openapi: 3.0.3
info:
  contact:
    name: Kibana Team
  description: |
    The Kibana REST APIs enable you to manage resources such as connectors, data views, and saved objects.
    The API calls are stateless.
    Each request that you make happens in isolation from other calls and must include all of the necessary information for Kibana to fulfill the
    request.
    API requests return JSON output, which is a format that is machine-readable and works well for automation.

    To interact with Kibana APIs, use the following operations:

    - GET: Fetches the information.
    - PATCH: Applies partial modifications to the existing information.
    - POST: Adds new information.
    - PUT: Updates the existing information.
    - DELETE: Removes the information.

    You can prepend any Kibana API endpoint with `kbn:` and run the request in **Dev Tools → Console**.
    For example:

    ```
    GET kbn:/api/data_views
    ```

    For more information about the console, refer to [Run API requests](https://www.elastic.co/docs/explore-analyze/query-filter/tools/console).

    NOTE: Access to internal Kibana API endpoints will be restricted in Kibana version 9.0. Please move any integrations to publicly documented APIs.

    ## Documentation source and versions

    This documentation is derived from the `main` branch of the [kibana](https://github.com/elastic/kibana) repository.
    It is provided under license [Attribution-NonCommercial-NoDerivatives 4.0 International](https://creativecommons.org/licenses/by-nc-nd/4.0/).

    This documentation contains work-in-progress information for future Elastic Stack releases.
  title: Kibana APIs
  version: ''
  x-doc-license:
    name: Attribution-NonCommercial-NoDerivatives 4.0 International
    url: https://creativecommons.org/licenses/by-nc-nd/4.0/
  x-feedbackLink:
    label: Feedback
    url: https://github.com/elastic/docs-content/issues/new?assignees=&labels=feedback%2Ccommunity&projects=&template=api-feedback.yaml&title=%5BFeedback%5D%3A+
servers:
  - url: https://{kibana_url}
    variables:
      kibana_url:
        default: localhost:5601
security:
  - apiKeyAuth: []
  - basicAuth: []
tags:
  - name: agent builder
    description: |
      Agent Builder is a set of AI-powered capabilities for developing and interacting with agents that work with your Elasticsearch data.

      Most users will probably want to integrate with Agent Builder using MCP or A2A, but you can also work programmatically with tools, agents, and conversations using these Kibana APIs. Follow the [Agent Builder API tutorial](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/agent-builder-api-tutorial) for a guided example.

      **Elastic Agent Builder requires an Enterprise subscription.**
    externalDocs:
      description: Agent Builder docs
      url: https://www.elastic.co/docs/solutions/search/agent-builder/programmatic-access
    x-displayName: Agent Builder
  - name: alerting
    description: |
      Alerting enables you to define rules, which detect complex conditions within your data. When a condition is met, the rule tracks it as an alert and runs the actions that are defined in the rule. Actions typically involve the use of connectors to interact with Kibana services or third party integrations.
    externalDocs:
      description: Alerting documentation
      url: https://www.elastic.co/docs/explore-analyze/alerts-cases/alerts
    x-displayName: Alerting
  - name: alerting-v2
    description: |
      Alerting V2 is an ES|QL-first alerting API for managing rules, alert actions, and action policies. Use these endpoints to create and manage detection rules, act on alerts, and control when and how notifications are delivered. These APIs are experimental.
    x-displayName: Alerting V2
  - description: |
      Adjust APM agent configuration without need to redeploy your application.
    name: APM agent configuration
  - description: |
      Configure APM agent keys to authorize requests from APM agents to the APM Server.
    name: APM agent keys
  - description: |
      Annotate visualizations in the APM app with significant events. Annotations enable you to easily see how events are impacting the performance of your applications.
    name: APM annotations
  - description: Create APM fleet server schema.
    name: APM server schema
  - description: |
      Configure APM source maps. A source map allows minified files to be mapped back to original source code--allowing you to maintain the speed advantage of minified code, without losing the ability to quickly and easily debug your application.
      For best results, uploading source maps should become a part of your deployment procedure, and not something you only do when you see unhelpful errors. That's because uploading source maps after errors happen won't make old errors magically readable--errors must occur again for source mapping to occur.
    name: APM sourcemaps
  - description: |
      Cases are used to open and track issues. You can add assignees and tags to your cases, set their severity and status, and add alerts, comments, and visualizations. You can also send cases to external incident management systems by configuring connectors.
    name: cases
    externalDocs:
      description: Cases documentation
      url: https://www.elastic.co/docs/explore-analyze/alerts-cases/cases
    x-displayName: Cases
  - name: connectors
    description: |
      Connectors provide a central place to store connection information for services and integrations with Elastic or third party systems. Alerting rules can use connectors to run actions when rule conditions are met.
    externalDocs:
      description: Connector documentation
      url: https://www.elastic.co/docs/reference/kibana/connectors-kibana
    x-displayName: Connectors
  - name: context engine
    description: |
      Use the Context Engine APIs to manage AI Indices, query them with ES|QL, and describe them for an agent. An AI Index attaches a name, sources, traces, and automations to a single data stream or index.

      In each space, these APIs return a 404 until the `contextEngine:enabled` advanced setting is turned on for that space.
    externalDocs:
      description: Context Engine documentation
      url: https://www.elastic.co/docs/explore-analyze/ai-features/context-engine
    x-displayName: Context Engine
  - name: Dashboards
    description: |
      > This documentation is temporarily hosted at a separate location.
      >
      > **[View the full Dashboards API reference →](https://elastic.github.io/dashboards-api-spec/dashboards#tag/Dashboards)**
    externalDocs:
      description: Dashboards documentation
      url: https://www.elastic.co/docs/explore-analyze/dashboards
    x-displayName: Dashboards
  - name: Data streams
    description: |
      Data stream APIs enable you to manage data streams, which are collections of indices that share the same index template and are managed as a single unit for time-series data.
    x-displayName: Data streams
  - description: Data view APIs enable you to manage data views, formerly known as Kibana index patterns.
    name: data views
    x-displayName: Data views
  - name: Elastic Agent actions
    description: |
      Elastic Agent actions APIs enable you to manage actions performed on Elastic Agents, including agent reassignment, diagnostics collection, enrollment management, upgrades, and bulk operations for agent lifecycle management.
    x-displayName: Elastic Agent actions
  - name: Elastic Agent binary download sources
    description: |
      Elastic Agent binary download sources APIs enable you to manage download sources for Elastic Agent binaries, including creating, updating, and deleting custom download sources for agent binaries.
    x-displayName: Elastic Agent binary download sources
  - name: Elastic Agent policies
    description: |
      Elastic Agent policies APIs enable you to manage agent policies, including creating, updating, and deleting policies, as well as to retrieve agent policy outputs, manifests, and auto-upgrade status information.
    x-displayName: Elastic Agent policies
  - name: Elastic Agent status
    description: |
      Enables you to retrieve status information about Elastic Agents, including health summaries and operational status.
    x-displayName: Elastic Agent status
  - name: Elastic Agents
    description: |
      Elastic Agents APIs enable you to manage Elastic Agents, including retrieving agent information, managing agent lifecycle, handling file uploads, and initiating agent setup.
    x-displayName: Elastic Agents
  - name: Elastic Package Manager (EPM)
    description: |
      Elastic Package Manager (EPM) APIs enable you to manage packages and integrations, including installing, updating, and uninstalling packages, managing custom integrations, and handling package assets.
    x-displayName: Elastic Package Manager (EPM)
  - name: Fleet agentless policies
  - name: Fleet cloud connectors
    description: |
      Fleet cloud connectors APIs enable you to manage Fleet cloud connectors, including creating, updating, and deleting cloud connector configurations for Fleet integrations.
    x-displayName: Fleet cloud connectors
  - name: Fleet cloud onboarding deployments
  - name: Fleet enrollment API keys
    description: |
      Fleet enrollment API keys APIs enable you to manage enrollment API keys for Fleet, including creating, retrieving, and revoking API keys used for agent enrollment.
    x-displayName: Fleet enrollment API keys
  - name: Fleet internals
    description: |
      Fleet internals APIs enable you to manage Fleet internal operations, including checking permissions, monitoring Fleet Server health, managing settings, and initiating Fleet setup.
    x-displayName: Fleet internals
  - name: Fleet managed integrations
  - name: Fleet outputs
    description: |
      Fleet outputs APIs enable you to manage Fleet outputs, including creating, updating, and deleting output configurations, generating Logstash API keys, and monitoring output health.
    x-displayName: Fleet outputs
  - name: Fleet package policies
    description: |
      Fleet package policies APIs enable you to manage Fleet package policies, including creating, updating, and deleting policies, performing bulk operations, and managing policy upgrades.
    x-displayName: Fleet package policies
  - name: Fleet proxies
    description: |
      Fleet proxies APIs enable you to manage Fleet proxies, including creating, updating, and deleting proxy configurations for Fleet agent communication.
    x-displayName: Fleet proxies
  - name: Fleet remote synced integrations
    description: |
      Use the Fleet remote synced integrations API to check the status of the automatic integrations synchronization on a remote cluster:
      * Use the `/api/fleet/remote_synced_integrations/{outputId}/remote_status` endpoint on the management cluster to query the synchronization status of the integrations installed on the remote cluster by the ID of the configured remote Elasticsearch output.
      * Use the `/api/fleet/remote_synced_integrations/status` endpoint on the remote cluster to query the synchronization status of the installed integrations.
    externalDocs:
      description: Automatic integrations synchronization documentation
      url: https://www.elastic.co/docs/reference/fleet/automatic-integrations-synchronization
  - name: Fleet Server hosts
    description: |
      Fleet Server hosts APIs enable you to manage Fleet Server hosts, including creating, updating, and deleting Fleet Server host configurations.
    x-displayName: Fleet Server hosts
  - name: Fleet service tokens
    description: |
      Enables you to create tokens for Fleet service authentication and authorization.
    x-displayName: Fleet service tokens
  - name: Fleet uninstall tokens
    description: |
      Fleet uninstall tokens APIs enable you to manage Fleet uninstall tokens, including retrieving metadata and decrypted tokens for agent uninstallation.
    x-displayName: Fleet uninstall tokens
  - name: Links
  - description: |
      Programmatically integrate with Logstash configuration management.
      > warn
      > Do not directly access the `.logstash` index. The structure of the `.logstash` index is subject to change, which could cause your integration to break. Instead, use the Logstash configuration management APIs.
    externalDocs:
      description: Centralized pipeline management
      url: https://www.elastic.co/docs/reference/logstash/logstash-centralized-pipeline-management
    name: logstash
    x-displayName: Logstash configuration management
  - name: maintenance-window
    description: |
      You can schedule single or recurring maintenance windows to temporarily reduce rule notifications. For example, a maintenance window prevents false alarms during planned outages.
    externalDocs:
      description: Maintenance window documentation
      url: https://www.elastic.co/docs/explore-analyze/alerts-cases/alerts/maintenance-windows
    x-displayName: Maintenance windows
  - name: Markdowns
  - name: Message Signing Service
    description: |
      Enables you to rotate message signing key pairs for secure Fleet communication.
    x-displayName: Fleet Message Signing Service
  - description: |
      Enables you to synchronize machine learning saved objects.
    name: ml
    x-displayName: Machine learning
  - description: Interact with the Observability AI Assistant resources.
    externalDocs:
      description: Observability AI Assistant
      url: https://www.elastic.co/docs/solutions/observability/observability-ai-assistant
    name: observability_ai_assistant
    x-displayName: Observability AI Assistant
  - name: roles
    x-displayName: Roles
    description: Manage the roles that grant Elasticsearch and Kibana privileges.
    externalDocs:
      description: Kibana role management
      url: https://www.elastic.co/docs/deploy-manage/users-roles/cluster-or-deployment-auth/defining-roles
  - name: saved objects
    x-displayName: Saved objects
    description: |
      Export sets of saved objects that you want to import into Kibana, resolve import errors, and rotate an encryption key for encrypted saved objects with the saved objects APIs.

      To manage a specific type of saved object, use the corresponding APIs.
      For example, use:

      * [Data views](../group/endpoint-data-views)
      * [Spaces](../group/endpoint-spaces)
      * [Short URLs](../group/endpoint-short-url)

      Warning: Do not write documents directly to the `.kibana` index. When you write directly to the `.kibana` index, the data becomes corrupted and permanently breaks future Kibana versions.
  - description: Manage and interact with Security Assistant resources.
    name: Security AI Assistant API
    x-displayName: Security AI assistant
  - description: Use the Attack discovery APIs to generate and manage Attack discoveries. Attack Discovery leverages large language models (LLMs) to analyze alerts in your environment and identify threats. Each "discovery" represents a potential attack and describes relationships among multiple alerts to tell you which users and hosts are involved, how alerts correspond to the MITRE ATT&CK matrix, and which threat actor might be responsible.
    name: Security Attack discovery API
    x-displayName: Security Attack discovery
  - description: |
      Use the detections APIs to create and manage detection rules. Detection rules search events and external alerts sent to Elastic Security and generate detection alerts from any hits. Alerts are displayed on the **Alerts** page and can be assigned and triaged, using the alert status to mark them as open, closed, or acknowledged.

      This API supports both key-based authentication and basic authentication.

      To use key-based authentication, create an API key, then specify the key in the header of your API calls.

      To use basic authentication, provide a username and password; this automatically creates an API key that matches the current user’s privileges.

      In both cases, the API key is subsequently used for authorization when the rule runs.
      > warn
      > If the API key used for authorization has different privileges than the key that created or most recently updated a rule, the rule behavior might change.

      > If the API key that created a rule is deleted, or the user that created the rule becomes inactive, the rule will stop running.

      To create and run rules, the user must meet specific requirements for the Kibana space. Refer to the [Detections requirements](https://www.elastic.co/guide/en/security/current/detections-permissions-section.html) for a complete list of requirements.
    name: Security Detections API
    x-displayName: Security detections
  - description: Endpoint Exceptions API allows you to manage detection rule endpoint exceptions to prevent a rule from generating an alert from incoming events even when the rule's other criteria are met.
    name: Security Endpoint Exceptions API
    x-displayName: Security Elastic Endpoint exceptions
  - description: Interact with and manage endpoints running the Elastic Defend integration.
    name: Security Endpoint Management API
    x-displayName: Security endpoint management
  - description: |
      Use the Security entity analytics APIs to manage entity analytics and risk scoring, including asset criticality, privileged user monitoring, and entity engines.
    name: Security Entity Analytics API
    x-displayName: Security entity analytics
  - name: Security entity store
  - description: |
      Exceptions are associated with detection and endpoint rules, and are used to prevent a rule from generating an alert from incoming events, even when the rule's other criteria are met. They can help reduce the number of false positives and prevent trusted processes and network activity from generating unnecessary alerts.

      Exceptions are made up of:

      * **Exception containers**: A container for related exceptions. Generally, a single exception container contains all the exception items relevant for a subset of rules. For example, a container can be used to group together network-related exceptions that are relevant for a large number of network rules. The container can then be associated with all the relevant rules.
      * **Exception items**: The query (fields, values, and logic) used to prevent rules from generating alerts. When an exception item's query evaluates to `true`, the rule does not generate an alert.

      For detection rules, you can also use lists to define rule exceptions. A list holds multiple values of the same Elasticsearch data type, such as IP addresses. These values are used to determine when an exception prevents an alert from being generated.
      > info
      > You cannot use lists with endpoint rule exceptions.

      > info
      > Only exception containers can be associated with rules. You cannot directly associate an exception item or a list container with a rule. To use list exceptions, create an exception item that references the relevant list container.

      ## Exceptions requirements

      Before you can start working with exceptions that use value lists, you must create the `.lists` and `.items` data streams for the relevant Kibana space. To do this, use the [Create list data streams](../operation/operation-createlistindex) endpoint. Once these data streams are created, your role needs privileges to manage rules. For a complete list of requirements, refer to [Enable and access detections](https://www.elastic.co/guide/en/security/current/detections-permissions-section.html#enable-detections-ui).
    name: Security Exceptions API
    x-displayName: Security exceptions
  - description: |
      Lists can be used with detection rule exceptions to define values that prevent a rule from generating alerts.

      Lists are made up of:

      * **List containers**: A container for values of the same Elasticsearch data type. The following data types can be used:
          * `boolean`
          * `byte`
          * `date`
          * `date_nanos`
          * `date_range`
          * `double`
          * `double_range`
          * `float`
          * `float_range`
          * `half_float`
          * `integer`
          * `integer_range`
          * `ip`
          * `ip_range`
          * `keyword`
          * `long`
          * `long_range`
          * `short`
          * `text`
      * **List items**: The values used to determine whether the exception prevents an alert from being generated.

      All list items in the same list container must be of the same data type, and each item defines a single value. For example, an IP list container named `internal-ip-addresses-southport` contains five items, where each item defines one internal IP address:
      1. `192.168.1.1`
      2. `192.168.1.3`
      3. `192.168.1.18`
      4. `192.168.1.12`
      5. `192.168.1.7`

      To use these IP addresses as values for defining rule exceptions, use the Security exceptions API to [create an exception list item](../operation/operation-createexceptionlistitem) that references the `internal-ip-addresses-southport` list.
      > info
      > Lists cannot be added directly to rules, nor do they define the operators used to determine when exceptions are applied (`is in list`, `is not in list`). Use an exception item to define the operator and associate it with an [exception container](../operation/operation-createexceptionlist). You can then add the exception container to a rule's `exceptions_list` object.

      ## Lists requirements

      Before you can start using lists, you must create the `.lists` and `.items` data streams for the relevant Kibana space. To do this, use the [Create list data streams](../operation/operation-createlistindex) endpoint. Once these data streams are created, your role needs privileges to manage rules. Refer to [Enable and access detections](https://www.elastic.co/guide/en/security/current/detections-permissions-section.html#enable-detections-ui) for a complete list of requirements.
    name: Security Lists API
    x-displayName: Security lists
  - description: Run live queries, manage packs and saved queries.
    name: Security Osquery API
    x-displayName: Security Osquery
  - description: |
      Use the initialization API to set up the assets Elastic Security needs to operate in a Kibana space.

      A single request can run one or more initialization flows. Each flow provisions a specific set of assets (for example, list indices, security data views, prebuilt detection rules, endpoint protection, AI prompts, or detection rule monitoring assets). The response reports a per-flow result so you can tell which flows completed and which returned an error.
    name: Security Solution Initialization API
    x-displayName: Security solution initialization
  - description: You can create Timelines and Timeline templates via the API, as well as import new Timelines from an ndjson file.
    name: Security Timeline API
    x-displayName: Security timeline
  - description: Manage Kibana short URLs.
    name: short url
    x-displayName: Short URLs
  - description: SLO APIs enable you to define, manage and track service-level objectives
    name: slo
    x-displayName: Service level objectives
  - name: spaces
    x-displayName: Spaces
    description: Manage your Kibana spaces.
    externalDocs:
      url: https://www.elastic.co/docs/deploy-manage/manage-spaces
      description: Space overview
  - name: streams
    description: |
      Streams provide a unified data management layer for ingestion, routing, and processing. There are three stream types:
      * **Wired** streams are managed by Kibana. They route documents to child streams based on
        field conditions and support custom field mappings and processing steps.

      * **Classic** streams map to existing Elasticsearch data streams. You can add processing
        steps to classic streams without changing their underlying index template.

      * **Query** streams are virtual aggregations backed by an ES|QL expression. They aggregate
        data from multiple streams into a single logical view without duplicating documents.
    x-displayName: Streams
    externalDocs:
      description: Streams documentation
      url: https://www.elastic.co/docs/solutions/observability/streams/streams
  - name: synthetics
    x-displayName: Synthetics
    description: Synthetics APIs enable you to check the status of your services and applications.
    externalDocs:
      description: Synthetic monitoring
      url: https://www.elastic.co/docs/solutions/observability/synthetics
  - name: system
    x-displayName: System
    description: |
      Get information about the system status, resource usage, features, and installed plugins.
  - name: Tags
  - description: Task manager APIs enable you to check the health of the Kibana task manager, which is used by features such as alerting, actions, and reporting to run mission critical work as persistent background tasks.
    externalDocs:
      description: Task manager
      url: https://www.elastic.co/docs/deploy-manage/distributed-architecture/kibana-tasks-management
    name: task manager
    x-displayName: Task manager
  - name: Universal Profiling
    description: |
      Universal Profiling provides whole-system, always-on, continuous profiling with zero instrumentation. Use these APIs to check whether the Elasticsearch resources Universal Profiling depends on are set up, and to set them up. Universal Profiling is available on Elastic Cloud Hosted and self-managed deployments.
    externalDocs:
      description: Universal Profiling documentation
      url: https://www.elastic.co/docs/solutions/observability/infra-and-hosts/universal-profiling
    x-displayName: Universal Profiling
  - description: |
      The Kibana Upgrade Assistant API helps you prepare for the next major Elasticsearch release.
      > warn
      > This is a Kibana REST API (not an Elasticsearch API) and requests must target your Kibana URL:
      > * Self-managed URL pattern: `https://localhost:5601`
      > * Elastic Cloud URL pattern: `https://your-deployment.kb.us-east-1.aws.elastic.cloud:9243`
    name: upgrade
    x-displayName: Upgrade assistant
  - description: Uptime APIs enable you to view and update uptime monitoring settings.
    externalDocs:
      description: Uptime monitoring
      url: https://www.elastic.co/docs/solutions/observability/uptime
    name: uptime
    x-displayName: Uptime
  - name: user session
    x-displayName: User session management
    description: |
      Enables you to invalidate user sessions for security and session management purposes.
  - name: Visualizations
    description: |
      > This documentation is temporarily hosted at a separate location.
      >
      > **[View the full Visualizations API reference →](https://elastic.github.io/dashboards-api-spec/visualizations#tag/Visualizations)**
    externalDocs:
      description: Visualizations documentation
      url: https://www.elastic.co/docs/explore-analyze/visualize/lens
    x-displayName: Visualizations
  - name: workflows
    description: |
      Workflows enable you to automate multi-step processes directly in Kibana. Define sequences of steps in YAML to transform data insights into automated actions and outcomes, without needing external automation tools.

