Create a security project

POST /api/v1/serverless/projects/security

The response will include the created project details, such as the project ID, the credentials to access the project, and the endpoints to access different apps such as Elasticsearch and Kibana. The credentials can be regenerated at any time using the _reset-credentials endpoint.

Query parameters

exclude_credentials boolean

If true, the username and password fields in the response credentials are set to empty strings and no usable credentials are returned. Credentials can be retrieved later using the _reset-credentials endpoint.

application/json

Body Required

Configuration of the security project to create.

name string Required

Descriptive name for a project.

Minimum length is 1, maximum length is 255.
alias string

A custom domain label compatible with RFC-1035 standards. Derived from the project name by default.

Minimum length is 1, maximum length is 50. Format should match the following pattern: ^[a-zA-Z]{1}(?:[a-zA-Z0-9-]*[a-zA-Z0-9]{1})?$.
region_id string Required

Unique human-readable identifier for a region in Elastic Cloud.
admin_features_package string

admin features package (BYOK, BYOIDP, CCS, CCR)

Values are standard or enterprise.
product_types array[object]

Defines Security product type object with product line and tier dimensions.

At least 1 but not more than 3 elements. Default value is [{"product_line" => "security", "product_tier" => "complete"}, {"product_line" => "cloud", "product_tier" => "complete"}, {"product_line" => "endpoint", "product_tier" => "complete"}].
Hide product_types attributes Show product_types attributes object
Defines Security product type object with product line and tier dimensions.
- product_line string Required
  
  The identifier of the Security Solution product line.
  
  Values are security, cloud, or endpoint.
- product_tier string Required
  
  The identifier of the Security Solution product tier.
  
  Values are complete or essentials.
search_lake object

Configuration for the entire set of capabilities that make the data searchable in Security.
Hide search_lake attribute Show search_lake attribute object
- data_retention object | null
  
  Configuration to control the data retention in Elasticsearch data streams.
  Hide data_retention attributes Show data_retention attributes object | null
  
  max_retention_days integer | null
  
  Maximum number of days allowed for retaining data in Elasticsearch data streams. Can be set to "null" for unlimited. A default of 396 will be applied if no value is specified on project creation.
  
  Minimum value is 7, maximum value is 3681.
  
  default_retention_days integer | null
  
  Default number of days during which data remains available in Elasticsearch data streams. Can be set to "null" for unlimited. A default of 396 will be applied if no value is specified on project creation.
  
  Minimum value is 7, maximum value is 3681.
traffic_filters array[object]

traffic filters IDs
Hide traffic_filters attribute Show traffic_filters attribute object
traffic filters association info
- id string Required
  
  traffic filter ID
linked object

Configuration for linked projects associated with this project

Additional properties are NOT allowed.
Hide linked attribute Show linked attribute object
- projects object Required
  Hide projects attribute Show projects attribute object
  
  * object Additional properties
  
  Details of the linked project
  
  Additional properties are NOT allowed.
  
  Hide * attribute Show * attribute object
  
  type string Required
  
  The type of the linked project
  
  Values are elasticsearch, observability, security, or vectordb.
metadata object

Metadata request for a project with tags and annotations.

Additional properties are NOT allowed.
Hide metadata attributes Show metadata attributes object
- tags object
  
  Tags associated with a project in the form of key-value pairs. Tags are limited to a minimum of 1 and a maximum of 64 per project. Each tag key must begin with a lowercase letter (a-z), contain only lowercase letters, digits, underscores, and hyphens (a-z0-9_-), and have a maximum length of 32 characters.
  Hide tags attribute Show tags attribute object
  
  * string Additional properties
  
  Minimum length is 1, maximum length is 128. Format should match the following pattern: ^[a-z0-9][a-z0-9_-]*$.
- annotations object
  
  Annotations associated with a project, as key-value pairs that keep their case. A project can have at most 64 annotations, separate from its tags. Each key must start with a letter, contain only letters, digits, underscores and hyphens (a-zA-Z0-9_-), and be at most 32 characters long. Annotations can't be used in cross-project search and can't filter the project list.
  Hide annotations attribute Show annotations attribute object
  
  * string Additional properties
  
  Minimum length is 1, maximum length is 128. Format should match the following pattern: ^[a-zA-Z0-9][a-zA-Z0-9_-]*$.
monitoring object

Configuration for monitoring a project.
Hide monitoring attribute Show monitoring attribute object
- logging object
  
  Configuration for project logs.
  
  Additional properties are NOT allowed.
  Hide logging attribute Show logging attribute object
  
  audit object
  
  Configuration for logs from a specific category.
  
  Additional properties are NOT allowed.
  
  Hide audit attributes Show audit attributes object
  
  destination object Required
  
  Configuration for destination of logs.
  
  Additional properties are NOT allowed.
  
