"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": true,
"shortDotsEnable": false,
"readFromDocValues": true
},
"DestLocation": {
"name": "DestLocation",
"type": "geo_point",
"count": 0,
"format": {
"id": "geo_point",
"params": {
"transform": "wkt"
}
},
"esTypes": [
"geo_point"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": true,
"shortDotsEnable": false,
"readFromDocValues": true
},
"OriginRegion": {
"name": "OriginRegion",
"type": "string",
"count": 0,
"format": {
"id": "string"
},
"esTypes": [
"keyword"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": true,
"shortDotsEnable": false,
"readFromDocValues": true
},
"DestAirportID": {
"name": "DestAirportID",
"type": "string",
"count": 0,
"format": {
"id": "string"
},
"esTypes": [
"keyword"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": true,
"shortDotsEnable": false,
"readFromDocValues": true
},
"DistanceMiles": {
"name": "DistanceMiles",
"type": "number",
"count": 0,
"format": {
"id": "number"
},
"esTypes": [
"float"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": true,
"shortDotsEnable": false,
"readFromDocValues": true
},
"FlightTimeMin": {
"name": "FlightTimeMin",
"type": "number",
"count": 0,
"format": {
"id": "number"
},
"esTypes": [
"float"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": true,
"shortDotsEnable": false,
"readFromDocValues": true
},
"OriginCountry": {
"name": "OriginCountry",
"type": "string",
"count": 0,
"format": {
"id": "string"
},
"esTypes": [
"keyword"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": true,
"shortDotsEnable": false,
"readFromDocValues": true
},
"OriginWeather": {
"name": "OriginWeather",
"type": "string",
"count": 0,
"format": {
"id": "string"
},
"esTypes": [
"keyword"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": true,
"shortDotsEnable": false,
"readFromDocValues": true
},
"AvgTicketPrice": {
"name": "AvgTicketPrice",
"type": "number",
"count": 0,
"format": {
"id": "number",
"params": {
"pattern": "$0,0.[00]"
}
},
"esTypes": [
"float"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": true,
"shortDotsEnable": false,
"readFromDocValues": true
},
"FlightDelayMin": {
"name": "FlightDelayMin",
"type": "number",
"count": 0,
"format": {
"id": "number"
},
"esTypes": [
"integer"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": true,
"shortDotsEnable": false,
"readFromDocValues": true
},
"FlightTimeHour": {
"name": "FlightTimeHour",
"type": "string",
"count": 0,
"format": {
"id": "string"
},
"esTypes": [
"keyword"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": true,
"shortDotsEnable": false,
"readFromDocValues": true
},
"OriginCityName": {
"name": "OriginCityName",
"type": "string",
"count": 0,
"format": {
"id": "string"
},
"esTypes": [
"keyword"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": true,
"shortDotsEnable": false,
"readFromDocValues": true
},
"OriginLocation": {
"name": "OriginLocation",
"type": "geo_point",
"count": 0,
"format": {
"id": "geo_point",
"params": {
"transform": "wkt"
}
},
"esTypes": [
"geo_point"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": true,
"shortDotsEnable": false,
"readFromDocValues": true
},
"FlightDelayType": {
"name": "FlightDelayType",
"type": "string",
"count": 0,
"format": {
"id": "string"
},
"esTypes": [
"keyword"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": true,
"shortDotsEnable": false,
"readFromDocValues": true
},
"OriginAirportID": {
"name": "OriginAirportID",
"type": "string",
"count": 0,
"format": {
"id": "string"
},
"esTypes": [
"keyword"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": true,
"shortDotsEnable": false,
"readFromDocValues": true
},
"DistanceKilometers": {
"name": "DistanceKilometers",
"type": "number",
"count": 0,
"format": {
"id": "number"
},
"esTypes": [
"float"
],
"isMapped": true,
"scripted": false,
"searchable": true,
"aggregatable": true,
"shortDotsEnable": false,
"readFromDocValues": true
}
},
"version": "WzM2LDJd",
"fieldAttrs": {},
"allowNoIndex": false,
"fieldFormats": {
"hour_of_day": {
"id": "number",
"params": {
"pattern": "00"
}
},
"AvgTicketPrice": {
"id": "number",
"params": {
"pattern": "$0,0.[00]"
}
}
},
"sourceFilters": [],
"timeFieldName": "timestamp",
"runtimeFieldMap": {
"hour_of_day": {
"type": "long",
"script": {
"source": "emit(doc['timestamp'].value.getHour());"
}
}
}
}
}
Response examples (404)
{
"error": "Not Found",
"message": "Saved object [index-pattern/caaad6d0-920c-11ed-b36a-874bd1548a00] not found",
"statusCode": 404
}Update a runtime field
Body
Required
-
runtimeField
object Required The runtime field definition object.
You can update following fields:
typescript
POST
/api/data_views/data_view/{viewId}/runtime_field/{fieldName}
curl \
--request POST 'http://api.example.com/api/data_views/data_view/ff959d40-b880-11e8-a6d9-e546fe2bba5f/runtime_field/hour_of_day' \
--header "Authorization: $API_KEY" \
--header "Content-Type: application/json" \
--data '{"runtimeField":{"script":{"source":"emit(doc[\"bar\"].value)"}}}'
Request example
{
"runtimeField": {
"script": {
"source": "emit(doc[\"bar\"].value)"
}
}
}
Response examples (400)
{
"error": "Bad Request",
"message": "string",
"statusCode": 400
}Delete a runtime field from a data view
DELETE
/api/data_views/data_view/{viewId}/runtime_field/{fieldName}
curl \
--request DELETE 'http://api.example.com/api/data_views/data_view/ff959d40-b880-11e8-a6d9-e546fe2bba5f/runtime_field/hour_of_day' \
--header "Authorization: $API_KEY"
Response examples (404)
{
"error": "Not Found",
"message": "Saved object [index-pattern/caaad6d0-920c-11ed-b36a-874bd1548a00] not found",
"statusCode": 404
}
GET
/api/data_views/default
curl \
--request GET 'http://api.example.com/api/data_views/default' \
--header "Authorization: $API_KEY"
Response examples (200)
{
"data_view_id": "ff959d40-b880-11e8-a6d9-e546fe2bba5f"
}
Response examples (400)
{
"error": "Bad Request",
"message": "string",
"statusCode": 400
}
Body
Required
-
data_view_id
string | null Required The data view identifier. NOTE: The API does not validate whether it is a valid identifier. Use
nullto unset the default data view. -
force
boolean Update an existing default data view identifier.
Default value is
false.
POST
/api/data_views/default
curl \
--request POST 'http://api.example.com/api/data_views/default' \
--header "Authorization: $API_KEY" \
--header "Content-Type: application/json" \
--header "kbn-xsrf: string" \
--data '{"force":true,"data_view_id":"ff959d40-b880-11e8-a6d9-e546fe2bba5f"}'
Request example
{
"force": true,
"data_view_id": "ff959d40-b880-11e8-a6d9-e546fe2bba5f"
}
Response examples (200)
{
"acknowledged": true
}
Response examples (400)
{
"error": "Bad Request",
"message": "string",
"statusCode": 400
}Swap saved object references
Changes saved object references from one data view identifier to another. WARNING: Misuse can break large numbers of saved objects! Practicing with a backup is recommended.
Body
Required
-
delete
boolean Deletes referenced saved object if all references are removed.
forId
string | array[string] Limit the affected saved objects to one or more by identifier.
-
forType
string Limit the affected saved objects by type.
-
fromId
string Required The saved object reference to change.
-
fromType
string Specify the type of the saved object reference to alter. The default value is
index-patternfor data views. -
toId
string Required New saved object reference value to replace the old value.
POST
/api/data_views/swap_references
curl \
--request POST 'http://api.example.com/api/data_views/swap_references' \
--header "Authorization: $API_KEY" \
--header "Content-Type: application/json" \
--header "kbn-xsrf: string" \
--data '{"toId":"xyz-123","delete":true,"fromId":"abcd-efg"}'
Request example
{
"toId": "xyz-123",
"delete": true,
"fromId": "abcd-efg"
}
Response examples (200)
{
"deleteStatus": {
"deletePerformed": true,
"remainingRefs": 42
},
"result": [
{
"id": "string",
"type": "string"
}
]
}Preview a saved object reference swap
Preview the impact of swapping saved object references from one data view identifier to another.
Body
Required
-
delete
boolean Deletes referenced saved object if all references are removed.
forId
string | array[string] Limit the affected saved objects to one or more by identifier.
-
forType
string Limit the affected saved objects by type.
-
fromId
string Required The saved object reference to change.
-
fromType
string Specify the type of the saved object reference to alter. The default value is
index-patternfor data views. -
toId
string Required New saved object reference value to replace the old value.
POST
/api/data_views/swap_references/_preview
curl \
--request POST 'http://api.example.com/api/data_views/swap_references/_preview' \
--header "Authorization: $API_KEY" \
--header "Content-Type: application/json" \
--header "kbn-xsrf: string" \
--data '{"toId":"xyz-123","fromId":"abcd-efg"}'
Request example
{
"toId": "xyz-123",
"fromId": "abcd-efg"
}
Response examples (200)
{
"result": [
{
"id": "string",
"type": "string"
}
]
}Create an agent action
[Required authorization] Route required privileges: fleet-agents-all.
Path parameters
-
agentId
string Required
POST
/api/fleet/agents/{agentId}/actions
curl \
--request POST 'http://api.example.com/api/fleet/agents/{agentId}/actions' \
--header "Authorization: $API_KEY" \
--header "Content-Type: application/json" \
--header "kbn-xsrf: true" \
--data '{"action":{"type":"UNENROLL"}}'
Request examples
# Headers
kbn-xsrf: true
# Payload
{
"action": {
"type": "UNENROLL"
}
}
Response examples (200)
{
"item": {
"agents": [
"string"
],
"created_at": "string",
"expiration": "string",
"id": "string",
"minimum_execution_duration": 42.0,
"namespaces": [
"string"
],
"rollout_duration_seconds": 42.0,
"sent_at": "string",
"source_uri": "string",
"start_time": "string",
"total": 42.0,
"type": "string"
}
}
Response examples (400)
{
"error": "string",
"errorType": "string",
"message": "string",
"statusCode": 42.0
}Reassign an agent
[Required authorization] Route required privileges: fleet-agents-all.
Path parameters
-
agentId
string Required
POST
/api/fleet/agents/{agentId}/reassign
curl \
--request POST 'http://api.example.com/api/fleet/agents/{agentId}/reassign' \
--header "Authorization: $API_KEY" \
--header "Content-Type: application/json" \
--header "kbn-xsrf: true" \
--data '{"policy_id":"string"}'
Request examples
# Headers
kbn-xsrf: true
# Payload
{
"policy_id": "string"
}
Response examples (200)
{}
Response examples (400)
{
"error": "string",
"errorType": "string",
"message": "string",
"statusCode": 42.0
}Request agent diagnostics
[Required authorization] Route required privileges: fleet-agents-read.
Path parameters
-
agentId
string Required
Body
-
additional_metrics
array[string] Value is
CPU.
POST
/api/fleet/agents/{agentId}/request_diagnostics
curl \
--request POST 'http://api.example.com/api/fleet/agents/{agentId}/request_diagnostics' \
--header "Authorization: $API_KEY" \
--header "Content-Type: application/json" \
--header "kbn-xsrf: true" \
--data '{"additional_metrics":["CPU"]}'
Request examples
# Headers
kbn-xsrf: true
# Payload
{
"additional_metrics": [
"CPU"
]
}
Response examples (200)
{
"actionId": "string"
}
Response examples (400)
{
"error": "string",
"errorType": "string",
"message": "string",
"statusCode": 42.0
}Unenroll an agent
[Required authorization] Route required privileges: fleet-agents-all.
Path parameters
-
agentId
string Required
POST
/api/fleet/agents/{agentId}/unenroll
curl \
--request POST 'http://api.example.com/api/fleet/agents/{agentId}/unenroll' \
--header "Authorization: $API_KEY" \
--header "Content-Type: application/json" \
--header "kbn-xsrf: true" \
--data '{"force":true,"revoke":true}'
Request examples
# Headers
kbn-xsrf: true
# Payload
{
"force": true,
"revoke": true
}Upgrade an agent
[Required authorization] Route required privileges: fleet-agents-all.
Path parameters
-
agentId
string Required
Body
-
force
boolean -
skipRateLimitCheck
boolean -
source_uri
string -
version
string Required
POST
/api/fleet/agents/{agentId}/upgrade
curl \
--request POST 'http://api.example.com/api/fleet/agents/{agentId}/upgrade' \
--header "Authorization: $API_KEY" \
--header "Content-Type: application/json" \
--header "kbn-xsrf: true" \
--data '{"force":true,"skipRateLimitCheck":true,"source_uri":"string","version":"string"}'
Request examples
# Headers
kbn-xsrf: true
# Payload
{
"force": true,
"skipRateLimitCheck": true,
"source_uri": "string",
"version": "string"
}
Response examples (200)
{}
Response examples (400)
{
"error": "string",
"errorType": "string",
"message": "string",
"statusCode": 42.0
}Get an agent action status
[Required authorization] Route required privileges: fleet-agents-read.
GET
/api/fleet/agents/action_status
curl \
--request GET 'http://api.example.com/api/fleet/agents/action_status' \
--header "Authorization: $API_KEY"
Response examples (200)
{
"items": [
{
"actionId": "string",
"cancellationTime": "string",
"completionTime": "string",
"creationTime": "string",
"expiration": "string",
"hasRolloutPeriod": true,
"is_automatic": true,
"latestErrors": [
{
"agentId": "string",
"error": "string",
"hostname": "string",
"timestamp": "string"
}
],
"nbAgentsAck": 42.0,
"nbAgentsActionCreated": 42.0,
"nbAgentsActioned": 42.0,
"nbAgentsFailed": 42.0,
"newPolicyId": "string",
"policyId": "string",
"revision": 42.0,
"startTime": "string",
"status": "COMPLETE",
"type": "UPGRADE",
"version": "string"
}
]
}
Response examples (400)
{
"error": "string",
"errorType": "string",
"message": "string",
"statusCode": 42.0
}Cancel an agent action
[Required authorization] Route required privileges: fleet-agents-all.
Path parameters
-
actionId
string Required
POST
/api/fleet/agents/actions/{actionId}/cancel
curl \
--request POST 'http://api.example.com/api/fleet/agents/actions/{actionId}/cancel' \
--header "Authorization: $API_KEY" \
--header "kbn-xsrf: true"
Response examples (200)
{
"item": {
"agents": [
"string"
],
"created_at": "string",
"expiration": "string",
"id": "string",
"minimum_execution_duration": 42.0,
"namespaces": [
"string"
],
"rollout_duration_seconds": 42.0,
"sent_at": "string",
"source_uri": "string",
"start_time": "string",
"total": 42.0,
"type": "string"
}
}
Response examples (400)
{
"error": "string",
"errorType": "string",
"message": "string",
"statusCode": 42.0
}Bulk reassign agents
[Required authorization] Route required privileges: fleet-agents-all.
Body
agents
array[string] | string Required -
batchSize
number -
includeInactive
boolean Default value is
false. -
policy_id
string Required
POST
/api/fleet/agents/bulk_reassign
curl \
--request POST 'http://api.example.com/api/fleet/agents/bulk_reassign' \
--header "Authorization: $API_KEY" \
--header "Content-Type: application/json" \
--header "kbn-xsrf: true" \
--data '{"agents":["string"],"batchSize":42.0,"includeInactive":false,"policy_id":"string"}'
Request examples
# Headers
kbn-xsrf: true
# Payload
{
"agents": [
"string"
],
"batchSize": 42.0,
"includeInactive": false,
"policy_id": "string"
}
Response examples (200)
{
"actionId": "string"
}
Response examples (400)
{
"error": "string",
"errorType": "string",
"message": "string",
"statusCode": 42.0
}Bulk request diagnostics from agents
[Required authorization] Route required privileges: fleet-agents-read.
Body
-
additional_metrics
array[string] Value is
CPU. agents
array[string] | string Required -
batchSize
number
POST
/api/fleet/agents/bulk_request_diagnostics
curl \
--request POST 'http://api.example.com/api/fleet/agents/bulk_request_diagnostics' \
--header "Authorization: $API_KEY" \
--header "Content-Type: application/json" \
--header "kbn-xsrf: true" \
--data '{"additional_metrics":["CPU"],"agents":["string"],"batchSize":42.0}'
Request examples
# Headers
kbn-xsrf: true
# Payload
{
"additional_metrics": [
"CPU"
],
"agents": [
"string"
],
"batchSize": 42.0
}
Response examples (200)
{
"actionId": "string"
}
Response examples (400)
{
"error": "string",
"errorType": "string",
"message": "string",
"statusCode": 42.0
}Bulk unenroll agents
[Required authorization] Route required privileges: fleet-agents-all.
POST
/api/fleet/agents/bulk_unenroll
curl \
--request POST 'http://api.example.com/api/fleet/agents/bulk_unenroll' \
--header "Authorization: $API_KEY" \
--header "Content-Type: application/json" \
--header "kbn-xsrf: true" \
--data '{"agents":["string"],"batchSize":42.0,"force":true,"includeInactive":true,"revoke":true}'
Request examples
# Headers
kbn-xsrf: true
# Payload
{
"agents": [
"string"
],
"batchSize": 42.0,
"force": true,
"includeInactive": true,
"revoke": true
}
Response examples (200)
{
"actionId": "string"
}
Response examples (400)
{
"error": "string",
"errorType": "string",
"message": "string",
"statusCode": 42.0
}Bulk update agent tags
[Required authorization] Route required privileges: fleet-agents-all.
POST
/api/fleet/agents/bulk_update_agent_tags
curl \
--request POST 'http://api.example.com/api/fleet/agents/bulk_update_agent_tags' \
--header "Authorization: $API_KEY" \
--header "Content-Type: application/json" \
--header "kbn-xsrf: true" \
--data '{"agents":["string"],"batchSize":42.0,"includeInactive":false,"tagsToAdd":["string"],"tagsToRemove":["string"]}'
Request examples
# Headers
kbn-xsrf: true
# Payload
{
"agents": [
"string"
],
"batchSize": 42.0,
"includeInactive": false,
"tagsToAdd": [
"string"
],
"tagsToRemove": [
"string"
]
}
Response examples (200)
{
"actionId": "string"
}
Response examples (400)
{
"error": "string",
"errorType": "string",
"message": "string",
"statusCode": 42.0
}Bulk upgrade agents
[Required authorization] Route required privileges: fleet-agents-all.
Body
agents
array[string] | string Required -
batchSize
number -
force
boolean -
includeInactive
boolean Default value is
false. -
rollout_duration_seconds
number Minimum value is
600. -
skipRateLimitCheck
boolean -
source_uri
string -
start_time
string -
version
string Required
POST
/api/fleet/agents/bulk_upgrade
curl \
--request POST 'http://api.example.com/api/fleet/agents/bulk_upgrade' \
--header "Authorization: $API_KEY" \
--header "Content-Type: application/json" \
--header "kbn-xsrf: true" \
--data '{"agents":["string"],"batchSize":42.0,"force":true,"includeInactive":false,"rollout_duration_seconds":42.0,"skipRateLimitCheck":true,"source_uri":"string","start_time":"string","version":"string"}'
Request examples
# Headers
kbn-xsrf: true
# Payload
{
"agents": [
"string"
],
"batchSize": 42.0,
"force": true,
"includeInactive": false,
"rollout_duration_seconds": 42.0,
"skipRateLimitCheck": true,
"source_uri": "string",
"start_time": "string",
"version": "string"
}
Response examples (200)
{
"actionId": "string"
}
Response examples (400)
{
"error": "string",
"errorType": "string",
"message": "string",
"statusCode": 42.0
}Get agent binary download sources
[Required authorization] Route required privileges: fleet-agent-policies-read OR fleet-settings-read.
GET
/api/fleet/agent_download_sources
curl \
--request GET 'http://api.example.com/api/fleet/agent_download_sources' \
--header "Authorization: $API_KEY"
Response examples (200)
{
"items": [
{
"host": "https://example.com",
"id": "string",
"is_default": false,
"name": "string",
"proxy_id": "string",
"secrets": {
"ssl": {
"key": {
"id": "string"
}
}
},
"ssl": {
"certificate": "string",
"certificate_authorities": [
"string"
],
"key": "string"
}
}
],
"page": 42.0,
"perPage": 42.0,
"total": 42.0
}
Response examples (400)
{
"error": "string",
"errorType": "string",
"message": "string",
"statusCode": 42.0
}Create an agent binary download source
[Required authorization] Route required privileges: fleet-settings-all.
Body
-
host
string(uri) Required -
id
string -
is_default
boolean Default value is
false. -
name
string Required -
proxy_id
string | null The ID of the proxy to use for this download source. See the proxies API for more information.
-
secrets
object Additional properties are NOT allowed.
-
ssl
object Additional properties are NOT allowed.
POST
/api/fleet/agent_download_sources
curl \
--request POST 'http://api.example.com/api/fleet/agent_download_sources' \
--header "Authorization: $API_KEY" \
--header "Content-Type: application/json" \
--header "kbn-xsrf: true" \
--data '{"host":"https://example.com","id":"string","is_default":false,"name":"string","proxy_id":"string","secrets":{"ssl":{"key":{"id":"string"}}},"ssl":{"certificate":"string","certificate_authorities":["string"],"key":"string"}}'
Request examples
# Headers
kbn-xsrf: true
# Payload
{
"host": "https://example.com",
"id": "string",
"is_default": false,
"name": "string",
"proxy_id": "string",
"secrets": {
"ssl": {
"key": {
"id": "string"
}
}
},
"ssl": {
"certificate": "string",
"certificate_authorities": [
"string"
],
"key": "string"
}
}
Response examples (200)
{
"item": {
"host": "https://example.com",
"id": "string",
"is_default": false,
"name": "string",
"proxy_id": "string",
"secrets": {
"ssl": {
"key": {
"id": "string"
}
}
},
"ssl": {
"certificate": "string",
"certificate_authorities": [
"string"
],
"key": "string"
}
}
}
Response examples (400)
{
"error": "string",
"errorType": "string",
"message": "string",
"statusCode": 42.0
}Get an agent binary download source
Get an agent binary download source by ID.
[Required authorization] Route required privileges: fleet-agent-policies-read OR fleet-settings-read.
Path parameters
-
sourceId
string Required
GET
/api/fleet/agent_download_sources/{sourceId}
curl \
--request GET 'http://api.example.com/api/fleet/agent_download_sources/{sourceId}' \
--header "Authorization: $API_KEY"
Response examples (200)
{
"item": {
"host": "https://example.com",
"id": "string",
"is_default": false,
"name": "string",
"proxy_id": "string",
"secrets": {
"ssl": {
"key": {
"id": "string"
}
}
},
"ssl": {
"certificate": "string",
"certificate_authorities": [
"string"
],
"key": "string"
}
}
}
Response examples (400)
{
"error": "string",
"errorType": "string",
"message": "string",
"statusCode": 42.0
}Update an agent binary download source
Update an agent binary download source by ID.
[Required authorization] Route required privileges: fleet-settings-all.
Path parameters
-
sourceId
string Required
Body
-
host
string(uri) Required -
id
string -
is_default
boolean Default value is
false. -
name
string Required -
proxy_id
string | null The ID of the proxy to use for this download source. See the proxies API for more information.
-
secrets
object Additional properties are NOT allowed.
-
ssl
object Additional properties are NOT allowed.
PUT
/api/fleet/agent_download_sources/{sourceId}
curl \
--request PUT 'http://api.example.com/api/fleet/agent_download_sources/{sourceId}' \
--header "Authorization: $API_KEY" \
--header "Content-Type: application/json" \
--header "kbn-xsrf: true" \
--data '{"host":"https://example.com","id":"string","is_default":false,"name":"string","proxy_id":"string","secrets":{"ssl":{"key":{"id":"string"}}},"ssl":{"certificate":"string","certificate_authorities":["string"],"key":"string"}}'
Request examples
# Headers
kbn-xsrf: true
# Payload
{
"host": "https://example.com",
"id": "string",
"is_default": false,
"name": "string",
"proxy_id": "string",
"secrets": {
"ssl": {
"key": {
"id": "string"
}
}
},
"ssl": {
"certificate": "string",
"certificate_authorities": [
"string"
],
"key": "string"
}
}
Response examples (200)
{
"item": {
"host": "https://example.com",
"id": "string",
"is_default": false,
"name": "string",
"proxy_id": "string",
"secrets": {
"ssl": {
"key": {
"id": "string"
}
}
},
"ssl": {
"certificate": "string",
"certificate_authorities": [
"string"
],
"key": "string"
}
}
}
Response examples (400)
{
"error": "string",
"errorType": "string",
"message": "string",
"statusCode": 42.0
}Delete an agent binary download source
Delete an agent binary download source by ID.
[Required authorization] Route required privileges: fleet-settings-all.
Path parameters
-
sourceId
string Required
DELETE
/api/fleet/agent_download_sources/{sourceId}
curl \
--request DELETE 'http://api.example.com/api/fleet/agent_download_sources/{sourceId}' \
--header "Authorization: $API_KEY" \
--header "kbn-xsrf: true"
Response examples (200)
{
"id": "string"
}
Response examples (400)
{
"error": "string",
"errorType": "string",
"message": "string",
"statusCode": 42.0
}Get agent policies
[Required authorization] Route required privileges: fleet-agent-policies-read OR fleet-agents-read OR fleet-setup.
Query parameters
-
page
number -
perPage
number -
sortField
string -
sortOrder
string Values are
descorasc. -
showUpgradeable
boolean -
kuery
string -
noAgentCount
boolean Deprecated use withAgentCount instead
-
withAgentCount
boolean get policies with agent count
-
full
boolean get full policies with package policies populated
-
format
string Values are
simplifiedorlegacy.