      Use the workflows APIs to create, manage, and run workflows programmatically. You can also search, export, import, and monitor workflow executions.
    externalDocs:
      description: Workflows documentation
      url: https://www.elastic.co/docs/explore-analyze/workflows
    x-displayName: Workflows
paths:
  /api/actions/connector_types:
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/actions/connector_types</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        You do not need any Kibana feature privileges to run this API.
      operationId: get-actions-connector-types
      parameters:
        - description: A filter to limit the retrieved connector types to those that support a specific feature (such as alerting or cases).
          in: query
          name: feature_id
          required: false
          schema:
            maxLength: 100
            type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                items:
                  $ref: '#/components/schemas/Kibana_HTTP_APIs_connector_type_response'
                type: array
              examples:
                getConnectorTypesServerlessResponse:
                  $ref: '#/components/examples/get_connector_types_generativeai_response'
          description: Indicates a successful call.
        '403':
          description: Indicates that this call is forbidden.
      summary: Get connector types
      tags:
        - connectors
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/actions/connector/_oauth_callback:
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/actions/connector/_oauth_callback</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Handles the OAuth 2.0 authorization code callback from external providers. Exchanges the authorization code for access and refresh tokens.<br/><br/>[Required authorization] Route required privileges: actions:oauth.
      operationId: get-actions-connector-oauth-callback
      parameters:
        - description: The authorization code returned by the OAuth provider.
          in: query
          name: code
          required: false
          schema:
            type: string
        - description: The state parameter for CSRF protection.
          in: query
          name: state
          required: false
          schema:
            type: string
        - description: Error code if the authorization failed.
          in: query
          name: error
          required: false
          schema:
            type: string
        - description: Human-readable error description.
          in: query
          name: error_description
          required: false
          schema:
            type: string
        - description: Session state from the OAuth provider (e.g., Microsoft).
          in: query
          name: session_state
          required: false
          schema:
            type: string
      responses:
        '200':
          description: Returns an HTML callback page.
        '302':
          description: Redirects to the return URL with authorization result query parameters.
        '401':
          description: User is not authenticated.
      summary: Handle OAuth callback
      tags:
        - connectors
      x-state: Added in 9.4.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/actions/connector/_oauth_callback_script:
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/actions/connector/_oauth_callback_script</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Returns the OAuth callback script
      operationId: get-actions-connector-oauth-callback-script
      parameters: []
      responses:
        '200':
          description: Returns the OAuth callback script
      summary: ''
      tags: []
      x-state: Added in 9.4.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/actions/connector/{connectorId}/oauth/start:
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/actions/connector/{connectorId}/oauth/start</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        [Required authorization] Route required privileges: actions:oauth.
      operationId: get-actions-connector-connectorid-oauth-start
      parameters:
        - description: An identifier for the connector.
          in: path
          name: connectorId
          required: true
          schema:
            maxLength: 36
            type: string
      responses:
        '302':
          description: Redirects to the identity provider to begin OAuth authorization.
        '400':
          description: Invalid request, such as a disallowed returnUrl.
        '401':
          description: User is not authenticated.
        '404':
          description: Connector not found.
      summary: Start OAuth authorization (redirects to the identity provider)
      tags:
        - connectors
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/actions/connector/{id}:
    delete:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb delete">delete</span>&nbsp;<span class="operation-path">/s/{space_id}/api/actions/connector/{id}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        WARNING: When you delete a connector, it cannot be recovered.
      operationId: delete-actions-connector-id
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: An identifier for the connector.
          in: path
          name: id
          required: true
          schema:
            type: string
      responses:
        '204':
          description: Indicates a successful call.
        '403':
          description: Indicates that this call is forbidden.
      summary: Delete a connector
      tags:
        - connectors
      x-metaTags:
        - content: Kibana
          name: product_name
    get:
      operationId: get-actions-connector-id
      parameters:
        - description: An identifier for the connector.
          in: path
          name: id
          required: true
          schema:
            type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_connector_response'
              examples:
                getConnectorResponse:
                  $ref: '#/components/examples/get_connector_response'
          description: Indicates a successful call.
        '403':
          description: Indicates that this call is forbidden.
      summary: Get connector information
      tags:
        - connectors
      x-metaTags:
        - content: Kibana
          name: product_name
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/actions/connector/{id}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
    post:
      operationId: post-actions-connector-id
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: An identifier for the connector.
          in: path
          name: id
          required: true
          schema:
            maxLength: 36
            minLength: 1
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_new_connector'
            examples:
              createEmailConnectorRequest:
                $ref: '#/components/examples/create_email_connector_request'
              createIndexConnectorRequest:
                $ref: '#/components/examples/create_index_connector_request'
              createWebhookConnectorRequest:
                $ref: '#/components/examples/create_webhook_connector_request'
              createXmattersConnectorRequest:
                $ref: '#/components/examples/create_xmatters_connector_request'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_connector_response'
              examples:
                createEmailConnectorResponse:
                  $ref: '#/components/examples/create_email_connector_response'
                createIndexConnectorResponse:
                  $ref: '#/components/examples/create_index_connector_response'
                createWebhookConnectorResponse:
                  $ref: '#/components/examples/create_webhook_connector_response'
                createXmattersConnectorResponse:
                  $ref: '#/components/examples/get_connector_response'
          description: Indicates a successful call.
        '403':
          description: Indicates that this call is forbidden.
      summary: Create a connector
      tags:
        - connectors
      x-metaTags:
        - content: Kibana
          name: product_name
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/actions/connector/{id}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
    put:
      operationId: put-actions-connector-id
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: An identifier for the connector.
          in: path
          name: id
          required: true
          schema:
            maxLength: 36
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_update_connector'
            examples:
              updateIndexConnectorRequest:
                $ref: '#/components/examples/update_index_connector_request'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_connector_response'
          description: Indicates a successful call.
        '403':
          description: Indicates that this call is forbidden.
      summary: Update a connector
      tags:
        - connectors
      x-metaTags:
        - content: Kibana
          name: product_name
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb put">put</span>&nbsp;<span class="operation-path">/s/{space_id}/api/actions/connector/{id}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
  /api/actions/connector/{id}/_execute:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/actions/connector/{id}/_execute</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        You can use this API to test an action that involves interaction with Kibana services or integrations with third-party systems.
      operationId: post-actions-connector-id-execute
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: An identifier for the connector.
          in: path
          name: id
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_connector_execute_request'
            examples:
              runIndexConnectorRequest:
                $ref: '#/components/examples/run_index_connector_request'
              runJiraConnectorRequest:
                $ref: '#/components/examples/run_jira_connector_request'
              runServerLogConnectorRequest:
                $ref: '#/components/examples/run_servicenow_itom_connector_request'
              runSlackConnectorRequest:
                $ref: '#/components/examples/run_slack_api_connector_request'
              runSwimlaneConnectorRequest:
                $ref: '#/components/examples/run_swimlane_connector_request'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_connector_response'
              examples:
                runIndexConnectorResponse:
                  $ref: '#/components/examples/run_index_connector_response'
                runJiraConnectorResponse:
                  $ref: '#/components/examples/run_jira_connector_response'
                runServerLogConnectorResponse:
                  $ref: '#/components/examples/run_server_log_connector_response'
                runServiceNowITOMConnectorResponse:
                  $ref: '#/components/examples/run_servicenow_itom_connector_response'
                runSlackConnectorResponse:
                  $ref: '#/components/examples/run_slack_api_connector_response'
                runSwimlaneConnectorResponse:
                  $ref: '#/components/examples/run_swimlane_connector_response'
          description: Indicates a successful call.
        '403':
          description: Indicates that this call is forbidden.
      summary: Run a connector
      tags:
        - connectors
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/actions/connectors:
    get:
      operationId: get-actions-connectors
      parameters: []
      responses:
        '200':
          content:
            application/json:
              schema:
                items:
                  $ref: '#/components/schemas/Kibana_HTTP_APIs_connector_response_with_references_count'
                type: array
              examples:
                getConnectorsResponse:
                  $ref: '#/components/examples/get_connectors_response'
          description: Indicates a successful call.
        '403':
          description: Indicates that this call is forbidden.
      summary: Get all connectors
      tags:
        - connectors
      x-metaTags:
        - content: Kibana
          name: product_name
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/actions/connectors</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
  /api/agent_builder/a2a/{agentId}:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/agent_builder/a2a/{agentId}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        > warn
        > This endpoint is designed for A2A protocol clients and should not be used directly via REST APIs. Use an A2A SDK or A2A Inspector instead.
        To learn more about the Agent Builder A2A server, refer to the [A2A server documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/a2a-server).<br/><br/>[Required authorization] Route required privileges: agentBuilder:read.
      operationId: post-agent-builder-a2a-agentid
      parameters:
        - description: The unique identifier of the agent to send the A2A task to.
          in: path
          name: agentId
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            examples:
              a2aTaskRequestExample:
                description: 'WARNING: DO NOT USE THIS ENDPOINT VIA REST API. These examples are auto-generated and should not be run. Integrate with A2A using an A2A SDK or A2A Inspector instead.'
                value:
                  id: task-123
                  jsonrpc: '2.0'
                  method: complete
                  params:
                    messages:
                      - content: Hello from A2A protocol
                        role: user
            schema: {}
      responses:
        '200':
          content:
            application/json:
              examples:
                a2aTaskResponseExample:
                  description: Example response from A2A Task Endpoint with results of task execution
                  value:
                    id: task-123
                    jsonrpc: '2.0'
                    result:
                      conversation_id: conv-456
                      response:
                        message: Hello! How can I help you today?
                      type: response
          description: Indicates a successful response
      summary: Send A2A task
      tags:
        - agent builder
      x-state: Experimental; added in 9.2.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/agent_builder/a2a/{agentId}.json:
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/agent_builder/a2a/{agentId}.json</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Get agent discovery metadata in JSON format. Use this endpoint to provide agent information for A2A protocol integration and discovery. To learn more about the Agent Builder A2A server, refer to the [A2A server documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/a2a-server).<br/><br/>[Required authorization] Route required privileges: agentBuilder:read.
      operationId: get-agent-builder-a2a-agentid.json
      parameters:
        - description: The unique identifier of the agent to get A2A metadata for.
          in: path
          name: agentId
          required: true
          schema:
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                a2aAgentCardResponseExample:
                  description: Example response card of Elastic AI Agent
                  value:
                    capabilities:
                      pushNotifications: false
                      stateTransitionHistory: false
                      streaming: false
                    defaultInputModes:
                      - text/plain
                    defaultOutputModes:
                      - text/plain
                    description: Elastic AI Agent
                    name: Elastic AI Agent
                    protocolVersion: 0.3.0
                    provider:
                      organization: Elastic
                      url: https://elastic.co
                    securitySchemes:
                      authorization:
                        description: Authentication token
                        in: header
                        name: Authorization
                        type: apiKey
                    skills:
                      - description: A powerful tool for searching and analyzing data within your Elasticsearch cluster.
                        examples: []
                        id: platform.core.search
                        inputModes:
                          - text/plain
                          - application/json
                        name: platform.core.search
                        outputModes:
                          - text/plain
                          - application/json
                        tags:
                          - tool
                    supportsAuthenticatedExtendedCard: false
                    url: http://localhost:5601/api/agent_builder/a2a/elastic-ai-agent
                    version: 0.1.0
          description: Indicates a successful response
      summary: Get A2A agent card
      tags:
        - agent builder
      x-codeSamples:
        - lang: curl
          source: |
            curl \
              -X GET "${KIBANA_URL}/api/agent_builder/a2a/{agentId}.json" \
              -H "Authorization: ApiKey ${API_KEY}"
        - lang: Console
          source: |
            GET kbn://api/agent_builder/a2a/{agentId}.json
      x-state: Experimental; added in 9.2.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/agent_builder/agents:
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/agent_builder/agents</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        List all available agents. Use this endpoint to retrieve complete agent information including their current configuration and assigned tools. To learn more about agents, refer to the [agents documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/agent-builder-agents).<br/><br/>[Required authorization] Route required privileges: agentBuilder:read.
      operationId: get-agent-builder-agents
      parameters: []
      responses:
        '200':
          content:
            application/json:
              examples:
                listAgentsResponseExample:
                  description: Example response that returns one built-in Elastic agent and one created by the user
                  value:
                    results:
                      - access_control: null
                        configuration:
                          tools:
                            - tool_ids:
                                - platform.core.search
                                - platform.core.list_indices
                                - platform.core.get_index_mapping
                                - platform.core.get_document_by_id
                        description: Elastic AI Agent
                        id: elastic-ai-agent
                        name: Elastic AI Agent
                        permissions:
                          update_access_control: false
                          update_agent: false
                        type: chat
                      - access_control:
                          access_mode: private
                          entries:
                            - name: alice
                              role: manager
                              type: user
                        avatar_color: '#BFDBFF'
                        avatar_symbol: SI
                        configuration:
                          instructions: You are a custom agent that wants to help searching data using all indices starting with prefix "content-".
                          tools:
                            - tool_ids:
                                - platform.core.search
                                - platform.core.list_indices
                                - platform.core.get_index_mapping
                                - platform.core.get_document_by_id
                        description: Hi! I can help you search the data within the indices starting with "content-" prefix.
                        id: created-agent-id
                        labels:
                          - custom-indices
                          - department-search
                        name: Search Index Helper
                        permissions:
                          update_access_control: true
                          update_agent: true
                        type: chat
          description: Indicates a successful response
      summary: List agents
      tags:
        - agent builder
      x-codeSamples:
        - lang: curl
          source: |
            curl \
             -X GET "${KIBANA_URL}/api/agent_builder/agents" \
             -H "Authorization: ApiKey ${API_KEY}"
        - lang: Console
          source: |
            GET kbn://api/agent_builder/agents
      x-state: Added in 9.2.0
      x-metaTags:
        - content: Kibana
          name: product_name
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/agent_builder/agents</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Create a new agent. Use this endpoint to define the agent's behavior, appearance, and capabilities through comprehensive configuration options. To learn more about agents, refer to the [agents documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/agent-builder-agents).<br/><br/>[Required authorization] Route required privileges: agentBuilder:manageAgents.
      operationId: post-agent-builder-agents
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
      requestBody:
        content:
          application/json:
            examples:
              createAgentRequestExample:
                description: Example request for creating a custom agent with special prompt and tools
                value:
                  avatar_color: '#BFDBFF'
                  avatar_symbol: SI
                  configuration:
                    instructions: You are a custom agent that wants to help searching data using all indices starting with prefix "content-".
                    tools:
                      - tool_ids:
                          - platform.core.search
                          - platform.core.list_indices
                          - platform.core.get_index_mapping
                          - platform.core.get_document_by_id
                  description: Hi! I can help you search the data within the indices starting with "content-" prefix.
                  id: created-agent-id
                  labels:
                    - custom-indices
                    - department-search
                  name: Search Index Helper
            schema:
              additionalProperties: false
              type: object
              properties:
                access_control:
                  additionalProperties: false
                  type: object
                  properties:
                    access_mode:
                      description: 'Access-control mode: `public` (any privileged user can read/write), `shared` (any privileged user can read, only owner can write), `private` (only owner can read/write). Agents created without an access-control mode default to `private`.'
                      enum:
                        - public
                        - shared
                        - private
                      type: string
                      x-state: Generally available; added in 9.4.0
                  required:
                    - access_mode
                avatar_color:
                  description: Optional hex color code for the agent avatar.
                  type: string
                avatar_symbol:
                  description: Optional symbol/initials for the agent avatar.
                  type: string
                configuration:
                  additionalProperties: false
                  description: Configuration settings for the agent.
                  type: object
                  properties:
                    ai_indices:
                      description: Array of AI indices to associate with the agent.
                      items:
                        description: AI indices to associate with the agent.
                        maxLength: 256
                        type: string
                      maxItems: 100
                      type: array
                    connector_ids:
                      description: Array of connector IDs to associate with the agent.
                      items:
                        description: Connector ID to associate with the agent.
                        type: string
                      maxItems: 100
                      type: array
                    enable_elastic_capabilities:
                      description: When true, enables built-in Elastic capabilities for the agent.
                      type: boolean
                    instructions:
                      description: Optional system instructions that define the agent behavior.
                      type: string
                    plugin_ids:
                      description: Array of plugin IDs to assign to the agent.
                      items:
                        description: Plugin ID to assign to the agent.
                        type: string
                      maxItems: 100
                      type: array
                    post_execution_workflow_ids:
                      items:
                        description: Optional list of workflow IDs. When set, these workflows run after the agent finishes each round.
                        maxLength: 512
                        type: string
                      maxItems: 100
                      type: array
                    skill_ids:
                      description: Array of skill IDs to be available to the agent.
                      items:
                        description: Skill ID to be available to the agent.
                        type: string
                      maxItems: 100
                      type: array
                    subagent_ids:
                      description: Allowlist of subagent IDs this agent may spawn. Missing or empty disables the `run_subagent` tool. Use '_self' to enable self-fork.
                      items:
                        description: Agent ID this agent may spawn as a subagent via `run_subagent`. Use '_self' to enable self-fork.
                        maxLength: 64
                        type: string
                      maxItems: 50
                      type: array
                      x-state: Generally available; added in 9.6.0
                    tools:
                      items:
                        additionalProperties: false
                        description: Tool selection configuration for the agent.
                        type: object
                        properties:
                          tool_ids:
                            description: Array of tool IDs that the agent can use.
                            items:
                              description: Tool ID to be available to the agent.
                              type: string
                            type: array
                        required:
                          - tool_ids
                      type: array
                    workflow_ids:
                      items:
                        description: Optional list of workflow IDs. When set, these workflows run before every agent execution, in order.
                        type: string
                      maxItems: 100
                      type: array
                  required:
                    - tools
                description:
                  description: Description of what the agent does.
                  type: string
                id:
                  description: Unique identifier for the agent.
                  type: string
                labels:
                  description: Optional labels for categorizing and organizing agents.
                  items:
                    description: Label for categorizing the agent.
                    type: string
                  type: array
                name:
                  description: Display name for the agent.
                  type: string
              required:
                - id
                - name
                - description
                - configuration
      responses:
        '200':
          content:
            application/json:
              examples:
                createAgentResponseExample:
                  description: Example response returning the definition of an agent created as a result of the request
                  value:
                    avatar_color: '#BFDBFF'
                    avatar_symbol: SI
                    configuration:
                      instructions: You are a custom agent that wants to help searching data using all indices starting with prefix "content-".
                      tools:
                        - tool_ids:
                            - platform.core.search
                            - platform.core.list_indices
                            - platform.core.get_index_mapping
                            - platform.core.get_document_by_id
                    description: Hi! I can help you search the data within the indices starting with "content-" prefix.
                    id: created-agent-id
                    labels:
                      - custom-indices
                      - department-search
                    name: Search Index Helper
                    type: chat
          description: Indicates a successful response
      summary: Create an agent
      tags:
        - agent builder
      x-codeSamples:
        - lang: curl
          source: |
            curl \
              -X POST "${KIBANA_URL}/api/agent_builder/agents" \
              -H "Authorization: ApiKey ${API_KEY}" \
              -H "kbn-xsrf: true" \
              -H "Content-Type: application/json" \
              -d '{
                "id": "new-agent-id",
                "name": "Search Index Helper",
                "description": "Hi! I can help you search the data within the indices starting with \"content-\" prefix.",
                "labels": ["custom-indices", "department-search"],
                "avatar_color": "#BFDBFF",
                "avatar_symbol": "SI",
                "configuration": {
                  "instructions": "You are a custom agent that wants to help searching data using all indices starting with prefix \"content-\".",
                  "tools": [
                    {
                      "tool_ids": [
                        "platform.core.search",
                        "platform.core.list_indices",
                        "platform.core.get_index_mapping",
                        "platform.core.get_document_by_id"
                      ]
                    }
                  ]
                }
            }'
        - lang: Console
          source: |
            POST kbn://api/agent_builder/agents
            {
              "id": "new-agent-id",
              "name": "Search Index Helper",
              "description": "Hi! I can help you search the data within the indices starting with \"content-\" prefix.",
              "labels": ["custom-indices", "department-search"],
              "avatar_color": "#BFDBFF",
              "avatar_symbol": "SI",
              "configuration": {
                "instructions": "You are a custom agent that wants to help searching data using all indices starting with prefix \"content-\".",
                "tools": [
                  {
                    "tool_ids": [
                      "platform.core.search",
                      "platform.core.list_indices",
                      "platform.core.get_index_mapping",
                      "platform.core.get_document_by_id"
                    ]
                  }
                ]
              }
            }
      x-state: Added in 9.2.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/agent_builder/agents/{agent_id}/consumption:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/agent_builder/agents/{agent_id}/consumption</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Returns paginated, per-conversation token consumption data for a given agent. Includes input/output token counts, round counts, LLM call counts, and warnings for conversations with high token usage. Requires the manageAgents privilege. To learn more about monitoring agent token usage, refer to the [monitor usage documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/monitor-usage).<br/><br/>[Required authorization] Route required privileges: agentBuilder:manageAgents.
      operationId: post-agent-builder-agents-agent-id-consumption
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: The unique identifier of the agent.
          in: path
          name: agent_id
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            examples:
              consumptionDefaultExample:
                description: Get consumption data for an agent with default pagination
                value:
                  size: 25
                  sort_field: updated_at
                  sort_order: desc
              consumptionFilteredExample:
                description: Get consumption data filtered by username with warnings
                value:
                  has_warnings: true
                  size: 10
                  sort_field: total_tokens
                  sort_order: desc
                  usernames:
                    - elastic
                    - admin
            schema:
              additionalProperties: false
              type: object
              properties:
                has_warnings:
                  description: Filter to conversations with or without high-token warnings.
                  type: boolean
                search:
                  description: Free-text search filter on conversation title.
                  type: string
                search_after:
                  description: Cursor for pagination. Pass the search_after value from the previous response.
                  items:
                    nullable: true
                  maxItems: 10000
                  type: array
                size:
                  default: 25
                  description: Number of results per page.
                  maximum: 100
                  minimum: 1
                  type: number
                sort_field:
                  default: updated_at
                  description: Field to sort results by.
                  enum:
                    - updated_at
                    - total_tokens
                    - round_count
                  type: string
                sort_order:
                  default: desc
                  description: Sort direction.
                  enum:
                    - asc
                    - desc
                  type: string
                usernames:
                  description: Filter results to conversations by these usernames.
                  items:
                    type: string
                  maxItems: 10000
                  type: array
      responses:
        '200':
          content:
            application/json:
              examples:
                consumptionResponseExample:
                  description: Example response with per-conversation token usage data
                  value:
                    aggregations:
                      total_with_warnings: 0
                      usernames:
                        - elastic
                        - admin
                    results:
                      - conversation_id: conv-abc123
                        created_at: '2025-03-01T10:00:00Z'
                        llm_calls: 8
                        round_count: 5
                        title: Help me search my data
                        token_usage:
                          input_tokens: 15000
                          output_tokens: 3000
                          total_tokens: 18000
                        updated_at: '2025-03-01T10:15:00Z'
                        user:
                          id: uid-1
                          username: elastic
                        warnings: []
                      - conversation_id: conv-def456
                        created_at: '2025-03-02T14:00:00Z'
                        llm_calls: 20
                        round_count: 12
                        title: Analyze server logs
                        token_usage:
                          input_tokens: 250000
                          output_tokens: 8000
                          total_tokens: 258000
                        updated_at: '2025-03-02T14:30:00Z'
                        user:
                          id: uid-2
                          username: admin
                        warnings:
                          - input_tokens: 250000
                            round_id: round-7
                            type: high_input_tokens
                    search_after:
                      - 1709391000000
                      - '2025-03-02T14:30:00Z'
                    total: 2
          description: Indicates a successful response
      summary: Get agent consumption data
      tags:
        - agent builder
      x-codeSamples:
        - lang: curl
          source: |
            curl \
             -X POST "${KIBANA_URL}/api/agent_builder/agents/elastic-ai-agent/consumption" \
             -H "Authorization: ApiKey ${API_KEY}" \
             -H "Content-Type: application/json" \
             -H "elastic-api-version: 2023-10-31" \
             -d '{"size": 25, "sort_field": "updated_at", "sort_order": "desc"}'
        - lang: Console
          source: |
            POST kbn://api/agent_builder/agents/elastic-ai-agent/consumption
            {"size": 25, "sort_field": "updated_at", "sort_order": "desc"}
      x-state: Experimental; added in 9.4.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/agent_builder/agents/{id}:
    delete:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb delete">delete</span>&nbsp;<span class="operation-path">/s/{space_id}/api/agent_builder/agents/{id}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Delete an agent by ID. This action cannot be undone. To learn more about agents, refer to the [agents documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/agent-builder-agents).<br/><br/>[Required authorization] Route required privileges: agentBuilder:manageAgents.
      operationId: delete-agent-builder-agents-id
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: The unique identifier of the agent to delete.
          in: path
          name: id
          required: true
          schema:
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                deleteAgentResponseExample:
                  description: Example response showing that deletion of the agent has been successful
                  value:
                    success: true
          description: Indicates a successful response
      summary: Delete an agent
      tags:
        - agent builder
      x-codeSamples:
        - lang: curl
          source: |
            curl \
              -X DELETE "${KIBANA_URL}/api/agent_builder/agents/{id}" \
              -H "Authorization: ApiKey ${API_KEY}" \
              -H "kbn-xsrf: true"
        - lang: Console
          source: |
            DELETE kbn://api/agent_builder/agents/{id}
      x-state: Added in 9.2.0
      x-metaTags:
        - content: Kibana
          name: product_name
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/agent_builder/agents/{id}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Get a specific agent by ID. Use this endpoint to retrieve the complete agent definition including all configuration details and tool assignments. To learn more about agents, refer to the [agents documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/agent-builder-agents).<br/><br/>[Required authorization] Route required privileges: agentBuilder:read.