  Hide destination attributes Show destination attributes object
  
  project_id string Required
  
  ID of the project.
  
  Format should match the following pattern: ^[a-z0-9]{32}$.
  
  project_type string
  
  The type of the linked project
  
  Values are elasticsearch, observability, security, or vectordb.
  
  enabled boolean
  
  When true (default), logs from this category are delivered to the configured destination. When false, delivery is paused but the configuration is preserved.
  
  Default value is true.
  
  ignore_filters array[object]
  
  References to logging ignore filters applied to reduce the volume of logs delivered for this category.
  
  Not more than 10 elements.
  
  Hide ignore_filters attribute Show ignore_filters attribute object
  
  Reference to a logging ignore filter applied to a logging category.
  
  id string Required
  
  The unique identifier of the ignore filter.

Responses

201 application/json

The created security project.
Hide headers attribute Show headers attribute
- ETag string
Hide response attributes Show response attributes object
The created Security project along with credentials to access Elasticsearch.
- id string Required
  
  ID of the project.
  
  Format should match the following pattern: ^[a-z0-9]{32}$.
- name string Required
  
  Descriptive name for a project.
  
  Minimum length is 1, maximum length is 255.
- alias string Required
  
  A domain label compatible with RFC-1035 standards. Project alias with a unique suffix added by the system to avoid naming conflicts.
  
  Minimum length is 8, maximum length is 57. Format should match the following pattern: ^[a-zA-Z]{1}(?:[a-zA-Z0-9-]*[a-zA-Z0-9]{1})?$.
- region_id string Required
  
  Unique human-readable identifier for a region in Elastic Cloud.
- metadata object Required
  
  Additional details about the project.
  
  Hide metadata attributes Show metadata attributes object
  
  created_at string(date-time) Required
  
  Date and time when the project was created.
  
  created_by string Required
  
  ID of the user.
  
  organization_id string Required
  
  The Organization ID who owns the project.
  
  suspended_at string(date-time)
  
  Date and time when the project was suspended.
  
  suspended_reason string
  
  Reason why the project was suspended.
  
  tags object
  
  Tags associated with a project in the form of key-value pairs. Tags are limited to a minimum of 1 and a maximum of 64 per project. Each tag key must begin with a lowercase letter (a-z), contain only lowercase letters, digits, underscores, and hyphens (a-z0-9_-), and have a maximum length of 32 characters.
  
  Hide tags attribute Show tags attribute object
  
  * string Additional properties
  
  Minimum length is 1, maximum length is 128. Format should match the following pattern: ^[a-z0-9][a-z0-9_-]*$.
  
  system_tags object
  
  System tags associated with a project in the form of key-value pairs. These tags are added by the internal system and are read-only. The keys are prefixed with an underscore to differentiate them from user tags.
  
  Hide system_tags attribute Show system_tags attribute object
  
  * string Additional properties
  
  Minimum length is 1, maximum length is 128. Format should match the following pattern: ^[a-z0-9][a-z0-9_-]*$.
  
  annotations object
  
  Annotations associated with a project, as key-value pairs that keep their case. A project can have at most 64 annotations, separate from its tags. Each key must start with a letter, contain only letters, digits, underscores and hyphens (a-zA-Z0-9_-), and be at most 32 characters long. Annotations can't be used in cross-project search and can't filter the project list.
  
  Hide annotations attribute Show annotations attribute object
  
  * string Additional properties
  
  Minimum length is 1, maximum length is 128. Format should match the following pattern: ^[a-zA-Z0-9][a-zA-Z0-9_-]*$.
- cloud_id string Required
  
  The cloud ID, an encoded string that provides other Elastic services with the necessary information to connect to this Elasticsearch and Kibana.
- traffic_filters array[object]
  
  traffic filters IDs
  
  Hide traffic_filters attribute Show traffic_filters attribute object
  
  traffic filters association info
  
  id string Required
  
  traffic filter ID
- linked object
  
  Configuration for projects linked to this project
  
  Additional properties are NOT allowed.
  
  Hide linked attribute Show linked attribute object
  
  projects object Required
  
  Hide projects attribute Show projects attribute object
  
  * object Additional properties
  
  Hide * attributes Show * attributes object
  
  status string Required
  
  The state of the linked project.
  
  Values are enabled, suspended, or deleted.
  
  type string Required
  
  The type of the linked project
  
  Values are elasticsearch, observability, security, or vectordb.
- monitoring object
  
  Configuration for monitoring a project.
  
  Hide monitoring attribute Show monitoring attribute object
  
  logging object
  
  Configuration for project logs.
  
  Hide logging attribute Show logging attribute object
  
  audit object
  
  Configuration for logs from a specific category.
  
  Hide audit attributes Show audit attributes object
  
  destination object Required
  
  Configuration for destination of logs.
  