GET
/api/fleet/agent_policies
curl \
--request GET 'http://api.example.com/api/fleet/agent_policies' \
--header "Authorization: $API_KEY"
Response examples (200)
{
"items": [
{
"advanced_settings": {},
"agent_features": [
{
"enabled": true,
"name": "string"
}
],
"agentless": {
"resources": {
"requests": {
"cpu": "string",
"memory": "string"
}
}
},
"agents": 42.0,
"data_output_id": "string",
"description": "string",
"download_source_id": "string",
"fleet_server_host_id": "string",
"global_data_tags": [
{
"name": "string",
"value": "string"
}
],
"has_fleet_server": true,
"id": "string",
"inactivity_timeout": 1209600,
"is_default": true,
"is_default_fleet_server": true,
"is_managed": true,
"is_preconfigured": true,
"is_protected": true,
"keep_monitoring_alive": false,
"monitoring_diagnostics": {
"limit": {
"burst": 42.0,
"interval": "string"
},
"uploader": {
"init_dur": "string",
"max_dur": "string",
"max_retries": 42.0
}
},
"monitoring_enabled": [
"logs"
],
"monitoring_http": {
"buffer": {
"enabled": false
},
"enabled": true,
"host": "string",
"port": 42.0
},
"monitoring_output_id": "string",
"monitoring_pprof_enabled": true,
"name": "string",
"namespace": "string",
"overrides": {},
"package_policies": [
"string"
],
"required_versions": [
{
"percentage": 42.0,
"version": "string"
}
],
"revision": 42.0,
"schema_version": "string",
"space_ids": [
"string"
],
"status": "active",
"supports_agentless": false,
"unenroll_timeout": 42.0,
"unprivileged_agents": 42.0,
"updated_at": "string",
"updated_by": "string",
"version": "string"
}
],
"page": 42.0,
"perPage": 42.0,
"total": 42.0
}
Response examples (400)
{
"error": "string",
"errorType": "string",
"message": "string",
"statusCode": 42.0
}Create an agent policy
[Required authorization] Route required privileges: fleet-agent-policies-all.
Query parameters
-
sys_monitoring
boolean
Body
-
advanced_settings
object Additional properties are NOT allowed.
-
agent_features
array[object] -
agentless
object Additional properties are NOT allowed.
-
data_output_id
string | null -
description
string -
download_source_id
string | null -
fleet_server_host_id
string | null -
force
boolean -
has_fleet_server
boolean -
id
string -
inactivity_timeout
number Minimum value is
0. Default value is1209600. -
is_default
boolean -
is_default_fleet_server
boolean -
is_managed
boolean -
is_protected
boolean -
keep_monitoring_alive
boolean | null When set to true, monitoring will be enabled but logs/metrics collection will be disabled
Default value is
false. -
monitoring_diagnostics
object Additional properties are NOT allowed.
-
monitoring_enabled
array[string] Values are
logs,metrics, ortraces. -
monitoring_http
object Additional properties are NOT allowed.
-
monitoring_output_id
string | null -
monitoring_pprof_enabled
boolean -
name
string Required Minimum length is
1. -
namespace
string Required Minimum length is
1. -
overrides
object | null Override settings that are defined in the agent policy. Input settings cannot be overridden. The override option should be used only in unusual circumstances and not as a routine procedure.
Additional properties are allowed.
-
required_versions
array[object] | null -
space_ids
array[string] -
supports_agentless
boolean | null Indicates whether the agent policy supports agentless integrations.
Default value is
false. -
unenroll_timeout
number Minimum value is
0.
POST
/api/fleet/agent_policies
curl \
--request POST 'http://api.example.com/api/fleet/agent_policies' \
--header "Authorization: $API_KEY" \
--header "Content-Type: application/json" \
--header "kbn-xsrf: true" \
--data '{"advanced_settings":{},"agent_features":[{"enabled":true,"name":"string"}],"agentless":{"resources":{"requests":{"cpu":"string","memory":"string"}}},"data_output_id":"string","description":"string","download_source_id":"string","fleet_server_host_id":"string","force":true,"global_data_tags":[{"name":"string","value":"string"}],"has_fleet_server":true,"id":"string","inactivity_timeout":1209600,"is_default":true,"is_default_fleet_server":true,"is_managed":true,"is_protected":true,"keep_monitoring_alive":false,"monitoring_diagnostics":{"limit":{"burst":42.0,"interval":"string"},"uploader":{"init_dur":"string","max_dur":"string","max_retries":42.0}},"monitoring_enabled":["logs"],"monitoring_http":{"buffer":{"enabled":false},"enabled":true,"host":"string","port":42.0},"monitoring_output_id":"string","monitoring_pprof_enabled":true,"name":"string","namespace":"string","overrides":{},"required_versions":[{"percentage":42.0,"version":"string"}],"space_ids":["string"],"supports_agentless":false,"unenroll_timeout":42.0}'
Request examples
# Headers
kbn-xsrf: true
# Payload
{
"advanced_settings": {},
"agent_features": [
{
"enabled": true,
"name": "string"
}
],
"agentless": {
"resources": {
"requests": {
"cpu": "string",
"memory": "string"
}
}
},
"data_output_id": "string",
"description": "string",
"download_source_id": "string",
"fleet_server_host_id": "string",
"force": true,
"global_data_tags": [
{
"name": "string",
"value": "string"
}
],
"has_fleet_server": true,
"id": "string",
"inactivity_timeout": 1209600,
"is_default": true,
"is_default_fleet_server": true,
"is_managed": true,
"is_protected": true,
"keep_monitoring_alive": false,
"monitoring_diagnostics": {
"limit": {
"burst": 42.0,
"interval": "string"
},
"uploader": {
"init_dur": "string",
"max_dur": "string",
"max_retries": 42.0
}
},
"monitoring_enabled": [
"logs"
],
"monitoring_http": {
"buffer": {
"enabled": false
},
"enabled": true,
"host": "string",
"port": 42.0
},
"monitoring_output_id": "string",
"monitoring_pprof_enabled": true,
"name": "string",
"namespace": "string",
"overrides": {},
"required_versions": [
{
"percentage": 42.0,
"version": "string"
}
],
"space_ids": [
"string"
],
"supports_agentless": false,
"unenroll_timeout": 42.0
}
Response examples (200)
{
"item": {
"advanced_settings": {},
"agent_features": [
{
"enabled": true,
"name": "string"
}
],
"agentless": {
"resources": {
"requests": {
"cpu": "string",
"memory": "string"
}
}
},
"agents": 42.0,
"data_output_id": "string",
"description": "string",
"download_source_id": "string",
"fleet_server_host_id": "string",
"global_data_tags": [
{
"name": "string",
"value": "string"
}
],
"has_fleet_server": true,
"id": "string",
"inactivity_timeout": 1209600,
"is_default": true,
"is_default_fleet_server": true,
"is_managed": true,
"is_preconfigured": true,
"is_protected": true,
"keep_monitoring_alive": false,
"monitoring_diagnostics": {
"limit": {
"burst": 42.0,
"interval": "string"
},
"uploader": {
"init_dur": "string",
"max_dur": "string",
"max_retries": 42.0
}
},
"monitoring_enabled": [
"logs"
],
"monitoring_http": {
"buffer": {
"enabled": false
},
"enabled": true,
"host": "string",
"port": 42.0
},
"monitoring_output_id": "string",
"monitoring_pprof_enabled": true,
"name": "string",
"namespace": "string",
"overrides": {},
"package_policies": [
"string"
],
"required_versions": [
{
"percentage": 42.0,
"version": "string"
}
],
"revision": 42.0,
"schema_version": "string",
"space_ids": [
"string"
],
"status": "active",
"supports_agentless": false,
"unenroll_timeout": 42.0,
"unprivileged_agents": 42.0,
"updated_at": "string",
"updated_by": "string",
"version": "string"
}
}
Response examples (400)
{
"error": "string",
"errorType": "string",
"message": "string",
"statusCode": 42.0
}Bulk get agent policies
[Required authorization] Route required privileges: fleet-agent-policies-read OR fleet-agents-read OR fleet-setup.
Query parameters
-
format
string Values are
simplifiedorlegacy.
Body
-
full
boolean get full policies with package policies populated
-
ids
array[string] Required list of package policy ids
-
ignoreMissing
boolean
POST
/api/fleet/agent_policies/_bulk_get
curl \
--request POST 'http://api.example.com/api/fleet/agent_policies/_bulk_get' \
--header "Authorization: $API_KEY" \
--header "Content-Type: application/json" \
--header "kbn-xsrf: true" \
--data '{"full":true,"ids":["string"],"ignoreMissing":true}'
Request examples
# Headers
kbn-xsrf: true
# Payload
{
"full": true,
"ids": [
"string"
],
"ignoreMissing": true
}
Response examples (200)
{
"items": [
{
"advanced_settings": {},
"agent_features": [
{
"enabled": true,
"name": "string"
}
],
"agentless": {
"resources": {
"requests": {
"cpu": "string",
"memory": "string"
}
}
},
"agents": 42.0,
"data_output_id": "string",
"description": "string",
"download_source_id": "string",
"fleet_server_host_id": "string",
"global_data_tags": [
{
"name": "string",
"value": "string"
}
],
"has_fleet_server": true,
"id": "string",
"inactivity_timeout": 1209600,
"is_default": true,
"is_default_fleet_server": true,
"is_managed": true,
"is_preconfigured": true,
"is_protected": true,
"keep_monitoring_alive": false,
"monitoring_diagnostics": {
"limit": {
"burst": 42.0,
"interval": "string"
},
"uploader": {
"init_dur": "string",
"max_dur": "string",
"max_retries": 42.0
}
},
"monitoring_enabled": [
"logs"
],
"monitoring_http": {
"buffer": {
"enabled": false
},
"enabled": true,
"host": "string",
"port": 42.0
},
"monitoring_output_id": "string",
"monitoring_pprof_enabled": true,
"name": "string",
"namespace": "string",
"overrides": {},
"package_policies": [
"string"
],
"required_versions": [
{
"percentage": 42.0,
"version": "string"
}
],
"revision": 42.0,
"schema_version": "string",
"space_ids": [
"string"
],
"status": "active",
"supports_agentless": false,
"unenroll_timeout": 42.0,
"unprivileged_agents": 42.0,
"updated_at": "string",
"updated_by": "string",
"version": "string"
}
]
}
Response examples (400)
{
"error": "string",
"errorType": "string",
"message": "string",
"statusCode": 42.0
}Get an agent policy
Get an agent policy by ID.
[Required authorization] Route required privileges: fleet-agent-policies-read OR fleet-agents-read OR fleet-setup.
Path parameters
-
agentPolicyId
string Required
Query parameters
-
format
string Values are
simplifiedorlegacy.
GET
/api/fleet/agent_policies/{agentPolicyId}
curl \
--request GET 'http://api.example.com/api/fleet/agent_policies/{agentPolicyId}' \
--header "Authorization: $API_KEY"
Response examples (200)
{
"item": {
"advanced_settings": {},
"agent_features": [
{
"enabled": true,
"name": "string"
}
],
"agentless": {
"resources": {
"requests": {
"cpu": "string",
"memory": "string"
}
}
},
"agents": 42.0,
"data_output_id": "string",
"description": "string",
"download_source_id": "string",
"fleet_server_host_id": "string",
"global_data_tags": [
{
"name": "string",
"value": "string"
}
],
"has_fleet_server": true,
"id": "string",
"inactivity_timeout": 1209600,
"is_default": true,
"is_default_fleet_server": true,
"is_managed": true,
"is_preconfigured": true,
"is_protected": true,
"keep_monitoring_alive": false,
"monitoring_diagnostics": {
"limit": {
"burst": 42.0,
"interval": "string"
},
"uploader": {
"init_dur": "string",
"max_dur": "string",
"max_retries": 42.0
}
},
"monitoring_enabled": [
"logs"
],
"monitoring_http": {
"buffer": {
"enabled": false
},
"enabled": true,
"host": "string",
"port": 42.0
},
"monitoring_output_id": "string",
"monitoring_pprof_enabled": true,
"name": "string",
"namespace": "string",
"overrides": {},
"package_policies": [
"string"
],
"required_versions": [
{
"percentage": 42.0,
"version": "string"
}
],
"revision": 42.0,
"schema_version": "string",
"space_ids": [
"string"
],
"status": "active",
"supports_agentless": false,
"unenroll_timeout": 42.0,
"unprivileged_agents": 42.0,
"updated_at": "string",
"updated_by": "string",
"version": "string"
}
}
Response examples (400)
{
"error": "string",
"errorType": "string",
"message": "string",
"statusCode": 42.0
}Update an agent policy
Update an agent policy by ID.
[Required authorization] Route required privileges: fleet-agent-policies-all.
Path parameters
-
agentPolicyId
string Required
Query parameters
-
format
string Values are
simplifiedorlegacy.
Body
-
advanced_settings
object Additional properties are NOT allowed.
-
agent_features
array[object] -
agentless
object Additional properties are NOT allowed.
-
bumpRevision
boolean -
data_output_id
string | null -
description
string -
download_source_id
string | null -
fleet_server_host_id
string | null -
force
boolean -
has_fleet_server
boolean -
id
string -
inactivity_timeout
number Minimum value is
0. Default value is1209600. -
is_default
boolean -
is_default_fleet_server
boolean -
is_managed
boolean -
is_protected
boolean -
keep_monitoring_alive
boolean | null When set to true, monitoring will be enabled but logs/metrics collection will be disabled
Default value is
false. -
monitoring_diagnostics
object Additional properties are NOT allowed.
-
monitoring_enabled
array[string] Values are
logs,metrics, ortraces. -
monitoring_http
object Additional properties are NOT allowed.
-
monitoring_output_id
string | null -
monitoring_pprof_enabled
boolean -
name
string Required Minimum length is
1. -
namespace
string Required Minimum length is
1. -
overrides
object | null Override settings that are defined in the agent policy. Input settings cannot be overridden. The override option should be used only in unusual circumstances and not as a routine procedure.
Additional properties are allowed.
-
required_versions
array[object] | null -
space_ids
array[string] -
supports_agentless
boolean | null Indicates whether the agent policy supports agentless integrations.
Default value is
false. -
unenroll_timeout
number Minimum value is
0.
PUT
/api/fleet/agent_policies/{agentPolicyId}
curl \
--request PUT 'http://api.example.com/api/fleet/agent_policies/{agentPolicyId}' \
--header "Authorization: $API_KEY" \
--header "Content-Type: application/json" \
--header "kbn-xsrf: true" \
--data '{"advanced_settings":{},"agent_features":[{"enabled":true,"name":"string"}],"agentless":{"resources":{"requests":{"cpu":"string","memory":"string"}}},"bumpRevision":true,"data_output_id":"string","description":"string","download_source_id":"string","fleet_server_host_id":"string","force":true,"global_data_tags":[{"name":"string","value":"string"}],"has_fleet_server":true,"id":"string","inactivity_timeout":1209600,"is_default":true,"is_default_fleet_server":true,"is_managed":true,"is_protected":true,"keep_monitoring_alive":false,"monitoring_diagnostics":{"limit":{"burst":42.0,"interval":"string"},"uploader":{"init_dur":"string","max_dur":"string","max_retries":42.0}},"monitoring_enabled":["logs"],"monitoring_http":{"buffer":{"enabled":false},"enabled":true,"host":"string","port":42.0},"monitoring_output_id":"string","monitoring_pprof_enabled":true,"name":"string","namespace":"string","overrides":{},"required_versions":[{"percentage":42.0,"version":"string"}],"space_ids":["string"],"supports_agentless":false,"unenroll_timeout":42.0}'
Request examples
# Headers
kbn-xsrf: true
# Payload
{
"advanced_settings": {},
"agent_features": [
{
"enabled": true,
"name": "string"
}
],
"agentless": {
"resources": {
"requests": {
"cpu": "string",
"memory": "string"
}
}
},
"bumpRevision": true,
"data_output_id": "string",
"description": "string",
"download_source_id": "string",
"fleet_server_host_id": "string",
"force": true,
"global_data_tags": [
{
"name": "string",
"value": "string"
}
],
"has_fleet_server": true,
"id": "string",
"inactivity_timeout": 1209600,
"is_default": true,
"is_default_fleet_server": true,
"is_managed": true,
"is_protected": true,
"keep_monitoring_alive": false,
"monitoring_diagnostics": {
"limit": {
"burst": 42.0,
"interval": "string"
},
"uploader": {
"init_dur": "string",
"max_dur": "string",
"max_retries": 42.0
}
},
"monitoring_enabled": [
"logs"
],
"monitoring_http": {
"buffer": {
"enabled": false
},
"enabled": true,
"host": "string",
"port": 42.0
},
"monitoring_output_id": "string",
"monitoring_pprof_enabled": true,
"name": "string",
"namespace": "string",
"overrides": {},
"required_versions": [
{
"percentage": 42.0,
"version": "string"
}
],
"space_ids": [
"string"
],
"supports_agentless": false,
"unenroll_timeout": 42.0
}
Response examples (200)
{
"item": {
"advanced_settings": {},
"agent_features": [
{
"enabled": true,
"name": "string"
}
],
"agentless": {
"resources": {
"requests": {
"cpu": "string",
"memory": "string"
}
}
},
"agents": 42.0,
"data_output_id": "string",
"description": "string",
"download_source_id": "string",
"fleet_server_host_id": "string",
"global_data_tags": [
{
"name": "string",
"value": "string"
}
],
"has_fleet_server": true,
"id": "string",
"inactivity_timeout": 1209600,
"is_default": true,
"is_default_fleet_server": true,
"is_managed": true,
"is_preconfigured": true,
"is_protected": true,
"keep_monitoring_alive": false,
"monitoring_diagnostics": {
"limit": {
"burst": 42.0,
"interval": "string"
},
"uploader": {
"init_dur": "string",
"max_dur": "string",
"max_retries": 42.0
}
},
"monitoring_enabled": [
"logs"
],
"monitoring_http": {
"buffer": {
"enabled": false
},
"enabled": true,
"host": "string",
"port": 42.0
},
"monitoring_output_id": "string",
"monitoring_pprof_enabled": true,
"name": "string",
"namespace": "string",
"overrides": {},
"package_policies": [
"string"
],
"required_versions": [
{
"percentage": 42.0,
"version": "string"
}
],
"revision": 42.0,
"schema_version": "string",
"space_ids": [
"string"
],
"status": "active",
"supports_agentless": false,
"unenroll_timeout": 42.0,
"unprivileged_agents": 42.0,
"updated_at": "string",
"updated_by": "string",
"version": "string"
}
}
Response examples (400)
{
"error": "string",
"errorType": "string",
"message": "string",
"statusCode": 42.0
}Copy an agent policy
Copy an agent policy by ID.
[Required authorization] Route required privileges: fleet-agent-policies-all.
Path parameters
-
agentPolicyId
string Required
Query parameters
-
format
string Values are
simplifiedorlegacy.
Body
-
description
string -
name
string Required Minimum length is
1.
POST
/api/fleet/agent_policies/{agentPolicyId}/copy
curl \
--request POST 'http://api.example.com/api/fleet/agent_policies/{agentPolicyId}/copy' \
--header "Authorization: $API_KEY" \
--header "Content-Type: application/json" \
--header "kbn-xsrf: true" \
--data '{"description":"string","name":"string"}'
Request examples
# Headers
kbn-xsrf: true
# Payload
{
"description": "string",
"name": "string"
}
Response examples (200)
{
"item": {
"advanced_settings": {},
"agent_features": [
{
"enabled": true,
"name": "string"
}
],
"agentless": {
"resources": {
"requests": {
"cpu": "string",
"memory": "string"
}
}
},
"agents": 42.0,
"data_output_id": "string",
"description": "string",
"download_source_id": "string",
"fleet_server_host_id": "string",
"global_data_tags": [
{
"name": "string",
"value": "string"
}
],
"has_fleet_server": true,
"id": "string",
"inactivity_timeout": 1209600,
"is_default": true,
"is_default_fleet_server": true,
"is_managed": true,
"is_preconfigured": true,
"is_protected": true,
"keep_monitoring_alive": false,
"monitoring_diagnostics": {
"limit": {
"burst": 42.0,
"interval": "string"
},
"uploader": {
"init_dur": "string",
"max_dur": "string",
"max_retries": 42.0
}
},
"monitoring_enabled": [
"logs"
],
"monitoring_http": {
"buffer": {
"enabled": false
},
"enabled": true,
"host": "string",
"port": 42.0
},
"monitoring_output_id": "string",
"monitoring_pprof_enabled": true,
"name": "string",
"namespace": "string",
"overrides": {},
"package_policies": [
"string"
],
"required_versions": [
{
"percentage": 42.0,
"version": "string"
}
],
"revision": 42.0,
"schema_version": "string",
"space_ids": [
"string"
],
"status": "active",
"supports_agentless": false,
"unenroll_timeout": 42.0,
"unprivileged_agents": 42.0,
"updated_at": "string",
"updated_by": "string",
"version": "string"
}
}
Response examples (400)
{
"error": "string",
"errorType": "string",
"message": "string",
"statusCode": 42.0
}Download an agent policy
Download an agent policy by ID.
[Required authorization] Route required privileges: fleet-agent-policies-read AND fleet-setup.
Path parameters
-
agentPolicyId
string Required
Query parameters
-
download
boolean -
standalone
boolean -
kubernetes
boolean
GET
/api/fleet/agent_policies/{agentPolicyId}/download
curl \
--request GET 'http://api.example.com/api/fleet/agent_policies/{agentPolicyId}/download' \
--header "Authorization: $API_KEY"
Response examples (200)
string
Response examples (400)
{
"error": "string",
"errorType": "string",
"message": "string",
"statusCode": 42.0
}
Response examples (404)
{
"error": "string",
"errorType": "string",
"message": "string",
"statusCode": 42.0
}Get a full agent policy
Get a full agent policy by ID.
[Required authorization] Route required privileges: fleet-agent-policies-read.
Path parameters
-
agentPolicyId
string Required
Query parameters
-
download
boolean -
standalone
boolean -
kubernetes
boolean
GET
/api/fleet/agent_policies/{agentPolicyId}/full
curl \
--request GET 'http://api.example.com/api/fleet/agent_policies/{agentPolicyId}/full' \
--header "Authorization: $API_KEY"
Response examples (200)
{
"item": "string"
}
Response examples (400)
{
"error": "string",
"errorType": "string",
"message": "string",
"statusCode": 42.0
}Get outputs for an agent policy
Get a list of outputs associated with agent policy by policy id.
[Required authorization] Route required privileges: fleet-agent-policies-read AND fleet-settings-read.
Path parameters
-
agentPolicyId
string Required
GET
/api/fleet/agent_policies/{agentPolicyId}/outputs
curl \
--request GET 'http://api.example.com/api/fleet/agent_policies/{agentPolicyId}/outputs' \
--header "Authorization: $API_KEY"
Response examples (200)
{
"item": {
"agentPolicyId": "string",
"data": {
"integrations": [
{
"id": "string",
"integrationPolicyName": "string",
"name": "string",
"pkgName": "string"
}
],
"output": {
"id": "string",
"name": "string"
}
},
"monitoring": {
"output": {
"id": "string",
"name": "string"
}
}
}
}
Response examples (400)
{
"error": "string",
"errorType": "string",
"message": "string",
"statusCode": 42.0
}Delete an agent policy
Delete an agent policy by ID.
[Required authorization] Route required privileges: fleet-agent-policies-all.
Body
-
agentPolicyId
string Required -
force
boolean bypass validation checks that can prevent agent policy deletion
POST
/api/fleet/agent_policies/delete
curl \
--request POST 'http://api.example.com/api/fleet/agent_policies/delete' \
--header "Authorization: $API_KEY" \
--header "Content-Type: application/json" \
--header "kbn-xsrf: true" \
--data '{"agentPolicyId":"string","force":true}'
Request examples
# Headers
kbn-xsrf: true
# Payload
{
"agentPolicyId": "string",
"force": true
}
Response examples (200)
{
"id": "string",
"name": "string"
}
Response examples (400)
{
"error": "string",
"errorType": "string",
"message": "string",
"statusCode": 42.0
}Get outputs for agent policies
Get a list of outputs associated with agent policies.
[Required authorization] Route required privileges: fleet-agent-policies-read AND fleet-settings-read.
POST
/api/fleet/agent_policies/outputs
curl \
--request POST 'http://api.example.com/api/fleet/agent_policies/outputs' \
--header "Authorization: $API_KEY" \
--header "Content-Type: application/json" \
--header "kbn-xsrf: true" \
--data '{"ids":["string"]}'
Request examples
# Headers
kbn-xsrf: true
# Payload
{
"ids": [
"string"
]
}
Response examples (200)
{
"items": [
{
"agentPolicyId": "string",
"data": {
"integrations": [
{
"id": "string",
"integrationPolicyName": "string",
"name": "string",
"pkgName": "string"
}
],
"output": {
"id": "string",
"name": "string"
}
},
"monitoring": {
"output": {
"id": "string",
"name": "string"
}
}
}
]
}
Response examples (400)
{
"error": "string",
"errorType": "string",
"message": "string",
"statusCode": 42.0
}Get a full K8s agent manifest
[Required authorization] Route required privileges: fleet-agent-policies-read AND fleet-setup.
Query parameters
-
download
boolean -
fleetServer
string -
enrolToken
string
GET
/api/fleet/kubernetes
curl \
--request GET 'http://api.example.com/api/fleet/kubernetes' \
--header "Authorization: $API_KEY"
Response examples (200)
{
"item": "string"
}
Response examples (400)
{
"error": "string",
"errorType": "string",
"message": "string",
"statusCode": 42.0
}Download an agent manifest
[Required authorization] Route required privileges: fleet-agent-policies-read AND fleet-setup.