      operationId: get-agent-builder-agents-id
      parameters:
        - description: The unique identifier of the agent to retrieve.
          in: path
          name: id
          required: true
          schema:
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                getAgentByIdResponseExample:
                  description: Example response that an agent created by the user that will query elasticsearch indices starting with 'content-' prefix to answer the questions.
                  value:
                    access_control:
                      access_mode: private
                      entries:
                        - name: alice
                          role: manager
                          type: user
                    avatar_color: '#BFDBFF'
                    avatar_symbol: SI
                    configuration:
                      instructions: You are a custom agent that wants to help searching data using all indices starting with prefix "content-".
                      tools:
                        - tool_ids:
                            - platform.core.search
                            - platform.core.list_indices
                            - platform.core.get_index_mapping
                            - platform.core.get_document_by_id
                    description: Hi! I can help you search the data within the indices starting with "content-" prefix.
                    id: created-agent-id
                    labels:
                      - custom-indices
                      - department-search
                    name: Search Index Helper
                    permissions:
                      update_access_control: true
                      update_agent: true
                    type: chat
          description: Indicates a successful response
      summary: Get an agent by ID
      tags:
        - agent builder
      x-codeSamples:
        - lang: curl
          source: |
            curl \
              -X GET "${KIBANA_URL}/api/agent_builder/agents/{id}" \
              -H "Authorization: ApiKey ${API_KEY}"
        - lang: Console
          source: |
            GET kbn://api/agent_builder/agents/{id}
      x-state: Added in 9.2.0
      x-metaTags:
        - content: Kibana
          name: product_name
    put:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb put">put</span>&nbsp;<span class="operation-path">/s/{space_id}/api/agent_builder/agents/{id}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Update an existing agent configuration. Use this endpoint to modify any aspect of the agent's behavior, appearance, or capabilities. To learn more about agents, refer to the [agents documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/agent-builder-agents).<br/><br/>[Required authorization] Route required privileges: agentBuilder:manageAgents.
      operationId: put-agent-builder-agents-id
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: The unique identifier of the agent to update.
          in: path
          name: id
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            examples:
              createAgentRequestExample:
                description: Example request for updating custom agent
                value:
                  avatar_color: '#BFDBFF'
                  avatar_symbol: SI
                  configuration:
                    instructions: You are a custom agent that wants to help searching data using all indices starting with prefix "content-".
                    tools:
                      - tool_ids:
                          - platform.core.search
                          - platform.core.list_indices
                          - platform.core.get_index_mapping
                          - platform.core.get_document_by_id
                  description: Updated description - Search for anything in "content-*" indices!
                  id: created-agent-id
                  labels:
                    - custom-indices
                    - department-search
                    - elastic-employees
                  name: Search Index Helper
            schema:
              additionalProperties: false
              type: object
              properties:
                access_control:
                  additionalProperties: false
                  type: object
                  properties:
                    access_mode:
                      description: 'Access-control mode: `public` (any privileged user can read/write), `shared` (any privileged user can read, only owner can write), `private` (only owner can read/write). Agents created without an access-control mode default to `private`.'
                      enum:
                        - public
                        - shared
                        - private
                      type: string
                      x-state: Generally available; added in 9.4.0
                  required:
                    - access_mode
                avatar_color:
                  description: Updated hex color code for the agent avatar.
                  type: string
                avatar_symbol:
                  description: Updated symbol/initials for the agent avatar.
                  type: string
                configuration:
                  additionalProperties: false
                  description: Updated configuration settings for the agent.
                  type: object
                  properties:
                    ai_indices:
                      description: Array of AI indices to associate with the agent.
                      items:
                        description: AI indices to associate with the agent.
                        maxLength: 256
                        type: string
                      maxItems: 100
                      type: array
                    connector_ids:
                      description: Array of connector IDs to associate with the agent.
                      items:
                        description: Connector ID to associate with the agent.
                        type: string
                      maxItems: 100
                      type: array
                    enable_elastic_capabilities:
                      description: When true, enables built-in Elastic capabilities for the agent.
                      type: boolean
                    instructions:
                      description: Updated system instructions that define the agent behavior.
                      type: string
                    plugin_ids:
                      description: Array of plugin IDs to assign to the agent.
                      items:
                        description: Plugin ID to assign to the agent.
                        type: string
                      maxItems: 100
                      type: array
                    post_execution_workflow_ids:
                      items:
                        description: Updated list of workflow IDs. When set, these workflows run after the agent finishes each round.
                        maxLength: 512
                        type: string
                      maxItems: 100
                      type: array
                    skill_ids:
                      description: Array of skill IDs to be available to the agent.
                      items:
                        description: Skill ID to be available to the agent.
                        type: string
                      maxItems: 100
                      type: array
                    subagent_ids:
                      description: Allowlist of subagent IDs this agent may spawn. Missing or empty disables the `run_subagent` tool. Use '_self' to enable self-fork.
                      items:
                        description: Agent ID this agent may spawn as a subagent via `run_subagent`. Use '_self' to enable self-fork.
                        maxLength: 64
                        type: string
                      maxItems: 50
                      type: array
                      x-state: Generally available; added in 9.6.0
                    tools:
                      items:
                        additionalProperties: false
                        description: Tool selection configuration for the agent.
                        type: object
                        properties:
                          tool_ids:
                            description: Array of tool IDs that the agent can use.
                            items:
                              description: Tool ID to be available to the agent.
                              type: string
                            type: array
                        required:
                          - tool_ids
                      type: array
                    workflow_ids:
                      items:
                        description: Updated list of workflow IDs. When set, these workflows run every agent execution, in order.
                        type: string
                      maxItems: 100
                      type: array
                description:
                  description: Updated description of what the agent does.
                  type: string
                labels:
                  description: Updated labels for categorizing and organizing agents.
                  items:
                    description: Updated label for categorizing the agent.
                    type: string
                  type: array
                name:
                  description: Updated display name for the agent.
                  type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                updateAgentResponseExample:
                  description: Example response returning the agent definition with the changes applied from the request
                  value:
                    avatar_color: '#BFDBFF'
                    avatar_symbol: SI
                    configuration:
                      instructions: You are a custom agent that wants to help searching data using all indices starting with prefix "content-".
                      tools:
                        - tool_ids:
                            - platform.core.search
                            - platform.core.list_indices
                            - platform.core.get_index_mapping
                            - platform.core.get_document_by_id
                    description: Updated description - Search for anything in "content-*" indices!
                    id: created-agent-id
                    labels:
                      - custom-indices
                      - department-search
                      - elastic-employees
                    name: Search Index Helper
                    type: chat
          description: Indicates a successful response
      summary: Update an agent
      tags:
        - agent builder
      x-codeSamples:
        - lang: curl
          source: |
            curl \
              -X PUT "${KIBANA_URL}/api/agent_builder/agents/{id}" \
              -H "Authorization: ApiKey ${API_KEY}" \
              -H "kbn-xsrf: true" \
              -H "Content-Type: application/json" \
              -d '{
                "name": "Search Index Helper",
                "description": "Updated description - Search for anything in \"content-*\" indices!",
                "labels": ["custom-indices", "department-search", "elastic-employees"],
                "avatar_color": "#BFDBFF",
                "avatar_symbol": "SI",
                "configuration": {
                  "instructions": "You are a custom agent that wants to help searching data using all indices starting with prefix \"content-\".",
                  "tools": [{
                    "tool_ids": [
                      "platform.core.search",
                      "platform.core.list_indices",
                      "platform.core.get_index_mapping",
                      "platform.core.get_document_by_id"
                    ]
                  }]
                }
              }'
        - lang: Console
          source: |
            PUT kbn://api/agent_builder/agents/{id}
            {
              "name": "Search Index Helper",
              "description": "Updated description - Search for anything in \"content-*\" indices!",
              "labels": ["custom-indices", "department-search", "elastic-employees"],
              "avatar_color": "#BFDBFF",
              "avatar_symbol": "SI",
              "configuration": {
                "instructions": "You are a custom agent that wants to help searching data using all indices starting with prefix \"content-\".",
                "tools": [{
                  "tool_ids": [
                    "platform.core.search",
                    "platform.core.list_indices",
                    "platform.core.get_index_mapping",
                    "platform.core.get_document_by_id"
                  ]
                }]
              }
            }
      x-state: Added in 9.2.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/agent_builder/agents/{id}/access_control:
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/agent_builder/agents/{id}/access_control</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Get the access control for a specific agent. Callers without permission to manage access control receive `permissions.update_access_control: false` and only their own entry. To learn more about agents, refer to the [agents documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/agent-builder-agents).<br/><br/>[Required authorization] Route required privileges: agentBuilder:read.
      operationId: get-agent-builder-agents-id-access-control
      parameters:
        - description: The unique identifier of the agent whose access control to retrieve.
          in: path
          name: id
          required: true
          schema:
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                getAgentAccessControlMaskedResponseExample:
                  description: Example response for a caller without manage permission — only the caller's own entry is returned.
                  value:
                    access_control:
                      access_mode: private
                      entries:
                        - added_at: '2026-02-11T10:15:00.000Z'
                          id: u_bob_profile_uid
                          role: user
                          type: user
                    permissions:
                      update_access_control: false
                getAgentAccessControlResponseExample:
                  description: Example response for a caller who can manage access control — the agent has two grantees keyed on their Kibana user profile uid.
                  value:
                    access_control:
                      access_mode: private
                      entries:
                        - added_at: '2026-02-11T10:15:00.000Z'
                          id: u_alice_profile_uid
                          role: editor
                          type: user
                        - added_at: '2026-02-11T10:15:00.000Z'
                          id: u_bob_profile_uid
                          role: user
                          type: user
                    permissions:
                      update_access_control: true
          description: Indicates a successful response
        '404':
          content:
            application/json:
              examples:
                agentNotFoundResponseExample:
                  value:
                    attributes:
                      trace_id: 8d4f2a3b-1c5e-4a9b-9f0d-2e6c1a3d4f5e
                    error: Not Found
                    message: Agent custom-agent-id not found
                    statusCode: 404
          description: Not Found — no agent with this ID is visible to the caller. Matches the existing `agentNotFound` shape, so unprivileged callers cannot probe for hidden agents.
      summary: Get an agent's access control list
      tags:
        - agent builder
      x-codeSamples:
        - lang: curl
          source: |
            curl \
              -X GET "${KIBANA_URL}/api/agent_builder/agents/{id}/access_control" \
              -H "Authorization: ApiKey ${API_KEY}"
        - lang: Console
          source: |
            GET kbn://api/agent_builder/agents/{id}/access_control
      x-state: Generally available; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
    put:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb put">put</span>&nbsp;<span class="operation-path">/s/{space_id}/api/agent_builder/agents/{id}/access_control</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Replace the per-agent access-control entries. Each entry grants one user a role on this agent. Identify the user by their Kibana user profile uid (`id`). Entries created before profile uids were adopted may use `name` (deprecated) instead. The agent owner, cluster admins, and anyone access control grants Manager can call this endpoint. Each call replaces the entire entries list — the most recent successful update wins. To learn more about agents, refer to the [agents documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/agent-builder-agents).<br/><br/>[Required authorization] Route required privileges: agentBuilder:manageAgents.
      operationId: put-agent-builder-agents-id-access-control
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: The unique identifier of the agent whose access control to update.
          in: path
          name: id
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            examples:
              clearAgentAccessControlRequestExample:
                description: Submit an empty entries list to remove all custom grants. Access then falls back to the agent's access-control mode.
                value:
                  entries: []
              updateAgentAccessControlRequestExample:
                description: Example request granting two users access to the agent by their Kibana user profile uid — Alice as Editor (can update the agent configuration), Bob as User (can run the agent).
                value:
                  entries:
                    - id: u_alice_profile_uid
                      role: editor
                      type: user
                    - id: u_bob_profile_uid
                      role: user
                      type: user
            schema:
              additionalProperties: false
              type: object
              properties:
                entries:
                  description: Access-control entries to apply to the agent. Each entry has a `type` (for example `user`), a `role`, and either an `id` (the principal user profile uid, preferred) or a deprecated `name` (username).
                  items:
                    additionalProperties: false
                    type: object
                    properties:
                      id:
                        description: Stable identifier of the user to grant access to (Kibana user profile uid). Preferred over `name`.
                        maxLength: 1024
                        minLength: 1
                        type: string
                        x-state: Generally available; added in 9.6.0
                      name:
                        description: Case-sensitive Kibana username of the user to grant access to. Still supported, but `id` is preferred for new grants because a username cannot distinguish same-named users across authentication realms.
                        maxLength: 1024
                        minLength: 1
                        type: string
                      role:
                        description: 'Role granted to the principal. Roles are hierarchical: `user` allows viewing, listing, reading, and running the agent; `editor` adds updating the agent configuration; `manager` adds deleting the agent and managing its access control.'
                        enum:
                          - user
                          - editor
                          - manager
                        type: string
                      type:
                        enum:
                          - user
                        type: string
                    required:
                      - type
                      - role
                  maxItems: 100
                  type: array
              required:
                - entries
      responses:
        '200':
          content:
            application/json:
              examples:
                updateAgentAccessControlResponseExample:
                  description: Example response returning the persisted access control after the update.
                  value:
                    access_mode: private
                    entries:
                      - added_at: '2026-02-11T10:15:00.000Z'
                        id: u_alice_profile_uid
                        role: editor
                        type: user
                      - added_at: '2026-02-11T10:15:00.000Z'
                        id: u_bob_profile_uid
                        role: user
                        type: user
          description: Indicates a successful response
        '400':
          content:
            application/json:
              examples:
                accessControlOnDefaultAgentResponseExample:
                  description: The built-in Elastic default agent (`elastic-ai-agent`) cannot have custom access control — its access is governed by the platform, not per-agent grants.
                  value:
                    attributes:
                      trace_id: 8d4f2a3b-1c5e-4a9b-9f0d-2e6c1a3d4f5e
                    error: Bad Request
                    message: The default agent (elastic-ai-agent) does not support custom access controls.
                    statusCode: 400
                tooManyEntriesResponseExample:
                  description: Request body exceeds the 100-entry maximum.
                  value:
                    error: Bad Request
                    message: '[request body.entries]: array size is [101], but cannot be greater than [100]'
                    statusCode: 400
          description: Bad Request — the request body failed validation, or the request targets the built-in Elastic default agent (which cannot have custom access control).
        '404':
          content:
            application/json:
              examples:
                agentNotFoundResponseExample:
                  value:
                    attributes:
                      trace_id: 8d4f2a3b-1c5e-4a9b-9f0d-2e6c1a3d4f5e
                    error: Not Found
                    message: Agent custom-agent-id not found
                    statusCode: 404
          description: Not Found — no agent with this ID is visible to the caller, or the caller lacks write access. Matches the existing `agentNotFound` shape so unprivileged callers cannot probe for hidden agents.
      summary: Update an agent's access control list
      tags:
        - agent builder
      x-codeSamples:
        - lang: curl
          source: |
            curl \
              -X PUT "${KIBANA_URL}/api/agent_builder/agents/{id}/access_control" \
              -H "Authorization: ApiKey ${API_KEY}" \
              -H "kbn-xsrf: true" \
              -H "Content-Type: application/json" \
              -d '{
                "entries": [
                  { "type": "user", "id": "u_alice_profile_uid", "role": "editor" },
                  { "type": "user", "id": "u_bob_profile_uid", "role": "user" }
                ]
              }'
        - lang: Console
          source: |
            PUT kbn://api/agent_builder/agents/{id}/access_control
            {
              "entries": [
                { "type": "user", "id": "u_alice_profile_uid", "role": "editor" },
                { "type": "user", "id": "u_bob_profile_uid", "role": "user" }
              ]
            }
      x-state: Generally available; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/agent_builder/conversations:
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/agent_builder/conversations</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        List all conversations for a user. Use the optional agent ID to filter conversations by a specific agent. To learn more about agent conversations, refer to the [agent chat documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/chat).<br/><br/>[Required authorization] Route required privileges: agentBuilder:read.
      operationId: get-agent-builder-conversations
      parameters:
        - description: Optional agent ID to filter conversations by a specific agent.
          in: query
          name: agent_id
          required: false
          schema:
            maxLength: 64
            type: string
        - description: Page number, 1-based.
          in: query
          name: page
          required: false
          schema:
            default: 1
            minimum: 1
            type: number
        - description: Number of results per page. Maximum 1000.
          in: query
          name: per_page
          required: false
          schema:
            default: 1000
            maximum: 1000
            minimum: 1
            type: number
        - description: Sort direction for results, ordered by updated_at.
          in: query
          name: sort_order
          required: false
          schema:
            default: desc
            enum:
              - asc
              - desc
            type: string
        - description: Filter to pinned (true) or unpinned (false) conversations. Omit to return all.
          in: query
          name: pinned
          required: false
          schema:
            type: boolean
      responses:
        '200':
          content:
            application/json:
              examples:
                listConversationsPinnedExample:
                  description: Example response filtered to pinned conversations only
                  value:
                    pagination:
                      page: 1
                      per_page: 1000
                      total: 3
                    results:
                      - agent_id: elastic-ai-agent
                        created_at: '2025-08-01T10:00:00.000Z'
                        id: a1b2c3d4-1234-5678-abcd-000000000001
                        permissions:
                          delete: true
                          rename: true
                        pinned: true
                        title: Important reference conversation
                        updated_at: '2025-09-20T08:30:00.000Z'
                        user:
                          username: elastic
                listConversationsResponseExample:
                  description: Example response returning the first page of conversations for all agents
                  value:
                    pagination:
                      page: 1
                      per_page: 1000
                      total: 128
                    results:
                      - agent_id: elastic-ai-agent
                        attachments:
                          - id: 6f1c0f1e-6c2a-4a0a-9a1e-2f2b1c7d4e11
                            type: text
                          - id: 2b9d7c53-0b8e-4a77-9f0c-91a5d6c3b208
                            type: esql
                        created_at: '2025-09-19T17:45:39.554Z'
                        id: bcc176c5-38f6-40be-be0c-898e34fa1480
                        permissions:
                          delete: true
                          rename: true
                        title: General Greeting
                        updated_at: '2025-09-19T17:45:39.554Z'
                        user:
                          username: elastic
          description: Indicates a successful response
      summary: List conversations
      tags:
        - agent builder
      x-codeSamples:
        - lang: curl
          source: |
            curl \
              -X GET "${KIBANA_URL}/api/agent_builder/conversations?page=1&sort_order=desc" \
              -H "Authorization: ApiKey ${API_KEY}" \
              -H "elastic-api-version: 2023-10-31"
        - label: Filter to pinned conversations
          lang: curl
          source: |
            curl \
              -X GET "${KIBANA_URL}/api/agent_builder/conversations?pinned=true" \
              -H "Authorization: ApiKey ${API_KEY}" \
              -H "elastic-api-version: 2023-10-31"
        - lang: Console
          source: |
            GET kbn://api/agent_builder/conversations?page=1&sort_order=desc
      x-state: Added in 9.2.0
      x-metaTags:
        - content: Kibana
          name: product_name
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/agent_builder/conversations</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Create an empty conversation without sending a message. Returns the created conversation immediately. Use this to obtain a conversation ID before starting a chat session. To learn more about agent conversations, refer to the [agent chat documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/chat).<br/><br/>[Required authorization] Route required privileges: agentBuilder:read.
      operationId: post-agent-builder-conversations
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
      requestBody:
        content:
          application/json:
            examples:
              createConversationFromTemplateExample:
                description: Example request applying a conversation template and seeding metadata (each key must be declared by the template)
                value:
                  metadata:
                    on_call: true
                    services:
                      - checkout
                      - payments
                    severity: high
                  template_id: incident-response
                  title: Incident triage
              createConversationRequestExample:
                description: Example request for creating a private shared conversation with a custom title and two members
                value:
                  access_control:
                    access_mode: private
                    entries:
                      - id: u_abc123_uid
                        role: member
                        type: user
                      - id: u_def456_uid
                        role: member
                        type: user
                  title: My new conversation
            schema:
              additionalProperties: false
              type: object
              properties:
                access_control:
                  additionalProperties: false
                  description: Optional access control settings. Defaults to private.
                  type: object
                  properties:
                    access_mode:
                      description: "Access-control mode: `private` (only the owner and the listed members can read and continue the conversation), `public` (any user with access to the conversation's agent can read and continue it)."
                      enum:
                        - private
                        - public
                      type: string
                    entries:
                      description: Members to share the conversation with. The list replaces the stored one; submit an empty list to unshare. Entries naming the owner are ignored. Must be empty when `access_mode` is `public`; repeated ids are rejected.
                      items:
                        additionalProperties: false
                        type: object
                        properties:
                          id:
                            description: 'Stable identifier of the user to share the conversation with: a Kibana user profile uid. Users without a profile cannot be granted access.'
                            maxLength: 1024
                            minLength: 1
                            type: string
                          role:
                            description: 'Role granted to the principal. `member` is the only role: it grants read and converse access to the conversation.'
                            enum:
                              - member
                            type: string
                          type:
                            enum:
                              - user
                            type: string
                        required:
                          - type
                          - id
                          - role
                      maxItems: 100
                      type: array
                  required:
                    - access_mode
                agent_id:
                  description: The ID of the agent to associate with the conversation. Defaults to the default Elastic AI agent.
                  maxLength: 64
                  type: string
                conversation_id:
                  description: Optional client-supplied UUID for the conversation. Server-generated if omitted.
                  maxLength: 256
                  type: string
                metadata:
                  additionalProperties:
                    anyOf:
                      - maxLength: 10000
                        type: string
                      - type: number
                      - type: boolean
                      - items:
                          maxLength: 2000
                          type: string
                        maxItems: 100
                        type: array
                  description: Initial metadata values. Each key must be declared by the referenced template; each value is validated against the field definition (type, options, min/max, regex, max_length). Requires `template_id`.
                  type: object
                template_id:
                  description: Optional ID of a conversation template to apply. When set, the template seeds default metadata and any caller-supplied `metadata` is validated against the template field definitions.
                  maxLength: 256
                  minLength: 1
                  type: string
                title:
                  description: Title for the conversation. Defaults to "New conversation".
                  maxLength: 500
                  type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                createConversationResponseExample:
                  description: Example response returning the newly created conversation
                  value:
                    access_control:
                      access_mode: private
                      entries:
                        - added_at: '2026-08-14T10:00:00.000Z'
                          id: u_abc123_uid
                          role: member
                          type: user
                        - added_at: '2026-08-14T10:00:00.000Z'
                          id: u_def456_uid
                          role: member
                          type: user
                    agent_id: elastic-ai-agent
                    created_at: '2026-08-14T10:00:00.000Z'
                    id: bcc176c5-38f6-40be-be0c-898e34fa1480
                    permissions:
                      delete: true
                      rename: true
                    rounds: []
                    title: My new conversation
                    updated_at: '2026-08-14T10:00:00.000Z'
                    user:
                      username: elastic
          description: Indicates a successful response
      summary: Create conversation
      tags:
        - agent builder
      x-codeSamples:
        - lang: curl
          source: |
            curl \
              -X POST "${KIBANA_URL}/api/agent_builder/conversations" \
              -H "Authorization: ApiKey ${API_KEY}" \
              -H "kbn-xsrf: true" \
              -H "Content-Type: application/json" \
              -d '{
                "title": "My new conversation",
                "access_control": {
                  "access_mode": "private",
                  "entries": [{ "type": "user", "id": "u_abc123_uid", "role": "member" }]
                }
              }'
        - lang: Console
          source: |
            POST kbn://api/agent_builder/conversations
            {
              "title": "My new conversation",
              "access_control": {
                "access_mode": "private",
                "entries": [{ "type": "user", "id": "u_abc123_uid", "role": "member" }]
              }
            }
      x-state: Added in 9.6.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/agent_builder/conversations/{conversation_id}:
    delete:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb delete">delete</span>&nbsp;<span class="operation-path">/s/{space_id}/api/agent_builder/conversations/{conversation_id}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Delete a conversation by ID. This action cannot be undone. To learn more about agent conversations, refer to the [agent chat documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/chat).<br/><br/>[Required authorization] Route required privileges: agentBuilder:read.
      operationId: delete-agent-builder-conversations-conversation-id
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: The unique identifier of the conversation to delete.
          in: path
          name: conversation_id
          required: true
          schema:
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                deleteConversationResponseExample:
                  description: Example response showing that deletion of conversation has been successful
                  value:
                    success: true
          description: Indicates a successful response
      summary: Delete conversation by ID
      tags:
        - agent builder
      x-codeSamples:
        - lang: curl
          source: |
            curl \
              -X DELETE "${KIBANA_URL}/api/agent_builder/conversations/{conversation_id}" \
              -H "Authorization: ApiKey ${API_KEY}" \
              -H "kbn-xsrf: true"
        - lang: Console
          source: |
            DELETE kbn://api/agent_builder/conversations/{conversation_id}
      x-state: Added in 9.2.0
      x-metaTags:
        - content: Kibana
          name: product_name
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/agent_builder/conversations/{conversation_id}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Get a specific conversation by ID. Use this endpoint to retrieve the complete conversation history including all messages and metadata. To learn more about agent conversations, refer to the [agent chat documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/chat).<br/><br/>[Required authorization] Route required privileges: agentBuilder:read.
      operationId: get-agent-builder-conversations-conversation-id
      parameters:
        - description: The unique identifier of the conversation to retrieve.
          in: path
          name: conversation_id
          required: true
          schema:
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                getConversationByIdResponseExample:
                  description: Example response containing the contents of a convesation with the chat agent
                  value:
                    agent_id: elastic-ai-agent
                    created_at: '2025-09-19T17:45:39.554Z'
                    id: bcc176c5-38f6-40be-be0c-898e34fa1480
                    permissions:
                      delete: true
                      rename: true
                    rounds:
                      - feedback:
                          chips:
                            - accurate
                            - useful
                          comment: ''
                          submitted_at: '2025-09-19T17:46:12.000Z'
                          vote: up
                        id: 170ec3b2-0f5a-4538-8b60-549572386d2a
                        input:
                          message: Hello, how are you?
                        response:
                          message: |-
                            Since this is a general greeting that doesn't require any organizational or product-specific information, I can respond without using tools.