  Hide destination attributes Show destination attributes object
  
  project_id string Required
  
  ID of the project.
  
  Format should match the following pattern: ^[a-z0-9]{32}$.
  
  project_type string Required
  
  The type of the linked project
  
  Values are elasticsearch, observability, security, or vectordb.
  
  status string Required
  
  The state of log delivery to this destination. Controlled by the system and read-only: it is set to suspended or deleted when the destination project is suspended or deleted. Logs are only delivered when this is enabled and the logging category's enabled flag is true.
  
  Values are enabled, suspended, or deleted.
  
  enabled boolean Required
  
  When true, logs from this category are delivered to the configured destination. When false, delivery is paused but the configuration is preserved.
  
  ignore_filters array[object]
  
  References to logging ignore filters applied to reduce the volume of logs delivered for this category.
  
  Hide ignore_filters attribute Show ignore_filters attribute object
  
  Reference to a logging ignore filter applied to a logging category.
  
  id string Required
  
  The unique identifier of the ignore filter.
- type string Required
  
  the type of the project
  
  Value is security.
- endpoints object Required
  
  The endpoints to access the different apps of the project.
  
  Hide endpoints attributes Show endpoints attributes object
  
  elasticsearch string Required
  
  The endpoint to access elasticsearch.
  
  kibana string Required
  
  The endpoint to access kibana.
  
  ingest string Required
  
  The endpoint to access the Managed OTLP Endpoint.
- private_endpoints object
  
  Private endpoints (URLs) for Security projects when PrivateLink is enabled.
  
  Hide private_endpoints attributes Show private_endpoints attributes object
  
  elasticsearch string Required
  
  The PrivateLink endpoint URL to access elasticsearch.
  
  kibana string Required
  
  The PrivateLink endpoint URL to access kibana.
  
  ingest string Required
  
  The PrivateLink endpoint URL to access the Managed OTLP Endpoint.
- search_lake object
  
  Configuration for the entire set of capabilities that make the data searchable in Security.
  
  Hide search_lake attribute Show search_lake attribute object
  
  data_retention object | null
  
  Configuration to control the data retention in Elasticsearch data streams.
  
  Hide data_retention attributes Show data_retention attributes object | null
  
  max_retention_days integer | null
  
  Maximum number of days allowed for retaining data in Elasticsearch data streams. Can be set to "null" for unlimited. A default of 396 will be applied if no value is specified on project creation.
  
  Minimum value is 7, maximum value is 3681.
  
  default_retention_days integer | null
  
  Default number of days during which data remains available in Elasticsearch data streams. Can be set to "null" for unlimited. A default of 396 will be applied if no value is specified on project creation.
  
  Minimum value is 7, maximum value is 3681.
- admin_features_package string
  
  admin features package (BYOK, BYOIDP, CCS, CCR)
  
  Values are standard or enterprise.
- product_types array[object]
  
  Defines Security product type object with product line and tier dimensions.
  
  At least 1 but not more than 3 elements. Default value is [{"product_line" => "security", "product_tier" => "complete"}, {"product_line" => "cloud", "product_tier" => "complete"}, {"product_line" => "endpoint", "product_tier" => "complete"}].
  
  Hide product_types attributes Show product_types attributes object
  
  Defines Security product type object with product line and tier dimensions.
  
  product_line string Required
  
  The identifier of the Security Solution product line.
  
  Values are security, cloud, or endpoint.
  
  product_tier string Required
  
  The identifier of the Security Solution product tier.
  
  Values are complete or essentials.
- credentials object Required
  
  Basic auth credentials to access the Elasticsearch API.
  
  Hide credentials attributes Show credentials attributes object
  
  username string Required
  
  Basic auth username that can be used to access the Elasticsearch API.
  
  password string(password) Required
  
  Basic auth password that can be used to access the Elasticsearch API.
400 application/json

Bad request
Hide response attribute Show response attribute object
- errors array[object] Required
  
  An error response returned by the API.
  
  Hide errors attributes Show errors attributes object
  
  An error response returned by the API.
  
  message string Required
  
  A human-readable message of the error.
  
  code string Required
  
  An identifier for this type of error.
422 application/json

Unprocessable entity
Hide response attribute Show response attribute object
- errors array[object] Required
  
  An error response returned by the API.
  
  Hide errors attributes Show errors attributes object
  
  An error response returned by the API.
  
  message string Required
  
  A human-readable message of the error.
  
  code string Required
  
  An identifier for this type of error.

POST /api/v1/serverless/projects/security

curl \
 --request POST 'https://api.elastic-cloud.com/api/v1/serverless/projects/security' \
 --header "Authorization: $API_KEY" \
 --header "Content-Type: application/json" \
 --data '{
  "name": "Example project",
  "region_id": "aws-us-east-1"
}'

Request example

{
  "name": "Example project",
  "region_id": "aws-us-east-1"
}