Query parameters
-
download
boolean -
fleetServer
string -
enrolToken
string
GET
/api/fleet/kubernetes/download
curl \
--request GET 'http://api.example.com/api/fleet/kubernetes/download' \
--header "Authorization: $API_KEY"
Response examples (200)
string
Response examples (400)
{
"error": "string",
"errorType": "string",
"message": "string",
"statusCode": 42.0
}
Response examples (404)
{
"error": "string",
"errorType": "string",
"message": "string",
"statusCode": 42.0
}
GET
/api/fleet/agent_status
curl \
--request GET 'http://api.example.com/api/fleet/agent_status' \
--header "Authorization: $API_KEY"
Response examples (200)
{
"results": {
"active": 42.0,
"all": 42.0,
"error": 42.0,
"events": 42.0,
"inactive": 42.0,
"offline": 42.0,
"online": 42.0,
"orphaned": 42.0,
"other": 42.0,
"unenrolled": 42.0,
"uninstalled": 42.0,
"updating": 42.0
}
}
Response examples (400)
{
"error": "string",
"errorType": "string",
"message": "string",
"statusCode": 42.0
}Get incoming agent data
[Required authorization] Route required privileges: fleet-agents-read.
Query parameters
-
agentsIds
array[string] | string Required -
pkgName
string -
pkgVersion
string -
previewData
boolean Default value is
false.
GET
/api/fleet/agent_status/data
curl \
--request GET 'http://api.example.com/api/fleet/agent_status/data?agentsIds=string' \
--header "Authorization: $API_KEY"
Response examples (200)
{
"dataPreview": [],
"items": [
{
"additionalProperty1": {
"data": true
},
"additionalProperty2": {
"data": true
}
}
]
}
Response examples (400)
{
"error": "string",
"errorType": "string",
"message": "string",
"statusCode": 42.0
}Get agents
[Required authorization] Route required privileges: fleet-agents-read.
Query parameters
-
page
number -
perPage
number Default value is
20. -
kuery
string -
showInactive
boolean Default value is
false. -
withMetrics
boolean Default value is
false. -
showUpgradeable
boolean Default value is
false. -
getStatusSummary
boolean Default value is
false. -
sortField
string -
sortOrder
string Values are
ascordesc. -
searchAfter
string -
openPit
boolean -
pitId
string -
pitKeepAlive
string
GET
/api/fleet/agents
curl \
--request GET 'http://api.example.com/api/fleet/agents' \
--header "Authorization: $API_KEY"
Response examples (200)
{
"items": [
{
"access_api_key": "string",
"access_api_key_id": "string",
"active": true,
"agent": {
"id": "string",
"version": "string"
},
"audit_unenrolled_reason": "string",
"components": [
{
"id": "string",
"message": "string",
"status": "STARTING",
"type": "string",
"units": [
{
"id": "string",
"message": "string",
"payload": {},
"status": "STARTING",
"type": "input"
}
]
}
],
"default_api_key": "string",
"default_api_key_history": [
{
"id": "string",
"retired_at": "string"
}
],
"default_api_key_id": "string",
"enrolled_at": "string",
"id": "string",
"last_checkin": "string",
"last_checkin_message": "string",
"last_checkin_status": "error",
"local_metadata": {},
"metrics": {
"cpu_avg": 42.0,
"memory_size_byte_avg": 42.0
},
"namespaces": [
"string"
],
"outputs": {
"additionalProperty1": {
"api_key_id": "string",
"to_retire_api_key_ids": [
{
"id": "string",
"retired_at": "string"
}
],
"type": "string"
},
"additionalProperty2": {
"api_key_id": "string",
"to_retire_api_key_ids": [
{
"id": "string",
"retired_at": "string"
}
],
"type": "string"
}
},
"packages": [
"string"
],
"policy_id": "string",
"policy_revision": 42.0,
"sort": [],
"status": "offline",
"tags": [
"string"
],
"type": "PERMANENT",
"unenrolled_at": "string",
"unenrollment_started_at": "string",
"unhealthy_reason": [
"input"
],
"upgrade_attempts": [
"string"
],
"upgrade_details": {
"action_id": "string",
"metadata": {
"download_percent": 42.0,
"download_rate": 42.0,
"error_msg": "string",
"failed_state": "UPG_REQUESTED",
"retry_error_msg": "string",
"retry_until": "string",
"scheduled_at": "string"
},
"state": "UPG_REQUESTED",
"target_version": "string"
},
"upgrade_started_at": "string",
"upgraded_at": "string",
"user_provided_metadata": {}
}
],
"nextSearchAfter": "string",
"page": 42.0,
"perPage": 42.0,
"pit": "string",
"statusSummary": {
"additionalProperty1": 42.0,
"additionalProperty2": 42.0
},
"total": 42.0
}
Response examples (400)
{
"error": "string",
"errorType": "string",
"message": "string",
"statusCode": 42.0
}Get agents by action ids
[Required authorization] Route required privileges: fleet-agents-read.
POST
/api/fleet/agents
curl \
--request POST 'http://api.example.com/api/fleet/agents' \
--header "Authorization: $API_KEY" \
--header "Content-Type: application/json" \
--header "kbn-xsrf: true" \
--data '{"actionIds":["string"]}'
Request examples
# Headers
kbn-xsrf: true
# Payload
{
"actionIds": [
"string"
]
}
Response examples (200)
{
"items": [
"string"
]
}
Response examples (400)
{
"error": "string",
"errorType": "string",
"message": "string",
"statusCode": 42.0
}Get an agent
Get an agent by ID.
[Required authorization] Route required privileges: fleet-agents-read.
Path parameters
-
agentId
string Required
Query parameters
-
withMetrics
boolean Default value is
false.
GET
/api/fleet/agents/{agentId}
curl \
--request GET 'http://api.example.com/api/fleet/agents/{agentId}' \
--header "Authorization: $API_KEY"
Response examples (200)
{
"item": {
"access_api_key": "string",
"access_api_key_id": "string",
"active": true,
"agent": {
"id": "string",
"version": "string"
},
"audit_unenrolled_reason": "string",
"components": [
{
"id": "string",
"message": "string",
"status": "STARTING",
"type": "string",
"units": [
{
"id": "string",
"message": "string",
"payload": {},
"status": "STARTING",
"type": "input"
}
]
}
],
"default_api_key": "string",
"default_api_key_history": [
{
"id": "string",
"retired_at": "string"
}
],
"default_api_key_id": "string",
"enrolled_at": "string",
"id": "string",
"last_checkin": "string",
"last_checkin_message": "string",
"last_checkin_status": "error",
"local_metadata": {},
"metrics": {
"cpu_avg": 42.0,
"memory_size_byte_avg": 42.0
},
"namespaces": [
"string"
],
"outputs": {
"additionalProperty1": {
"api_key_id": "string",
"to_retire_api_key_ids": [
{
"id": "string",
"retired_at": "string"
}
],
"type": "string"
},
"additionalProperty2": {
"api_key_id": "string",
"to_retire_api_key_ids": [
{
"id": "string",
"retired_at": "string"
}
],
"type": "string"
}
},
"packages": [
"string"
],
"policy_id": "string",
"policy_revision": 42.0,
"sort": [],
"status": "offline",
"tags": [
"string"
],
"type": "PERMANENT",
"unenrolled_at": "string",
"unenrollment_started_at": "string",
"unhealthy_reason": [
"input"
],
"upgrade_attempts": [
"string"
],
"upgrade_details": {
"action_id": "string",
"metadata": {
"download_percent": 42.0,
"download_rate": 42.0,
"error_msg": "string",
"failed_state": "UPG_REQUESTED",
"retry_error_msg": "string",
"retry_until": "string",
"scheduled_at": "string"
},
"state": "UPG_REQUESTED",
"target_version": "string"
},
"upgrade_started_at": "string",
"upgraded_at": "string",
"user_provided_metadata": {}
}
}
Response examples (400)
{
"error": "string",
"errorType": "string",
"message": "string",
"statusCode": 42.0
}Update an agent
Update an agent by ID.
[Required authorization] Route required privileges: fleet-agents-all.
Path parameters
-
agentId
string Required
Body
-
user_provided_metadata
object Additional properties are allowed.
PUT
/api/fleet/agents/{agentId}
curl \
--request PUT 'http://api.example.com/api/fleet/agents/{agentId}' \
--header "Authorization: $API_KEY" \
--header "Content-Type: application/json" \
--header "kbn-xsrf: true" \
--data '{"tags":["string"],"user_provided_metadata":{}}'
Request examples
# Headers
kbn-xsrf: true
# Payload
{
"tags": [
"string"
],
"user_provided_metadata": {}
}
Response examples (200)
{
"item": {
"access_api_key": "string",
"access_api_key_id": "string",
"active": true,
"agent": {
"id": "string",
"version": "string"
},
"audit_unenrolled_reason": "string",
"components": [
{
"id": "string",
"message": "string",
"status": "STARTING",
"type": "string",
"units": [
{
"id": "string",
"message": "string",
"payload": {},
"status": "STARTING",
"type": "input"
}
]
}
],
"default_api_key": "string",
"default_api_key_history": [
{
"id": "string",
"retired_at": "string"
}
],
"default_api_key_id": "string",
"enrolled_at": "string",
"id": "string",
"last_checkin": "string",
"last_checkin_message": "string",
"last_checkin_status": "error",
"local_metadata": {},
"metrics": {
"cpu_avg": 42.0,
"memory_size_byte_avg": 42.0
},
"namespaces": [
"string"
],
"outputs": {
"additionalProperty1": {
"api_key_id": "string",
"to_retire_api_key_ids": [
{
"id": "string",
"retired_at": "string"
}
],
"type": "string"
},
"additionalProperty2": {
"api_key_id": "string",
"to_retire_api_key_ids": [
{
"id": "string",
"retired_at": "string"
}
],
"type": "string"
}
},
"packages": [
"string"
],
"policy_id": "string",
"policy_revision": 42.0,
"sort": [],
"status": "offline",
"tags": [
"string"
],
"type": "PERMANENT",
"unenrolled_at": "string",
"unenrollment_started_at": "string",
"unhealthy_reason": [
"input"
],
"upgrade_attempts": [
"string"
],
"upgrade_details": {
"action_id": "string",
"metadata": {
"download_percent": 42.0,
"download_rate": 42.0,
"error_msg": "string",
"failed_state": "UPG_REQUESTED",
"retry_error_msg": "string",
"retry_until": "string",
"scheduled_at": "string"
},
"state": "UPG_REQUESTED",
"target_version": "string"
},
"upgrade_started_at": "string",
"upgraded_at": "string",
"user_provided_metadata": {}
}
}
Response examples (400)
{
"error": "string",
"errorType": "string",
"message": "string",
"statusCode": 42.0
}Delete an agent
Delete an agent by ID.
[Required authorization] Route required privileges: fleet-agents-all.
Path parameters
-
agentId
string Required
DELETE
/api/fleet/agents/{agentId}
curl \
--request DELETE 'http://api.example.com/api/fleet/agents/{agentId}' \
--header "Authorization: $API_KEY" \
--header "kbn-xsrf: true"
Response examples (200)
{
"action": "deleted"
}
Response examples (400)
{
"error": "string",
"errorType": "string",
"message": "string",
"statusCode": 42.0
}Get agent uploads
[Required authorization] Route required privileges: fleet-agents-read.
Path parameters
-
agentId
string Required
GET
/api/fleet/agents/{agentId}/uploads
curl \
--request GET 'http://api.example.com/api/fleet/agents/{agentId}/uploads' \
--header "Authorization: $API_KEY"
Response examples (200)
{
"items": [
{
"actionId": "string",
"createTime": "string",
"error": "string",
"filePath": "string",
"id": "string",
"name": "string",
"status": "READY"
}
]
}
Response examples (400)
{
"error": "string",
"errorType": "string",
"message": "string",
"statusCode": 42.0
}Get available agent versions
[Required authorization] Route required privileges: fleet-agents-read.
GET
/api/fleet/agents/available_versions
curl \
--request GET 'http://api.example.com/api/fleet/agents/available_versions' \
--header "Authorization: $API_KEY"
Response examples (200)
{
"items": [
"string"
]
}
Response examples (400)
{
"error": "string",
"errorType": "string",
"message": "string",
"statusCode": 42.0
}Delete an uploaded file
Delete a file uploaded by an agent.
[Required authorization] Route required privileges: fleet-agents-all.
Path parameters
-
fileId
string Required
DELETE
/api/fleet/agents/files/{fileId}
curl \
--request DELETE 'http://api.example.com/api/fleet/agents/files/{fileId}' \
--header "Authorization: $API_KEY" \
--header "kbn-xsrf: true"
Response examples (200)
{
"deleted": true,
"id": "string"
}
Response examples (400)
{
"error": "string",
"errorType": "string",
"message": "string",
"statusCode": 42.0
}Get an uploaded file
Get a file uploaded by an agent.
[Required authorization] Route required privileges: fleet-agents-read.
GET
/api/fleet/agents/files/{fileId}/{fileName}
curl \
--request GET 'http://api.example.com/api/fleet/agents/files/{fileId}/{fileName}' \
--header "Authorization: $API_KEY"
Response examples (200)
{}
Response examples (400)
{
"error": "string",
"errorType": "string",
"message": "string",
"statusCode": 42.0
}Get agent setup info
[Required authorization] Route required privileges: fleet-agents-read OR fleet-agent-policies-read OR fleet-settings-read OR fleet-setup.
GET
/api/fleet/agents/setup
curl \
--request GET 'http://api.example.com/api/fleet/agents/setup' \
--header "Authorization: $API_KEY"
Response examples (200)
{
"is_secrets_storage_enabled": true,
"is_space_awareness_enabled": true,
"isReady": true,
"missing_optional_features": [
"encrypted_saved_object_encryption_key_required"
],
"missing_requirements": [
"security_required"
],
"package_verification_key_id": "string"
}
Response examples (400)
{
"error": "string",
"errorType": "string",
"message": "string",
"statusCode": 42.0
}Initiate agent setup
[Required authorization] Route required privileges: fleet-agents-read OR fleet-agent-policies-read OR fleet-settings-read OR fleet-setup.
POST
/api/fleet/agents/setup
curl \
--request POST 'http://api.example.com/api/fleet/agents/setup' \
--header "Authorization: $API_KEY" \
--header "kbn-xsrf: true"
Response examples (200)
{
"isInitialized": true,
"nonFatalErrors": [
{
"message": "string",
"name": "string"
}
]
}
Response examples (400)
{
"error": "string",
"errorType": "string",
"message": "string",
"statusCode": 42.0
}Get agent tags
[Required authorization] Route required privileges: fleet-agents-read.
GET
/api/fleet/agents/tags
curl \
--request GET 'http://api.example.com/api/fleet/agents/tags' \
--header "Authorization: $API_KEY"
Response examples (200)
{
"items": [
"string"
]
}
Response examples (400)
{
"error": "string",
"errorType": "string",
"message": "string",
"statusCode": 42.0
}Bulk get assets
[Required authorization] Route required privileges: integrations-read OR fleet-setup OR fleet-all.
POST
/api/fleet/epm/bulk_assets
curl \
--request POST 'http://api.example.com/api/fleet/epm/bulk_assets' \
--header "Authorization: $API_KEY" \
--header "Content-Type: application/json" \
--header "kbn-xsrf: true" \
--data '{"assetIds":[{"id":"string","type":"string"}]}'
Request examples
# Headers
kbn-xsrf: true
# Payload
{
"assetIds": [
{
"id": "string",
"type": "string"
}
]
}
Response examples (200)
{
"items": [
{
"appLink": "string",
"attributes": {
"description": "string",
"service": "string",
"title": "string"
},
"id": "string",
"type": "string",
"updatedAt": "string"
}
]
}
Response examples (400)
{
"error": "string",
"errorType": "string",
"message": "string",
"statusCode": 42.0
}Get package categories
[Required authorization] Route required privileges: integrations-read OR fleet-setup OR fleet-all.
Query parameters
-
prerelease
boolean -
include_policy_templates
boolean
GET
/api/fleet/epm/categories
curl \
--request GET 'http://api.example.com/api/fleet/epm/categories' \
--header "Authorization: $API_KEY"
Response examples (200)
{
"items": [
{
"count": 42.0,
"id": "string",
"parent_id": "string",
"parent_title": "string",
"title": "string"
}
]
}
Response examples (400)
{
"error": "string",
"errorType": "string",
"message": "string",
"statusCode": 42.0
}Create a custom integration
[Required authorization] Route required privileges: integrations-all AND fleet-agent-policies-all.
Body
-
datasets
array[object] Required -
force
boolean -
integrationName
string Required
POST
/api/fleet/epm/custom_integrations
curl \
--request POST 'http://api.example.com/api/fleet/epm/custom_integrations' \
--header "Authorization: $API_KEY" \
--header "Content-Type: application/json" \
--header "kbn-xsrf: true" \
--data '{"datasets":[{"name":"string","type":"logs"}],"force":true,"integrationName":"string"}'
Request examples
# Headers
kbn-xsrf: true
# Payload
{
"datasets": [
{
"name": "string",
"type": "logs"
}
],
"force": true,
"integrationName": "string"
}
Response examples (200)
{
"_meta": {
"install_source": "string"
},
"items": [
{
"id": "string",
"originId": "string",
"type": "dashboard"
}
]
}
Response examples (400)
{
"error": "string",
"errorType": "string",
"message": "string",
"statusCode": 42.0
}Get packages
[Required authorization] Route required privileges: integrations-read OR fleet-setup OR fleet-all.
Query parameters
-
category
string -
prerelease
boolean -
excludeInstallStatus
boolean -
withPackagePoliciesCount
boolean
GET
/api/fleet/epm/packages
curl \
--request GET 'http://api.example.com/api/fleet/epm/packages' \
--header "Authorization: $API_KEY"
Response examples (200)
{
"items": [
{
"categories": [
"string"
],
"conditions": {
"elastic": {
"capabilities": [
"string"
],
"subscription": "string"
},
"kibana": {
"version": "string"
}
},
"data_streams": [
{}
],
"description": "string",
"discovery": {
"fields": [
{
"name": "string"
}
]
},
"download": "string",
"format_version": "string",
"icons": [
{
"dark_mode": true,
"path": "string",
"size": "string",
"src": "string",
"title": "string",
"type": "string"
}
],
"id": "string",
"installationInfo": {
"additional_spaces_installed_kibana": {
"additionalProperty1": [
{
"id": "string",
"originId": "string",
"type": "dashboard"
}
],
"additionalProperty2": [
{
"id": "string",
"originId": "string",
"type": "dashboard"
}
]
},
"created_at": "string",
"experimental_data_stream_features": [
{
"data_stream": "string",
"features": {
"doc_value_only_numeric": true,
"doc_value_only_other": true,
"synthetic_source": true,
"tsdb": true
}
}
],
"install_format_schema_version": "string",
"install_source": "registry",
"install_status": "installed",
"installed_es": [
{
"deferred": true,
"id": "string",
"type": "index",
"version": "string"
}
],
"installed_kibana": [
{
"id": "string",
"originId": "string",
"type": "dashboard"
}
],
"installed_kibana_space_id": "string",
"latest_executed_state": {
"error": "string",
"name": "string",
"started_at": "string"
},
"latest_install_failed_attempts": [
{
"created_at": "string",
"error": {
"message": "string",
"name": "string",
"stack": "string"
},
"target_version": "string"
}
],
"name": "string",
"namespaces": [
"string"
],
"type": "string",
"updated_at": "string",
"verification_key_id": "string",
"verification_status": "unverified",
"version": "string"
},
"integration": "string",
"internal": true,
"latestVersion": "string",
"name": "string",
"owner": {
"github": "string",
"type": "elastic"
},
"path": "string",
"policy_templates": [
{}
],
"readme": "string",
"release": "ga",
"signature_path": "string",
"source": {
"license": "string"
},
"status": "string",
"title": "string",
"type": "integration",
"vars": [
{}
],
"version": "string"
}
]
}
Response examples (400)
{
"error": "string",
"errorType": "string",
"message": "string",
"statusCode": 42.0
}Install a package by upload
[Required authorization] Route required privileges: integrations-all AND fleet-agent-policies-all.
Query parameters
-
ignoreMappingUpdateErrors
boolean Default value is
false. -
skipDataStreamRollover
boolean Default value is
false.
Body
string(binary)
string(binary)
POST
/api/fleet/epm/packages
curl \
--request POST 'http://api.example.com/api/fleet/epm/packages' \
--header "Authorization: $API_KEY" \
--header "Content-Type: application/gzip; application/zip" \
--header "kbn-xsrf: true" \
--data-binary '@file'Bulk install packages
[Required authorization] Route required privileges: integrations-all AND fleet-agent-policies-all.
Query parameters
-
prerelease
boolean
POST
/api/fleet/epm/packages/_bulk
curl \
--request POST 'http://api.example.com/api/fleet/epm/packages/_bulk' \
--header "Authorization: $API_KEY" \
--header "Content-Type: application/json" \
--header "kbn-xsrf: true" \
--data '{"force":false,"packages":["string"]}'
Request examples
# Headers
kbn-xsrf: true
# Payload
{
"force": false,
"packages": [
"string"
]
}
Response examples (200)
{
"items": [
{
"name": "string",
"result": {
"assets": [
{
"id": "string",
"originId": "string",
"type": "dashboard"
}
],
"installSource": "string",
"installType": "string",
"status": "installed"
},
"version": "string"
}
]
}
Response examples (400)
{
"error": "string",
"errorType": "string",
"message": "string",
"statusCode": 42.0
}Path parameters
-
pkgName
string Required -
pkgVersion
string
Query parameters
-
ignoreUnverified
boolean -
prerelease
boolean -
full
boolean -
withMetadata
boolean Default value is
false.
GET
/api/fleet/epm/packages/{pkgName}/{pkgVersion}
curl \
--request GET 'http://api.example.com/api/fleet/epm/packages/{pkgName}/{pkgVersion}' \
--header "Authorization: $API_KEY"
Response examples (200)
{
"item": {
"agent": {
"privileges": {
"root": true
}
},
"asset_tags": [
{
"asset_ids": [
"string"
],
"asset_types": [
"string"
],
"text": "string"
}
],
"assets": {},
"categories": [
"string"
],
"conditions": {
"elastic": {
"capabilities": [
"string"
],
"subscription": "string"
},
"kibana": {
"version": "string"
}
},
"data_streams": [
{}
],
"description": "string",
"discovery": {
"fields": [
{
"name": "string"
}
]
},
"download": "string",
"elasticsearch": {},
"format_version": "string",
"icons": [
{
"dark_mode": true,
"path": "string",
"size": "string",
"src": "string",
"title": "string",
"type": "string"
}
],
"installationInfo": {
"additional_spaces_installed_kibana": {
"additionalProperty1": [
{
"id": "string",
"originId": "string",
"type": "dashboard"
}
],
"additionalProperty2": [
{
"id": "string",
"originId": "string",
"type": "dashboard"
}
]
},
"created_at": "string",
"experimental_data_stream_features": [
{
"data_stream": "string",
"features": {
"doc_value_only_numeric": true,
"doc_value_only_other": true,
"synthetic_source": true,
"tsdb": true
}
}
],
"install_format_schema_version": "string",
"install_source": "registry",
"install_status": "installed",
"installed_es": [
{
"deferred": true,
"id": "string",
"type": "index",
"version": "string"
}
],
"installed_kibana": [
{
"id": "string",
"originId": "string",
"type": "dashboard"
}
],
"installed_kibana_space_id": "string",
"latest_executed_state": {
"error": "string",
"name": "string",
"started_at": "string"
},
"latest_install_failed_attempts": [
{
"created_at": "string",
"error": {
"message": "string",
"name": "string",
"stack": "string"
},
"target_version": "string"
}
],
"name": "string",
"namespaces": [
"string"
],
"type": "string",
"updated_at": "string",
"verification_key_id": "string",
"verification_status": "unverified",
"version": "string"
},
"internal": true,
"keepPoliciesUpToDate": true,
"latestVersion": "string",
"license": "string",
"licensePath": "string",
"name": "string",
"notice": "string",
"owner": {
"github": "string",
"type": "elastic"
},
"path": "string",
"policy_templates": [
{}
],
"readme": "string",
"release": "ga",
"screenshots": [
{
"dark_mode": true,
"path": "string",
"size": "string",
"src": "string",
"title": "string",
"type": "string"
}
],
"signature_path": "string",
"source": {
"license": "string"
},
"status": "string",
"title": "string",
"type": "integration",
"vars": [
{}
],
"version": "string"
},
"metadata": {
"has_policies": true
}
}
Response examples (400)
{
"error": "string",
"errorType": "string",
"message": "string",
"statusCode": 42.0
}Update package settings
[Required authorization] Route required privileges: integrations-all AND fleet-agent-policies-all.