                            Hello! I'm doing well, thank you for asking. I'm here to help you with any questions you may have. How can I assist you today?
                        steps: []
                    title: General Greeting
                    updated_at: '2025-09-19T17:45:39.554Z'
                    user:
                      username: elastic
          description: Indicates a successful response
      summary: Get conversation by ID
      tags:
        - agent builder
      x-codeSamples:
        - lang: curl
          source: |
            curl \
              -X GET "${KIBANA_URL}/api/agent_builder/conversations/{conversation_id}" \
              -H "Authorization: ApiKey ${API_KEY}"
        - lang: Console
          source: |
            GET kbn://api/agent_builder/conversations/{conversation_id}
      x-state: Added in 9.2.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/agent_builder/conversations/{conversation_id}/_add_events:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/agent_builder/conversations/{conversation_id}/_add_events</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Append custom events to a conversation's timeline. The caller must be the owner, a member, or the conversation must be public. Server assigns id, created_at, and actor for each event; the body provides type and data. Only registered custom event types are accepted — built-in lifecycle types are rejected. To learn more about agent conversations, refer to the [agent chat documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/chat).<br/><br/>[Required authorization] Route required privileges: agentBuilder:read.
      operationId: post-agent-builder-conversations-conversation-id-add-events
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: The unique identifier of the conversation.
          in: path
          name: conversation_id
          required: true
          schema:
            maxLength: 256
            type: string
      requestBody:
        content:
          application/json:
            examples:
              addEventsRequestExample:
                description: Example request appending two custom events to a conversation
                value:
                  events:
                    - data:
                        text: First note on this conversation
                      type: text_note
                    - data:
                        text: Second note on this conversation
                      type: text_note
            schema:
              additionalProperties: false
              type: object
              properties:
                events:
                  description: Events to append. Between 1 and 10.
                  items:
                    additionalProperties: false
                    type: object
                    properties:
                      data:
                        additionalProperties: true
                        description: The event payload. Its shape is defined by the event type.
                        type: object
                        properties: {}
                      type:
                        description: The registered custom event type.
                        maxLength: 256
                        minLength: 1
                        type: string
                    required:
                      - type
                      - data
                  maxItems: 10
                  minItems: 1
                  type: array
              required:
                - events
      responses:
        '200':
          content:
            application/json:
              examples:
                addEventsResponseExample:
                  description: Example response returning the materialized events with server-assigned fields
                  value:
                    events:
                      - actor:
                          id: u_abc123_uid
                          type: user
                          username: elastic
                        created_at: '2026-09-14T10:00:00.000Z'
                        data:
                          text: First note on this conversation
                        id: 7d3f1a2b-4c5e-6f7a-8b9c-0d1e2f3a4b5c
                        type: text_note
                      - actor:
                          id: u_abc123_uid
                          type: user
                          username: elastic
                        created_at: '2026-09-14T10:00:00.000Z'
                        data:
                          text: Second note on this conversation
                        id: 8e4f2b3c-5d6f-7a8b-9c0d-1e2f3a4b5c6d
                        type: text_note
          description: Indicates a successful response
      summary: Add events to a conversation
      tags:
        - agent builder
      x-codeSamples:
        - lang: curl
          source: |
            curl \
              -X POST "${KIBANA_URL}/api/agent_builder/conversations/${CONVERSATION_ID}/_add_events" \
              -H "Authorization: ApiKey ${API_KEY}" \
              -H "kbn-xsrf: true" \
              -H "elastic-api-version: 2023-10-31" \
              -H "Content-Type: application/json" \
              -d '{
                "events": [
                  { "type": "text_note", "data": { "text": "A note on this conversation" } }
                ]
              }'
        - lang: Console
          source: |
            POST kbn://api/agent_builder/conversations/${CONVERSATION_ID}/_add_events
            {
              "events": [
                { "type": "text_note", "data": { "text": "A note on this conversation" } }
              ]
            }
      x-state: Technical Preview; added in 9.6.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/agent_builder/conversations/{conversation_id}/access_control:
    put:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb put">put</span>&nbsp;<span class="operation-path">/s/{space_id}/api/agent_builder/conversations/{conversation_id}/access_control</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Replace a conversation's access mode and member list. Only the conversation owner can call this endpoint; every other caller receives a not-found response. Each call replaces the entire access control — the most recent successful update wins. Members can read and continue the conversation, but still need access to the conversation's agent. To learn more about agent conversations, refer to the [agent chat documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/chat).<br/><br/>[Required authorization] Route required privileges: agentBuilder:read.
      operationId: put-agent-builder-conversations-conversation-id-access-control
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: The unique identifier of the conversation whose access control to update.
          in: path
          name: conversation_id
          required: true
          schema:
            maxLength: 256
            type: string
      requestBody:
        content:
          application/json:
            examples:
              publishConversationRequestExample:
                description: Switch the conversation to `public` so any user with access to its agent can read and continue it. A public conversation is already open to everyone with agent access, so `entries` must be empty.
                value:
                  access_mode: public
                  entries: []
              shareConversationRequestExample:
                description: Example request sharing a private conversation with two users. They can read and continue the conversation, provided they also have access to its agent.
                value:
                  access_mode: private
                  entries:
                    - id: u_kd2Wm6QCf9nBBqGGyfxBcQxIrgLLLLxbPHOTNHOTgWM_0
                      role: member
                      type: user
                    - id: u_9xXGnqPB4mLTNhOlHMHXqYbGrGFOTuQIRWlqLpKq0dE_0
                      role: member
                      type: user
              unshareConversationRequestExample:
                description: Submit an empty entries list to remove every member. Access then falls back to the access mode alone.
                value:
                  access_mode: private
                  entries: []
            schema:
              additionalProperties: false
              type: object
              properties:
                access_mode:
                  description: "Access-control mode: `private` (only the owner and the listed members can read and continue the conversation), `public` (any user with access to the conversation's agent can read and continue it)."
                  enum:
                    - private
                    - public
                  type: string
                entries:
                  description: Members to share the conversation with. The list replaces the stored one; submit an empty list to unshare. Entries naming the owner are ignored. Must be empty when `access_mode` is `public`; repeated ids are rejected.
                  items:
                    additionalProperties: false
                    type: object
                    properties:
                      id:
                        description: 'Stable identifier of the user to share the conversation with: a Kibana user profile uid. Users without a profile cannot be granted access.'
                        maxLength: 1024
                        minLength: 1
                        type: string
                      role:
                        description: 'Role granted to the principal. `member` is the only role: it grants read and converse access to the conversation.'
                        enum:
                          - member
                        type: string
                      type:
                        enum:
                          - user
                        type: string
                    required:
                      - type
                      - id
                      - role
                  maxItems: 100
                  type: array
              required:
                - access_mode
                - entries
      responses:
        '200':
          content:
            application/json:
              examples:
                updateConversationAccessControlResponseExample:
                  description: Example response returning the persisted access control. `added_at` is stamped by the server for newly added members and preserved for members that were already listed.
                  value:
                    access_mode: private
                    entries:
                      - added_at: '2026-08-11T10:00:00.000Z'
                        id: u_kd2Wm6QCf9nBBqGGyfxBcQxIrgLLLLxbPHOTNHOTgWM_0
                        role: member
                        type: user
                      - added_at: '2026-08-11T11:30:00.000Z'
                        id: u_9xXGnqPB4mLTNhOlHMHXqYbGrGFOTuQIRWlqLpKq0dE_0
                        role: member
                        type: user
          description: Indicates a successful response
        '400':
          content:
            application/json:
              examples:
                duplicateEntryResponseExample:
                  description: Two entries name the same user id.
                  value:
                    error: Bad Request
                    message: Duplicate ACL entry for user "u_kd2Wm6QCf9nBBqGGyfxBcQxIrgLLLLxbPHOTNHOTgWM_0"
                    statusCode: 400
                entriesWithPublicModeResponseExample:
                  description: '`entries` must be empty when `access_mode` is `public` — a public conversation is already open to everyone with agent access.'
                  value:
                    error: Bad Request
                    message: ACL entries are not supported when access_mode is "public"
                    statusCode: 400
                tooManyEntriesResponseExample:
                  description: Request body exceeds the 100-member maximum.
                  value:
                    error: Bad Request
                    message: '[request body.entries]: array size is [101], but cannot be greater than [100]'
                    statusCode: 400
          description: Bad Request — the request body failed validation.
        '404':
          content:
            application/json:
              examples:
                conversationNotFoundResponseExample:
                  value:
                    attributes:
                      trace_id: 8d4f2a3b-1c5e-4a9b-9f0d-2e6c1a3d4f5e
                    error: Not Found
                    message: Conversation my-conversation-id not found
                    statusCode: 404
          description: Not Found — no conversation with this ID is readable by the caller, or the caller is not its owner. Matches the existing `conversationNotFound` shape, so members cannot distinguish a conversation they may not re-share from one that does not exist.
      summary: Update a conversation's access control
      tags:
        - agent builder
      x-codeSamples:
        - lang: curl
          source: |
            curl \
              -X PUT "${KIBANA_URL}/api/agent_builder/conversations/{conversation_id}/access_control" \
              -H "Authorization: ApiKey ${API_KEY}" \
              -H "kbn-xsrf: true" \
              -H "Content-Type: application/json" \
              -d '{
                "access_mode": "private",
                "entries": [
                  { "type": "user", "id": "u_kd2Wm6QCf9nBBqGGyfxBcQxIrgLLLLxbPHOTNHOTgWM_0", "role": "member" }
                ]
              }'
        - lang: Console
          source: |
            PUT kbn://api/agent_builder/conversations/{conversation_id}/access_control
            {
              "access_mode": "private",
              "entries": [
                { "type": "user", "id": "u_kd2Wm6QCf9nBBqGGyfxBcQxIrgLLLLxbPHOTNHOTgWM_0", "role": "member" }
              ]
            }
      x-state: Generally available; added in 9.6.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/agent_builder/conversations/{conversation_id}/attachments:
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/agent_builder/conversations/{conversation_id}/attachments</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        List all attachments for a conversation. Use the optional include_deleted query parameter to include soft-deleted attachments.<br/><br/>[Required authorization] Route required privileges: agentBuilder:read.
      operationId: get-agent-builder-conversations-conversation-id-attachments
      parameters:
        - description: The unique identifier of the conversation.
          in: path
          name: conversation_id
          required: true
          schema:
            maxLength: 256
            type: string
        - description: Whether to include deleted attachments in the list.
          in: query
          name: include_deleted
          required: false
          schema:
            type: boolean
      responses:
        '200':
          content:
            application/json:
              examples:
                listAttachmentsResponseExample:
                  description: Example response containing active attachments for a conversation
                  value:
                    results:
                      - active: true
                        current_version: 2
                        description: My text file
                        id: attachment-1
                        type: text
                        versions:
                          - content_hash: abc123
                            created_at: '2025-01-01T10:00:00.000Z'
                            data: Initial content
                            estimated_tokens: 3
                            version: 1
                          - content_hash: def456
                            created_at: '2025-01-01T11:00:00.000Z'
                            data: Updated content
                            estimated_tokens: 3
                            version: 2
                      - active: true
                        current_version: 1
                        description: Configuration data
                        id: attachment-2
                        type: json
                        versions:
                          - content_hash: ghi789
                            created_at: '2025-01-01T12:00:00.000Z'
                            data:
                              key: value
                              nested:
                                field: 123
                            estimated_tokens: 15
                            version: 1
                    total_token_estimate: 21
          description: Indicates a successful response
      summary: List conversation attachments
      tags:
        - agent builder
      x-state: Experimental; added in 9.2.0
      x-metaTags:
        - content: Kibana
          name: product_name
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/agent_builder/conversations/{conversation_id}/attachments</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Create a new attachment for a conversation with version tracking.<br/><br/>[Required authorization] Route required privileges: agentBuilder:read.
      operationId: post-agent-builder-conversations-conversation-id-attachments
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: The unique identifier of the conversation.
          in: path
          name: conversation_id
          required: true
          schema:
            maxLength: 256
            type: string
      requestBody:
        content:
          application/json:
            examples:
              createHiddenAttachmentExample:
                description: Example request for creating a hidden attachment
                value:
                  data: Internal system data
                  description: System context
                  hidden: true
                  type: text
              createJsonAttachmentExample:
                description: Example request for creating a JSON attachment with custom ID
                value:
                  data:
                    configuration:
                      enabled: true
                      threshold: 50
                    metadata:
                      source: user_input
                  description: Application settings
                  id: custom-attachment-id
                  type: json
              createTextAttachmentExample:
                description: Example request for creating a text attachment
                value:
                  data: This is the content of my text attachment
                  description: Meeting notes
                  type: text
            schema:
              additionalProperties: false
              type: object
              properties:
                data:
                  description: The attachment data/content. Required unless origin is provided.
                  nullable: true
                description:
                  description: Human-readable description of the attachment.
                  maxLength: 2048
                  type: string
                hidden:
                  description: Whether the attachment should be hidden from the user.
                  type: boolean
                id:
                  description: Optional custom ID for the attachment.
                  maxLength: 256
                  type: string
                origin:
                  description: Origin string (for example, saved object ID) for by-reference attachments. When provided without data, the content is resolved once at creation time.
                  maxLength: 2048
                  type: string
                render_inline:
                  default: false
                  description: When true, the attachment is rendered inline in the UI when the conversation is opened, without the agent referencing it.
                  type: boolean
                type:
                  description: The type of the attachment (e.g., text, esql, visualization).
                  maxLength: 256
                  type: string
              required:
                - type
                - data
      responses:
        '200':
          content:
            application/json:
              examples:
                createAttachmentResponseExample:
                  description: Example response returning the created attachment
                  value:
                    attachment:
                      active: true
                      current_version: 1
                      description: Meeting notes
                      id: att-abc123
                      type: text
                      versions:
                        - content_hash: sha256-xyz
                          created_at: '2025-01-06T10:00:00.000Z'
                          data: This is the content of my text attachment
                          estimated_tokens: 12
                          version: 1
          description: Indicates a successful response
      summary: Create conversation attachment
      tags:
        - agent builder
      x-state: Experimental; added in 9.2.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/agent_builder/conversations/{conversation_id}/attachments/{attachment_id}:
    delete:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb delete">delete</span>&nbsp;<span class="operation-path">/s/{space_id}/api/agent_builder/conversations/{conversation_id}/attachments/{attachment_id}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Delete an attachment. By default performs a soft delete (can be restored). Use permanent=true to permanently remove unreferenced attachments.<br/><br/>[Required authorization] Route required privileges: agentBuilder:read.
      operationId: delete-agent-builder-conversations-conversation-id-attachments-attachment-id
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: The unique identifier of the conversation.
          in: path
          name: conversation_id
          required: true
          schema:
            maxLength: 256
            type: string
        - description: The unique identifier of the attachment to delete.
          in: path
          name: attachment_id
          required: true
          schema:
            maxLength: 256
            type: string
        - description: If true, permanently removes the attachment (only for unreferenced attachments).
          in: query
          name: permanent
          required: false
          schema:
            type: boolean
      responses:
        '200':
          content:
            application/json:
              examples:
                permanentDeleteAttachmentResponseExample:
                  description: Example response for permanent delete (cannot be restored)
                  value:
                    permanent: true
                    success: true
                softDeleteAttachmentResponseExample:
                  description: Example response for soft delete (can be restored)
                  value:
                    permanent: false
                    success: true
          description: Indicates a successful response
      summary: Delete conversation attachment
      tags:
        - agent builder
      x-state: Experimental; added in 9.2.0
      x-metaTags:
        - content: Kibana
          name: product_name
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/agent_builder/conversations/{conversation_id}/attachments/{attachment_id}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Get a single attachment by ID for a conversation.<br/><br/>[Required authorization] Route required privileges: agentBuilder:read.
      operationId: get-agent-builder-conversations-conversation-id-attachments-attachment-id
      parameters:
        - description: The unique identifier of the conversation.
          in: path
          name: conversation_id
          required: true
          schema:
            maxLength: 256
            type: string
        - description: The unique identifier of the attachment.
          in: path
          name: attachment_id
          required: true
          schema:
            maxLength: 256
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                getAttachmentResponseExample:
                  description: Example response containing a single attachment
                  value:
                    attachment:
                      active: true
                      current_version: 1
                      description: My text file
                      id: attachment-1
                      type: text
                      versions:
                        - content_hash: abc123
                          created_at: '2025-01-01T10:00:00.000Z'
                          data: File content
                          estimated_tokens: 2
                          version: 1
          description: Indicates a successful response
      summary: Get conversation attachment
      tags:
        - agent builder
      x-state: Experimental; added in 9.6.0
      x-metaTags:
        - content: Kibana
          name: product_name
    patch:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb patch">patch</span>&nbsp;<span class="operation-path">/s/{space_id}/api/agent_builder/conversations/{conversation_id}/attachments/{attachment_id}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Rename an attachment without creating a new version.<br/><br/>[Required authorization] Route required privileges: agentBuilder:read.
      operationId: patch-agent-builder-conversations-conversation-id-attachments-attachment-id
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: The unique identifier of the conversation.
          in: path
          name: conversation_id
          required: true
          schema:
            maxLength: 256
            type: string
        - description: The unique identifier of the attachment to rename.
          in: path
          name: attachment_id
          required: true
          schema:
            maxLength: 256
            type: string
      requestBody:
        content:
          application/json:
            examples:
              renameAttachmentExample:
                description: Example request for renaming an attachment
                value:
                  description: Updated attachment name
            schema:
              additionalProperties: false
              type: object
              properties:
                description:
                  description: The new description/name for the attachment.
                  maxLength: 2048
                  type: string
              required:
                - description
      responses:
        '200':
          content:
            application/json:
              examples:
                renameAttachmentResponseExample:
                  description: Example response returning the renamed attachment (version unchanged)
                  value:
                    attachment:
                      active: true
                      current_version: 1
                      description: Updated attachment name
                      id: att-abc123
                      type: text
                      versions:
                        - content_hash: sha256-xyz
                          created_at: '2025-01-06T10:00:00.000Z'
                          data: Content remains the same
                          estimated_tokens: 10
                          version: 1
                    success: true
          description: Indicates a successful response
      summary: Rename attachment
      tags:
        - agent builder
      x-state: Experimental; added in 9.2.0
      x-metaTags:
        - content: Kibana
          name: product_name
    put:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb put">put</span>&nbsp;<span class="operation-path">/s/{space_id}/api/agent_builder/conversations/{conversation_id}/attachments/{attachment_id}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Update an attachment content. Creates a new version if content changed.<br/><br/>[Required authorization] Route required privileges: agentBuilder:read.
      operationId: put-agent-builder-conversations-conversation-id-attachments-attachment-id
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: The unique identifier of the conversation.
          in: path
          name: conversation_id
          required: true
          schema:
            maxLength: 256
            type: string
        - description: The unique identifier of the attachment to update.
          in: path
          name: attachment_id
          required: true
          schema:
            maxLength: 256
            type: string
      requestBody:
        content:
          application/json:
            examples:
              updateAttachmentContentExample:
                description: Example request for updating attachment content
                value:
                  data: This is the updated content
              updateAttachmentWithDescriptionExample:
                description: Example request for updating both content and description
                value:
                  data: New content version
                  description: Updated meeting notes - v2
            schema:
              additionalProperties: false
              type: object
              properties:
                data:
                  description: The new attachment data/content.
                  nullable: true
                description:
                  description: Optional new description for the attachment.
                  maxLength: 2048
                  type: string
                render_inline:
                  default: false
                  description: When true, the attachment is rendered inline in the UI when the conversation is opened, without the agent referencing it.
                  type: boolean
              required:
                - data
      responses:
        '200':
          content:
            application/json:
              examples:
                updateAttachmentResponseExample:
                  description: Example response returning the updated attachment with new version
                  value:
                    attachment:
                      active: true
                      current_version: 2
                      description: Meeting notes
                      id: att-abc123
                      type: text
                      versions:
                        - content_hash: sha256-abc
                          created_at: '2025-01-06T10:00:00.000Z'
                          data: Original content
                          estimated_tokens: 10
                          version: 1
                        - content_hash: sha256-def
                          created_at: '2025-01-06T11:00:00.000Z'
                          data: This is the updated content
                          estimated_tokens: 12
                          version: 2
                    new_version: 2
          description: Indicates a successful response
      summary: Update conversation attachment
      tags:
        - agent builder
      x-state: Experimental; added in 9.2.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/agent_builder/conversations/{conversation_id}/attachments/{attachment_id}/_restore:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/agent_builder/conversations/{conversation_id}/attachments/{attachment_id}/_restore</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Restore a soft-deleted attachment.<br/><br/>[Required authorization] Route required privileges: agentBuilder:read.
      operationId: post-agent-builder-conversations-conversation-id-attachments-attachment-id-restore
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: The unique identifier of the conversation.
          in: path
          name: conversation_id
          required: true
          schema:
            maxLength: 256
            type: string
        - description: The unique identifier of the attachment to restore.
          in: path
          name: attachment_id
          required: true
          schema:
            maxLength: 256
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                restoreAttachmentResponseExample:
                  description: Example response returning the restored attachment
                  value:
                    attachment:
                      active: true
                      current_version: 1
                      description: Restored attachment
                      id: att-abc123
                      type: text
                      versions:
                        - content_hash: sha256-xyz
                          created_at: '2025-01-06T10:00:00.000Z'
                          data: Restored content
                          estimated_tokens: 10
                          version: 1
                    success: true
          description: Indicates a successful response
      summary: Restore deleted attachment
      tags:
        - agent builder
      x-state: Experimental; added in 9.2.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/agent_builder/conversations/{conversation_id}/attachments/{attachment_id}/origin:
    put:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb put">put</span>&nbsp;<span class="operation-path">/s/{space_id}/api/agent_builder/conversations/{conversation_id}/attachments/{attachment_id}/origin</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Update the origin reference for an attachment. Use this after saving a by-value attachment to link it to its persistent store.<br/><br/>[Required authorization] Route required privileges: agentBuilder:read.
      operationId: put-agent-builder-conversations-conversation-id-attachments-attachment-id-origin
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: The unique identifier of the conversation.
          in: path
          name: conversation_id
          required: true
          schema:
            maxLength: 256
            type: string
        - description: The unique identifier of the attachment to update.
          in: path
          name: attachment_id
          required: true
          schema:
            maxLength: 256
            type: string
      requestBody:
        content:
          application/json:
            examples:
              updateOriginExample:
                description: Example request for linking an attachment to a saved visualization
                value:
                  origin: abc123
            schema:
              additionalProperties: false
              type: object
              properties:
                origin:
                  description: The origin string (e.g., saved object ID for visualizations and dashboards).
                  maxLength: 2048
                  type: string
              required:
                - origin
      responses:
        '200':
          content:
            application/json:
              examples:
                updateOriginResponseExample:
                  description: Example response returning the attachment with updated origin
                  value:
                    attachment:
                      active: true
                      current_version: 1
                      description: Sales chart
                      id: att-123
                      origin: abc123
                      type: visualization
                      versions:
                        - content_hash: sha256-xyz
                          created_at: '2025-01-06T10:00:00.000Z'
                          data:
                            chart_type: bar
                            esql: FROM sales | STATS count=COUNT(*) BY month
                            query: Show monthly sales
                            visualization: {}
                          estimated_tokens: 50
                          version: 1
                    success: true
          description: Indicates a successful response
      summary: Update attachment origin
      tags:
        - agent builder
      x-state: Experimental; added in 9.4.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/agent_builder/conversations/{conversation_id}/attachments/stale:
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/agent_builder/conversations/{conversation_id}/attachments/stale</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Checks staleness for the latest version of all conversation attachments against their origin snapshot.<br/><br/>[Required authorization] Route required privileges: agentBuilder:read.
      operationId: get-agent-builder-conversations-conversation-id-attachments-stale
      parameters:
        - description: The unique identifier of the conversation.
          in: path
          name: conversation_id
          required: true
          schema:
            maxLength: 256
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                checkStaleAttachmentsResponseExample:
                  description: 'Mixed conversation: attachments without a stale source return only id and is_stale. When a staleness check fails for one attachment, is_stale is false and an error explains why. When an origin-backed attachment is out of date, the response includes type, origin, and resolved data (here a simple text body) for resync.'
                  value:
                    attachments:
                      - id: att-text-meeting-notes
                        is_stale: false
                      - id: att-lens-active-users
                        is_stale: false
                      - error: Origin could not be resolved
                        id: att-query-attachment
                        is_stale: false
                      - data: This is the content of my text attachment
                        hidden: false
                        id: att-text-runbook
                        is_stale: true
                        origin: document:hr-onboarding-v2
                        type: text
          description: Indicates a successful response
      summary: Check attachment staleness
      tags:
        - agent builder
      x-state: Experimental; added in 9.4.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/agent_builder/converse:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/agent_builder/converse</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Send a message to an agent and receive a complete response. This synchronous endpoint waits for the agent to fully process your request before returning the final result. Use this for simple chat interactions where you need the complete response. To learn more about agent chat, refer to the [agent chat documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/chat).<br/><br/>[Required authorization] Route required privileges: agentBuilder:read.
      operationId: post-agent-builder-converse
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
      requestBody:
        content:
          application/json:
            examples:
              conversePublicRequestExample:
                description: Example request to create a public conversation
                value:
                  access_control:
                    access_mode: public
                  agent_id: elastic-ai-agent
                  connector_id: my-connector-id
                  input: What is Elasticsearch?
              converseRequestExample:
                description: Example request to send a message to the agent as a part of the conversation
                value:
                  agent_id: elastic-ai-agent
                  connector_id: my-connector-id
                  input: What is Elasticsearch?
              converseRequestInferenceExample:
                description: Example using inference_id (mutually exclusive with connector_id)
                value:
                  agent_id: elastic-ai-agent
                  inference_id: my-inference-endpoint-id
                  input: What is Elasticsearch?
            schema:
              additionalProperties: false
              type: object
              properties:
                _execution_mode:
                  description: define how to execute the agent (local execution or via task_manager)
                  enum:
                    - local
                    - task_manager
                  type: string
                  x-state: Experimental; added in 9.4.0
                access_control:
                  additionalProperties: false
                  description: Optional conversation access control. Defaults to private.
                  type: object
                  properties:
                    access_mode:
                      description: Access mode to apply when creating a new conversation. Set to public to make the conversation visible to other users who can access the underlying agent. This setting is ignored when continuing an existing conversation.
                      enum:
                        - private
                        - public
                      type: string
                  required:
                    - access_mode
                  x-state: Generally available; added in 9.5.0
                action:
                  deprecated: true
                  description: Deprecated and ignored. The "regenerate" action has been removed; the field is still accepted for backward compatibility.
                  enum:
                    - regenerate
                  type: string
                agent_id:
                  default: elastic-ai-agent
                  description: The ID of the agent to chat with. Defaults to the default Elastic AI agent.
                  type: string
                attachments:
                  description: Optional attachments to send with the message.
                  items:
                    additionalProperties: false
                    type: object
                    properties:
                      data:
                        additionalProperties:
                          nullable: true
                        description: Payload of the attachment. Required unless `origin` is provided (content is resolved once at send time).
                        type: object
                      description:
                        description: Human-readable label for the attachment.
                        maxLength: 1024
                        type: string
                      group_id:
                        description: Stable identifier for the logical group this attachment belongs to. Attachments sharing the same group_id were submitted together as a single logical entity.
                        maxLength: 256
                        type: string
                      hidden:
                        description: When true, the attachment will not be displayed in the UI.
                        type: boolean
                      id:
                        description: Optional id for the attachment.
                        type: string
                      origin:
                        description: Origin string (for example, saved object ID) for by-reference attachments. When provided without `data`, the content is resolved once using the attachment type’s `resolve` hook.
                        type: string
                      type:
                        description: Type of the attachment.
                        type: string
                    required:
                      - type
                  type: array
                  x-state: Technical Preview; added in 9.3.0
                browser_api_tools:
                  description: Optional browser API tools to be registered as LLM tools with browser.* namespace. These tools execute on the client side.
                  items:
                    additionalProperties: false
                    type: object
                    properties:
                      description:
                        description: Description of what the browser API tool does.
                        type: string
                      id:
                        description: Unique identifier for the browser API tool.
                        type: string
                      schema:
                        description: JSON Schema defining the tool parameters (JsonSchema7Type).
                        nullable: true
                    required:
                      - id
                      - description
                      - schema
                  type: array
                configuration_overrides:
                  additionalProperties: false
                  description: Runtime configuration overrides. These override the stored agent configuration for this execution only.
                  type: object
                  properties:
                    enable_elastic_capabilities:
                      description: Whether to enable built-in Elastic skills for this execution.
                      type: boolean
                    instructions:
                      description: Custom instructions for the agent.
                      type: string
                    skill_ids:
                      description: 'Skill IDs to enable for this execution, replacing the stored skill list. Note: only fully restricts the available skill set when enable_elastic_capabilities is also set to false.'
                      items:
                        maxLength: 256
                        type: string
                      maxItems: 100
                      type: array
                    tools:
                      description: Tool selection to enable for this execution.
                      items:
                        additionalProperties: false
                        type: object
                        properties:
                          tool_ids:
                            items:
                              type: string
                            type: array
                        required:
                          - tool_ids
                      type: array
                connector_id:
                  description: Optional connector ID for the agent to use for model routing. Mutually exclusive with `inference_id`; omit or use only one.
                  nullable: true
                  type: string
                conversation_id:
                  description: Optional existing conversation ID to continue a previous conversation.
                  maxLength: 256
                  type: string
                execution_id:
                  description: Optional client-generated execution ID. Provide it to address this execution later (for example, to abort it). Must be unique; defaults to a server-generated ID.
                  type: string
                inference_id:
                  description: Optional inference endpoint ID for model routing (public alias for the same internal identifier as `connector_id`). Mutually exclusive with `connector_id`.
                  nullable: true
                  type: string
                input:
                  description: The user input message to send to the agent.
                  type: string
                project_routing:
                  description: Cross-project search routing expression resolved from the header project picker, applied to the run's searches. Serverless (CPS) only; ignored elsewhere.
                  maxLength: 2048
                  type: string
                prompts:
                  additionalProperties:
                    anyOf:
                      - additionalProperties: false
                        type: object
                        properties:
                          allow:
                            type: boolean
                        required:
                          - allow
                      - additionalProperties: false
                        type: object
                        properties:
                          authorized:
                            type: boolean
                        required:
                          - authorized
                      - additionalProperties: false
                        description: Answers to an `ask_user_question` prompt; one entry per question, in order.
                        type: object
                        properties:
                          answers:
                            items:
                              additionalProperties: false
                              type: object
                              properties:
                                choice:
                                  items:
                                    type: number
                                  maxItems: 100
                                  type: array
                                custom:
                                  maxLength: 20000
                                  minLength: 1
                                  type: string
                                skipped:
                                  type: boolean
                            maxItems: 100
                            type: array
                        required:
                          - answers
                        x-state: Technical Preview
                  description: Use this field to respond to a `confirmation`, `authorization`, or `ask_user_question` prompt. Send an `allow` boolean to answer a `confirmation` prompt, an `authorized` boolean to answer an `authorization` prompt, or an `answers` array (one entry per question) to answer an `ask_user_question` prompt.
                  type: object
                read_only:
                  description: 'When true, the created conversation is presented as read-only in the UI: its history is shown but no message input is offered. This carries no authorization meaning — the conversation can still be continued through the API. This setting is ignored when continuing an existing conversation.'
                  type: boolean
                  x-state: Technical Preview; added in 9.6.0
                reasoning_level:
                  description: 'Reasoning effort level for the LLM. One of: none, minimal, low, medium, high, xhigh. Support depends on the underlying model and provider.'
                  enum:
                    - none
                    - minimal
                    - low
                    - medium
                    - high
                    - xhigh
                  type: string
                  x-state: Experimental; added in 9.6.0
      responses:
        '200':
          content:
            application/json:
              examples:
                converseResponseExample:
                  description: Example response containing the chain of events representing a conversation with the agent
                  value:
                    access_control:
                      access_mode: private
                    conversation_id: 696ccd6d-4bff-4b26-a62e-522ccf2dcd16
                    response:
                      message: Elasticsearch is a distributed, RESTful search and analytics engine capable of addressing a growing number of use cases. As the heart of the Elastic Stack, it centrally stores your data for lightning fast search, fine‑tuned relevancy, and powerful analytics that scale with ease.
                    steps:
                      - reasoning: Searching for official documentation or content that explains what Elasticsearch is
                        type: reasoning
                      - params:
                          query: what is elasticsearch definition overview introduction
                        progression:
                          - message: Selecting the best target for this query
                        results:
                          - data:
                              message: Could not figure out which index to use
                            type: error
                        tool_call_id: tooluse_shOdUwKIRwC9YhqGzeg0cQ
                        tool_id: platform.core.search
                        type: tool_call
          description: Indicates a successful response
      summary: Send chat message
      tags:
        - agent builder
      x-codeSamples:
        - lang: curl
          source: |
            curl \
              -X POST "${KIBANA_URL}/api/agent_builder/converse" \
              -H "Authorization: ApiKey ${API_KEY}" \
              -H "kbn-xsrf: true" \
              -H "Content-Type: application/json" \
              -d '{
                "input": "What is Elasticsearch?",
                "agent_id": "elastic-ai-agent",
                "access_control": {
                  "access_mode": "public"
                }
              }'
        - lang: Console
          source: |
            POST kbn://api/agent_builder/converse
            {
              "input": "What is Elasticsearch?",
              "agent_id": "elastic-ai-agent",
              "access_control": {
                "access_mode": "public"
              }
            }
      x-state: Added in 9.2.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/agent_builder/converse/async:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/agent_builder/converse/async</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Send a message to an agent and receive real-time streaming events. This asynchronous endpoint provides live updates as the agent processes your request, allowing you to see intermediate steps and progress. Use this for interactive experiences where you want to monitor the agent's thinking process.