Path parameters
-
pkgName
string Required -
pkgVersion
string
Body
-
keepPoliciesUpToDate
boolean Required
PUT
/api/fleet/epm/packages/{pkgName}/{pkgVersion}
curl \
--request PUT 'http://api.example.com/api/fleet/epm/packages/{pkgName}/{pkgVersion}' \
--header "Authorization: $API_KEY" \
--header "Content-Type: application/json" \
--header "kbn-xsrf: true" \
--data '{"keepPoliciesUpToDate":true}'
Request examples
# Headers
kbn-xsrf: true
# Payload
{
"keepPoliciesUpToDate": true
}
Response examples (200)
{
"item": {
"agent": {
"privileges": {
"root": true
}
},
"asset_tags": [
{
"asset_ids": [
"string"
],
"asset_types": [
"string"
],
"text": "string"
}
],
"assets": {},
"categories": [
"string"
],
"conditions": {
"elastic": {
"capabilities": [
"string"
],
"subscription": "string"
},
"kibana": {
"version": "string"
}
},
"data_streams": [
{}
],
"description": "string",
"discovery": {
"fields": [
{
"name": "string"
}
]
},
"download": "string",
"elasticsearch": {},
"format_version": "string",
"icons": [
{
"dark_mode": true,
"path": "string",
"size": "string",
"src": "string",
"title": "string",
"type": "string"
}
],
"installationInfo": {
"additional_spaces_installed_kibana": {
"additionalProperty1": [
{
"id": "string",
"originId": "string",
"type": "dashboard"
}
],
"additionalProperty2": [
{
"id": "string",
"originId": "string",
"type": "dashboard"
}
]
},
"created_at": "string",
"experimental_data_stream_features": [
{
"data_stream": "string",
"features": {
"doc_value_only_numeric": true,
"doc_value_only_other": true,
"synthetic_source": true,
"tsdb": true
}
}
],
"install_format_schema_version": "string",
"install_source": "registry",
"install_status": "installed",
"installed_es": [
{
"deferred": true,
"id": "string",
"type": "index",
"version": "string"
}
],
"installed_kibana": [
{
"id": "string",
"originId": "string",
"type": "dashboard"
}
],
"installed_kibana_space_id": "string",
"latest_executed_state": {
"error": "string",
"name": "string",
"started_at": "string"
},
"latest_install_failed_attempts": [
{
"created_at": "string",
"error": {
"message": "string",
"name": "string",
"stack": "string"
},
"target_version": "string"
}
],
"name": "string",
"namespaces": [
"string"
],
"type": "string",
"updated_at": "string",
"verification_key_id": "string",
"verification_status": "unverified",
"version": "string"
},
"internal": true,
"keepPoliciesUpToDate": true,
"latestVersion": "string",
"license": "string",
"licensePath": "string",
"name": "string",
"notice": "string",
"owner": {
"github": "string",
"type": "elastic"
},
"path": "string",
"policy_templates": [
{}
],
"readme": "string",
"release": "ga",
"screenshots": [
{
"dark_mode": true,
"path": "string",
"size": "string",
"src": "string",
"title": "string",
"type": "string"
}
],
"signature_path": "string",
"source": {
"license": "string"
},
"status": "string",
"title": "string",
"type": "integration",
"vars": [
{}
],
"version": "string"
}
}
Response examples (400)
{
"error": "string",
"errorType": "string",
"message": "string",
"statusCode": 42.0
}Install a package from the registry
[Required authorization] Route required privileges: integrations-all AND fleet-agent-policies-all.
Path parameters
-
pkgName
string Required -
pkgVersion
string
Query parameters
-
prerelease
boolean -
ignoreMappingUpdateErrors
boolean Default value is
false. -
skipDataStreamRollover
boolean Default value is
false.
Body
-
force
boolean Default value is
false. -
ignore_constraints
boolean Default value is
false.
POST
/api/fleet/epm/packages/{pkgName}/{pkgVersion}
curl \
--request POST 'http://api.example.com/api/fleet/epm/packages/{pkgName}/{pkgVersion}' \
--header "Authorization: $API_KEY" \
--header "Content-Type: application/json" \
--header "kbn-xsrf: true" \
--data '{"force":false,"ignore_constraints":false}'
Request examples
# Headers
kbn-xsrf: true
# Payload
{
"force": false,
"ignore_constraints": false
}
Response examples (200)
{
"_meta": {
"install_source": "string"
},
"items": [
{
"id": "string",
"originId": "string",
"type": "dashboard"
}
]
}
Response examples (400)
{
"error": "string",
"errorType": "string",
"message": "string",
"statusCode": 42.0
}Delete a package
[Required authorization] Route required privileges: integrations-all AND fleet-agent-policies-all.
Path parameters
-
pkgName
string Required -
pkgVersion
string
Query parameters
-
force
boolean
DELETE
/api/fleet/epm/packages/{pkgName}/{pkgVersion}
curl \
--request DELETE 'http://api.example.com/api/fleet/epm/packages/{pkgName}/{pkgVersion}' \
--header "Authorization: $API_KEY" \
--header "kbn-xsrf: true"
Response examples (200)
{
"items": [
{
"id": "string",
"originId": "string",
"type": "dashboard"
}
]
}
Response examples (400)
{
"error": "string",
"errorType": "string",
"message": "string",
"statusCode": 42.0
}Get a package file
[Required authorization] Route required privileges: integrations-read OR fleet-setup OR fleet-all.
Path parameters
-
pkgName
string Required -
pkgVersion
string Required -
filePath
string Required
GET
/api/fleet/epm/packages/{pkgName}/{pkgVersion}/{filePath}
curl \
--request GET 'http://api.example.com/api/fleet/epm/packages/{pkgName}/{pkgVersion}/{filePath}' \
--header "Authorization: $API_KEY"
Response examples (400)
{
"error": "string",
"errorType": "string",
"message": "string",
"statusCode": 42.0
}Install Kibana assets for a package
[Required authorization] Route required privileges: integrations-all AND fleet-agent-policies-all.
Path parameters
-
pkgName
string Required -
pkgVersion
string Required
POST
/api/fleet/epm/packages/{pkgName}/{pkgVersion}/kibana_assets
curl \
--request POST 'http://api.example.com/api/fleet/epm/packages/{pkgName}/{pkgVersion}/kibana_assets' \
--header "Authorization: $API_KEY" \
--header "Content-Type: application/json" \
--header "kbn-xsrf: true" \
--data '{"force":true,"space_ids":["string"]}'
Request examples
# Headers
kbn-xsrf: true
# Payload
{
"force": true,
"space_ids": [
"string"
]
}
Response examples (200)
{
"success": true
}
Response examples (400)
{
"error": "string",
"errorType": "string",
"message": "string",
"statusCode": 42.0
}Delete Kibana assets for a package
[Required authorization] Route required privileges: integrations-all AND fleet-agent-policies-all.
Path parameters
-
pkgName
string Required -
pkgVersion
string Required
DELETE
/api/fleet/epm/packages/{pkgName}/{pkgVersion}/kibana_assets
curl \
--request DELETE 'http://api.example.com/api/fleet/epm/packages/{pkgName}/{pkgVersion}/kibana_assets' \
--header "Authorization: $API_KEY" \
--header "kbn-xsrf: true"
Response examples (200)
{
"success": true
}
Response examples (400)
{
"error": "string",
"errorType": "string",
"message": "string",
"statusCode": 42.0
}Authorize transforms
POST
/api/fleet/epm/packages/{pkgName}/{pkgVersion}/transforms/authorize
curl \
--request POST 'http://api.example.com/api/fleet/epm/packages/{pkgName}/{pkgVersion}/transforms/authorize' \
--header "Authorization: $API_KEY" \
--header "Content-Type: application/json" \
--header "kbn-xsrf: true" \
--data '{"transforms":[{"transformId":"string"}]}'
Request examples
# Headers
kbn-xsrf: true
# Payload
{
"transforms": [
{
"transformId": "string"
}
]
}
Response examples (200)
[
{
"success": true,
"transformId": "string"
}
]
Response examples (400)
{
"error": "string",
"errorType": "string",
"message": "string",
"statusCode": 42.0
}Get package stats
[Required authorization] Route required privileges: integrations-read OR fleet-setup OR fleet-all.
Path parameters
-
pkgName
string Required
GET
/api/fleet/epm/packages/{pkgName}/stats
curl \
--request GET 'http://api.example.com/api/fleet/epm/packages/{pkgName}/stats' \
--header "Authorization: $API_KEY"
Response examples (200)
{
"response": {
"agent_policy_count": 42.0
}
}
Response examples (400)
{
"error": "string",
"errorType": "string",
"message": "string",
"statusCode": 42.0
}Get installed packages
[Required authorization] Route required privileges: integrations-read OR fleet-setup OR fleet-all.
Query parameters
-
dataStreamType
string Values are
logs,metrics,traces,synthetics, orprofiling. -
showOnlyActiveDataStreams
boolean -
nameQuery
string -
searchAfter
array[string | number] -
perPage
number Default value is
15. -
sortOrder
string Values are
ascordesc. Default value isasc.
GET
/api/fleet/epm/packages/installed
curl \
--request GET 'http://api.example.com/api/fleet/epm/packages/installed' \
--header "Authorization: $API_KEY"
Response examples (200)
{
"items": [
{
"dataStreams": [
{
"name": "string",
"title": "string"
}
],
"description": "string",
"icons": [
{
"dark_mode": true,
"path": "string",
"size": "string",
"src": "string",
"title": "string",
"type": "string"
}
],
"name": "string",
"status": "string",
"title": "string",
"version": "string"
}
],
"searchAfter": [
"string"
],
"total": 42.0
}
Response examples (400)
{
"error": "string",
"errorType": "string",
"message": "string",
"statusCode": 42.0
}Get a limited package list
[Required authorization] Route required privileges: integrations-read OR fleet-setup OR fleet-all.
GET
/api/fleet/epm/packages/limited
curl \
--request GET 'http://api.example.com/api/fleet/epm/packages/limited' \
--header "Authorization: $API_KEY"
Response examples (200)
{
"items": [
"string"
]
}
Response examples (400)
{
"error": "string",
"errorType": "string",
"message": "string",
"statusCode": 42.0
}Get an inputs template
[Required authorization] Route required privileges: integrations-read OR fleet-setup OR fleet-all.
Path parameters
-
pkgName
string Required -
pkgVersion
string Required
Query parameters
-
format
string Values are
json,yml, oryaml. Default value isjson. -
prerelease
boolean -
ignoreUnverified
boolean
GET
/api/fleet/epm/templates/{pkgName}/{pkgVersion}/inputs
curl \
--request GET 'http://api.example.com/api/fleet/epm/templates/{pkgName}/{pkgVersion}/inputs' \
--header "Authorization: $API_KEY"
Response examples (200)
String-1
string{
"inputs": [
{
"id": "string",
"streams": [
{
"data_stream": {
"dataset": "string",
"type": "string"
},
"id": "string"
}
],
"type": "string"
}
]
}
Response examples (400)
{
"error": "string",
"errorType": "string",
"message": "string",
"statusCode": 42.0
}Get a package signature verification key ID
[Required authorization] Route required privileges: integrations-read OR fleet-setup OR fleet-all.
GET
/api/fleet/epm/verification_key_id
curl \
--request GET 'http://api.example.com/api/fleet/epm/verification_key_id' \
--header "Authorization: $API_KEY"
Response examples (200)
{
"id": "string"
}
Response examples (400)
{
"error": "string",
"errorType": "string",
"message": "string",
"statusCode": 42.0
}Get enrollment API keys
[Required authorization] Route required privileges: fleet-agents-all OR fleet-setup.
GET
/api/fleet/enrollment_api_keys
curl \
--request GET 'http://api.example.com/api/fleet/enrollment_api_keys' \
--header "Authorization: $API_KEY"
Response examples (200)
{
"items": [
{
"active": true,
"api_key": "string",
"api_key_id": "string",
"created_at": "string",
"id": "string",
"name": "string",
"policy_id": "string"
}
],
"list": [
{
"active": true,
"api_key": "string",
"api_key_id": "string",
"created_at": "string",
"id": "string",
"name": "string",
"policy_id": "string"
}
],
"page": 42.0,
"perPage": 42.0,
"total": 42.0
}
Response examples (400)
{
"error": "string",
"errorType": "string",
"message": "string",
"statusCode": 42.0
}Create an enrollment API key
[Required authorization] Route required privileges: fleet-agents-all.
Body
-
expiration
string -
name
string -
policy_id
string Required
POST
/api/fleet/enrollment_api_keys
curl \
--request POST 'http://api.example.com/api/fleet/enrollment_api_keys' \
--header "Authorization: $API_KEY" \
--header "Content-Type: application/json" \
--header "kbn-xsrf: true" \
--data '{"expiration":"string","name":"string","policy_id":"string"}'
Request examples
# Headers
kbn-xsrf: true
# Payload
{
"expiration": "string",
"name": "string",
"policy_id": "string"
}
Response examples (200)
{
"action": "created",
"item": {
"active": true,
"api_key": "string",
"api_key_id": "string",
"created_at": "string",
"id": "string",
"name": "string",
"policy_id": "string"
}
}
Response examples (400)
{
"error": "string",
"errorType": "string",
"message": "string",
"statusCode": 42.0
}Get an enrollment API key
Get an enrollment API key by ID.
[Required authorization] Route required privileges: fleet-agents-all OR fleet-setup.
Path parameters
-
keyId
string Required
GET
/api/fleet/enrollment_api_keys/{keyId}
curl \
--request GET 'http://api.example.com/api/fleet/enrollment_api_keys/{keyId}' \
--header "Authorization: $API_KEY"
Response examples (200)
{
"item": {
"active": true,
"api_key": "string",
"api_key_id": "string",
"created_at": "string",
"id": "string",
"name": "string",
"policy_id": "string"
}
}
Response examples (400)
{
"error": "string",
"errorType": "string",
"message": "string",
"statusCode": 42.0
}Revoke an enrollment API key
Revoke an enrollment API key by ID by marking it as inactive.
[Required authorization] Route required privileges: fleet-agents-all.
Path parameters
-
keyId
string Required
DELETE
/api/fleet/enrollment_api_keys/{keyId}
curl \
--request DELETE 'http://api.example.com/api/fleet/enrollment_api_keys/{keyId}' \
--header "Authorization: $API_KEY" \
--header "kbn-xsrf: true"
Response examples (200)
{
"action": "deleted"
}
Response examples (400)
{
"error": "string",
"errorType": "string",
"message": "string",
"statusCode": 42.0
}Query parameters
-
fleetServerSetup
boolean
GET
/api/fleet/check-permissions
curl \
--request GET 'http://api.example.com/api/fleet/check-permissions' \
--header "Authorization: $API_KEY"
Response examples (200)
{
"error": "MISSING_SECURITY",
"success": true
}
Response examples (400)
{
"error": "string",
"errorType": "string",
"message": "string",
"statusCode": 42.0
}Check Fleet Server health
[Required authorization] Route required privileges: fleet-settings-all.
POST
/api/fleet/health_check
curl \
--request POST 'http://api.example.com/api/fleet/health_check' \
--header "Authorization: $API_KEY" \
--header "Content-Type: application/json" \
--header "kbn-xsrf: true" \
--data '{"id":"string"}'
Request examples
# Headers
kbn-xsrf: true
# Payload
{
"id": "string"
}
Response examples (200)
{
"host_id": "string",
"name": "string",
"status": "string"
}
Response examples (400)
{
"error": "string",
"errorType": "string",
"message": "string",
"statusCode": 42.0
}
Response examples (404)
{
"error": "string",
"errorType": "string",
"message": "string",
"statusCode": 42.0
}Get settings
[Required authorization] Route required privileges: fleet-settings-read.
GET
/api/fleet/settings
curl \
--request GET 'http://api.example.com/api/fleet/settings' \
--header "Authorization: $API_KEY"
Response examples (200)
{
"item": {
"delete_unenrolled_agents": {
"enabled": true,
"is_preconfigured": true
},
"has_seen_add_data_notice": true,
"id": "string",
"output_secret_storage_requirements_met": true,
"preconfigured_fields": [
"fleet_server_hosts"
],
"prerelease_integrations_enabled": true,
"secret_storage_requirements_met": true,
"use_space_awareness_migration_started_at": "string",
"use_space_awareness_migration_status": "pending",
"version": "string"
}
}
Response examples (400)
{
"error": "string",
"errorType": "string",
"message": "string",
"statusCode": 42.0
}
Response examples (404)
{
"message": "string"
}Update settings
[Required authorization] Route required privileges: fleet-settings-all.
Body
-
additional_yaml_config
string -
delete_unenrolled_agents
object Additional properties are NOT allowed.
-
has_seen_add_data_notice
boolean -
kibana_ca_sha256
string -
kibana_urls
array[string(uri)] -
prerelease_integrations_enabled
boolean
PUT
/api/fleet/settings
curl \
--request PUT 'http://api.example.com/api/fleet/settings' \
--header "Authorization: $API_KEY" \
--header "Content-Type: application/json" \
--header "kbn-xsrf: true" \
--data '{"additional_yaml_config":"string","delete_unenrolled_agents":{"enabled":true,"is_preconfigured":true},"has_seen_add_data_notice":true,"kibana_ca_sha256":"string","kibana_urls":["https://example.com"],"prerelease_integrations_enabled":true}'
Request examples
# Headers
kbn-xsrf: true
# Payload
{
"additional_yaml_config": "string",
"delete_unenrolled_agents": {
"enabled": true,
"is_preconfigured": true
},
"has_seen_add_data_notice": true,
"kibana_ca_sha256": "string",
"kibana_urls": [
"https://example.com"
],
"prerelease_integrations_enabled": true
}
Response examples (200)
{
"item": {
"delete_unenrolled_agents": {
"enabled": true,
"is_preconfigured": true
},
"has_seen_add_data_notice": true,
"id": "string",
"output_secret_storage_requirements_met": true,
"preconfigured_fields": [
"fleet_server_hosts"
],
"prerelease_integrations_enabled": true,
"secret_storage_requirements_met": true,
"use_space_awareness_migration_started_at": "string",
"use_space_awareness_migration_status": "pending",
"version": "string"
}
}
Response examples (400)
{
"error": "string",
"errorType": "string",
"message": "string",
"statusCode": 42.0
}
Response examples (404)
{
"message": "string"
}Initiate Fleet setup
[Required authorization] Route required privileges: fleet-agents-read OR fleet-agent-policies-read OR fleet-settings-read OR fleet-setup.
POST
/api/fleet/setup
curl \
--request POST 'http://api.example.com/api/fleet/setup' \
--header "Authorization: $API_KEY" \
--header "kbn-xsrf: true"
Response examples (200)
{
"isInitialized": true,
"nonFatalErrors": [
{
"message": "string",
"name": "string"
}
]
}
Response examples (400)
{
"error": "string",
"errorType": "string",
"message": "string",
"statusCode": 42.0
}
Response examples (500)
{
"message": "string"
}Generate a Logstash API key
[Required authorization] Route required privileges: fleet-settings-all.
POST
/api/fleet/logstash_api_keys
curl \
--request POST 'http://api.example.com/api/fleet/logstash_api_keys' \
--header "Authorization: $API_KEY" \
--header "kbn-xsrf: true"
Response examples (200)
{
"api_key": "string"
}
Response examples (400)
{
"error": "string",
"errorType": "string",
"message": "string",
"statusCode": 42.0
}Get outputs
[Required authorization] Route required privileges: fleet-settings-read OR fleet-agent-policies-read.
GET
/api/fleet/outputs
curl \
--request GET 'http://api.example.com/api/fleet/outputs' \
--header "Authorization: $API_KEY"
Response examples (200)
{
"items": [
{
"allow_edit": [
"string"
],
"ca_sha256": "string",
"ca_trusted_fingerprint": "string",
"config_yaml": "string",
"hosts": [
"https://example.com"
],
"id": "string",
"is_default": false,
"is_default_monitoring": false,
"is_internal": true,
"is_preconfigured": true,
"name": "string",
"preset": "balanced",
"proxy_id": "string",
"secrets": {
"ssl": {
"key": {
"id": "string"
}
}
},
"shipper": {
"compression_level": 42.0,
"disk_queue_compression_enabled": true,
"disk_queue_enabled": false,
"disk_queue_encryption_enabled": true,
"disk_queue_max_size": 42.0,
"disk_queue_path": "string",
"loadbalance": true,
"max_batch_bytes": 42.0,
"mem_queue_events": 42.0,
"queue_flush_timeout": 42.0
},
"ssl": {
"certificate": "string",
"certificate_authorities": [
"string"
],
"key": "string",
"verification_mode": "full"
},
"type": "elasticsearch"
}
],
"page": 42.0,
"perPage": 42.0,
"total": 42.0
}
Response examples (400)
{
"error": "string",
"errorType": "string",
"message": "string",
"statusCode": 42.0
}Create output
[Required authorization] Route required privileges: fleet-settings-all.
Body
object
-
allow_edit
array[string] -
ca_sha256
string | null -
ca_trusted_fingerprint
string | null -
config_yaml
string | null -
hosts
array[string(uri)] Required At least
1element. -
id
string -
is_default
boolean Default value is
false. -
is_default_monitoring
boolean Default value is
false. -
is_internal
boolean -
is_preconfigured
boolean -
name
string Required -
preset
string Values are
balanced,custom,throughput,scale, orlatency. -
proxy_id
string | null -
secrets
object Additional properties are NOT allowed.
-
shipper
object | null Additional properties are NOT allowed.
-
ssl
object | null Additional properties are NOT allowed.
-
type
string Required Value is
elasticsearch.
POST
/api/fleet/outputs
curl \
--request POST 'http://api.example.com/api/fleet/outputs' \
--header "Authorization: $API_KEY" \
--header "Content-Type: application/json" \
--header "kbn-xsrf: true" \
--data '{"allow_edit":["string"],"ca_sha256":"string","ca_trusted_fingerprint":"string","config_yaml":"string","hosts":["https://example.com"],"id":"string","is_default":false,"is_default_monitoring":false,"is_internal":true,"is_preconfigured":true,"name":"string","preset":"balanced","proxy_id":"string","secrets":{"ssl":{"key":{"id":"string"}}},"shipper":{"compression_level":42.0,"disk_queue_compression_enabled":true,"disk_queue_enabled":false,"disk_queue_encryption_enabled":true,"disk_queue_max_size":42.0,"disk_queue_path":"string","loadbalance":true,"max_batch_bytes":42.0,"mem_queue_events":42.0,"queue_flush_timeout":42.0},"ssl":{"certificate":"string","certificate_authorities":["string"],"key":"string","verification_mode":"full"},"type":"elasticsearch"}'
Request examples
Object-1
# Headers
kbn-xsrf: true
# Payload
{
"allow_edit": [
"string"
],
"ca_sha256": "string",
"ca_trusted_fingerprint": "string",
"config_yaml": "string",
"hosts": [
"https://example.com"
],
"id": "string",
"is_default": false,
"is_default_monitoring": false,
"is_internal": true,
"is_preconfigured": true,
"name": "string",
"preset": "balanced",
"proxy_id": "string",
"secrets": {
"ssl": {
"key": {
"id": "string"
}
}
},
"shipper": {
"compression_level": 42.0,
"disk_queue_compression_enabled": true,
"disk_queue_enabled": false,
"disk_queue_encryption_enabled": true,
"disk_queue_max_size": 42.0,
"disk_queue_path": "string",
"loadbalance": true,
"max_batch_bytes": 42.0,
"mem_queue_events": 42.0,
"queue_flush_timeout": 42.0
},
"ssl": {
"certificate": "string",
"certificate_authorities": [
"string"
],
"key": "string",
"verification_mode": "full"
},
"type": "elasticsearch"
}# Headers
kbn-xsrf: true
# Payload
{
"allow_edit": [
"string"
],
"ca_sha256": "string",
"ca_trusted_fingerprint": "string",
"config_yaml": "string",
"hosts": [
"https://example.com"
],
"id": "string",
"is_default": false,
"is_default_monitoring": false,
"is_internal": true,
"is_preconfigured": true,
"kibana_api_key": "string",
"kibana_url": "string",
"name": "string",
"preset": "balanced",
"proxy_id": "string",
"secrets": {
"service_token": {
"id": "string"
},
"ssl": {
"key": {
"id": "string"
}
}
},
"service_token": "string",
"shipper": {
"compression_level": 42.0,
"disk_queue_compression_enabled": true,
"disk_queue_enabled": false,
"disk_queue_encryption_enabled": true,
"disk_queue_max_size": 42.0,
"disk_queue_path": "string",
"loadbalance": true,
"max_batch_bytes": 42.0,
"mem_queue_events": 42.0,
"queue_flush_timeout": 42.0
},
"ssl": {
"certificate": "string",
"certificate_authorities": [
"string"
],
"key": "string",
"verification_mode": "full"
},
"sync_integrations": true,
"sync_uninstalled_integrations": true,
"type": "remote_elasticsearch"
}# Headers
kbn-xsrf: true
# Payload
{
"allow_edit": [
"string"
],
"ca_sha256": "string",
"ca_trusted_fingerprint": "string",
"config_yaml": "string",
"hosts": [
"string"
],
"id": "string",
"is_default": false,
"is_default_monitoring": false,
"is_internal": true,
"is_preconfigured": true,
"name": "string",
"proxy_id": "string",
"secrets": {
"ssl": {
"key": {
"id": "string"
}
}
},
"shipper": {
"compression_level": 42.0,
"disk_queue_compression_enabled": true,
"disk_queue_enabled": false,
"disk_queue_encryption_enabled": true,
"disk_queue_max_size": 42.0,
"disk_queue_path": "string",
"loadbalance": true,
"max_batch_bytes": 42.0,
"mem_queue_events": 42.0,
"queue_flush_timeout": 42.0
},
"ssl": {
"certificate": "string",
"certificate_authorities": [
"string"
],
"key": "string",
"verification_mode": "full"
},
"type": "logstash"
}# Headers
kbn-xsrf: true
# Payload
{
"allow_edit": [
"string"
],
"auth_type": "none",
"broker_timeout": 42.0,
"ca_sha256": "string",
"ca_trusted_fingerprint": "string",
"client_id": "string",
"compression": "gzip",
"compression_level": [],
"config_yaml": "string",
"connection_type": [],
"hash": {
"hash": "string",
"random": true
},
"headers": [
{
"key": "string",
"value": "string"
}
],
"hosts": [
"string"
],
"id": "string",
"is_default": false,
"is_default_monitoring": false,
"is_internal": true,
"is_preconfigured": true,
"key": "string",
"name": "string",
"partition": "random",
"password": [],
"proxy_id": "string",
"random": {
"group_events": 42.0
},
"required_acks": 1,
"round_robin": {
"group_events": 42.0
},
"sasl": {
"mechanism": "PLAIN"
},
"secrets": {
"password": {
"id": "string"
},
"ssl": {
"key": {
"id": "string"
}
}
},
"shipper": {
"compression_level": 42.0,
"disk_queue_compression_enabled": true,
"disk_queue_enabled": false,
"disk_queue_encryption_enabled": true,
"disk_queue_max_size": 42.0,
"disk_queue_path": "string",
"loadbalance": true,
"max_batch_bytes": 42.0,
"mem_queue_events": 42.0,
"queue_flush_timeout": 42.0
},
"ssl": {
"certificate": "string",
"certificate_authorities": [
"string"
],
"key": "string",
"verification_mode": "full"
},
"timeout": 42.0,
"topic": "string",
"type": "kafka",
"username": [],
"version": "string"
}
Response examples (200)
{
"item": {
"allow_edit": [
"string"
],
"ca_sha256": "string",
"ca_trusted_fingerprint": "string",
"config_yaml": "string",
"hosts": [
"https://example.com"
],
"id": "string",
"is_default": false,
"is_default_monitoring": false,
"is_internal": true,
"is_preconfigured": true,
"name": "string",
"preset": "balanced",
"proxy_id": "string",
"secrets": {
"ssl": {
"key": {
"id": "string"
}
}
},
"shipper": {
"compression_level": 42.0,
"disk_queue_compression_enabled": true,
"disk_queue_enabled": false,
"disk_queue_encryption_enabled": true,
"disk_queue_max_size": 42.0,
"disk_queue_path": "string",
"loadbalance": true,
"max_batch_bytes": 42.0,
"mem_queue_events": 42.0,
"queue_flush_timeout": 42.0
},
"ssl": {
"certificate": "string",
"certificate_authorities": [
"string"
],
"key": "string",
"verification_mode": "full"
},
"type": "elasticsearch"
}
}
Response examples (400)
{
"error": "string",
"errorType": "string",
"message": "string",
"statusCode": 42.0
}Get output
Get output by ID.