        ## Event types

        The endpoint emits Server-Sent Events (SSE) with the following custom event types:

        `conversation_id_set`

        Sets the conversation ID.

        Schema:
        ```json
        {
          "conversation_id": "uuid"
        }
        ```

        ---

        `conversation_created`

        Fires when a new conversation is persisted and assigned an ID.

        Schema:
        ```json
        {
          "conversation_id": "uuid",
          "title": "conversation title"
        }
        ```

        ---

        `conversation_updated`

        Fires when a conversation is updated.

        Schema:
        ```json
        {
          "conversation_id": "uuid",
          "title": "updated conversation title"
        }
        ```

        ---

        `reasoning`

        Handles reasoning-related data.

        Schema:
        ```json
        {
          "reasoning": "plain text reasoning content",
          "transient": false
        }
        ```

        ---

        `tool_call`

        Triggers when a tool is invoked.

        Schema:
        ```json
        {
          "tool_call_id": "uuid",
          "tool_id": "tool_name",
          "params": {}
        }
        ```

        ---

        `tool_progress`

        Reports progress of a running tool.

        Schema:
        ```json
        {
          "tool_call_id": "uuid",
          "message": "progress message"
        }
        ```

        ---

        `tool_result`

        Returns results from a completed tool call.

        Schema:
        ```json
        {
          "tool_call_id": "uuid",
          "tool_id": "tool_name",
          "results": []
        }
        ```

        **Note:** `results` is an array of `ToolResult` objects.

        ---

        `message_chunk`

        Streams partial text chunks.

        Schema:
        ```json
        {
          "message_id": "uuid",
          "text_chunk": "partial text"
        }
        ```

        ---

        `message_complete`

        Indicates message stream is finished.

        Schema:
        ```json
        {
          "message_id": "uuid",
          "message_content": "full text content of the message"
        }
        ```

        ---

        `thinking_complete`

        Marks the end of the thinking/reasoning phase.

        Schema:
        ```json
        {
          "time_to_first_token": 0
        }
        ```

        **Note:** `time_to_first_token` is in milliseconds.

        ---

        `round_complete`

        Marks end of one conversation round.

        Schema:
        ```json
        {
          "round": {}
        }
        ```

        **Note:** `round` contains the full round json object.

        ---

        ## Event flow

        A typical conversation round emits events in this sequence:

        1. `reasoning` (potentially multiple, some transient)
        2. `tool_call` (if tools are used)
        3. `tool_progress` (zero or more progress updates)
        4. `tool_result` (when tool completes)
        5. `thinking_complete`
        6. `message_chunk` (multiple, as text streams)
        7. `message_complete`
        8. `round_complete`

        <br/><br/>[Required authorization] Route required privileges: agentBuilder:read.
      operationId: post-agent-builder-converse-async
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
      requestBody:
        content:
          application/json:
            examples:
              converseAsyncPublicRequestExample:
                description: Example request to create a public conversation
                value:
                  access_control:
                    access_mode: public
                  agent_id: elastic-ai-agent
                  input: Hello
              converseAsyncRequestExample:
                description: Example request to send a message to the agent as a part of the conversation
                value:
                  agent_id: elastic-ai-agent
                  conversation_id: c250305b-1929-4248-b568-b9e3f065fda5
                  input: Hello
              converseAsyncRequestInferenceExample:
                description: Example using inference_id (mutually exclusive with connector_id)
                value:
                  agent_id: elastic-ai-agent
                  inference_id: my-inference-endpoint-id
                  input: Hello
            schema:
              additionalProperties: false
              type: object
              properties:
                _execution_mode:
                  description: define how to execute the agent (local execution or via task_manager)
                  enum:
                    - local
                    - task_manager
                  type: string
                  x-state: Experimental; added in 9.4.0
                access_control:
                  additionalProperties: false
                  description: Optional conversation access control. Defaults to private.
                  type: object
                  properties:
                    access_mode:
                      description: Access mode to apply when creating a new conversation. Set to public to make the conversation visible to other users who can access the underlying agent. This setting is ignored when continuing an existing conversation.
                      enum:
                        - private
                        - public
                      type: string
                  required:
                    - access_mode
                  x-state: Generally available; added in 9.5.0
                action:
                  deprecated: true
                  description: Deprecated and ignored. The "regenerate" action has been removed; the field is still accepted for backward compatibility.
                  enum:
                    - regenerate
                  type: string
                agent_id:
                  default: elastic-ai-agent
                  description: The ID of the agent to chat with. Defaults to the default Elastic AI agent.
                  type: string
                attachments:
                  description: Optional attachments to send with the message.
                  items:
                    additionalProperties: false
                    type: object
                    properties:
                      data:
                        additionalProperties:
                          nullable: true
                        description: Payload of the attachment. Required unless `origin` is provided (content is resolved once at send time).
                        type: object
                      description:
                        description: Human-readable label for the attachment.
                        maxLength: 1024
                        type: string
                      group_id:
                        description: Stable identifier for the logical group this attachment belongs to. Attachments sharing the same group_id were submitted together as a single logical entity.
                        maxLength: 256
                        type: string
                      hidden:
                        description: When true, the attachment will not be displayed in the UI.
                        type: boolean
                      id:
                        description: Optional id for the attachment.
                        type: string
                      origin:
                        description: Origin string (for example, saved object ID) for by-reference attachments. When provided without `data`, the content is resolved once using the attachment type’s `resolve` hook.
                        type: string
                      type:
                        description: Type of the attachment.
                        type: string
                    required:
                      - type
                  type: array
                  x-state: Technical Preview; added in 9.3.0
                browser_api_tools:
                  description: Optional browser API tools to be registered as LLM tools with browser.* namespace. These tools execute on the client side.
                  items:
                    additionalProperties: false
                    type: object
                    properties:
                      description:
                        description: Description of what the browser API tool does.
                        type: string
                      id:
                        description: Unique identifier for the browser API tool.
                        type: string
                      schema:
                        description: JSON Schema defining the tool parameters (JsonSchema7Type).
                        nullable: true
                    required:
                      - id
                      - description
                      - schema
                  type: array
                configuration_overrides:
                  additionalProperties: false
                  description: Runtime configuration overrides. These override the stored agent configuration for this execution only.
                  type: object
                  properties:
                    enable_elastic_capabilities:
                      description: Whether to enable built-in Elastic skills for this execution.
                      type: boolean
                    instructions:
                      description: Custom instructions for the agent.
                      type: string
                    skill_ids:
                      description: 'Skill IDs to enable for this execution, replacing the stored skill list. Note: only fully restricts the available skill set when enable_elastic_capabilities is also set to false.'
                      items:
                        maxLength: 256
                        type: string
                      maxItems: 100
                      type: array
                    tools:
                      description: Tool selection to enable for this execution.
                      items:
                        additionalProperties: false
                        type: object
                        properties:
                          tool_ids:
                            items:
                              type: string
                            type: array
                        required:
                          - tool_ids
                      type: array
                connector_id:
                  description: Optional connector ID for the agent to use for model routing. Mutually exclusive with `inference_id`; omit or use only one.
                  nullable: true
                  type: string
                conversation_id:
                  description: Optional existing conversation ID to continue a previous conversation.
                  maxLength: 256
                  type: string
                execution_id:
                  description: Optional client-generated execution ID. Provide it to address this execution later (for example, to abort it). Must be unique; defaults to a server-generated ID.
                  type: string
                inference_id:
                  description: Optional inference endpoint ID for model routing (public alias for the same internal identifier as `connector_id`). Mutually exclusive with `connector_id`.
                  nullable: true
                  type: string
                input:
                  description: The user input message to send to the agent.
                  type: string
                project_routing:
                  description: Cross-project search routing expression resolved from the header project picker, applied to the run's searches. Serverless (CPS) only; ignored elsewhere.
                  maxLength: 2048
                  type: string
                prompts:
                  additionalProperties:
                    anyOf:
                      - additionalProperties: false
                        type: object
                        properties:
                          allow:
                            type: boolean
                        required:
                          - allow
                      - additionalProperties: false
                        type: object
                        properties:
                          authorized:
                            type: boolean
                        required:
                          - authorized
                      - additionalProperties: false
                        description: Answers to an `ask_user_question` prompt; one entry per question, in order.
                        type: object
                        properties:
                          answers:
                            items:
                              additionalProperties: false
                              type: object
                              properties:
                                choice:
                                  items:
                                    type: number
                                  maxItems: 100
                                  type: array
                                custom:
                                  maxLength: 20000
                                  minLength: 1
                                  type: string
                                skipped:
                                  type: boolean
                            maxItems: 100
                            type: array
                        required:
                          - answers
                        x-state: Technical Preview
                  description: Use this field to respond to a `confirmation`, `authorization`, or `ask_user_question` prompt. Send an `allow` boolean to answer a `confirmation` prompt, an `authorized` boolean to answer an `authorization` prompt, or an `answers` array (one entry per question) to answer an `ask_user_question` prompt.
                  type: object
                read_only:
                  description: 'When true, the created conversation is presented as read-only in the UI: its history is shown but no message input is offered. This carries no authorization meaning — the conversation can still be continued through the API. This setting is ignored when continuing an existing conversation.'
                  type: boolean
                  x-state: Technical Preview; added in 9.6.0
                reasoning_level:
                  description: 'Reasoning effort level for the LLM. One of: none, minimal, low, medium, high, xhigh. Support depends on the underlying model and provider.'
                  enum:
                    - none
                    - minimal
                    - low
                    - medium
                    - high
                    - xhigh
                  type: string
                  x-state: Experimental; added in 9.6.0
      responses:
        '200':
          content:
            text/event-stream:
              examples:
                converseAsyncResponseExample:
                  description: Example stream containing the chain of events representing a conversation with the agent
                  value:
                    - data:
                        data:
                          conversation_id: c250305b-1929-4248-b568-b9e3f065fda5
                      event: conversation_id_set
                    - data:
                        data:
                          reasoning: Starting with a general search to understand what content is available.
                      event: reasoning
                    - data:
                        data:
                          params:
                            query: latest documents
                          tool_call_id: tooluse__2aJELgyRYqD8SDOKSiwtg
                          tool_id: platform.core.search
                      event: tool_call
                    - data:
                        data:
                          results:
                            - data:
                                message: Could not figure out which index to use
                              type: error
                          tool_call_id: tooluse__2aJELgyRYqD8SDOKSiwtg
                      event: tool_result
                    - data:
                        data:
                          round:
                            id: a5692d54-bc06-4a6e-aea1-412779c73f66
                            input:
                              message: Hello
                            response:
                              message: Hello! How can I help you today?
                      event: round_complete
                    - data:
                        data:
                          access_control:
                            access_mode: private
                          conversation_id: c250305b-1929-4248-b568-b9e3f065fda5
                          title: Hello
                      event: conversation_created
          description: Indicates a successful response
      summary: Send chat message (streaming)
      tags:
        - agent builder
      x-codeSamples:
        - lang: curl
          source: |
            curl \
              -X POST "${KIBANA_URL}/api/agent_builder/converse/async" \
              -H "Authorization: ApiKey ${API_KEY}" \
              -H "kbn-xsrf: true" \
              -H "Content-Type: application/json" \
              -d '{
                "input": "Hello again let us have an async chat",
                "agent_id": "elastic-ai-agent",
                "conversation_id": "<CONVERSATION_ID>"
              }'
        - lang: Console
          source: |
            POST kbn://api/agent_builder/converse/async
            {
              "input": "Hello again let's have an async chat",
              "agent_id": "elastic-ai-agent",
              "conversation_id": "<CONVERSATION_ID>"
            }
      x-state: Added in 9.2.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/agent_builder/mcp:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/agent_builder/mcp</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        > warn
        > This endpoint is designed for MCP clients (Claude Desktop, Cursor, VS Code, etc.) and should not be used directly via REST APIs. Use MCP Inspector or native MCP clients instead.
        To learn more about the Agent Builder MCP server, refer to the [MCP documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/mcp-server).<br/><br/>[Required authorization] Route required privileges: agentBuilder:read.
      operationId: post-agent-builder-mcp
      parameters:
        - description: Comma-separated list of namespaces to filter tools. Only tools matching the specified namespaces will be returned.
          in: query
          name: namespace
          required: false
          schema:
            type: string
      requestBody:
        content:
          application/json:
            examples:
              mcpInitializeRequestExample:
                description: 'WARNING: DO NOT USE THIS ENDPOINT VIA REST API. These examples are auto-generated and should not be run. Integrate with MCP using MCP Inspector or native MCP clients (Claude Desktop, Cursor, VS Code) instead.'
                value:
                  id: 1
                  jsonrpc: '2.0'
                  method: initialize
                  params:
                    capabilities: {}
                    clientInfo:
                      name: test-client
                      version: 1.0.0
                    protocolVersion: '2024-11-05'
            schema: {}
      responses:
        '200':
          content:
            application/json:
              examples:
                mcpInitializeResponseExample:
                  description: Example response showing the successful result of communication initialisation over MCP protocol
                  value:
                    id: 1
                    jsonrpc: '2.0'
                    result:
                      capabilities:
                        tools:
                          listChanged: true
                      protocolVersion: '2024-11-05'
                      serverInfo:
                        name: elastic-mcp-server
                        version: 0.0.1
          description: Indicates a successful response
      summary: MCP server
      tags:
        - agent builder
      x-state: Added in 9.2.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/agent_builder/plugins:
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/agent_builder/plugins</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        List all installed plugins and their managed assets. Plugins are installable packages that bundle agent capabilities such as skills, following the [Claude agent plugin specification](https://code.claude.com/docs/en/plugins). To learn more about Agent Builder plugins, refer to the [plugins documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/plugins).<br/><br/>[Required authorization] Route required privileges: agentBuilder:read.
      operationId: get-agent-builder-plugins
      parameters: []
      responses:
        '200':
          content:
            application/json:
              examples:
                listPluginsResponseExample:
                  description: Example response that returns one installed plugin
                  value:
                    results:
                      - created_at: '2025-01-01T00:00:00.000Z'
                        description: Financial analysis tools and skills for Claude
                        id: financial-analysis
                        manifest:
                          author:
                            name: Anthropic
                            url: https://www.anthropic.com
                          keywords:
                            - finance
                            - analysis
                          repository: https://github.com/anthropics/financial-services-plugins
                        name: financial-analysis
                        skill_ids:
                          - financial-analysis-analyze-portfolio
                        source_url: https://github.com/anthropics/financial-services-plugins/tree/main/financial-analysis
                        unmanaged_assets:
                          agents: []
                          hooks: []
                          lsp_servers: []
                          mcp_servers: []
                          output_styles: []
                        updated_at: '2025-01-01T00:00:00.000Z'
                        version: 1.0.0
          description: Indicates a successful response
      summary: List plugins
      tags:
        - agent builder
      x-codeSamples:
        - lang: curl
          source: |
            curl \
             -X GET "${KIBANA_URL}/api/agent_builder/plugins" \
             -H "Authorization: ApiKey ${API_KEY}"
        - lang: Console
          source: |
            GET kbn://api/agent_builder/plugins
      x-state: Experimental; added in 9.4.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/agent_builder/plugins/{pluginId}:
    delete:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb delete">delete</span>&nbsp;<span class="operation-path">/s/{space_id}/api/agent_builder/plugins/{pluginId}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Delete an installed plugin by ID. This action cannot be undone. To learn more about Agent Builder plugins, refer to the [plugins documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/plugins).<br/><br/>[Required authorization] Route required privileges: agentBuilder:write.
      operationId: delete-agent-builder-plugins-pluginid
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: The unique identifier of the plugin.
          in: path
          name: pluginId
          required: true
          schema:
            type: string
        - description: If true, removes the plugin skills from agents that use them and then deletes the plugin. If false and any agent uses the plugin skills, the request returns 409 Conflict with the list of agents.
          in: query
          name: force
          required: false
          schema:
            default: false
            type: boolean
      responses:
        '200':
          content:
            application/json:
              examples:
                deletePluginResponseExample:
                  description: Example response showing that deletion of the plugin has been successful
                  value:
                    success: true
          description: Indicates a successful response
      summary: Delete a plugin
      tags:
        - agent builder
      x-codeSamples:
        - lang: curl
          source: |
            curl \
              -X DELETE "${KIBANA_URL}/api/agent_builder/plugins/{id}" \
              -H "Authorization: ApiKey ${API_KEY}" \
              -H "kbn-xsrf: true"
        - lang: Console
          source: |
            DELETE kbn://api/agent_builder/plugins/{id}
      x-state: Experimental; added in 9.4.0
      x-metaTags:
        - content: Kibana
          name: product_name
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/agent_builder/plugins/{pluginId}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Get a specific plugin by ID. To learn more about Agent Builder plugins, refer to the [plugins documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/plugins).<br/><br/>[Required authorization] Route required privileges: agentBuilder:read.
      operationId: get-agent-builder-plugins-pluginid
      parameters:
        - description: The unique identifier of the plugin.
          in: path
          name: pluginId
          required: true
          schema:
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                getPluginByIdResponseExample:
                  description: Example response returning a single installed plugin
                  value:
                    created_at: '2025-01-01T00:00:00.000Z'
                    description: Financial analysis tools and skills for Claude
                    id: financial-analysis
                    manifest:
                      author:
                        name: Anthropic
                        url: https://www.anthropic.com
                      keywords:
                        - finance
                        - analysis
                      repository: https://github.com/anthropics/financial-services-plugins
                    name: financial-analysis
                    skill_ids:
                      - financial-analysis-analyze-portfolio
                    source_url: https://github.com/anthropics/financial-services-plugins/tree/main/financial-analysis
                    unmanaged_assets:
                      agents: []
                      hooks: []
                      lsp_servers: []
                      mcp_servers: []
                      output_styles: []
                    updated_at: '2025-01-01T00:00:00.000Z'
                    version: 1.0.0
          description: Indicates a successful response
      summary: Get a plugin by id
      tags:
        - agent builder
      x-codeSamples:
        - lang: curl
          source: |
            curl \
              -X GET "${KIBANA_URL}/api/agent_builder/plugins/{id}" \
              -H "Authorization: ApiKey ${API_KEY}"
        - lang: Console
          source: |
            GET kbn://api/agent_builder/plugins/{id}
      x-state: Experimental; added in 9.4.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/agent_builder/plugins/install:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/agent_builder/plugins/install</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Install a plugin from a [GitHub Claude plugin URL](https://code.claude.com/docs/en/plugins) or a direct ZIP URL. Plugins bundle agent capabilities such as skills. To learn more about Agent Builder plugins, refer to the [plugins documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/plugins).<br/><br/>[Required authorization] Route required privileges: agentBuilder:write.
      operationId: post-agent-builder-plugins-install
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
      requestBody:
        content:
          application/json:
            examples:
              installPluginFromGithubExample:
                description: Example request for installing a plugin from a GitHub URL
                value:
                  url: https://github.com/anthropics/financial-services-plugins/tree/main/financial-analysis
              installPluginFromZipExample:
                description: Example request for installing a plugin from a direct zip URL
                value:
                  url: https://my-server.example.com/my-plugin.zip
              installPluginWithNameOverrideExample:
                description: Example request for installing a plugin with a custom name
                value:
                  plugin_name: my-custom-plugin-name
                  url: https://github.com/anthropics/financial-services-plugins/tree/main/financial-analysis
            schema:
              additionalProperties: false
              type: object
              properties:
                plugin_name:
                  description: Optional name override for the plugin. Defaults to the manifest name.
                  type: string
                url:
                  description: URL to install the plugin from (GitHub URL or direct zip URL).
                  type: string
              required:
                - url
      responses:
        '200':
          content:
            application/json:
              examples:
                installPluginResponseExample:
                  description: Example response returning the definition of the installed plugin
                  value:
                    created_at: '2025-01-01T00:00:00.000Z'
                    description: Financial analysis tools and skills for Claude
                    id: financial-analysis
                    manifest:
                      author:
                        name: Anthropic
                        url: https://www.anthropic.com
                      keywords:
                        - finance
                        - analysis
                      repository: https://github.com/anthropics/financial-services-plugins
                    name: financial-analysis
                    skill_ids:
                      - financial-analysis-analyze-portfolio
                    source_url: https://github.com/anthropics/financial-services-plugins/tree/main/financial-analysis
                    unmanaged_assets:
                      agents: []
                      hooks: []
                      lsp_servers: []
                      mcp_servers: []
                      output_styles: []
                    updated_at: '2025-01-01T00:00:00.000Z'
                    version: 1.0.0
          description: Indicates a successful response
      summary: Install a plugin
      tags:
        - agent builder
      x-codeSamples:
        - lang: curl
          source: |
            curl \
              -X POST "${KIBANA_URL}/api/agent_builder/plugins/install" \
              -H "Authorization: ApiKey ${API_KEY}" \
              -H "kbn-xsrf: true" \
              -H "Content-Type: application/json" \
              -d '{
                "url": "https://github.com/anthropics/financial-services-plugins/tree/main/financial-analysis"
            }'
        - lang: Console
          source: |
            POST kbn://api/agent_builder/plugins/install
            {
              "url": "https://github.com/anthropics/financial-services-plugins/tree/main/financial-analysis"
            }
      x-state: Experimental; added in 9.4.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/agent_builder/skills:
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/agent_builder/skills</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        List all available skills (built-in and user-created). To learn more about Agent Builder skills, refer to the [skills documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/skills).<br/><br/>[Required authorization] Route required privileges: agentBuilder:read.
      operationId: get-agent-builder-skills
      parameters:
        - description: Set to true to include skills from plugins.
          in: query
          name: include_plugins
          required: false
          schema:
            default: false
            type: boolean
      responses:
        '200':
          content:
            application/json:
              examples:
                listSkillsResponseExample:
                  description: Example response returning a list of skills
                  value:
                    results:
                      - description: A built-in skill provided by the platform.
                        experimental: false
                        id: built-in-skill-id
                        name: Built-in Skill
                        readonly: true
                        referenced_content_count: 0
                      - description: A user-created skill for data analysis.
                        experimental: false
                        id: custom-skill-id
                        name: Custom Skill
                        readonly: false
                        referenced_content_count: 1
                        tool_ids:
                          - platform.core.search
          description: Indicates a successful response
      summary: List skills
      tags:
        - agent builder
      x-codeSamples:
        - lang: curl
          source: |
            curl \
              -X GET "https://${KIBANA_URL}/api/agent_builder/skills" \
              -H "Authorization: ApiKey ${API_KEY}"
        - lang: Console
          source: |
            GET kbn:/api/agent_builder/skills
      x-state: Experimental; added in 9.4.0
      x-metaTags:
        - content: Kibana
          name: product_name
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/agent_builder/skills</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Create a new user-defined skill. To learn more about Agent Builder skills, refer to the [skills documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/skills).<br/><br/>[Required authorization] Route required privileges: agentBuilder:manageSkills.
      operationId: post-agent-builder-skills
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
      requestBody:
        content:
          application/json:
            examples:
              createSkillRequestExample:
                description: Example request to create a user-defined skill
                value:
                  content: You are an expert data analyst. Use the available tools to query and analyze data.
                  description: A skill for performing custom data analysis.
                  id: my-custom-skill
                  name: Custom Analysis Skill
                  tool_ids:
                    - platform.core.search
            schema:
              additionalProperties: false
              type: object
              properties:
                content:
                  description: Skill instructions content (markdown).
                  type: string
                description:
                  description: Description of what the skill does.
                  type: string
                id:
                  description: Unique identifier for the skill.
                  type: string
                name:
                  description: Human-readable name for the skill.
                  type: string
                referenced_content:
                  items:
                    additionalProperties: false
                    type: object
                    properties:
                      content:
                        description: Content of the reference.
                        type: string
                      name:
                        description: Name of the referenced content.
                        type: string
                      relativePath:
                        description: Relative path of the referenced content.
                        type: string
                    required:
                      - name
                      - relativePath
                      - content
                  maxItems: 100
                  type: array
                tool_ids:
                  default: []
                  description: Tool IDs from the tool registry that this skill references.
                  items:
                    description: Tool ID from the tool registry.
                    type: string
                  maxItems: 100
                  type: array
              required:
                - id
                - name
                - description
                - content
      responses:
        '200':
          content:
            application/json:
              examples:
                createSkillResponseExample:
                  description: Example response returning the created skill
                  value:
                    content: You are an expert data analyst. Use the available tools to query and analyze data.
                    description: A skill for performing custom data analysis.
                    experimental: false
                    id: my-custom-skill
                    name: Custom Analysis Skill
                    readonly: false
                    tool_ids:
                      - platform.core.search
          description: Indicates a successful response
      summary: Create a skill
      tags:
        - agent builder
      x-codeSamples:
        - lang: curl
          source: |
            curl \
              -X POST "https://${KIBANA_URL}/api/agent_builder/skills" \
              -H "Authorization: ApiKey ${API_KEY}" \
              -H "kbn-xsrf: true" \
              -H "Content-Type: application/json" \
              -d '{
                "id": "my-custom-skill",
                "name": "Custom Analysis Skill",
                "description": "A skill for performing custom data analysis.",
                "content": "You are an expert data analyst.",
                "tool_ids": ["platform.core.search"]
              }'
        - lang: Console
          source: |
            POST kbn:/api/agent_builder/skills
            {
              "id": "my-custom-skill",
              "name": "Custom Analysis Skill",
              "description": "A skill for performing custom data analysis.",
              "content": "You are an expert data analyst.",
              "tool_ids": ["platform.core.search"]
            }
      x-state: Experimental; added in 9.4.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/agent_builder/skills/{skillId}:
    delete:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb delete">delete</span>&nbsp;<span class="operation-path">/s/{space_id}/api/agent_builder/skills/{skillId}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Delete a user-created skill by ID. If agents still reference the skill, the request returns 409 unless force=true, which removes the skill from agents first. Built-in skills cannot be deleted. To learn more about Agent Builder skills, refer to the [skills documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/skills).<br/><br/>[Required authorization] Route required privileges: agentBuilder:manageSkills.
      operationId: delete-agent-builder-skills-skillid
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: The unique identifier of the skill.
          in: path
          name: skillId
          required: true
          schema:
            maxLength: 512
            minLength: 1
            type: string
        - description: If true, removes the skill from agents that use it and then deletes it. If false and any agent uses the skill, the request returns 409 Conflict with the list of agents.
          in: query
          name: force
          required: false
          schema:
            default: false
            type: boolean
      responses:
        '200':
          content:
            application/json:
              examples:
                deleteSkillResponseExample:
                  description: Example response showing that the deletion operation was successful
                  value:
                    success: true
          description: Indicates a successful response
      summary: Delete a skill
      tags:
        - agent builder
      x-codeSamples:
        - lang: curl
          source: |
            curl \
              -X DELETE "https://${KIBANA_URL}/api/agent_builder/skills/{skillId}?force=false" \
              -H "Authorization: ApiKey ${API_KEY}" \
              -H "kbn-xsrf: true"
        - lang: Console
          source: |
            DELETE kbn:/api/agent_builder/skills/{skillId}
      x-state: Experimental; added in 9.4.0
      x-metaTags:
        - content: Kibana
          name: product_name
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/agent_builder/skills/{skillId}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Get a specific skill by ID. To learn more about Agent Builder skills, refer to the [skills documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/skills).<br/><br/>[Required authorization] Route required privileges: agentBuilder:read.
      operationId: get-agent-builder-skills-skillid
      parameters:
        - description: The unique identifier of the skill.
          in: path
          name: skillId
          required: true
          schema:
            maxLength: 512
            minLength: 1
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                getSkillResponseExample:
                  description: Example response returning a skill by ID
                  value:
                    content: You are an expert data analyst. Use the available tools to query and analyze data.
                    description: A skill for performing custom data analysis.
                    experimental: false
                    id: my-custom-skill
                    name: Custom Analysis Skill
                    readonly: false
                    tool_ids:
                      - platform.core.search
          description: Indicates a successful response
      summary: Get a skill by id
      tags:
        - agent builder
      x-codeSamples:
        - lang: curl
          source: |
            curl \
              -X GET "https://${KIBANA_URL}/api/agent_builder/skills/{skillId}" \
              -H "Authorization: ApiKey ${API_KEY}"
        - lang: Console
          source: |
            GET kbn:/api/agent_builder/skills/{skillId}
      x-state: Experimental; added in 9.4.0
      x-metaTags:
        - content: Kibana
          name: product_name
    put:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb put">put</span>&nbsp;<span class="operation-path">/s/{space_id}/api/agent_builder/skills/{skillId}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Update an existing user-created skill. To learn more about Agent Builder skills, refer to the [skills documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/skills).<br/><br/>[Required authorization] Route required privileges: agentBuilder:manageSkills.
      operationId: put-agent-builder-skills-skillid
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: The unique identifier of the skill.
          in: path
          name: skillId
          required: true
          schema:
            maxLength: 512
            minLength: 1
            type: string
      requestBody:
        content:
          application/json:
            examples:
              updateSkillRequestExample:
                description: Example request to update a user-defined skill
                value:
                  content: Updated skill instructions content.
                  description: Updated description for the skill.
                  name: Updated Skill Name
                  tool_ids:
                    - platform.core.search
                    - platform.core.execute_esql
            schema:
              additionalProperties: false
              type: object
              properties:
                content:
                  description: Updated skill instructions content.
                  type: string
                description:
                  description: Updated description.
                  type: string
                name:
                  description: Updated name for the skill.
                  type: string
                referenced_content:
                  items:
                    additionalProperties: false
                    type: object
                    properties:
                      content:
                        description: Content of the reference.
                        type: string
                      name:
                        description: Name of the referenced content.
                        type: string
                      relativePath:
                        description: Relative path of the referenced content.
                        type: string
                    required:
                      - name
                      - relativePath
                      - content
                  maxItems: 100
                  type: array
                tool_ids:
                  description: Updated tool IDs from the tool registry.
                  items:
                    description: Updated tool ID.
                    type: string
                  maxItems: 100
                  type: array
      responses:
        '200':
          content:
            application/json:
              examples:
                updateSkillResponseExample:
                  description: Example response returning the updated skill
                  value:
                    content: Updated skill instructions content.
                    description: Updated description for the skill.
                    experimental: false
                    id: my-custom-skill
                    name: Updated Skill Name
                    readonly: false
                    tool_ids:
                      - platform.core.search
                      - platform.core.execute_esql
          description: Indicates a successful response
      summary: Update a skill
      tags:
        - agent builder
      x-codeSamples:
        - lang: curl
          source: |
            curl \
              -X PUT "https://${KIBANA_URL}/api/agent_builder/skills/{skillId}" \
              -H "Authorization: ApiKey ${API_KEY}" \
              -H "kbn-xsrf: true" \
              -H "Content-Type: application/json" \
              -d '{
                "name": "Updated Skill Name",
                "description": "Updated description for the skill."
              }'
        - lang: Console
          source: |
            PUT kbn:/api/agent_builder/skills/{skillId}
            {
              "name": "Updated Skill Name",
              "description": "Updated description for the skill."
            }
      x-state: Experimental; added in 9.4.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/agent_builder/tools:
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/agent_builder/tools</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        List all available tools. Use this endpoint to retrieve complete tool definitions including their schemas and configuration requirements. To learn more about Agent Builder tools, refer to the [tools documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/tools).<br/><br/>[Required authorization] Route required privileges: agentBuilder:read.
      operationId: get-agent-builder-tools
      parameters: []
      responses:
        '200':
          content:
            application/json:
              examples:
                listToolsResponseExample:
                  description: Example response returning a list of existing tools
                  value:
                    results:
                      - configuration: {}
                        description: |-
                          A powerful tool for searching and analyzing data within your Elasticsearch cluster.
                          It supports both full-text relevance searches and structured analytical queries.

                          Use this tool for any query that involves finding documents, counting, aggregating, or summarizing data from a known index.

                          Examples of queries:
                          - "find articles about serverless architecture"
                          - "search for support tickets mentioning 'billing issue' or 'refund request'"
                          - "what is our policy on parental leave?"
                          - "list all products where the category is 'electronics'"
                          - "show me the last 5 documents from that index"
                          - "show me the sales over the last year break down by month"

                          Note:
                          - The 'index' parameter can be used to specify which index to search against.
                           If not provided, the tool will decide itself which is the best index to use.
                          - It is perfectly fine not to specify the 'index' parameter. It should only be specified when you already
                           know about the index and fields you want to search on, e.g. if the user explicitly specified it.
                        id: platform.core.search
                        readonly: true
                        schema:
                          $schema: http://json-schema.org/draft-07/schema#
                          additionalProperties: false
                          type: object
                          properties:
                            index:
                              description: (optional) Index to search against. If not provided, will automatically select the best index to use based on the query.
                              type: string
                            query:
                              description: A natural language query expressing the search request
                              type: string
                          required:
                            - query
                        tags: []
                        type: builtin
                      - configuration: {}
                        description: Retrieve the full content (source) of an Elasticsearch document based on its ID and index name.
                        id: platform.core.get_document_by_id
                        readonly: true
                        schema:
                          $schema: http://json-schema.org/draft-07/schema#
                          additionalProperties: false
                          type: object
                          properties:
                            id:
                              description: ID of the document to retrieve
                              type: string
                            index:
                              description: Name of the index to retrieve the document from
                              type: string
                          required:
                            - id
                            - index
                        tags: []
                        type: builtin
                      - configuration: {}
                        description: |-
                          Execute an ES|QL query and return the results in a tabular format.

                          **IMPORTANT**: This tool only **runs** queries; it does not write them.
                          Think of this as the final step after a query has been prepared.

                          You **must** get the query from one of two sources before calling this tool:
                          1.  The output of the `platform.core.generate_esql` tool (if the tool is available).
                          2.  A verbatim query provided directly by the user.

                          Under no circumstances should you invent, guess, or modify a query yourself for this tool.
                          If you need a query, use the `platform.core.generate_esql` tool first.
                        id: platform.core.execute_esql
                        readonly: true
                        schema:
                          $schema: http://json-schema.org/draft-07/schema#
                          additionalProperties: false
                          type: object
                          properties:
                            query:
                              description: The ES|QL query to execute
                              type: string
                          required:
                            - query
                        tags: []
                        type: builtin
                      - configuration:
                          params:
                            limit:
                              description: Maximum number of results to return
                              type: integer
                            startTime:
                              description: Start time for the analysis in ISO format
                              type: date
                          query: FROM financial_trades | WHERE execution_timestamp >= ?startTime | STATS trade_count=COUNT(*), avg_price=AVG(execution_price) BY symbol | SORT trade_count DESC | LIMIT ?limit
                        description: Example ES|QL query tool for analyzing financial trades with time filtering
                        id: example-esql-tool
                        readonly: false
                        schema:
                          $schema: http://json-schema.org/draft-07/schema#
                          additionalProperties: false
                          description: Parameters needed to execute the query
                          type: object
                          properties:
                            limit:
                              description: Maximum number of results to return
                              type: integer
                            startTime:
                              description: Start time for the analysis in ISO format
                              format: date-time
                              type: string
                          required:
                            - startTime
                            - limit
                        tags:
                          - analytics
                          - finance
                        type: esql
                      - configuration:
                          pattern: financial_*
                        description: Search tool specifically for financial data analysis and reporting
                        id: example-index-search-tool
                        readonly: false
                        schema:
                          $schema: http://json-schema.org/draft-07/schema#
                          additionalProperties: false
                          type: object
                          properties:
                            nlQuery:
                              description: A natural language query expressing the search request
                              type: string
                          required:
                            - nlQuery
                        tags:
                          - search
                          - finance
                        type: index_search
          description: Indicates a successful response
      summary: List tools
      tags:
        - agent builder
      x-codeSamples:
        - lang: curl
          source: |
            curl \
              -X GET "https://${KIBANA_URL}/api/agent_builder/tools" \
              -H "Authorization: ApiKey ${API_KEY}"
        - lang: Console
          source: |
            GET kbn:/api/agent_builder/tools
      x-state: Added in 9.2.0
      x-metaTags:
        - content: Kibana
          name: product_name
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/agent_builder/tools</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Create a new tool. Use this endpoint to define a custom tool with specific functionality and configuration for use by agents. To learn more about Agent Builder tools, refer to the [tools documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/tools).<br/><br/>[Required authorization] Route required privileges: agentBuilder:manageTools.
      operationId: post-agent-builder-tools
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
      requestBody:
        content:
          application/json:
            examples:
              createEsqlToolRequest:
                description: Example request to create an ESQL query tool with a pre-defined query
                value:
                  configuration:
                    params:
                      limit:
                        description: Maximum number of results to return
                        type: integer
                      startTime:
                        description: Start time for the analysis in ISO format
                        type: date
                    query: FROM financial_trades | WHERE execution_timestamp >= ?startTime | STATS trade_count=COUNT(*), avg_price=AVG(execution_price) BY symbol | SORT trade_count DESC | LIMIT ?limit
                  description: Example ES|QL query tool for analyzing financial trades with time filtering
                  id: example-esql-tool
                  tags:
                    - analytics
                    - finance
                  type: esql
              createIndexSearchToolRequest:
                description: Example request to create an index_search tool with a pre-defined index pattern
                value:
                  configuration:
                    pattern: financial_*
                  description: Search tool specifically for financial data analysis and reporting
                  id: example-index-search-tool
                  tags:
                    - search
                    - finance
                  type: index_search
            schema:
              additionalProperties: false
              type: object
              properties:
                configuration:
                  additionalProperties:
                    nullable: true
                  description: Tool-specific configuration parameters. See examples for details.
                  type: object
                confirmation:
                  additionalProperties: false
                  description: Optional tool call policy to control tool call confirmation behavior
                  type: object
                  properties:
                    askUser:
                      enum:
                        - once
                        - always
                        - never
                      type: string
                description:
                  default: ''
                  description: Description of what the tool does.
                  type: string
                id:
                  description: Unique identifier for the tool.
                  type: string
                tags:
                  default: []
                  description: Optional tags for categorizing and organizing tools.
                  items:
                    description: Tag for categorizing the tool.
                    type: string
                  type: array
                type:
                  description: The type of tool to create (e.g., esql, index_search).
                  enum:
                    - esql
                    - index_search
                    - workflow
                    - mcp
                  type: string
              required:
                - id
                - type
                - configuration
      responses:
        '200':
          content:
            application/json:
              examples:
                createEsqlToolExample:
                  description: Example response returning a definition of ESQL tool created
                  value:
                    configuration:
                      params:
                        limit:
                          description: Maximum number of results to return
                          type: integer
                        startTime:
                          description: Start time for the analysis in ISO format
                          type: date
                      query: FROM financial_trades | WHERE execution_timestamp >= ?startTime | STATS trade_count=COUNT(*), avg_price=AVG(execution_price) BY symbol | SORT trade_count DESC | LIMIT ?limit
                    description: Example ES|QL query tool for analyzing financial trades with time filtering
                    id: example-esql-tool
                    readonly: false
                    schema:
                      $schema: http://json-schema.org/draft-07/schema#
                      additionalProperties: false
                      description: Parameters needed to execute the query
                      type: object
                      properties:
                        limit:
                          description: Maximum number of results to return
                          type: integer
                        startTime:
                          description: Start time for the analysis in ISO format
                          format: date-time
                          type: string
                      required:
                        - startTime
                        - limit
                    tags:
                      - analytics
                      - finance
                    type: esql
                createIndexSearchToolExample:
                  description: Example response returning a definition of search tool tool created
                  value:
                    configuration:
                      pattern: financial_*
                    description: Search tool specifically for financial data analysis and reporting
                    id: example-index-search-tool
                    readonly: false
                    schema:
                      $schema: http://json-schema.org/draft-07/schema#
                      additionalProperties: false
                      type: object
                      properties:
                        nlQuery:
                          description: A natural language query expressing the search request
                          type: string
                      required:
                        - nlQuery
                    tags:
                      - search
                      - finance
                    type: index_search
          description: Indicates a successful response
      summary: Create a tool
      tags:
        - agent builder
      x-codeSamples:
        - lang: curl
          source: |
            curl \
             -X POST "https://${KIBANA_URL}/api/agent_builder/tools" \
             -H "Authorization: ApiKey ${API_KEY}" \
             -H "kbn-xsrf: true" \
             -H "Content-Type: application/json" \
             -d '{
               "id": "example-esql-tool",
               "type": "esql",
               "description": "Example ES|QL query tool for analyzing financial trades with time filtering",
               "tags": ["analytics", "finance"],
               "configuration": {
                 "query": "FROM financial_trades | WHERE execution_timestamp >= ?startTime | STATS trade_count=COUNT(*), avg_price=AVG(execution_price) BY symbol | SORT trade_count DESC | LIMIT ?limit",
                 "params": {
                   "startTime": {
                     "type": "date",
                     "description": "Start time for the analysis in ISO format"
                   },
                   "limit": {
                     "type": "integer",
                     "description": "Maximum number of results to return"
                   }
                 }
               }
             }'
        - lang: Console
          source: |
            POST kbn:/api/agent_builder/tools
            {
              "id": "example-esql-tool",
              "type": "esql",
              "description": "An ES|QL query tool for analyzing financial trades with time filtering",
              "tags": ["analytics", "finance", "updated"],
              "configuration": {
                "query": "FROM financial_trades | WHERE execution_timestamp >= ?startTime | STATS trade_count=COUNT(*), avg_price=AVG(execution_price) BY symbol | SORT trade_count DESC | LIMIT ?limit",
                "params": {
                  "startTime": {
                    "type": "date",
                    "description": "Start time for the analysis in ISO format"
                  },
                  "limit": {
                    "type": "integer",
                    "description": "Maximum number of results to return"
                  }
                }
              }
            }
      x-state: Added in 9.2.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/agent_builder/tools/_execute:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/agent_builder/tools/_execute</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Run a tool with parameters. Use this endpoint to run a tool directly with specified inputs and optional external connector integration. To learn more about Agent Builder tools, refer to the [tools documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/tools).<br/><br/>[Required authorization] Route required privileges: agentBuilder:read.
      operationId: post-agent-builder-tools-execute
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
      requestBody:
        content:
          application/json:
            examples:
              executeBuiltinEsqlToolRequest:
                description: Example request executing platform.core.execute_esql tool
                value:
                  tool_id: platform.core.execute_esql
                  tool_params:
                    query: FROM financial_trades | LIMIT 3
              executeBuiltinToolRequest:
                description: Example request executing platform.core.get_document_by_id tool
                value:
                  tool_id: platform.core.get_document_by_id
                  tool_params:
                    id: TRD-20250805-0820a89f
                    index: financial_trades
              executeCustomEsqlToolRequest:
                description: Example request executing custom example-esql-tool tool
                value:
                  tool_id: example-esql-tool
                  tool_params:
                    limit: 3
                    startTime: '2024-01-01T00:00:00Z'
              executeIndexSearchToolRequest:
                description: Example request executing custom example-index-search-tool tool
                value:
                  tool_id: example-index-search-tool
                  tool_params:
                    nlQuery: find trades with high execution prices above 100
            schema:
              additionalProperties: false
              type: object
              properties:
                approvals:
                  additionalProperties: false
                  description: Actions the tool run may take that would otherwise need a live user to approve them. Applies to this run and any sub-agents it spawns.
                  type: object
                  properties:
                    auto_approved_apis:
                      additionalProperties: false
                      description: Destructive Elasticsearch or Kibana APIs the tool may call without a user confirmation, keyed by backend. A tool run has no live user to answer the confirmation prompt, so a destructive API is refused unless it is listed here.
                      type: object
                      properties:
                        elasticsearch:
                          description: Elasticsearch APIs pre-approved for this run. Each entry is an exact identifier formed from the namespace and name (for example `indices.create`), a namespace wildcard (for example `indices.*`), or `*` for every Elasticsearch API.
                          items:
                            maxLength: 256
                            type: string
                          maxItems: 100
                          type: array
                        kibana:
                          description: Kibana APIs pre-approved for this run. Each entry is an exact identifier formed from the namespace and name (for example `alerting.delete-alerting-rule-id`), a namespace wildcard (for example `alerting.*`), or `*` for every Kibana API.
                          items:
                            maxLength: 256
                            type: string
                          maxItems: 100
                          type: array
                connector_id:
                  description: Optional connector ID for tools that require external integrations.
                  type: string
                tool_id:
                  description: The ID of the tool to execute.
                  type: string
                tool_params:
                  additionalProperties:
                    nullable: true
                  description: Parameters to pass to the tool execution. See examples for details
                  type: object
              required:
                - tool_id
                - tool_params
      responses:
        '200':
          content:
            application/json:
              examples:
                executeBuiltinEsqlToolExample:
                  description: Example response calling built-in platform.core.execute_esql tool
                  value:
                    results:
                      - data:
                          esql: FROM financial_trades | LIMIT 3
                        type: query
                      - data:
                          columns:
                            - name: account_id
                              type: keyword
                            - name: execution_price
                              type: double
                            - name: symbol
                              type: keyword
                            - name: trade_type
                              type: keyword
                          query: FROM financial_trades | LIMIT 3
                          source: esql
                          values:
                            - - ACC00179-1f91
                              - 43.77000045776367
                              - CVX
                              - sell
                            - - ACC00407-0bbb
                              - 660.4199829101562
                              - V
                              - buy
                            - - ACC00179-1f91
                              - 440.3599853515625
                              - KO
                              - buy
                        tool_result_id: xTpT
                        type: esql_results
                executeBuiltinToolExample:
                  description: Example response calling built-in platform.core.get_document_by_id tool
                  value:
                    results:
                      - data:
                          content:
                            account_id: ACC00271-fb5c
                            execution_price: 488.54
                            execution_timestamp: '2025-08-05T08:04:11.649855'
                            last_updated: '2025-09-15T13:23:36'
                            order_status: executed
                            order_type: market
                            quantity: 131
                            status_reason: fully_filled
                            symbol: EWL
                            trade_cost: 63998.74
                            trade_id: TRD-20250805-0820a89f
                            trade_type: sell
                          partial: false
                          reference:
                            id: TRD-20250805-0820a89f
                            index: financial_trades
                        type: resource
                executeCustomEsqlToolExample:
                  description: Example response calling custom example-esql-tool tool
                  value:
                    results:
                      - data:
                          columns:
                            - name: trade_count
                              type: long
                            - name: avg_price
                              type: double
                            - name: symbol
                              type: keyword
                          query: FROM financial_trades | WHERE execution_timestamp >= ?startTime | STATS trade_count=COUNT(*), avg_price=AVG(execution_price) BY symbol | SORT trade_count DESC | LIMIT ?limit
                          source: esql
                          values:
                            - - 2115
                              - 89.33911587329621
                              - US_T_BOND_20YR
                            - - 2112
                              - 104.20854155945055
                              - INTL_CORP_ASIA_D
                            - - 2105
                              - 89.93244177666526
                              - INTL_CORP_EU_B
                        tool_result_id: Voy8
                        type: esql_results
                executeIndexSearchToolExample:
                  description: Example response calling custom example-index-search-tool tool
                  value:
                    results:
                      - data:
                          esql: |-
                            FROM financial_trades
                            | WHERE execution_price > 100
                            | LIMIT 100
                        type: query
                      - data:
                          columns:
                            - name: account_id
                              type: keyword
                            - name: execution_price
                              type: double
                            - name: execution_timestamp
                              type: date
                            - name: symbol
                              type: keyword
                            - name: trade_type
                              type: keyword
                          query: |-
                            FROM financial_trades
                            | WHERE execution_price > 100
                            | LIMIT 100
                          source: esql
                          values:
                            - - ACC00407-0bbb
                              - 660.4199829101562
                              - '2020-09-25T11:06:08.687Z'
                              - V
                              - buy
                            - - ACC00179-1f91
                              - 440.3599853515625
                              - '2025-08-07T21:56:45.377Z'
                              - KO
                              - buy
                            - - ACC00407-0bbb
                              - 132.8800048828125
                              - '2020-11-19T04:39:13.655Z'
                              - JAP_JGB_10YR
                              - sell
                        tool_result_id: uE8y
                        type: esql_results
          description: Indicates a successful response
      summary: Run a tool
      tags:
        - agent builder
      x-codeSamples:
        - lang: curl
          source: |
            curl \
             -X POST "https://${KIBANA_URL}/api/agent_builder/tools/_execute" \
             -H "Authorization: ApiKey ${API_KEY}" \
             -H "kbn-xsrf: true" \
             -H "Content-Type: application/json" \
             -d '{
               "tool_id": "platform.core.search",
               "tool_params": {
                 "query": "can you find john doe's email from the employee index?"}
               }
             }'
        - lang: Console
          source: |
            POST kbn:/api/agent_builder/tools/_execute
            {
              "tool_id": "platform.core.search",
              "tool_params": {
                "query": "can you find john doe's email from the employee index?"
              }
            }
      x-state: Added in 9.2.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/agent_builder/tools/{toolId}:
    delete:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb delete">delete</span>&nbsp;<span class="operation-path">/s/{space_id}/api/agent_builder/tools/{toolId}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Delete a tool by ID. This action cannot be undone. To learn more about Agent Builder tools, refer to the [tools documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/tools).<br/><br/>[Required authorization] Route required privileges: agentBuilder:manageTools.
      operationId: delete-agent-builder-tools-toolid
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: The unique identifier of the tool to delete.
          in: path
          name: toolId
          required: true
          schema:
            type: string
        - description: If true, removes the tool from agents that use it and then deletes it. If false and any agent uses the tool, the request returns 409 Conflict with the list of agents.
          in: query
          name: force
          required: false
          schema:
            default: false
            type: boolean
      responses:
        '200':
          content:
            application/json:
              examples:
                deleteAgentResponseExample:
                  description: Example response showing that the deletion operation was successful
                  value:
                    success: true
          description: Indicates a successful response
      summary: Delete a tool
      tags:
        - agent builder
      x-codeSamples:
        - lang: curl
          source: |
            curl \
              -X DELETE "https://${KIBANA_URL}/api/agent_builder/tools/{toolId}" \
              -H "Authorization: ApiKey ${API_KEY}" \
              -H "kbn-xsrf: true"
        - lang: Console
          source: |
            DELETE kbn:/api/agent_builder/tools/{toolId}
      x-state: Added in 9.2.0
      x-metaTags:
        - content: Kibana
          name: product_name
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/agent_builder/tools/{toolId}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Get a specific tool by ID. Use this endpoint to retrieve the complete tool definition including its schema and configuration requirements. To learn more about Agent Builder tools, refer to the [tools documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/tools).<br/><br/>[Required authorization] Route required privileges: agentBuilder:read.
      operationId: get-agent-builder-tools-toolid
      parameters:
        - description: The unique identifier of the tool to retrieve.
          in: path
          name: toolId
          required: true
          schema:
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                getBuiltinToolExample:
                  description: Example response returning built-in platform.core.search tool
                  value:
                    configuration: {}
                    description: |-
                      A powerful tool for searching and analyzing data within your Elasticsearch cluster.
                      It supports both full-text relevance searches and structured analytical queries.