[Required authorization] Route required privileges: fleet-settings-read OR fleet-agent-policies-read.
Path parameters
-
outputId
string Required
GET
/api/fleet/outputs/{outputId}
curl \
--request GET 'http://api.example.com/api/fleet/outputs/{outputId}' \
--header "Authorization: $API_KEY"
Response examples (200)
{
"item": {
"allow_edit": [
"string"
],
"ca_sha256": "string",
"ca_trusted_fingerprint": "string",
"config_yaml": "string",
"hosts": [
"https://example.com"
],
"id": "string",
"is_default": false,
"is_default_monitoring": false,
"is_internal": true,
"is_preconfigured": true,
"name": "string",
"preset": "balanced",
"proxy_id": "string",
"secrets": {
"ssl": {
"key": {
"id": "string"
}
}
},
"shipper": {
"compression_level": 42.0,
"disk_queue_compression_enabled": true,
"disk_queue_enabled": false,
"disk_queue_encryption_enabled": true,
"disk_queue_max_size": 42.0,
"disk_queue_path": "string",
"loadbalance": true,
"max_batch_bytes": 42.0,
"mem_queue_events": 42.0,
"queue_flush_timeout": 42.0
},
"ssl": {
"certificate": "string",
"certificate_authorities": [
"string"
],
"key": "string",
"verification_mode": "full"
},
"type": "elasticsearch"
}
}
Response examples (400)
{
"error": "string",
"errorType": "string",
"message": "string",
"statusCode": 42.0
}Update output
Update output by ID.
[Required authorization] Route required privileges: fleet-settings-all OR fleet-agent-policies-all.
Path parameters
-
outputId
string Required
Body
object
-
allow_edit
array[string] -
ca_sha256
string | null -
ca_trusted_fingerprint
string | null -
config_yaml
string | null -
hosts
array[string(uri)] At least
1element. -
id
string -
is_default
boolean -
is_default_monitoring
boolean -
is_internal
boolean -
is_preconfigured
boolean -
name
string -
preset
string Values are
balanced,custom,throughput,scale, orlatency. -
proxy_id
string | null -
secrets
object Additional properties are NOT allowed.
-
shipper
object | null Additional properties are NOT allowed.
-
ssl
object | null Additional properties are NOT allowed.
-
type
string Value is
elasticsearch.
PUT
/api/fleet/outputs/{outputId}
curl \
--request PUT 'http://api.example.com/api/fleet/outputs/{outputId}' \
--header "Authorization: $API_KEY" \
--header "Content-Type: application/json" \
--header "kbn-xsrf: true" \
--data '{"allow_edit":["string"],"ca_sha256":"string","ca_trusted_fingerprint":"string","config_yaml":"string","hosts":["https://example.com"],"id":"string","is_default":true,"is_default_monitoring":true,"is_internal":true,"is_preconfigured":true,"name":"string","preset":"balanced","proxy_id":"string","secrets":{"ssl":{"key":{"id":"string"}}},"shipper":{"compression_level":42.0,"disk_queue_compression_enabled":true,"disk_queue_enabled":false,"disk_queue_encryption_enabled":true,"disk_queue_max_size":42.0,"disk_queue_path":"string","loadbalance":true,"max_batch_bytes":42.0,"mem_queue_events":42.0,"queue_flush_timeout":42.0},"ssl":{"certificate":"string","certificate_authorities":["string"],"key":"string","verification_mode":"full"},"type":"elasticsearch"}'
Request examples
Object-1
# Headers
kbn-xsrf: true
# Payload
{
"allow_edit": [
"string"
],
"ca_sha256": "string",
"ca_trusted_fingerprint": "string",
"config_yaml": "string",
"hosts": [
"https://example.com"
],
"id": "string",
"is_default": true,
"is_default_monitoring": true,
"is_internal": true,
"is_preconfigured": true,
"name": "string",
"preset": "balanced",
"proxy_id": "string",
"secrets": {
"ssl": {
"key": {
"id": "string"
}
}
},
"shipper": {
"compression_level": 42.0,
"disk_queue_compression_enabled": true,
"disk_queue_enabled": false,
"disk_queue_encryption_enabled": true,
"disk_queue_max_size": 42.0,
"disk_queue_path": "string",
"loadbalance": true,
"max_batch_bytes": 42.0,
"mem_queue_events": 42.0,
"queue_flush_timeout": 42.0
},
"ssl": {
"certificate": "string",
"certificate_authorities": [
"string"
],
"key": "string",
"verification_mode": "full"
},
"type": "elasticsearch"
}# Headers
kbn-xsrf: true
# Payload
{
"allow_edit": [
"string"
],
"ca_sha256": "string",
"ca_trusted_fingerprint": "string",
"config_yaml": "string",
"hosts": [
"https://example.com"
],
"id": "string",
"is_default": true,
"is_default_monitoring": true,
"is_internal": true,
"is_preconfigured": true,
"kibana_api_key": "string",
"kibana_url": "string",
"name": "string",
"preset": "balanced",
"proxy_id": "string",
"secrets": {
"service_token": {
"id": "string"
},
"ssl": {
"key": {
"id": "string"
}
}
},
"service_token": "string",
"shipper": {
"compression_level": 42.0,
"disk_queue_compression_enabled": true,
"disk_queue_enabled": false,
"disk_queue_encryption_enabled": true,
"disk_queue_max_size": 42.0,
"disk_queue_path": "string",
"loadbalance": true,
"max_batch_bytes": 42.0,
"mem_queue_events": 42.0,
"queue_flush_timeout": 42.0
},
"ssl": {
"certificate": "string",
"certificate_authorities": [
"string"
],
"key": "string",
"verification_mode": "full"
},
"sync_integrations": true,
"sync_uninstalled_integrations": true,
"type": "remote_elasticsearch"
}# Headers
kbn-xsrf: true
# Payload
{
"allow_edit": [
"string"
],
"ca_sha256": "string",
"ca_trusted_fingerprint": "string",
"config_yaml": "string",
"hosts": [
"string"
],
"id": "string",
"is_default": true,
"is_default_monitoring": true,
"is_internal": true,
"is_preconfigured": true,
"name": "string",
"proxy_id": "string",
"secrets": {
"ssl": {
"key": {
"id": "string"
}
}
},
"shipper": {
"compression_level": 42.0,
"disk_queue_compression_enabled": true,
"disk_queue_enabled": false,
"disk_queue_encryption_enabled": true,
"disk_queue_max_size": 42.0,
"disk_queue_path": "string",
"loadbalance": true,
"max_batch_bytes": 42.0,
"mem_queue_events": 42.0,
"queue_flush_timeout": 42.0
},
"ssl": {
"certificate": "string",
"certificate_authorities": [
"string"
],
"key": "string",
"verification_mode": "full"
},
"type": "logstash"
}# Headers
kbn-xsrf: true
# Payload
{
"allow_edit": [
"string"
],
"auth_type": "none",
"broker_timeout": 42.0,
"ca_sha256": "string",
"ca_trusted_fingerprint": "string",
"client_id": "string",
"compression": "gzip",
"compression_level": [],
"config_yaml": "string",
"connection_type": [],
"hash": {
"hash": "string",
"random": true
},
"headers": [
{
"key": "string",
"value": "string"
}
],
"hosts": [
"string"
],
"id": "string",
"is_default": false,
"is_default_monitoring": false,
"is_internal": true,
"is_preconfigured": true,
"key": "string",
"name": "string",
"partition": "random",
"password": [],
"proxy_id": "string",
"random": {
"group_events": 42.0
},
"required_acks": 1,
"round_robin": {
"group_events": 42.0
},
"sasl": {
"mechanism": "PLAIN"
},
"secrets": {
"password": {
"id": "string"
},
"ssl": {
"key": {
"id": "string"
}
}
},
"shipper": {
"compression_level": 42.0,
"disk_queue_compression_enabled": true,
"disk_queue_enabled": false,
"disk_queue_encryption_enabled": true,
"disk_queue_max_size": 42.0,
"disk_queue_path": "string",
"loadbalance": true,
"max_batch_bytes": 42.0,
"mem_queue_events": 42.0,
"queue_flush_timeout": 42.0
},
"ssl": {
"certificate": "string",
"certificate_authorities": [
"string"
],
"key": "string",
"verification_mode": "full"
},
"timeout": 42.0,
"topic": "string",
"type": "kafka",
"username": [],
"version": "string"
}
Response examples (200)
{
"item": {
"allow_edit": [
"string"
],
"ca_sha256": "string",
"ca_trusted_fingerprint": "string",
"config_yaml": "string",
"hosts": [
"https://example.com"
],
"id": "string",
"is_default": false,
"is_default_monitoring": false,
"is_internal": true,
"is_preconfigured": true,
"name": "string",
"preset": "balanced",
"proxy_id": "string",
"secrets": {
"ssl": {
"key": {
"id": "string"
}
}
},
"shipper": {
"compression_level": 42.0,
"disk_queue_compression_enabled": true,
"disk_queue_enabled": false,
"disk_queue_encryption_enabled": true,
"disk_queue_max_size": 42.0,
"disk_queue_path": "string",
"loadbalance": true,
"max_batch_bytes": 42.0,
"mem_queue_events": 42.0,
"queue_flush_timeout": 42.0
},
"ssl": {
"certificate": "string",
"certificate_authorities": [
"string"
],
"key": "string",
"verification_mode": "full"
},
"type": "elasticsearch"
}
}
Response examples (400)
{
"error": "string",
"errorType": "string",
"message": "string",
"statusCode": 42.0
}Delete output
Delete output by ID.
[Required authorization] Route required privileges: fleet-settings-all.
Path parameters
-
outputId
string Required
DELETE
/api/fleet/outputs/{outputId}
curl \
--request DELETE 'http://api.example.com/api/fleet/outputs/{outputId}' \
--header "Authorization: $API_KEY" \
--header "kbn-xsrf: true"
Response examples (200)
{
"id": "string"
}
Response examples (400)
{
"error": "string",
"errorType": "string",
"message": "string",
"statusCode": 42.0
}
Response examples (404)
{
"error": "string",
"errorType": "string",
"message": "string",
"statusCode": 42.0
}Get the latest output health
[Required authorization] Route required privileges: fleet-settings-read.
Path parameters
-
outputId
string Required
GET
/api/fleet/outputs/{outputId}/health
curl \
--request GET 'http://api.example.com/api/fleet/outputs/{outputId}/health' \
--header "Authorization: $API_KEY"
Response examples (200)
{
"message": "string",
"state": "string",
"timestamp": "string"
}
Response examples (400)
{
"error": "string",
"errorType": "string",
"message": "string",
"statusCode": 42.0
}Query parameters
-
page
number -
perPage
number -
sortField
string -
sortOrder
string Values are
descorasc. -
showUpgradeable
boolean -
kuery
string -
format
string Values are
simplifiedorlegacy. -
withAgentCount
boolean
GET
/api/fleet/package_policies
curl \
--request GET 'http://api.example.com/api/fleet/package_policies' \
--header "Authorization: $API_KEY"
Response examples (200)
{
"items": [
{
"additional_datastreams_permissions": [
"string"
],
"agents": 42.0,
"created_at": "string",
"created_by": "string",
"description": "string",
"elasticsearch": {
"privileges": {
"cluster": [
"string"
]
}
},
"enabled": true,
"id": "string",
"inputs": [
{
"config": {
"additionalProperty1": {
"frozen": true,
"type": "string"
},
"additionalProperty2": {
"frozen": true,
"type": "string"
}
},
"enabled": true,
"id": "string",
"keep_enabled": true,
"policy_template": "string",
"streams": [
{
"config": {
"additionalProperty1": {
"frozen": true,
"type": "string"
},
"additionalProperty2": {
"frozen": true,
"type": "string"
}
},
"data_stream": {
"dataset": "string",
"elasticsearch": {
"dynamic_dataset": true,
"dynamic_namespace": true,
"privileges": {
"indices": [
"string"
]
}
},
"type": "string"
},
"enabled": true,
"id": "string",
"keep_enabled": true,
"release": "ga",
"vars": {
"additionalProperty1": {
"frozen": true,
"type": "string"
},
"additionalProperty2": {
"frozen": true,
"type": "string"
}
}
}
],
"type": "string",
"vars": {
"additionalProperty1": {
"frozen": true,
"type": "string"
},
"additionalProperty2": {
"frozen": true,
"type": "string"
}
}
}
],
"is_managed": true,
"name": "string",
"namespace": "string",
"output_id": "string",
"overrides": {
"inputs": {}
},
"package": {
"experimental_data_stream_features": [
{
"data_stream": "string",
"features": {
"doc_value_only_numeric": true,
"doc_value_only_other": true,
"synthetic_source": true,
"tsdb": true
}
}
],
"name": "string",
"requires_root": true,
"title": "string",
"version": "string"
},
"policy_id": "string",
"policy_ids": [
"string"
],
"revision": 42.0,
"secret_references": [
{
"id": "string"
}
],
"spaceIds": [
"string"
],
"supports_agentless": false,
"updated_at": "string",
"updated_by": "string",
"vars": {
"additionalProperty1": {
"frozen": true,
"type": "string"
},
"additionalProperty2": {
"frozen": true,
"type": "string"
}
},
"version": "string"
}
],
"page": 42.0,
"perPage": 42.0,
"total": 42.0
}
Response examples (400)
{
"error": "string",
"errorType": "string",
"message": "string",
"statusCode": 42.0
}Query parameters
-
format
string Values are
simplifiedorlegacy.
Body
object
You should use inputs as an object and not use the deprecated inputs array.
-
additional_datastreams_permissions
array[string] | null Additional datastream permissions, that will be added to the agent policy.
-
description
string Package policy description
-
enabled
boolean -
force
boolean Force package policy creation even if package is not verified, or if the agent policy is managed.
-
id
string Package policy unique identifier
-
inputs
array[object] Required -
is_managed
boolean -
name
string Required Package policy name (should be unique)
-
namespace
string The package policy namespace. Leave blank to inherit the agent policy's namespace.
-
output_id
string | null -
overrides
object | null Override settings that are defined in the package policy. The override option should be used only in unusual circumstances and not as a routine procedure.
Additional properties are NOT allowed.
-
package
object Additional properties are NOT allowed.
-
policy_id
string | null Deprecated Agent policy ID where that package policy will be added
-
policy_ids
array[string] Agent policy IDs where that package policy will be added
-
supports_agentless
boolean | null Indicates whether the package policy belongs to an agentless agent policy.
Default value is
false. -
vars
object Package variable (see integration documentation for more information)
POST
/api/fleet/package_policies
curl \
--request POST 'http://api.example.com/api/fleet/package_policies' \
--header "Authorization: $API_KEY" \
--header "Content-Type: application/json" \
--header "kbn-xsrf: true" \
--data '{"additional_datastreams_permissions":["string"],"description":"string","enabled":true,"force":true,"id":"string","inputs":[{"config":{"additionalProperty1":{"frozen":true,"type":"string"},"additionalProperty2":{"frozen":true,"type":"string"}},"enabled":true,"id":"string","keep_enabled":true,"policy_template":"string","streams":[{"config":{"additionalProperty1":{"frozen":true,"type":"string"},"additionalProperty2":{"frozen":true,"type":"string"}},"data_stream":{"dataset":"string","elasticsearch":{"dynamic_dataset":true,"dynamic_namespace":true,"privileges":{"indices":["string"]}},"type":"string"},"enabled":true,"id":"string","keep_enabled":true,"release":"ga","vars":{"additionalProperty1":{"frozen":true,"type":"string"},"additionalProperty2":{"frozen":true,"type":"string"}}}],"type":"string","vars":{"additionalProperty1":{"frozen":true,"type":"string"},"additionalProperty2":{"frozen":true,"type":"string"}}}],"is_managed":true,"name":"string","namespace":"string","output_id":"string","overrides":{"inputs":{}},"package":{"experimental_data_stream_features":[{"data_stream":"string","features":{"doc_value_only_numeric":true,"doc_value_only_other":true,"synthetic_source":true,"tsdb":true}}],"name":"string","requires_root":true,"title":"string","version":"string"},"policy_id":"string","policy_ids":["string"],"supports_agentless":false,"vars":{"additionalProperty1":{"frozen":true,"type":"string"},"additionalProperty2":{"frozen":true,"type":"string"}}}'
Request examples
Object-1
# Headers
kbn-xsrf: true
# Payload
{
"additional_datastreams_permissions": [
"string"
],
"description": "string",
"enabled": true,
"force": true,
"id": "string",
"inputs": [
{
"config": {
"additionalProperty1": {
"frozen": true,
"type": "string"
},
"additionalProperty2": {
"frozen": true,
"type": "string"
}
},
"enabled": true,
"id": "string",
"keep_enabled": true,
"policy_template": "string",
"streams": [
{
"config": {
"additionalProperty1": {
"frozen": true,
"type": "string"
},
"additionalProperty2": {
"frozen": true,
"type": "string"
}
},
"data_stream": {
"dataset": "string",
"elasticsearch": {
"dynamic_dataset": true,
"dynamic_namespace": true,
"privileges": {
"indices": [
"string"
]
}
},
"type": "string"
},
"enabled": true,
"id": "string",
"keep_enabled": true,
"release": "ga",
"vars": {
"additionalProperty1": {
"frozen": true,
"type": "string"
},
"additionalProperty2": {
"frozen": true,
"type": "string"
}
}
}
],
"type": "string",
"vars": {
"additionalProperty1": {
"frozen": true,
"type": "string"
},
"additionalProperty2": {
"frozen": true,
"type": "string"
}
}
}
],
"is_managed": true,
"name": "string",
"namespace": "string",
"output_id": "string",
"overrides": {
"inputs": {}
},
"package": {
"experimental_data_stream_features": [
{
"data_stream": "string",
"features": {
"doc_value_only_numeric": true,
"doc_value_only_other": true,
"synthetic_source": true,
"tsdb": true
}
}
],
"name": "string",
"requires_root": true,
"title": "string",
"version": "string"
},
"policy_id": "string",
"policy_ids": [
"string"
],
"supports_agentless": false,
"vars": {
"additionalProperty1": {
"frozen": true,
"type": "string"
},
"additionalProperty2": {
"frozen": true,
"type": "string"
}
}
}# Headers
kbn-xsrf: true
# Payload
{
"additional_datastreams_permissions": [
"string"
],
"description": "string",
"force": true,
"id": "string",
"inputs": {
"additionalProperty1": {
"enabled": true,
"streams": {
"additionalProperty1": {
"enabled": true,
"vars": {}
},
"additionalProperty2": {
"enabled": true,
"vars": {}
}
},
"vars": {}
},
"additionalProperty2": {
"enabled": true,
"streams": {
"additionalProperty1": {
"enabled": true,
"vars": {}
},
"additionalProperty2": {
"enabled": true,
"vars": {}
}
},
"vars": {}
}
},
"name": "string",
"namespace": "string",
"output_id": "string",
"package": {
"experimental_data_stream_features": [
{
"data_stream": "string",
"features": {
"doc_value_only_numeric": true,
"doc_value_only_other": true,
"synthetic_source": true,
"tsdb": true
}
}
],
"name": "string",
"requires_root": true,
"title": "string",
"version": "string"
},
"policy_id": "string",
"policy_ids": [
"string"
],
"supports_agentless": false,
"vars": {}
}
Response examples (200)
{
"item": {
"additional_datastreams_permissions": [
"string"
],
"agents": 42.0,
"created_at": "string",
"created_by": "string",
"description": "string",
"elasticsearch": {
"privileges": {
"cluster": [
"string"
]
}
},
"enabled": true,
"id": "string",
"inputs": [
{
"config": {
"additionalProperty1": {
"frozen": true,
"type": "string"
},
"additionalProperty2": {
"frozen": true,
"type": "string"
}
},
"enabled": true,
"id": "string",
"keep_enabled": true,
"policy_template": "string",
"streams": [
{
"config": {
"additionalProperty1": {
"frozen": true,
"type": "string"
},
"additionalProperty2": {
"frozen": true,
"type": "string"
}
},
"data_stream": {
"dataset": "string",
"elasticsearch": {
"dynamic_dataset": true,
"dynamic_namespace": true,
"privileges": {
"indices": [
"string"
]
}
},
"type": "string"
},
"enabled": true,
"id": "string",
"keep_enabled": true,
"release": "ga",
"vars": {
"additionalProperty1": {
"frozen": true,
"type": "string"
},
"additionalProperty2": {
"frozen": true,
"type": "string"
}
}
}
],
"type": "string",
"vars": {
"additionalProperty1": {
"frozen": true,
"type": "string"
},
"additionalProperty2": {
"frozen": true,
"type": "string"
}
}
}
],
"is_managed": true,
"name": "string",
"namespace": "string",
"output_id": "string",
"overrides": {
"inputs": {}
},
"package": {
"experimental_data_stream_features": [
{
"data_stream": "string",
"features": {
"doc_value_only_numeric": true,
"doc_value_only_other": true,
"synthetic_source": true,
"tsdb": true
}
}
],
"name": "string",
"requires_root": true,
"title": "string",
"version": "string"
},
"policy_id": "string",
"policy_ids": [
"string"
],
"revision": 42.0,
"secret_references": [
{
"id": "string"
}
],
"spaceIds": [
"string"
],
"supports_agentless": false,
"updated_at": "string",
"updated_by": "string",
"vars": {
"additionalProperty1": {
"frozen": true,
"type": "string"
},
"additionalProperty2": {
"frozen": true,
"type": "string"
}
},
"version": "string"
}
}
Response examples (400)
{
"error": "string",
"errorType": "string",
"message": "string",
"statusCode": 42.0
}
Response examples (409)
{
"error": "string",
"errorType": "string",
"message": "string",
"statusCode": 42.0
}Query parameters
-
format
string Values are
simplifiedorlegacy.
Body
-
ids
array[string] Required list of package policy ids
-
ignoreMissing
boolean
POST
/api/fleet/package_policies/_bulk_get
curl \
--request POST 'http://api.example.com/api/fleet/package_policies/_bulk_get' \
--header "Authorization: $API_KEY" \
--header "Content-Type: application/json" \
--header "kbn-xsrf: true" \
--data '{"ids":["string"],"ignoreMissing":true}'
Request examples
# Headers
kbn-xsrf: true
# Payload
{
"ids": [
"string"
],
"ignoreMissing": true
}
Response examples (200)
{
"items": [
{
"additional_datastreams_permissions": [
"string"
],
"agents": 42.0,
"created_at": "string",
"created_by": "string",
"description": "string",
"elasticsearch": {
"privileges": {
"cluster": [
"string"
]
}
},
"enabled": true,
"id": "string",
"inputs": [
{
"config": {
"additionalProperty1": {
"frozen": true,
"type": "string"
},
"additionalProperty2": {
"frozen": true,
"type": "string"
}
},
"enabled": true,
"id": "string",
"keep_enabled": true,
"policy_template": "string",
"streams": [
{
"config": {
"additionalProperty1": {
"frozen": true,
"type": "string"
},
"additionalProperty2": {
"frozen": true,
"type": "string"
}
},
"data_stream": {
"dataset": "string",
"elasticsearch": {
"dynamic_dataset": true,
"dynamic_namespace": true,
"privileges": {
"indices": [
"string"
]
}
},
"type": "string"
},
"enabled": true,
"id": "string",
"keep_enabled": true,
"release": "ga",
"vars": {
"additionalProperty1": {
"frozen": true,
"type": "string"
},
"additionalProperty2": {
"frozen": true,
"type": "string"
}
}
}
],
"type": "string",
"vars": {
"additionalProperty1": {
"frozen": true,
"type": "string"
},
"additionalProperty2": {
"frozen": true,
"type": "string"
}
}
}
],
"is_managed": true,
"name": "string",
"namespace": "string",
"output_id": "string",
"overrides": {
"inputs": {}
},
"package": {
"experimental_data_stream_features": [
{
"data_stream": "string",
"features": {
"doc_value_only_numeric": true,
"doc_value_only_other": true,
"synthetic_source": true,
"tsdb": true
}
}
],
"name": "string",
"requires_root": true,
"title": "string",
"version": "string"
},
"policy_id": "string",
"policy_ids": [
"string"
],
"revision": 42.0,
"secret_references": [
{
"id": "string"
}
],
"spaceIds": [
"string"
],
"supports_agentless": false,
"updated_at": "string",
"updated_by": "string",
"vars": {
"additionalProperty1": {
"frozen": true,
"type": "string"
},
"additionalProperty2": {
"frozen": true,
"type": "string"
}
},
"version": "string"
}
]
}
Response examples (400)
{
"error": "string",
"errorType": "string",
"message": "string",
"statusCode": 42.0
}
Response examples (404)
{
"message": "string"
}Path parameters
-
packagePolicyId
string Required
Query parameters
-
format
string Values are
simplifiedorlegacy.
GET
/api/fleet/package_policies/{packagePolicyId}
curl \
--request GET 'http://api.example.com/api/fleet/package_policies/{packagePolicyId}' \
--header "Authorization: $API_KEY"
Response examples (200)
{
"item": {
"additional_datastreams_permissions": [
"string"
],
"agents": 42.0,
"created_at": "string",
"created_by": "string",
"description": "string",
"elasticsearch": {
"privileges": {
"cluster": [
"string"
]
}
},
"enabled": true,
"id": "string",
"inputs": [
{
"config": {
"additionalProperty1": {
"frozen": true,
"type": "string"
},
"additionalProperty2": {
"frozen": true,
"type": "string"
}
},
"enabled": true,
"id": "string",
"keep_enabled": true,
"policy_template": "string",
"streams": [
{
"config": {
"additionalProperty1": {
"frozen": true,
"type": "string"
},
"additionalProperty2": {
"frozen": true,
"type": "string"
}
},
"data_stream": {
"dataset": "string",
"elasticsearch": {
"dynamic_dataset": true,
"dynamic_namespace": true,
"privileges": {
"indices": [
"string"
]
}
},
"type": "string"
},
"enabled": true,
"id": "string",
"keep_enabled": true,
"release": "ga",
"vars": {
"additionalProperty1": {
"frozen": true,
"type": "string"
},
"additionalProperty2": {
"frozen": true,
"type": "string"
}
}
}
],
"type": "string",
"vars": {
"additionalProperty1": {
"frozen": true,
"type": "string"
},
"additionalProperty2": {
"frozen": true,
"type": "string"
}
}
}
],
"is_managed": true,
"name": "string",
"namespace": "string",
"output_id": "string",
"overrides": {
"inputs": {}
},
"package": {
"experimental_data_stream_features": [
{
"data_stream": "string",
"features": {
"doc_value_only_numeric": true,
"doc_value_only_other": true,
"synthetic_source": true,
"tsdb": true
}
}
],
"name": "string",
"requires_root": true,
"title": "string",
"version": "string"
},
"policy_id": "string",
"policy_ids": [
"string"
],
"revision": 42.0,
"secret_references": [
{
"id": "string"
}
],
"spaceIds": [
"string"
],
"supports_agentless": false,
"updated_at": "string",
"updated_by": "string",
"vars": {
"additionalProperty1": {
"frozen": true,
"type": "string"
},
"additionalProperty2": {
"frozen": true,
"type": "string"
}
},
"version": "string"
}
}
Response examples (400)
{
"error": "string",
"errorType": "string",
"message": "string",
"statusCode": 42.0
}
Response examples (404)
{
"message": "string"
}Update a package policy
Update a package policy by ID.
Path parameters
-
packagePolicyId
string Required
Query parameters
-
format
string Values are
simplifiedorlegacy.
Body
object
-
additional_datastreams_permissions
array[string] | null Additional datastream permissions, that will be added to the agent policy.
-
description
string Package policy description
-
enabled
boolean -
force
boolean -
inputs
array[object] -
is_managed
boolean -
name
string -
namespace
string The package policy namespace. Leave blank to inherit the agent policy's namespace.
-
output_id
string | null -
overrides
object | null Override settings that are defined in the package policy. The override option should be used only in unusual circumstances and not as a routine procedure.
Additional properties are NOT allowed.
-
package
object Additional properties are NOT allowed.
-
policy_id
string | null Deprecated Agent policy ID where that package policy will be added
-
policy_ids
array[string] Agent policy IDs where that package policy will be added
-
supports_agentless
boolean | null Indicates whether the package policy belongs to an agentless agent policy.
Default value is
false. -
vars
object Package variable (see integration documentation for more information)
-
version
string
PUT
/api/fleet/package_policies/{packagePolicyId}
curl \
--request PUT 'http://api.example.com/api/fleet/package_policies/{packagePolicyId}' \
--header "Authorization: $API_KEY" \
--header "Content-Type: application/json" \
--header "kbn-xsrf: true" \
--data '{"additional_datastreams_permissions":["string"],"description":"string","enabled":true,"force":true,"inputs":[{"config":{"additionalProperty1":{"frozen":true,"type":"string"},"additionalProperty2":{"frozen":true,"type":"string"}},"enabled":true,"id":"string","keep_enabled":true,"policy_template":"string","streams":[{"config":{"additionalProperty1":{"frozen":true,"type":"string"},"additionalProperty2":{"frozen":true,"type":"string"}},"data_stream":{"dataset":"string","elasticsearch":{"dynamic_dataset":true,"dynamic_namespace":true,"privileges":{"indices":["string"]}},"type":"string"},"enabled":true,"id":"string","keep_enabled":true,"release":"ga","vars":{"additionalProperty1":{"frozen":true,"type":"string"},"additionalProperty2":{"frozen":true,"type":"string"}}}],"type":"string","vars":{"additionalProperty1":{"frozen":true,"type":"string"},"additionalProperty2":{"frozen":true,"type":"string"}}}],"is_managed":true,"name":"string","namespace":"string","output_id":"string","overrides":{"inputs":{}},"package":{"experimental_data_stream_features":[{"data_stream":"string","features":{"doc_value_only_numeric":true,"doc_value_only_other":true,"synthetic_source":true,"tsdb":true}}],"name":"string","requires_root":true,"title":"string","version":"string"},"policy_id":"string","policy_ids":["string"],"supports_agentless":false,"vars":{"additionalProperty1":{"frozen":true,"type":"string"},"additionalProperty2":{"frozen":true,"type":"string"}},"version":"string"}'
Request examples
Object-1
# Headers
kbn-xsrf: true
# Payload
{
"additional_datastreams_permissions": [
"string"
],
"description": "string",
"enabled": true,
"force": true,
"inputs": [
{
"config": {
"additionalProperty1": {
"frozen": true,
"type": "string"
},
"additionalProperty2": {
"frozen": true,
"type": "string"
}
},
"enabled": true,
"id": "string",
"keep_enabled": true,
"policy_template": "string",
"streams": [
{
"config": {
"additionalProperty1": {
"frozen": true,
"type": "string"
},
"additionalProperty2": {
"frozen": true,
"type": "string"
}
},
"data_stream": {
"dataset": "string",
"elasticsearch": {
"dynamic_dataset": true,
"dynamic_namespace": true,
"privileges": {
"indices": [
"string"
]
}
},
"type": "string"
},
"enabled": true,
"id": "string",
"keep_enabled": true,
"release": "ga",
"vars": {
"additionalProperty1": {
"frozen": true,
"type": "string"
},
"additionalProperty2": {
"frozen": true,
"type": "string"
}
}
}
],
"type": "string",
"vars": {
"additionalProperty1": {
"frozen": true,
"type": "string"
},
"additionalProperty2": {
"frozen": true,
"type": "string"
}
}
}
],
"is_managed": true,
"name": "string",
"namespace": "string",
"output_id": "string",
"overrides": {
"inputs": {}
},
"package": {
"experimental_data_stream_features": [
{
"data_stream": "string",
"features": {
"doc_value_only_numeric": true,
"doc_value_only_other": true,
"synthetic_source": true,
"tsdb": true
}
}
],
"name": "string",
"requires_root": true,
"title": "string",
"version": "string"
},
"policy_id": "string",
"policy_ids": [
"string"
],
"supports_agentless": false,
"vars": {
"additionalProperty1": {
"frozen": true,
"type": "string"
},
"additionalProperty2": {
"frozen": true,
"type": "string"
}
},
"version": "string"
}# Headers
kbn-xsrf: true
# Payload
{
"additional_datastreams_permissions": [
"string"
],
"description": "string",
"force": true,
"id": "string",
"inputs": {
"additionalProperty1": {
"enabled": true,
"streams": {
"additionalProperty1": {
"enabled": true,
"vars": {}
},
"additionalProperty2": {
"enabled": true,
"vars": {}
}
},
"vars": {}
},
"additionalProperty2": {
"enabled": true,
"streams": {
"additionalProperty1": {
"enabled": true,
"vars": {}
},
"additionalProperty2": {
"enabled": true,
"vars": {}
}
},
"vars": {}
}
},
"name": "string",
"namespace": "string",
"output_id": "string",
"package": {
"experimental_data_stream_features": [
{
"data_stream": "string",
"features": {
"doc_value_only_numeric": true,
"doc_value_only_other": true,
"synthetic_source": true,
"tsdb": true
}
}
],
"name": "string",
"requires_root": true,
"title": "string",
"version": "string"
},
"policy_id": "string",
"policy_ids": [
"string"
],
"supports_agentless": false,
"vars": {}
}
Response examples (200)
{
"item": {
"additional_datastreams_permissions": [
"string"
],
"agents": 42.0,
"created_at": "string",
"created_by": "string",
"description": "string",
"elasticsearch": {
"privileges": {
"cluster": [
"string"
]
}
},
"enabled": true,
"id": "string",
"inputs": [
{
"config": {
"additionalProperty1": {
"frozen": true,
"type": "string"
},
"additionalProperty2": {
"frozen": true,
"type": "string"
}
},
"enabled": true,
"id": "string",
"keep_enabled": true,
"policy_template": "string",
"streams": [
{
"config": {
"additionalProperty1": {
"frozen": true,
"type": "string"
},
"additionalProperty2": {
"frozen": true,
"type": "string"
}
},
"data_stream": {
"dataset": "string",
"elasticsearch": {
"dynamic_dataset": true,
"dynamic_namespace": true,
"privileges": {
"indices": [
"string"
]
}
},
"type": "string"
},
"enabled": true,
"id": "string",
"keep_enabled": true,
"release": "ga",
"vars": {
"additionalProperty1": {
"frozen": true,
"type": "string"
},
"additionalProperty2": {
"frozen": true,
"type": "string"
}
}
}
],
"type": "string",
"vars": {
"additionalProperty1": {
"frozen": true,
"type": "string"
},
"additionalProperty2": {
"frozen": true,
"type": "string"
}
}
}
],
"is_managed": true,
"name": "string",
"namespace": "string",
"output_id": "string",
"overrides": {
"inputs": {}
},
"package": {
"experimental_data_stream_features": [
{
"data_stream": "string",
"features": {
"doc_value_only_numeric": true,
"doc_value_only_other": true,
"synthetic_source": true,
"tsdb": true
}
}
],
"name": "string",
"requires_root": true,
"title": "string",
"version": "string"
},
"policy_id": "string",
"policy_ids": [
"string"
],
"revision": 42.0,
"secret_references": [
{
"id": "string"
}
],
"spaceIds": [
"string"
],
"supports_agentless": false,
"updated_at": "string",
"updated_by": "string",
"vars": {
"additionalProperty1": {
"frozen": true,
"type": "string"
},
"additionalProperty2": {
"frozen": true,
"type": "string"
}
},
"version": "string"
}
}
Response examples (400)
{
"error": "string",
"errorType": "string",
"message": "string",
"statusCode": 42.0
}
Response examples (403)
{
"error": "string",
"errorType": "string",
"message": "string",
"statusCode": 42.0
}Delete a package policy
Delete a package policy by ID.
[Required authorization] Route required privileges: fleet-agent-policies-all AND integrations-all.
Path parameters
-
packagePolicyId
string Required
Query parameters
-
force
boolean
DELETE
/api/fleet/package_policies/{packagePolicyId}
curl \
--request DELETE 'http://api.example.com/api/fleet/package_policies/{packagePolicyId}' \
--header "Authorization: $API_KEY" \
--header "kbn-xsrf: true"
Response examples (200)
{
"id": "string"
}
Response examples (400)
{
"error": "string",
"errorType": "string",
"message": "string",
"statusCode": 42.0
}Bulk delete package policies
[Required authorization] Route required privileges: fleet-agent-policies-all AND integrations-all.
Body
-
force
boolean -
packagePolicyIds
array[string] Required
POST
/api/fleet/package_policies/delete
curl \
--request POST 'http://api.example.com/api/fleet/package_policies/delete' \
--header "Authorization: $API_KEY" \
--header "Content-Type: application/json" \
--header "kbn-xsrf: true" \
--data '{"force":true,"packagePolicyIds":["string"]}'
Request examples
# Headers
kbn-xsrf: true
# Payload
{
"force": true,
"packagePolicyIds": [
"string"
]
}
Response examples (200)
[
{
"body": {
"message": "string"
},
"id": "string",
"name": "string",
"output_id": "string",
"package": {
"experimental_data_stream_features": [
{
"data_stream": "string",
"features": {
"doc_value_only_numeric": true,
"doc_value_only_other": true,
"synthetic_source": true,
"tsdb": true
}
}
],
"name": "string",
"requires_root": true,
"title": "string",
"version": "string"
},
"policy_id": "string",
"policy_ids": [
"string"
],
"statusCode": 42.0,
"success": true
}
]
Response examples (400)
{
"error": "string",
"errorType": "string",
"message": "string",
"statusCode": 42.0
}Upgrade a package policy
Upgrade a package policy to a newer package version.
[Required authorization] Route required privileges: fleet-agent-policies-all AND integrations-all.
Body
-
packagePolicyIds
array[string] Required
POST
/api/fleet/package_policies/upgrade
curl \
--request POST 'http://api.example.com/api/fleet/package_policies/upgrade' \
--header "Authorization: $API_KEY" \
--header "Content-Type: application/json" \
--header "kbn-xsrf: true" \
--data '{"packagePolicyIds":["string"]}'
Request examples
# Headers
kbn-xsrf: true
# Payload
{
"packagePolicyIds": [
"string"
]
}
Response examples (200)
[
{
"body": {
"message": "string"
},
"id": "string",
"name": "string",
"statusCode": 42.0,
"success": true
}
]
Response examples (400)
{
"error": "string",
"errorType": "string",
"message": "string",
"statusCode": 42.0
}Dry run a package policy upgrade
[Required authorization] Route required privileges: fleet-agent-policies-read AND integrations-read.
Body
-
packagePolicyIds
array[string] Required -
packageVersion
string
POST
/api/fleet/package_policies/upgrade/dryrun
curl \
--request POST 'http://api.example.com/api/fleet/package_policies/upgrade/dryrun' \
--header "Authorization: $API_KEY" \
--header "Content-Type: application/json" \
--header "kbn-xsrf: true" \
--data '{"packagePolicyIds":["string"],"packageVersion":"string"}'
Request examples
# Headers
kbn-xsrf: true
# Payload
{
"packagePolicyIds": [
"string"
],
"packageVersion": "string"
}
Response examples (200)
[
{
"agent_diff": [
[
{
"data_stream": {
"namespace": "string"
},
"id": "string",
"meta": {
"package": {
"name": "string",
"version": "string"
}
},
"name": "string",
"package_policy_id": "string",
"processors": [
{
"add_fields": {
"fields": {},
"target": "string"
}
}
],
"revision": 42.0,
"streams": [
{
"data_stream": {
"dataset": "string",
"type": "string"
},
"id": "string"
}
],
"type": "string",
"use_output": "string"
}
]
],
"body": {
"message": "string"
},
"diff": [
{
"additional_datastreams_permissions": [
"string"
],
"agents": 42.0,
"created_at": "string",
"created_by": "string",
"description": "string",
"elasticsearch": {
"privileges": {
"cluster": [
"string"
]
}
},
"enabled": true,
"id": "string",
"inputs": [
{
"config": {
"additionalProperty1": {
"frozen": true,
"type": "string"
},
"additionalProperty2": {
"frozen": true,
"type": "string"
}
},
"enabled": true,
"id": "string",
"keep_enabled": true,
"policy_template": "string",
"streams": [
{
"config": {
"additionalProperty1": {
"frozen": true,
"type": "string"
},
"additionalProperty2": {
"frozen": true,
"type": "string"
}
},
"data_stream": {
"dataset": "string",
"elasticsearch": {
"dynamic_dataset": true,
"dynamic_namespace": true,
"privileges": {
"indices": [
"string"
]
}
},
"type": "string"
},
"enabled": true,
"id": "string",
"keep_enabled": true,
"release": "ga",
"vars": {
"additionalProperty1": {
"frozen": true,
"type": "string"
},
"additionalProperty2": {
"frozen": true,
"type": "string"
}
}
}
],
"type": "string",
"vars": {
"additionalProperty1": {
"frozen": true,
"type": "string"
},
"additionalProperty2": {
"frozen": true,
"type": "string"
}
}
}
],
"is_managed": true,
"name": "string",
"namespace": "string",
"output_id": "string",
"overrides": {
"inputs": {}
},
"package": {
"experimental_data_stream_features": [
{
"data_stream": "string",
"features": {
"doc_value_only_numeric": true,
"doc_value_only_other": true,
"synthetic_source": true,
"tsdb": true
}
}
],
"name": "string",
"requires_root": true,
"title": "string",
"version": "string"
},
"policy_id": "string",
"policy_ids": [
"string"
],
"revision": 42.0,
"secret_references": [
{
"id": "string"
}
],
"spaceIds": [
"string"
],
"supports_agentless": false,
"updated_at": "string",
"updated_by": "string",
"vars": {
"additionalProperty1": {
"frozen": true,
"type": "string"
},
"additionalProperty2": {
"frozen": true,
"type": "string"
}
},
"version": "string"
}
],
"hasErrors": true,
"name": "string",
"statusCode": 42.0
}
]
Response examples (400)
{
"error": "string",
"errorType": "string",
"message": "string",
"statusCode": 42.0
}Get proxies
[Required authorization] Route required privileges: fleet-settings-read.
GET
/api/fleet/proxies
curl \
--request GET 'http://api.example.com/api/fleet/proxies' \
--header "Authorization: $API_KEY"
Response examples (200)
{
"items": [
{
"certificate": "string",
"certificate_authorities": "string",
"certificate_key": "string",
"id": "string",
"is_preconfigured": false,
"name": "string",
"proxy_headers": {},
"url": "string"
}
],
"page": 42.0,
"perPage": 42.0,
"total": 42.0
}
Response examples (400)
{
"error": "string",
"errorType": "string",
"message": "string",
"statusCode": 42.0
}Create a proxy
[Required authorization] Route required privileges: fleet-settings-all.
Body
-
certificate
string | null -
certificate_key
string | null -
id
string -
is_preconfigured
boolean Default value is
false. -
name
string Required -
proxy_headers
object | null -
url
string Required
POST
/api/fleet/proxies
curl \
--request POST 'http://api.example.com/api/fleet/proxies' \
--header "Authorization: $API_KEY" \
--header "Content-Type: application/json" \
--header "kbn-xsrf: true" \
--data '{"certificate":"string","certificate_authorities":"string","certificate_key":"string","id":"string","is_preconfigured":false,"name":"string","proxy_headers":{},"url":"string"}'
Request examples
# Headers
kbn-xsrf: true
# Payload
{
"certificate": "string",
"certificate_authorities": "string",
"certificate_key": "string",
"id": "string",
"is_preconfigured": false,
"name": "string",
"proxy_headers": {},
"url": "string"
}
Response examples (200)
{
"item": {
"certificate": "string",
"certificate_authorities": "string",
"certificate_key": "string",
"id": "string",
"is_preconfigured": false,
"name": "string",
"proxy_headers": {},
"url": "string"
}
}
Response examples (400)
{
"error": "string",
"errorType": "string",
"message": "string",
"statusCode": 42.0
}Get a proxy
Get a proxy by ID.
[Required authorization] Route required privileges: fleet-settings-read.
Path parameters
-
itemId
string Required
GET
/api/fleet/proxies/{itemId}
curl \
--request GET 'http://api.example.com/api/fleet/proxies/{itemId}' \
--header "Authorization: $API_KEY"
Response examples (200)
{
"item": {
"certificate": "string",
"certificate_authorities": "string",
"certificate_key": "string",
"id": "string",
"is_preconfigured": false,
"name": "string",
"proxy_headers": {},
"url": "string"
}
}
Response examples (400)
{
"error": "string",
"errorType": "string",
"message": "string",
"statusCode": 42.0
}Update a proxy
Update a proxy by ID.
[Required authorization] Route required privileges: fleet-settings-all.
Path parameters
-
itemId
string Required
Body
-
certificate
string | null Required -
certificate_key
string | null Required -
name
string -
proxy_headers
object | null Required -
url
string
PUT
/api/fleet/proxies/{itemId}
curl \
--request PUT 'http://api.example.com/api/fleet/proxies/{itemId}' \
--header "Authorization: $API_KEY" \
--header "Content-Type: application/json" \
--header "kbn-xsrf: true" \
--data '{"certificate":"string","certificate_authorities":"string","certificate_key":"string","name":"string","proxy_headers":{},"url":"string"}'
Request examples
# Headers
kbn-xsrf: true
# Payload
{
"certificate": "string",
"certificate_authorities": "string",
"certificate_key": "string",
"name": "string",
"proxy_headers": {},
"url": "string"
}
Response examples (200)
{
"item": {
"certificate": "string",
"certificate_authorities": "string",
"certificate_key": "string",
"id": "string",
"is_preconfigured": false,
"name": "string",
"proxy_headers": {},
"url": "string"
}
}
Response examples (400)
{
"error": "string",
"errorType": "string",
"message": "string",
"statusCode": 42.0
}Delete a proxy
Delete a proxy by ID
[Required authorization] Route required privileges: fleet-settings-all.
Path parameters
-
itemId
string Required
DELETE
/api/fleet/proxies/{itemId}
curl \
--request DELETE 'http://api.example.com/api/fleet/proxies/{itemId}' \
--header "Authorization: $API_KEY" \
--header "kbn-xsrf: true"
Response examples (200)
{
"id": "string"
}
Response examples (400)
{
"error": "string",
"errorType": "string",
"message": "string",
"statusCode": 42.0
}Get Fleet Server hosts
[Required authorization] Route required privileges: fleet-agents-all OR fleet-settings-read.
GET
/api/fleet/fleet_server_hosts
curl \
--request GET 'http://api.example.com/api/fleet/fleet_server_hosts' \
--header "Authorization: $API_KEY"
Response examples (200)
{
"items": [
{
"host_urls": [
"string"
],
"id": "string",
"is_default": false,
"is_internal": true,
"is_preconfigured": false,
"name": "string",
"proxy_id": "string",
"secrets": {
"ssl": {
"es_key": {
"id": "string"
},
"key": {
"id": "string"
}
}
},
"ssl": {
"certificate": "string",
"certificate_authorities": [
"string"
],
"client_auth": "optional",
"es_certificate": "string",
"es_certificate_authorities": [
"string"
],
"es_key": "string",
"key": "string"
}
}
],
"page": 42.0,
"perPage": 42.0,
"total": 42.0
}
Response examples (400)
{
"error": "string",
"errorType": "string",
"message": "string",
"statusCode": 42.0
}Create a Fleet Server host
[Required authorization] Route required privileges: fleet-settings-all.
Body
-
host_urls
array[string] Required At least
1element. -
id
string -
is_default
boolean Default value is
false. -
is_internal
boolean -
is_preconfigured
boolean Default value is
false. -
name
string Required -
proxy_id
string | null -
secrets
object Additional properties are NOT allowed.
-
ssl
object | null Additional properties are NOT allowed.
POST
/api/fleet/fleet_server_hosts
curl \
--request POST 'http://api.example.com/api/fleet/fleet_server_hosts' \
--header "Authorization: $API_KEY" \
--header "Content-Type: application/json" \
--header "kbn-xsrf: true" \
--data '{"host_urls":["string"],"id":"string","is_default":false,"is_internal":true,"is_preconfigured":false,"name":"string","proxy_id":"string","secrets":{"ssl":{"es_key":{"id":"string"},"key":{"id":"string"}}},"ssl":{"certificate":"string","certificate_authorities":["string"],"client_auth":"optional","es_certificate":"string","es_certificate_authorities":["string"],"es_key":"string","key":"string"}}'
Request examples
# Headers
kbn-xsrf: true
# Payload
{
"host_urls": [
"string"
],
"id": "string",
"is_default": false,
"is_internal": true,
"is_preconfigured": false,
"name": "string",
"proxy_id": "string",
"secrets": {
"ssl": {
"es_key": {
"id": "string"
},
"key": {
"id": "string"
}
}
},
"ssl": {
"certificate": "string",
"certificate_authorities": [
"string"
],
"client_auth": "optional",
"es_certificate": "string",
"es_certificate_authorities": [
"string"
],
"es_key": "string",
"key": "string"
}
}
Response examples (200)
{
"item": {
"host_urls": [
"string"
],
"id": "string",
"is_default": false,
"is_internal": true,
"is_preconfigured": false,
"name": "string",
"proxy_id": "string",
"secrets": {
"ssl": {
"es_key": {
"id": "string"
},
"key": {
"id": "string"
}
}
},
"ssl": {
"certificate": "string",
"certificate_authorities": [
"string"
],
"client_auth": "optional",
"es_certificate": "string",
"es_certificate_authorities": [
"string"
],
"es_key": "string",
"key": "string"
}
}
}
Response examples (400)
{
"error": "string",
"errorType": "string",
"message": "string",
"statusCode": 42.0
}Get a Fleet Server host
Get a Fleet Server host by ID.
[Required authorization] Route required privileges: fleet-settings-read.
Path parameters
-
itemId
string Required
GET
/api/fleet/fleet_server_hosts/{itemId}
curl \
--request GET 'http://api.example.com/api/fleet/fleet_server_hosts/{itemId}' \
--header "Authorization: $API_KEY"
Response examples (200)
{
"item": {
"host_urls": [
"string"
],
"id": "string",
"is_default": false,
"is_internal": true,
"is_preconfigured": false,
"name": "string",
"proxy_id": "string",
"secrets": {
"ssl": {
"es_key": {
"id": "string"
},
"key": {
"id": "string"
}
}
},
"ssl": {
"certificate": "string",
"certificate_authorities": [
"string"
],
"client_auth": "optional",
"es_certificate": "string",
"es_certificate_authorities": [
"string"
],
"es_key": "string",
"key": "string"
}
}
}
Response examples (400)
{
"error": "string",
"errorType": "string",
"message": "string",
"statusCode": 42.0
}Update a Fleet Server host
Update a Fleet Server host by ID.
[Required authorization] Route required privileges: fleet-settings-all.
Path parameters
-
itemId
string Required
Body
-
host_urls
array[string] At least
1element. -
is_default
boolean -
is_internal
boolean -
name
string -
proxy_id
string | null Required -
secrets
object Additional properties are NOT allowed.
-
ssl
object | null Additional properties are NOT allowed.
PUT
/api/fleet/fleet_server_hosts/{itemId}
curl \
--request PUT 'http://api.example.com/api/fleet/fleet_server_hosts/{itemId}' \
--header "Authorization: $API_KEY" \
--header "Content-Type: application/json" \
--header "kbn-xsrf: true" \
--data '{"host_urls":["string"],"is_default":true,"is_internal":true,"name":"string","proxy_id":"string","secrets":{"ssl":{"es_key":{"id":"string"},"key":{"id":"string"}}},"ssl":{"certificate":"string","certificate_authorities":["string"],"client_auth":"optional","es_certificate":"string","es_certificate_authorities":["string"],"es_key":"string","key":"string"}}'
Request examples
# Headers
kbn-xsrf: true
# Payload
{
"host_urls": [
"string"
],
"is_default": true,
"is_internal": true,
"name": "string",
"proxy_id": "string",
"secrets": {
"ssl": {
"es_key": {
"id": "string"
},
"key": {
"id": "string"
}
}
},
"ssl": {
"certificate": "string",
"certificate_authorities": [
"string"
],
"client_auth": "optional",
"es_certificate": "string",
"es_certificate_authorities": [
"string"
],
"es_key": "string",
"key": "string"
}
}
Response examples (200)
{
"item": {
"host_urls": [
"string"
],
"id": "string",
"is_default": false,
"is_internal": true,
"is_preconfigured": false,
"name": "string",
"proxy_id": "string",
"secrets": {
"ssl": {
"es_key": {
"id": "string"
},
"key": {
"id": "string"
}
}
},
"ssl": {
"certificate": "string",
"certificate_authorities": [
"string"
],
"client_auth": "optional",
"es_certificate": "string",
"es_certificate_authorities": [
"string"
],
"es_key": "string",
"key": "string"
}
}
}
Response examples (400)
{
"error": "string",
"errorType": "string",
"message": "string",
"statusCode": 42.0
}Delete a Fleet Server host
Delete a Fleet Server host by ID.
[Required authorization] Route required privileges: fleet-settings-all.
Path parameters
-
itemId
string Required
DELETE
/api/fleet/fleet_server_hosts/{itemId}
curl \
--request DELETE 'http://api.example.com/api/fleet/fleet_server_hosts/{itemId}' \
--header "Authorization: $API_KEY" \
--header "kbn-xsrf: true"
Response examples (200)
{
"id": "string"
}
Response examples (400)
{
"error": "string",
"errorType": "string",
"message": "string",
"statusCode": 42.0
}Create a service token
[Required authorization] Route required privileges: fleet-agents-all.
POST
/api/fleet/service_tokens
curl \
--request POST 'http://api.example.com/api/fleet/service_tokens' \
--header "Authorization: $API_KEY" \
--header "Content-Type: application/json" \
--header "kbn-xsrf: true" \
--data '{"remote":false}'
Request examples
# Headers
kbn-xsrf: true
# Payload
{
"remote": false
}
Response examples (200)
{
"name": "string",
"value": "string"
}
Response examples (400)
{
"error": "string",
"errorType": "string",
"message": "string",
"statusCode": 42.0
}Get metadata for latest uninstall tokens
List the metadata for the latest uninstall tokens per agent policy.
[Required authorization] Route required privileges: fleet-agents-all.
GET
/api/fleet/uninstall_tokens
curl \
--request GET 'http://api.example.com/api/fleet/uninstall_tokens' \
--header "Authorization: $API_KEY"
Response examples (200)
{
"items": [
{
"created_at": "string",
"id": "string",
"namespaces": [
"string"
],
"policy_id": "string",
"policy_name": "string"
}
],
"page": 42.0,
"perPage": 42.0,
"total": 42.0
}
Response examples (400)
{
"error": "string",
"errorType": "string",
"message": "string",
"statusCode": 42.0
}Get a decrypted uninstall token
Get one decrypted uninstall token by its ID.
[Required authorization] Route required privileges: fleet-agents-all.
Path parameters
-
uninstallTokenId
string Required
GET
/api/fleet/uninstall_tokens/{uninstallTokenId}
curl \
--request GET 'http://api.example.com/api/fleet/uninstall_tokens/{uninstallTokenId}' \
--header "Authorization: $API_KEY"
Response examples (200)
{
"item": {
"created_at": "string",
"id": "string",
"namespaces": [
"string"
],
"policy_id": "string",
"policy_name": "string",
"token": "string"
}
}
Response examples (400)
{
"error": "string",
"errorType": "string",
"message": "string",
"statusCode": 42.0
}Rotate a Fleet message signing key pair
[Required authorization] Route required privileges: fleet-agents-all AND fleet-agent-policies-all AND fleet-settings-all.
Query parameters
-
acknowledge
boolean Default value is
false.
POST
/api/fleet/message_signing_service/rotate_key_pair
curl \
--request POST 'http://api.example.com/api/fleet/message_signing_service/rotate_key_pair' \
--header "Authorization: $API_KEY" \
--header "kbn-xsrf: true"
Response examples (200)
{
"message": "string"
}
Response examples (400)
{
"error": "string",
"errorType": "string",
"message": "string",
"statusCode": 42.0
}
Response examples (500)
{
"error": "string",
"errorType": "string",
"message": "string",
"statusCode": 42.0
}Machine learning
Machine learning
Sync machine learning saved objects
Synchronizes Kibana saved objects for machine learning jobs and trained models. This API runs automatically when you start Kibana and periodically thereafter.
Query parameters
-
simulate
boolean When true, simulates the synchronization by returning only the list of actions that would be performed.
GET
/api/ml/saved_objects/sync
curl \
--request GET 'http://api.example.com/api/ml/saved_objects/sync' \
--header "Authorization: $API_KEY"
Response examples (200)
{
"datafeedsAdded": {},
"datafeedsRemoved": {},
"savedObjectsCreated": {
"anomaly-detector": {
"myjob1": {
"success": true
},
"myjob2": {
"success": true
}
}
},
"savedObjectsDeleted": {}
}
Response examples (401)
{
"error": "Unauthorized",
"message": "string",
"statusCode": 401
}Roles
Manage the roles that grant Elasticsearch and Kibana privileges.
Query parameters
-
replaceDeprecatedPrivileges
boolean If
trueand the response contains any privileges that are associated with deprecated features, they are omitted in favor of details about the appropriate replacement feature privileges.
GET
/api/security/role
curl \
--request GET 'http://api.example.com/api/security/role' \
--header "Authorization: $API_KEY"Path parameters
-
name
string Required The role name.
Minimum length is
1.
Query parameters
-
replaceDeprecatedPrivileges
boolean If
trueand the response contains any privileges that are associated with deprecated features, they are omitted in favor of details about the appropriate replacement feature privileges.
GET
/api/security/role/{name}
curl \
--request GET 'http://api.example.com/api/security/role/{name}' \
--header "Authorization: $API_KEY"Create or update a role
Create a new Kibana role or update the attributes of an existing role. Kibana roles are stored in the Elasticsearch native realm.
Path parameters
-
name
string Required The role name.
Minimum length is
1, maximum length is1024.
Query parameters
-
createOnly
boolean When true, a role is not overwritten if it already exists.
Default value is
false.
Body
-
description
string A description for the role.
Maximum length is
2048. -
elasticsearch
object Required Additional properties are NOT allowed.
-
kibana
array[object] -
metadata
object Additional properties are allowed.
PUT
/api/security/role/{name}
curl \
--request PUT 'http://api.example.com/api/security/role/{name}' \
--header "Authorization: $API_KEY" \
--header "Content-Type: application/json" \
--header "kbn-xsrf: true" \
--data '{"description":"string","elasticsearch":{"cluster":["string"],"indices":[{"allow_restricted_indices":true,"field_security":{"additionalProperty1":["string"],"additionalProperty2":["string"]},"names":["string"],"privileges":["string"],"query":"string"}],"remote_cluster":[{"clusters":["string"],"privileges":["string"]}],"remote_indices":[{"allow_restricted_indices":true,"clusters":["string"],"field_security":{"additionalProperty1":["string"],"additionalProperty2":["string"]},"names":["string"],"privileges":["string"],"query":"string"}],"run_as":["string"]},"kibana":[{"base":[],"feature":{"additionalProperty1":["string"],"additionalProperty2":["string"]},"spaces":["*"]}],"metadata":{}}'
Request examples
# Headers
kbn-xsrf: true
# Payload
{
"description": "string",
"elasticsearch": {
"cluster": [
"string"
],
"indices": [
{
"allow_restricted_indices": true,
"field_security": {
"additionalProperty1": [
"string"
],
"additionalProperty2": [
"string"
]
},
"names": [
"string"
],
"privileges": [
"string"
],
"query": "string"
}
],
"remote_cluster": [
{
"clusters": [
"string"
],
"privileges": [
"string"
]
}
],
"remote_indices": [
{
"allow_restricted_indices": true,
"clusters": [
"string"
],
"field_security": {
"additionalProperty1": [
"string"
],
"additionalProperty2": [
"string"
]
},
"names": [
"string"
],
"privileges": [
"string"
],
"query": "string"
}
],
"run_as": [
"string"
]
},
"kibana": [
{
"base": [],
"feature": {
"additionalProperty1": [
"string"
],
"additionalProperty2": [
"string"
]
},
"spaces": [
"*"
]
}
],
"metadata": {}
}Path parameters
-
name
string Required Minimum length is
1.
DELETE
/api/security/role/{name}
curl \
--request DELETE 'http://api.example.com/api/security/role/{name}' \
--header "Authorization: $API_KEY" \
--header "kbn-xsrf: true"
POST
/api/security/roles
curl \
--request POST 'http://api.example.com/api/security/roles' \
--header "Authorization: $API_KEY" \
--header "Content-Type: application/json" \
--header "kbn-xsrf: true" \
--data '{"roles":{"additionalProperty1":{"description":"string","elasticsearch":{"cluster":["string"],"indices":[{"allow_restricted_indices":true,"field_security":{"additionalProperty1":["string"],"additionalProperty2":["string"]},"names":["string"],"privileges":["string"],"query":"string"}],"remote_cluster":[{"clusters":["string"],"privileges":["string"]}],"remote_indices":[{"allow_restricted_indices":true,"clusters":["string"],"field_security":{"additionalProperty1":["string"],"additionalProperty2":["string"]},"names":["string"],"privileges":["string"],"query":"string"}],"run_as":["string"]},"kibana":[{"base":[],"feature":{"additionalProperty1":["string"],"additionalProperty2":["string"]},"spaces":["*"]}],"metadata":{}},"additionalProperty2":{"description":"string","elasticsearch":{"cluster":["string"],"indices":[{"allow_restricted_indices":true,"field_security":{"additionalProperty1":["string"],"additionalProperty2":["string"]},"names":["string"],"privileges":["string"],"query":"string"}],"remote_cluster":[{"clusters":["string"],"privileges":["string"]}],"remote_indices":[{"allow_restricted_indices":true,"clusters":["string"],"field_security":{"additionalProperty1":["string"],"additionalProperty2":["string"]},"names":["string"],"privileges":["string"],"query":"string"}],"run_as":["string"]},"kibana":[{"base":[],"feature":{"additionalProperty1":["string"],"additionalProperty2":["string"]},"spaces":["*"]}],"metadata":{}}}}'
Request examples
# Headers
kbn-xsrf: true
# Payload
{
"roles": {
"additionalProperty1": {
"description": "string",
"elasticsearch": {
"cluster": [
"string"
],
"indices": [
{
"allow_restricted_indices": true,
"field_security": {
"additionalProperty1": [
"string"
],
"additionalProperty2": [
"string"
]
},
"names": [
"string"
],
"privileges": [
"string"
],
"query": "string"
}
],
"remote_cluster": [
{
"clusters": [
"string"
],
"privileges": [
"string"
]
}
],
"remote_indices": [
{
"allow_restricted_indices": true,
"clusters": [
"string"
],
"field_security": {
"additionalProperty1": [
"string"
],
"additionalProperty2": [
"string"
]
},
"names": [
"string"
],
"privileges": [
"string"
],
"query": "string"
}
],
"run_as": [
"string"
]
},
"kibana": [
{
"base": [],
"feature": {
"additionalProperty1": [
"string"
],
"additionalProperty2": [
"string"
]
},
"spaces": [
"*"
]
}
],
"metadata": {}
},
"additionalProperty2": {
"description": "string",
"elasticsearch": {
"cluster": [
"string"
],
"indices": [
{
"allow_restricted_indices": true,
"field_security": {
"additionalProperty1": [
"string"
],
"additionalProperty2": [
"string"
]
},
"names": [
"string"
],
"privileges": [
"string"
],
"query": "string"
}
],
"remote_cluster": [
{
"clusters": [
"string"
],
"privileges": [
"string"
]
}
],
"remote_indices": [
{
"allow_restricted_indices": true,
"clusters": [
"string"
],
"field_security": {
"additionalProperty1": [
"string"
],
"additionalProperty2": [
"string"
]
},
"names": [
"string"
],
"privileges": [
"string"
],
"query": "string"
}
],
"run_as": [
"string"
]
},
"kibana": [
{
"base": [],
"feature": {
"additionalProperty1": [
"string"
],
"additionalProperty2": [
"string"
]
},
"spaces": [
"*"
]
}
],
"metadata": {}
}
}
}Saved objects
Export or import sets of saved objects.
To manage a specific type of saved object, use the corresponding APIs. For example, use:
Export saved objects
Retrieve sets of saved objects that you want to import into Kibana. You must include type or objects in the request body.
Exported saved objects are not backwards compatible and cannot be imported into an older version of Kibana.
NOTE: The savedObjects.maxImportExportSize configuration setting limits the number of saved objects which may be exported.
Body
-
excludeExportDetails
boolean Do not add export details entry at the end of the stream.
Default value is
false. hasReference
object | array[object] -
includeReferencesDeep
boolean Includes all of the referenced objects in the exported objects.
Default value is
false. -
objects
array[object] A list of objects to export. NOTE: this optiona cannot be combined with
typesoptionNot more than
10000elements. -
search
string Search for documents to export using the Elasticsearch Simple Query String syntax.
type
string | array[string] The saved object types to include in the export. Use
*to export all the types.
POST
/api/saved_objects/_export
curl \
--request POST 'http://api.example.com/api/saved_objects/_export' \
--header "Authorization: $API_KEY" \
--header "Content-Type: application/json" \
--header "kbn-xsrf: true" \
--data '{"objects":[{"id":"de71f4f0-1902-11e9-919b-ffe5949a18d2","type":"map"}],"excludeExportDetails":true,"includeReferencesDeep":false}'
Request example
{
"objects": [
{
"id": "de71f4f0-1902-11e9-919b-ffe5949a18d2",
"type": "map"
}
],
"excludeExportDetails": true,
"includeReferencesDeep": false
}
Response examples (200)
{
"id": "de71f4f0-1902-11e9-919b-ffe5949a18d2",
"type": "map",
"managed": false,
"version": "WzEzLDFd",
"attributes": {
"title": "[Logs] Total Requests and Bytes",
"description": "",
"uiStateJSON": "{\"isDarkMode\":false}",
"mapStateJSON": "{\"zoom\":3.64,\"center\":{\"lon\":-88.92107,\"lat\":42.16337},\"timeFilters\":{\"from\":\"now-7d\",\"to\":\"now\"},\"refreshConfig\":{\"isPaused\":true,\"interval\":0},\"query\":{\"language\":\"kuery\",\"query\":\"\"},\"settings\":{\"autoFitToDataBounds\":false}}",
"layerListJSON": "[{\"id\":\"0hmz5\",\"alpha\":1,\"sourceDescriptor\":{\"type\":\"EMS_TMS\",\"isAutoSelect\":true,\"lightModeDefault\":\"road_map_desaturated\"},\"visible\":true,\"style\":{},\"type\":\"EMS_VECTOR_TILE\",\"minZoom\":0,\"maxZoom\":24},{\"id\":\"edh66\",\"label\":\"Total Requests by Destination\",\"minZoom\":0,\"maxZoom\":24,\"alpha\":0.5,\"sourceDescriptor\":{\"type\":\"EMS_FILE\",\"id\":\"world_countries\",\"tooltipProperties\":[\"name\",\"iso2\"]},\"visible\":true,\"style\":{\"type\":\"VECTOR\",\"properties\":{\"fillColor\":{\"type\":\"DYNAMIC\",\"options\":{\"field\":{\"name\":\"__kbnjoin__count__673ff994-fc75-4c67-909b-69fcb0e1060e\",\"origin\":\"join\"},\"color\":\"Greys\",\"fieldMetaOptions\":{\"isEnabled\":false,\"sigma\":3}}},\"lineColor\":{\"type\":\"STATIC\",\"options\":{\"color\":\"#FFFFFF\"}},\"lineWidth\":{\"type\":\"STATIC\",\"options\":{\"size\":1}},\"iconSize\":{\"type\":\"STATIC\",\"options\":{\"size\":10}},\"symbolizeAs\":{\"options\":{\"value\":\"circle\"}},\"icon\":{\"type\":\"STATIC\",\"options\":{\"value\":\"marker\"}}}},\"type\":\"GEOJSON_VECTOR\",\"joins\":[{\"leftField\":\"iso2\",\"right\":{\"type\":\"ES_TERM_SOURCE\",\"id\":\"673ff994-fc75-4c67-909b-69fcb0e1060e\",\"indexPatternTitle\":\"kibana_sample_data_logs\",\"term\":\"geo.dest\",\"indexPatternRefName\":\"layer_1_join_0_index_pattern\",\"metrics\":[{\"type\":\"count\",\"label\":\"web logs count\"}],\"applyGlobalQuery\":true}}]},{\"id\":\"gaxya\",\"label\":\"Actual Requests\",\"minZoom\":9,\"maxZoom\":24,\"alpha\":1,\"sourceDescriptor\":{\"id\":\"b7486535-171b-4d3b-bb2e-33c1a0a2854c\",\"type\":\"ES_SEARCH\",\"geoField\":\"geo.coordinates\",\"limit\":2048,\"filterByMapBounds\":true,\"tooltipProperties\":[\"clientip\",\"timestamp\",\"host\",\"request\",\"response\",\"machine.os\",\"agent\",\"bytes\"],\"indexPatternRefName\":\"layer_2_source_index_pattern\",\"applyGlobalQuery\":true,\"scalingType\":\"LIMIT\"},\"visible\":true,\"style\":{\"type\":\"VECTOR\",\"properties\":{\"fillColor\":{\"type\":\"STATIC\",\"options\":{\"color\":\"#2200ff\"}},\"lineColor\":{\"type\":\"STATIC\",\"options\":{\"color\":\"#FFFFFF\"}},\"lineWidth\":{\"type\":\"STATIC\",\"options\":{\"size\":2}},\"iconSize\":{\"type\":\"DYNAMIC\",\"options\":{\"field\":{\"name\":\"bytes\",\"origin\":\"source\"},\"minSize\":1,\"maxSize\":23,\"fieldMetaOptions\":{\"isEnabled\":false,\"sigma\":3}}},\"symbolizeAs\":{\"options\":{\"value\":\"circle\"}},\"icon\":{\"type\":\"STATIC\",\"options\":{\"value\":\"marker\"}}}},\"type\":\"GEOJSON_VECTOR\"},{\"id\":\"tfi3f\",\"label\":\"Total Requests and Bytes\",\"minZoom\":0,\"maxZoom\":9,\"alpha\":1,\"sourceDescriptor\":{\"type\":\"ES_GEO_GRID\",\"resolution\":\"COARSE\",\"id\":\"8aaa65b5-a4e9-448b-9560-c98cb1c5ac5b\",\"geoField\":\"geo.coordinates\",\"requestType\":\"point\",\"metrics\":[{\"type\":\"count\",\"label\":\"web logs count\"},{\"type\":\"sum\",\"field\":\"bytes\"}],\"indexPatternRefName\":\"layer_3_source_index_pattern\",\"applyGlobalQuery\":true},\"visible\":true,\"style\":{\"type\":\"VECTOR\",\"properties\":{\"fillColor\":{\"type\":\"DYNAMIC\",\"options\":{\"field\":{\"name\":\"doc_count\",\"origin\":\"source\"},\"color\":\"Blues\",\"fieldMetaOptions\":{\"isEnabled\":false,\"sigma\":3}}},\"lineColor\":{\"type\":\"STATIC\",\"options\":{\"color\":\"#cccccc\"}},\"lineWidth\":{\"type\":\"STATIC\",\"options\":{\"size\":1}},\"iconSize\":{\"type\":\"DYNAMIC\",\"options\":{\"field\":{\"name\":\"sum_of_bytes\",\"origin\":\"source\"},\"minSize\":7,\"maxSize\":25,\"fieldMetaOptions\":{\"isEnabled\":false,\"sigma\":3}}},\"labelText\":{\"type\":\"DYNAMIC\",\"options\":{\"field\":{\"name\":\"doc_count\",\"origin\":\"source\"},\"fieldMetaOptions\":{\"isEnabled\":false,\"sigma\":3}}},\"labelSize\":{\"type\":\"DYNAMIC\",\"options\":{\"field\":{\"name\":\"doc_count\",\"origin\":\"source\"},\"minSize\":12,\"maxSize\":24,\"fieldMetaOptions\":{\"isEnabled\":false,\"sigma\":3}}},\"symbolizeAs\":{\"options\":{\"value\":\"circle\"}},\"icon\":{\"type\":\"STATIC\",\"options\":{\"value\":\"marker\"}}}},\"type\":\"GEOJSON_VECTOR\"}]"
},
"created_at": "2023-08-23T20:03:32.204Z",
"references": [
{
"id": "90943e30-9a47-11e8-b64d-95841ca0b247",
"name": "layer_1_join_0_index_pattern",
"type": "index-pattern"
},
{
"id": "90943e30-9a47-11e8-b64d-95841ca0b247",
"name": "layer_2_source_index_pattern",
"type": "index-pattern"
},
{
"id": "90943e30-9a47-11e8-b64d-95841ca0b247",
"name": "layer_3_source_index_pattern",
"type": "index-pattern"
}
],
"updated_at": "2023-08-23T20:03:32.204Z",
"coreMigrationVersion": "8.8.0",
"typeMigrationVersion": "8.4.0"
}
Response examples (400)
{
"error": "string",
"message": "string",
"statusCode": 400
}Import saved objects
Create sets of Kibana saved objects from a file created by the export API. Saved objects can only be imported into the same version, a newer minor on the same major, or the next major. Exported saved objects are not backwards compatible and cannot be imported into an older version of Kibana.
Query parameters
-
overwrite
boolean Overwrites saved objects when they already exist. When used, potential conflict errors are automatically resolved by overwriting the destination object. NOTE: This option cannot be used with the
createNewCopiesoption.Default value is
false. -
createNewCopies
boolean Creates copies of saved objects, regenerates each object ID, and resets the origin. When used, potential conflict errors are avoided. NOTE: This option cannot be used with the
overwriteandcompatibilityModeoptions.Default value is
false. -
compatibilityMode
boolean Applies various adjustments to the saved objects that are being imported to maintain compatibility between different Kibana versions. Use this option only if you encounter issues with imported saved objects. NOTE: This option cannot be used with the
createNewCopiesoption.Default value is
false.
Body
-
file
object Required A file exported using the export API. Changing the contents of the exported file in any way before importing it can cause errors, crashes or data loss. NOTE: The
savedObjects.maxImportExportSizeconfiguration setting limits the number of saved objects which may be included in this file. Similarly, thesavedObjects.maxImportPayloadBytessetting limits the overall size of the file that can be imported.
POST
/api/saved_objects/_import
curl \
-X POST api/saved_objects/_import?createNewCopies=true
-H "kbn-xsrf: true"
--form file=@file.ndjson
Request example
{"file"=>"file.ndjson"}
Response examples (200)
{
"success": true,
"successCount": 1,
"successResults": [
{
"id": "90943e30-9a47-11e8-b64d-95841ca0b247",
"meta": {
"icon": "indexPatternApp",
"title": "Kibana Sample Data Logs"
},
"type": "index-pattern",
"managed": false,
"destinationId": "82d2760c-468f-49cf-83aa-b9a35b6a8943"
}
]
}
Response examples (400)
{
"error": "string",
"message": "string",
"statusCode": 400
}Security AI assistant
Manage and interact with Security Assistant resources.
Apply a bulk action to anonymization fields
Apply a bulk action to multiple anonymization fields. The bulk action is applied to all anonymization fields that match the filter or to the list of anonymization fields by their IDs.
POST
/api/security_ai_assistant/anonymization_fields/_bulk_action
curl \
--request POST 'http://api.example.com/api/security_ai_assistant/anonymization_fields/_bulk_action' \
--header "Authorization: $API_KEY" \
--header "Content-Type: application/json" \
--data '{"create":[{"allowed":true,"anonymized":true,"field":"string"}],"delete":{"ids":["string"],"query":"string"},"update":[{"allowed":true,"anonymized":true,"id":"string"}]}'
Request examples
{
"create": [
{
"allowed": true,
"anonymized": true,
"field": "string"
}
],
"delete": {
"ids": [
"string"
],
"query": "string"
},
"update": [
{
"allowed": true,
"anonymized": true,
"id": "string"
}
]
}
Response examples (200)
{
"anonymization_fields_count": 42,
"attributes": {
"errors": [
{
"anonymization_fields": [
{
"id": "string",
"name": "string"
}
],
"err_code": "string",
"message": "string",
"status_code": 42
}
],
"results": {
"created": [
{
"allowed": true,
"anonymized": true,
"createdAt": "string",
"createdBy": "string",
"field": "string",
"id": "string",
"namespace": "string",
"timestamp": "string",
"updatedAt": "string",
"updatedBy": "string"
}
],
"deleted": [
"string"
],
"skipped": [
{
"id": "string",
"name": "string",
"skip_reason": "ANONYMIZATION_FIELD_NOT_MODIFIED"
}
],
"updated": [
{
"allowed": true,
"anonymized": true,
"createdAt": "string",
"createdBy": "string",
"field": "string",
"id": "string",
"namespace": "string",
"timestamp": "string",
"updatedAt": "string",
"updatedBy": "string"
}
]
},
"summary": {
"failed": 42,
"skipped": 42,
"succeeded": 42,
"total": 42
}
},
"message": "string",
"status_code": 42,
"success": true
}
Response examples (400)
{
"error": "string",
"message": "string",
"statusCode": 42.0
}Get anonymization fields
Get a list of all anonymization fields.
Query parameters
-
fields
array[string] -
filter
string Search query
-
sort_field
string Field to sort by
Values are
created_at,anonymized,allowed,field, orupdated_at. -
sort_order
string Sort order
Values are
ascordesc. -
page
integer Page number
Minimum value is
1. Default value is1. -
per_page
integer AnonymizationFields per page
Minimum value is
0. Default value is20.
GET
/api/security_ai_assistant/anonymization_fields/_find
curl \
--request GET 'http://api.example.com/api/security_ai_assistant/anonymization_fields/_find' \
--header "Authorization: $API_KEY"
Response examples (200)
{
"data": [
{
"allowed": true,
"anonymized": true,
"createdAt": "string",
"createdBy": "string",
"field": "string",
"id": "string",
"namespace": "string",
"timestamp": "string",
"updatedAt": "string",
"updatedBy": "string"
}
],
"page": 42,
"perPage": 42,
"total": 42
}
Response examples (400)
{
"error": "string",
"message": "string",
"statusCode": 42.0
}Create a model response
Create a model response for the given chat conversation.
Query parameters
-
content_references_disabled
boolean If true, the response will not include content references.
Default value is
false.
Body
Required
-
connectorId
string Required -
conversationId
string(nonempty) A string that does not contain only whitespace characters
Minimum length is
1. -
isStream
boolean -
langSmithApiKey
string -
langSmithProject
string -
messages
array[object] Required AI assistant message.
-
model
string -
persist
boolean Required -
promptId
string -
responseLanguage
string
POST
/api/security_ai_assistant/chat/complete
curl \
--request POST 'http://api.example.com/api/security_ai_assistant/chat/complete' \
--header "Authorization: $API_KEY" \
--header "Content-Type: application/json" \
--data '{"connectorId":"string","conversationId":"string","isStream":true,"langSmithApiKey":"string","langSmithProject":"string","messages":[{"content":"string","data":{},"fields_to_anonymize":["string"],"role":"system"}],"model":"string","persist":true,"promptId":"string","responseLanguage":"string"}'
Request examples
{
"connectorId": "string",
"conversationId": "string",
"isStream": true,
"langSmithApiKey": "string",
"langSmithProject": "string",
"messages": [
{
"content": "string",
"data": {},
"fields_to_anonymize": [
"string"
],
"role": "system"
}
],
"model": "string",
"persist": true,
"promptId": "string",
"responseLanguage": "string"
}
Response examples (400)
{
"error": "string",
"message": "string",
"statusCode": 42.0
}Create a conversation
Create a new Security AI Assistant conversation.
Body
Required
-
apiConfig
object LLM API configuration.
-
category
string The conversation category.
Values are
assistantorinsights. -
excludeFromLastConversationStorage.
-
id
string The conversation id.
-
messages
array[object] The conversation messages.
AI assistant conversation message.
-
replacements
object Replacements object used to anonymize/deanomymize messsages
-
title
string Required The conversation title.
POST
/api/security_ai_assistant/current_user/conversations
curl \
--request POST 'http://api.example.com/api/security_ai_assistant/current_user/conversations' \
--header "Authorization: $API_KEY" \
--header "Content-Type: application/json" \
--data '{"apiConfig":{"actionTypeId":"string","connectorId":"string","defaultSystemPromptId":"string","model":"string","provider":"OpenAI"},"category":"assistant","excludeFromLastConversationStorage":true,"id":"string","messages":[{"content":"string","isError":true,"metadata":{"contentReferences":{}},"reader":{},"role":"system","timestamp":"string","traceData":{"traceId":"string","transactionId":"string"}}],"replacements":{"additionalProperty1":"string","additionalProperty2":"string"},"title":"string"}'
Request examples
{
"apiConfig": {
"actionTypeId": "string",
"connectorId": "string",
"defaultSystemPromptId": "string",
"model": "string",
"provider": "OpenAI"
},
"category": "assistant",
"excludeFromLastConversationStorage": true,
"id": "string",
"messages": [
{
"content": "string",
"isError": true,
"metadata": {
"contentReferences": {}
},
"reader": {},
"role": "system",
"timestamp": "string",
"traceData": {
"traceId": "string",
"transactionId": "string"
}
}
],
"replacements": {
"additionalProperty1": "string",
"additionalProperty2": "string"
},
"title": "string"
}
Response examples (200)
{
"apiConfig": {
"actionTypeId": "string",
"connectorId": "string",
"defaultSystemPromptId": "string",
"model": "string",
"provider": "OpenAI"
},
"category": "assistant",
"createdAt": "string",
"excludeFromLastConversationStorage": true,
"id": "string",
"messages": [
{
"content": "string",
"isError": true,
"metadata": {
"contentReferences": {}
},
"reader": {},
"role": "system",
"timestamp": "string",
"traceData": {
"traceId": "string",
"transactionId": "string"
}
}
],
"namespace": "string",
"replacements": {
"additionalProperty1": "string",
"additionalProperty2": "string"
},
"summary": {
"confidence": "low",
"content": "string",
"public": true,
"timestamp": "string"
},
"timestamp": "string",
"title": "string",
"updatedAt": "string",
"users": [
{
"id": "string",
"name": "string"
}
]
}
Response examples (400)
{
"error": "string",
"message": "string",
"statusCode": 42.0
}Get conversations
Get a list of all conversations for the current user.
Query parameters
-
fields
array[string] -
filter
string Search query
-
sort_field
string Field to sort by
Values are
created_at,title, orupdated_at. -
sort_order
string Sort order
Values are
ascordesc. -
page
integer Page number
Minimum value is
1. Default value is1. -
per_page
integer Conversations per page
Minimum value is
0. Default value is20.
GET
/api/security_ai_assistant/current_user/conversations/_find
curl \
--request GET 'http://api.example.com/api/security_ai_assistant/current_user/conversations/_find' \
--header "Authorization: $API_KEY"
Response examples (200)
{
"data": [
{
"apiConfig": {
"actionTypeId": "string",
"connectorId": "string",
"defaultSystemPromptId": "string",
"model": "string",
"provider": "OpenAI"
},
"category": "assistant",
"createdAt": "string",
"excludeFromLastConversationStorage": true,
"id": "string",
"messages": [
{
"content": "string",
"isError": true,
"metadata": {
"contentReferences": {}
},
"reader": {},
"role": "system",
"timestamp": "string",
"traceData": {
"traceId": "string",
"transactionId": "string"
}
}
],
"namespace": "string",
"replacements": {
"additionalProperty1": "string",
"additionalProperty2": "string"
},
"summary": {
"confidence": "low",
"content": "string",
"public": true,
"timestamp": "string"
},
"timestamp": "string",
"title": "string",
"updatedAt": "string",
"users": [
{
"id": "string",
"name": "string"
}
]
}
],
"page": 42,
"perPage": 42,
"total": 42
}
Response examples (400)
{
"error": "string",
"message": "string",
"statusCode": 42.0
}Get a conversation
Get the details of an existing conversation using the conversation ID.
Path parameters
-
id
string(nonempty) Required The conversation's
idvalue.Minimum length is
1.
GET
/api/security_ai_assistant/current_user/conversations/{id}
curl \
--request GET 'http://api.example.com/api/security_ai_assistant/current_user/conversations/{id}' \
--header "Authorization: $API_KEY"
Response examples (200)
{
"apiConfig": {
"actionTypeId": "string",
"connectorId": "string",
"defaultSystemPromptId": "string",
"model": "string",
"provider": "OpenAI"
},
"category": "assistant",
"createdAt": "string",
"excludeFromLastConversationStorage": true,
"id": "string",
"messages": [
{
"content": "string",
"isError": true,
"metadata": {
"contentReferences": {}
},
"reader": {},
"role": "system",
"timestamp": "string",
"traceData": {
"traceId": "string",
"transactionId": "string"
}
}
],
"namespace": "string",
"replacements": {
"additionalProperty1": "string",
"additionalProperty2": "string"
},
"summary": {
"confidence": "low",
"content": "string",
"public": true,
"timestamp": "string"
},
"timestamp": "string",
"title": "string",
"updatedAt": "string",
"users": [
{
"id": "string",
"name": "string"
}
]
}
Response examples (400)
{
"error": "string",
"message": "string",
"statusCode": 42.0
}Update a conversation
Update an existing conversation using the conversation ID.
Path parameters
-
id
string(nonempty) Required The conversation's
idvalue.Minimum length is
1.
Body
Required
-
apiConfig
object LLM API configuration.
-
category
string The conversation category.
Values are
assistantorinsights. -
excludeFromLastConversationStorage.
-
id
string(nonempty) Required A string that does not contain only whitespace characters
Minimum length is
1. -
messages
array[object] The conversation messages.
AI assistant conversation message.
-
replacements
object Replacements object used to anonymize/deanomymize messsages
-
summary
object -
title
string The conversation title.
PUT
/api/security_ai_assistant/current_user/conversations/{id}
curl \
--request PUT 'http://api.example.com/api/security_ai_assistant/current_user/conversations/{id}' \
--header "Authorization: $API_KEY" \
--header "Content-Type: application/json" \
--data '{"apiConfig":{"actionTypeId":"string","connectorId":"string","defaultSystemPromptId":"string","model":"string","provider":"OpenAI"},"category":"assistant","excludeFromLastConversationStorage":true,"id":"string","messages":[{"content":"string","isError":true,"metadata":{"contentReferences":{}},"reader":{},"role":"system","timestamp":"string","traceData":{"traceId":"string","transactionId":"string"}}],"replacements":{"additionalProperty1":"string","additionalProperty2":"string"},"summary":{"confidence":"low","content":"string","public":true,"timestamp":"string"},"title":"string"}'
Request examples
{
"apiConfig": {
"actionTypeId": "string",
"connectorId": "string",
"defaultSystemPromptId": "string",
"model": "string",
"provider": "OpenAI"
},
"category": "assistant",
"excludeFromLastConversationStorage": true,
"id": "string",
"messages": [
{
"content": "string",
"isError": true,
"metadata": {
"contentReferences": {}
},
"reader": {},
"role": "system",
"timestamp": "string",
"traceData": {
"traceId": "string",
"transactionId": "string"
}
}
],
"replacements": {
"additionalProperty1": "string",
"additionalProperty2": "string"
},
"summary": {
"confidence": "low",
"content": "string",
"public": true,
"timestamp": "string"
},
"title": "string"
}
Response examples (200)
{
"apiConfig": {
"actionTypeId": "string",
"connectorId": "string",
"defaultSystemPromptId": "string",
"model": "string",
"provider": "OpenAI"
},
"category": "assistant",
"createdAt": "string",
"excludeFromLastConversationStorage": true,
"id": "string",
"messages": [
{
"content": "string",
"isError": true,
"metadata": {
"contentReferences": {}
},
"reader": {},
"role": "system",
"timestamp": "string",
"traceData": {
"traceId": "string",
"transactionId": "string"
}
}
],
"namespace": "string",
"replacements": {
"additionalProperty1": "string",
"additionalProperty2": "string"
},
"summary": {
"confidence": "low",
"content": "string",
"public": true,
"timestamp": "string"
},
"timestamp": "string",
"title": "string",
"updatedAt": "string",
"users": [
{
"id": "string",
"name": "string"
}
]
}
Response examples (400)
{
"error": "string",
"message": "string",
"statusCode": 42.0
}Delete a conversation
Delete an existing conversation using the conversation ID.
Path parameters
-
id
string(nonempty) Required The conversation's
idvalue.Minimum length is
1.
DELETE
/api/security_ai_assistant/current_user/conversations/{id}
curl \
--request DELETE 'http://api.example.com/api/security_ai_assistant/current_user/conversations/{id}' \
--header "Authorization: $API_KEY"
Response examples (200)
{
"apiConfig": {
"actionTypeId": "string",
"connectorId": "string",
"defaultSystemPromptId": "string",
"model": "string",
"provider": "OpenAI"
},
"category": "assistant",
"createdAt": "string",
"excludeFromLastConversationStorage": true,
"id": "string",
"messages": [
{
"content": "string",
"isError": true,
"metadata": {
"contentReferences": {}
},
"reader": {},
"role": "system",
"timestamp": "string",
"traceData": {
"traceId": "string",
"transactionId": "string"
}
}
],
"namespace": "string",
"replacements": {
"additionalProperty1": "string",
"additionalProperty2": "string"
},
"summary": {
"confidence": "low",
"content": "string",
"public": true,
"timestamp": "string"
},
"timestamp": "string",
"title": "string",
"updatedAt": "string",
"users": [
{
"id": "string",
"name": "string"
}
]
}
Response examples (400)
{
"error": "string",
"message": "string",
"statusCode": 42.0
}Path parameters
-
resource
string The KnowledgeBase
resourcevalue.
GET
/api/security_ai_assistant/knowledge_base/{resource}
curl \
--request GET 'http://api.example.com/api/security_ai_assistant/knowledge_base/{resource}' \
--header "Authorization: $API_KEY"
Response examples (200)
{
"elser_exists": true,
"is_setup_available": true,
"is_setup_in_progress": true,
"product_documentation_status": "string",
"security_labs_exists": true,
"user_data_exists": true
}
Response examples (400)
{
"error": "string",
"message": "string",
"statusCode": 42.0
}Create a KnowledgeBase
Create a KnowledgeBase
Path parameters
-
resource
string The KnowledgeBase
resourcevalue.
Query parameters
-
modelId
string Optional ELSER modelId to use when setting up the Knowledge Base
-
ignoreSecurityLabs
boolean Indicates whether we should or should not install Security Labs docs when setting up the Knowledge Base
Default value is
false.
POST
/api/security_ai_assistant/knowledge_base/{resource}
curl \
--request POST 'http://api.example.com/api/security_ai_assistant/knowledge_base/{resource}' \
--header "Authorization: $API_KEY"
Response examples (200)
{
"success": true
}
Response examples (400)
{
"error": "string",
"message": "string",
"statusCode": 42.0
}Create a Knowledge Base Entry
Create a Knowledge Base Entry
Body
object
Required
-
global
boolean Whether this Knowledge Base Entry is global, defaults to false
-
name
string Required Name of the Knowledge Base Entry
-
namespace
string Kibana Space, defaults to 'default' space
-
users
array[object] Users who have access to the Knowledge Base Entry, defaults to current user. Empty array provides access to all users.
Could be any string, not necessarily a UUID
-
kbResource
string Required Knowledge Base resource name for grouping entries, e.g. 'security_labs', 'user', etc
Values are
security_labsoruser. -
source
string Required Source document name or filepath
-
text
string Required Knowledge Base Entry content
-
type
string Required Discriminator Entry type
Value is
document. -
required
boolean Whether this resource should always be included, defaults to false
-
vector
object Object containing Knowledge Base Entry text embeddings and modelId used to create the embeddings
POST
/api/security_ai_assistant/knowledge_base/entries
curl \
--request POST 'http://api.example.com/api/security_ai_assistant/knowledge_base/entries' \
--header "Authorization: $API_KEY" \
--header "Content-Type: application/json" \
--data '{"global":true,"name":"string","namespace":"string","users":[{"id":"string","name":"string"}],"kbResource":"security_labs","source":"string","text":"string","type":"document","required":true,"vector":{"modelId":"string","tokens":{"additionalProperty1":42.0,"additionalProperty2":42.0}}}'
Request examples
Security_ai_assistant_api_documententrycreatefields
{
"global": true,
"name": "string",
"namespace": "string",
"users": [
{
"id": "string",
"name": "string"
}
],
"kbResource": "security_labs",
"source": "string",
"text": "string",
"type": "document",
"required": true,
"vector": {
"modelId": "string",
"tokens": {
"additionalProperty1": 42.0,
"additionalProperty2": 42.0
}
}
}{
"global": true,
"name": "string",
"namespace": "string",
"users": [
{
"id": "string",
"name": "string"
}
],
"description": "string",
"field": "string",
"index": "string",
"queryDescription": "string",
"type": "index",
"inputSchema": [
{
"description": "string",
"fieldName": "string",
"fieldType": "string"
}
],
"outputFields": [
"string"
]
}
Response examples (200)
Security_ai_assistant_api_documententryresponsefields
{
"global": true,
"name": "string",
"namespace": "string",
"users": [
{
"id": "string",
"name": "string"
}
],
"createdAt": "string",
"createdBy": "string",
"id": "string",
"updatedAt": "string",
"updatedBy": "string",
"kbResource": "security_labs",
"source": "string",
"text": "string",
"type": "document",
"required": true,
"vector": {
"modelId": "string",
"tokens": {
"additionalProperty1": 42.0,
"additionalProperty2": 42.0
}
}
}{
"global": true,
"name": "string",
"namespace": "string",
"users": [
{
"id": "string",
"name": "string"
}
],
"createdAt": "string",
"createdBy": "string",
"id": "string",
"updatedAt": "string",
"updatedBy": "string",
"description": "string",
"field": "string",
"index": "string",
"queryDescription": "string",
"type": "index",
"inputSchema": [
{
"description": "string",
"fieldName": "string",
"fieldType": "string"
}
],
"outputFields": [
"string"
]
}
Response examples (400)
{
"error": "string",
"message": "string",
"statusCode": 42.0
}Applies a bulk action to multiple Knowledge Base Entries
The bulk action is applied to all Knowledge Base Entries that match the filter or to the list of Knowledge Base Entries by their IDs
POST
/api/security_ai_assistant/knowledge_base/entries/_bulk_action
curl \
--request POST 'http://api.example.com/api/security_ai_assistant/knowledge_base/entries/_bulk_action' \
--header "Authorization: $API_KEY" \
--header "Content-Type: application/json" \
--data '{"create":[{"global":true,"name":"string","namespace":"string","users":[{"id":"string","name":"string"}],"kbResource":"security_labs","source":"string","text":"string","type":"document","required":true,"vector":{"modelId":"string","tokens":{"additionalProperty1":42.0,"additionalProperty2":42.0}}}],"delete":{"ids":["string"],"query":"string"},"update":[{"global":true,"id":"string","name":"string","namespace":"string","users":[{"id":"string","name":"string"}],"kbResource":"security_labs","source":"string","text":"string","type":"document","required":true,"vector":{"modelId":"string","tokens":{"additionalProperty1":42.0,"additionalProperty2":42.0}}}]}'
Request examples
{
"create": [
{
"global": true,
"name": "string",
"namespace": "string",
"users": [
{
"id": "string",
"name": "string"
}
],
"kbResource": "security_labs",
"source": "string",
"text": "string",
"type": "document",
"required": true,
"vector": {
"modelId": "string",
"tokens": {
"additionalProperty1": 42.0,
"additionalProperty2": 42.0
}
}
}
],
"delete": {
"ids": [
"string"
],
"query": "string"
},
"update": [
{
"global": true,
"id": "string",
"name": "string",
"namespace": "string",
"users": [
{
"id": "string",
"name": "string"
}
],
"kbResource": "security_labs",
"source": "string",
"text": "string",
"type": "document",
"required": true,
"vector": {
"modelId": "string",
"tokens": {
"additionalProperty1": 42.0,
"additionalProperty2": 42.0
}
}
}
]
}
Response examples (200)
{
"attributes": {
"errors": [
{
"err_code": "string",
"knowledgeBaseEntries": [
{
"id": "string",
"name": "string"
}
],
"message": "string",
"statusCode": 42
}
],
"results": {
"created": [
{
"global": true,
"name": "string",
"namespace": "string",
"users": [
{
"id": "string",
"name": "string"
}
],
"createdAt": "string",
"createdBy": "string",
"id": "string",
"updatedAt": "string",
"updatedBy": "string",
"kbResource": "security_labs",
"source": "string",
"text": "string",
"type": "document",
"required": true,
"vector": {
"modelId": "string",
"tokens": {
"additionalProperty1": 42.0,
"additionalProperty2": 42.0
}
}
}
],
"deleted": [
"string"
],
"skipped": [
{
"id": "string",
"name": "string",
"skip_reason": "KNOWLEDGE_BASE_ENTRY_NOT_MODIFIED"
}
],
"updated": [
{
"global": true,
"name": "string",
"namespace": "string",
"users": [
{
"id": "string",
"name": "string"
}
],
"createdAt": "string",
"createdBy": "string",
"id": "string",
"updatedAt": "string",
"updatedBy": "string",
"kbResource": "security_labs",
"source": "string",
"text": "string",
"type": "document",
"required": true,
"vector": {
"modelId": "string",
"tokens": {
"additionalProperty1": 42.0,
"additionalProperty2": 42.0
}
}
}
]
},
"summary": {
"failed": 42,
"skipped": 42,
"succeeded": 42,
"total": 42
}
},
"knowledgeBaseEntriesCount": 42,
"message": "string",
"statusCode": 42,
"success": true
}
Response examples (400)
{
"error": "string",
"message": "string",
"statusCode": 42.0
}Finds Knowledge Base Entries that match the given query.
Finds Knowledge Base Entries that match the given query.
Query parameters
-
fields
array[string] -
filter
string Search query
-
sort_field
string Field to sort by
Values are
created_at,is_default,title, orupdated_at. -
sort_order
string Sort order
Values are
ascordesc. -
page
integer Page number
Minimum value is
1. Default value is1. -
per_page
integer Knowledge Base Entries per page
Minimum value is
0. Default value is20.
GET
/api/security_ai_assistant/knowledge_base/entries/_find
curl \
--request GET 'http://api.example.com/api/security_ai_assistant/knowledge_base/entries/_find' \
--header "Authorization: $API_KEY"
Response examples (200)
{
"data": [
{
"global": true,
"name": "string",
"namespace": "string",
"users": [
{
"id": "string",
"name": "string"
}
],
"createdAt": "string",
"createdBy": "string",
"id": "string",
"updatedAt": "string",
"updatedBy": "string",
"kbResource": "security_labs",
"source": "string",
"text": "string",
"type": "document",
"required": true,
"vector": {
"modelId": "string",
"tokens": {
"additionalProperty1": 42.0,
"additionalProperty2": 42.0
}
}
}
],
"page": 42,
"perPage": 42,
"total": 42
}
Response examples (400)
{
"error": "string",
"message": "string",
"statusCode": 42.0
}Read a Knowledge Base Entry
Read a Knowledge Base Entry
Path parameters
-
id
string(nonempty) Required The Knowledge Base Entry's
idvalue.Minimum length is
1.
GET
/api/security_ai_assistant/knowledge_base/entries/{id}
curl \
--request GET 'http://api.example.com/api/security_ai_assistant/knowledge_base/entries/{id}' \
--header "Authorization: $API_KEY"
Response examples (200)
Security_ai_assistant_api_documententryresponsefields
{
"global": true,
"name": "string",
"namespace": "string",
"users": [
{
"id": "string",
"name": "string"
}
],
"createdAt": "string",
"createdBy": "string",
"id": "string",
"updatedAt": "string",
"updatedBy": "string",
"kbResource": "security_labs",
"source": "string",
"text": "string",
"type": "document",
"required": true,
"vector": {
"modelId": "string",
"tokens": {
"additionalProperty1": 42.0,
"additionalProperty2": 42.0
}
}
}{
"global": true,
"name": "string",
"namespace": "string",
"users": [
{
"id": "string",
"name": "string"
}
],
"createdAt": "string",
"createdBy": "string",
"id": "string",
"updatedAt": "string",
"updatedBy": "string",
"description": "string",
"field": "string",
"index": "string",
"queryDescription": "string",
"type": "index",
"inputSchema": [
{
"description": "string",
"fieldName": "string",
"fieldType": "string"
}
],
"outputFields": [
"string"
]
}
Response examples (400)
{
"error": "string",
"message": "string",
"statusCode": 42.0
}