                      Use this tool for any query that involves finding documents, counting, aggregating, or summarizing data from a known index.

                      Examples of queries:
                      - "find articles about serverless architecture"
                      - "search for support tickets mentioning 'billing issue' or 'refund request'"
                      - "what is our policy on parental leave?"
                      - "list all products where the category is 'electronics'"
                      - "show me the last 5 documents from that index"
                      - "show me the sales over the last year break down by month"

                      Note:
                      - The 'index' parameter can be used to specify which index to search against.
                       If not provided, the tool will decide itself which is the best index to use.
                      - It is perfectly fine not to specify the 'index' parameter. It should only be specified when you already
                       know about the index and fields you want to search on, e.g. if the user explicitly specified it.
                    id: platform.core.search
                    readonly: true
                    schema:
                      $schema: http://json-schema.org/draft-07/schema#
                      additionalProperties: false
                      type: object
                      properties:
                        index:
                          description: (optional) Index to search against. If not provided, will automatically select the best index to use based on the query.
                          type: string
                        query:
                          description: A natural language query expressing the search request
                          type: string
                      required:
                        - query
                    tags: []
                    type: builtin
                getEsqlToolExample:
                  description: Example response returning custom example-esql-tool tool
                  value:
                    configuration:
                      params:
                        limit:
                          description: Maximum number of results to return
                          type: integer
                        startTime:
                          description: Start time for the analysis in ISO format
                          type: date
                      query: FROM financial_trades | WHERE execution_timestamp >= ?startTime | STATS trade_count=COUNT(*), avg_price=AVG(execution_price) BY symbol | SORT trade_count DESC | LIMIT ?limit
                    description: Example ES|QL query tool for analyzing financial trades with time filtering
                    id: example-esql-tool
                    readonly: false
                    schema:
                      $schema: http://json-schema.org/draft-07/schema#
                      additionalProperties: false
                      description: Parameters needed to execute the query
                      type: object
                      properties:
                        limit:
                          description: Maximum number of results to return
                          type: integer
                        startTime:
                          description: Start time for the analysis in ISO format
                          format: date-time
                          type: string
                      required:
                        - startTime
                        - limit
                    tags:
                      - analytics
                      - finance
                    type: esql
                getIndexSearchToolExample:
                  description: Example response returning custom example-index-search-tool tool
                  value:
                    configuration:
                      pattern: financial_*
                    description: Search tool specifically for financial data analysis and reporting
                    id: example-index-search-tool
                    readonly: false
                    schema:
                      $schema: http://json-schema.org/draft-07/schema#
                      additionalProperties: false
                      type: object
                      properties:
                        nlQuery:
                          description: A natural language query expressing the search request
                          type: string
                      required:
                        - nlQuery
                    tags:
                      - search
                      - finance
                    type: index_search
          description: Indicates a successful response
      summary: Get a tool by id
      tags:
        - agent builder
      x-codeSamples:
        - lang: curl
          source: |
            curl \
              -X GET "https://${KIBANA_URL}/api/agent_builder/tools/{toolId}" \
              -H "Authorization: ApiKey ${API_KEY}"
        - lang: Console
          source: |
            GET kbn:/api/agent_builder/tools/{toolId}
      x-state: Added in 9.2.0
      x-metaTags:
        - content: Kibana
          name: product_name
    put:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb put">put</span>&nbsp;<span class="operation-path">/s/{space_id}/api/agent_builder/tools/{toolId}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Update an existing tool. Use this endpoint to modify any aspect of the tool's configuration or metadata. To learn more about Agent Builder tools, refer to the [tools documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/tools).<br/><br/>[Required authorization] Route required privileges: agentBuilder:manageTools.
      operationId: put-agent-builder-tools-toolid
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: The unique identifier of the tool to update.
          in: path
          name: toolId
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            examples:
              updateEsqlToolRequest:
                description: Example request to update the custom ESQL tool
                value:
                  configuration:
                    params:
                      limit:
                        description: Maximum number of results to return
                        type: integer
                      startTime:
                        description: Start time for the analysis in ISO format
                        type: date
                      symbolPattern:
                        description: Pattern to filter symbols (e.g., 'US_*' for US instruments)
                        type: keyword
                    query: FROM financial_trades | WHERE execution_timestamp >= ?startTime AND symbol LIKE ?symbolPattern | STATS trade_count=COUNT(*), avg_price=AVG(execution_price), total_volume=SUM(quantity) BY symbol | SORT trade_count DESC | LIMIT ?limit
                  description: Updated ES|QL query tool for comprehensive financial analysis with enhanced filtering
                  tags:
                    - analytics
                    - finance
                    - reporting
              updateIndexSearchToolRequest:
                description: Example request to update the custom Search tool
                value:
                  description: Updated search tool for comprehensive financial data analysis, reporting, and compliance monitoring
                  tags:
                    - search
                    - finance
                    - compliance
                    - reporting
            schema:
              additionalProperties: false
              type: object
              properties:
                configuration:
                  additionalProperties:
                    nullable: true
                  description: Updated tool-specific configuration parameters. See examples for details.
                  type: object
                confirmation:
                  additionalProperties: false
                  description: Updated tool call policy to control tool call confirmation behavior
                  type: object
                  properties:
                    askUser:
                      enum:
                        - once
                        - always
                        - never
                      type: string
                description:
                  description: Updated description of what the tool does.
                  type: string
                tags:
                  description: Updated tags for categorizing and organizing tools.
                  items:
                    description: Updated tag for categorizing the tool.
                    type: string
                  type: array
      responses:
        '200':
          content:
            application/json:
              examples:
                updateEsqlToolExample:
                  description: Example response showing the updated ESQL tool
                  value:
                    configuration:
                      params:
                        limit:
                          description: Maximum number of results to return
                          type: integer
                        startTime:
                          description: Start time for the analysis in ISO format
                          type: date
                        symbolPattern:
                          description: Pattern to filter symbols (e.g., 'US_*' for US instruments)
                          type: keyword
                      query: FROM financial_trades | WHERE execution_timestamp >= ?startTime AND symbol LIKE ?symbolPattern | STATS trade_count=COUNT(*), avg_price=AVG(execution_price), total_volume=SUM(quantity) BY symbol | SORT trade_count DESC | LIMIT ?limit
                    description: Updated ES|QL query tool for comprehensive financial analysis with enhanced filtering
                    id: example-esql-tool
                    readonly: false
                    schema:
                      $schema: http://json-schema.org/draft-07/schema#
                      additionalProperties: false
                      description: Parameters needed to execute the enhanced query
                      type: object
                      properties:
                        limit:
                          description: Maximum number of results to return
                          type: integer
                        startTime:
                          description: Start time for the analysis in ISO format
                          format: date-time
                          type: string
                        symbolPattern:
                          description: Pattern to filter symbols (e.g., 'US_*' for US instruments)
                          type: string
                      required:
                        - startTime
                        - symbolPattern
                        - limit
                    tags:
                      - analytics
                      - finance
                      - reporting
                    type: esql
                updateIndexSearchToolExample:
                  description: Example response showing the updated Search tool
                  value:
                    configuration:
                      pattern: financial_*
                    description: Updated search tool for comprehensive financial data analysis, reporting, and compliance monitoring
                    id: example-index-search-tool
                    readonly: false
                    schema:
                      $schema: http://json-schema.org/draft-07/schema#
                      additionalProperties: false
                      type: object
                      properties:
                        nlQuery:
                          description: A natural language query expressing the search request
                          type: string
                      required:
                        - nlQuery
                    tags:
                      - search
                      - finance
                      - compliance
                      - reporting
                    type: index_search
          description: Indicates a successful response
      summary: Update a tool
      tags:
        - agent builder
      x-codeSamples:
        - lang: curl
          source: |
            curl \
             -X PUT "https://${KIBANA_URL}/api/agent_builder/tools/{toolId}" \
             -H "Authorization: ApiKey ${API_KEY}" \
             -H "kbn-xsrf: true" \
             -H "Content-Type: application/json" \
             -d '{
               "description": "Updated ES|QL query tool for analyzing financial trades with time filtering",
               "tags": ["analytics", "finance", "updated"],
               "configuration": {
                 "query": "FROM financial_trades | WHERE execution_timestamp >= ?startTime | STATS trade_count=COUNT(*), avg_price=AVG(execution_price) BY symbol | SORT trade_count DESC | LIMIT ?limit",
                 "params": {
                   "startTime": {
                     "type": "date",
                     "description": "Start time for the analysis in ISO format"
                   },
                   "limit": {
                     "type": "integer",
                     "description": "Maximum number of results to return"
                   }
                 }
               }
             }'
        - lang: Console
          source: |
            PUT kbn:/api/agent_builder/tools/{toolId}
            {
              "description": "Updated ES|QL query tool for analyzing financial trades with time filtering",
              "tags": ["analytics", "finance", "updated"],
              "configuration": {
                "query": "FROM financial_trades | WHERE execution_timestamp >= ?startTime | STATS trade_count=COUNT(*), avg_price=AVG(execution_price) BY symbol | SORT trade_count DESC | LIMIT ?limit",
                "params": {
                  "startTime": {
                    "type": "date",
                    "description": "Start time for the analysis in ISO format"
                  },
                  "limit": {
                    "type": "integer",
                    "description": "Maximum number of results to return"
                  }
                }
              }
            }
      x-state: Added in 9.2.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/alerting/_health:
    get:
      description: |
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/_health</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        You must have `read` privileges for the **Management > Stack Rules** feature or for at least one of the **Analytics > Discover**, **Analytics > Machine Learning**, **Observability**, or **Security** features.
      operationId: getAlertingHealth
      responses:
        '200':
          content:
            application/json:
              examples:
                getAlertingHealthResponse:
                  $ref: '#/components/examples/Alerting_get_health_response'
              schema:
                type: object
                properties:
                  alerting_framework_health:
                    description: |
                      Three substates identify the health of the alerting framework: `decryption_health`, `execution_health`, and `read_health`.
                    type: object
                    properties:
                      decryption_health:
                        description: The timestamp and status of the rule decryption.
                        type: object
                        properties:
                          status:
                            enum:
                              - error
                              - ok
                              - warn
                            example: ok
                            type: string
                          timestamp:
                            example: '2023-01-13T01:28:00.280Z'
                            format: date-time
                            type: string
                      execution_health:
                        description: The timestamp and status of the rule run.
                        type: object
                        properties:
                          status:
                            enum:
                              - error
                              - ok
                              - warn
                            example: ok
                            type: string
                          timestamp:
                            example: '2023-01-13T01:28:00.280Z'
                            format: date-time
                            type: string
                      read_health:
                        description: The timestamp and status of the rule reading events.
                        type: object
                        properties:
                          status:
                            enum:
                              - error
                              - ok
                              - warn
                            example: ok
                            type: string
                          timestamp:
                            example: '2023-01-13T01:28:00.280Z'
                            format: date-time
                            type: string
                  has_permanent_encryption_key:
                    description: If `false`, the encrypted saved object plugin does not have a permanent encryption key.
                    example: true
                    type: boolean
                  is_sufficiently_secure:
                    description: If `false`, security is enabled but TLS is not.
                    example: true
                    type: boolean
          description: Indicates a successful call.
        '401':
          content:
            application/json:
              examples:
                healthUnauthorizedResponse:
                  $ref: '#/components/examples/Alerting_401_health_response'
              schema:
                $ref: '#/components/schemas/Alerting_401_response'
          description: Authorization information is missing or invalid.
      summary: Get the alerting framework health
      tags:
        - alerting
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/alerting/rule_types:
    get:
      description: |
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/rule_types</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        If you have `read` privileges for one or more Kibana features, the API response contains information about the appropriate rule types. For example, there are rule types associated with the **Management > Stack Rules** feature, **Analytics > Discover** and **Machine Learning** features, **Observability** features, and **Security** features. To get rule types associated with the **Stack Monitoring** feature, use the `monitoring_user` built-in role.
      operationId: getRuleTypes
      responses:
        '200':
          content:
            application/json:
              examples:
                getRuleTypesResponse:
                  $ref: '#/components/examples/Alerting_get_rule_types_response'
              schema:
                items:
                  type: object
                  properties:
                    action_groups:
                      description: |
                        An explicit list of groups for which the rule type can schedule actions, each with the action group's unique ID and human readable name. Rule actions validation uses this configuration to ensure that groups are valid.
                      items:
                        type: object
                        properties:
                          id:
                            type: string
                          name:
                            type: string
                      type: array
                    action_variables:
                      description: |
                        A list of action variables that the rule type makes available via context and state in action parameter templates, and a short human readable description. When you create a rule in Kibana, it uses this information to prompt you for these variables in action parameter editors.
                      type: object
                      properties:
                        context:
                          items:
                            type: object
                            properties:
                              description:
                                type: string
                              name:
                                type: string
                              useWithTripleBracesInTemplates:
                                type: boolean
                          type: array
                        params:
                          items:
                            type: object
                            properties:
                              description:
                                type: string
                              name:
                                type: string
                          type: array
                        state:
                          items:
                            type: object
                            properties:
                              description:
                                type: string
                              name:
                                type: string
                          type: array
                    alerts:
                      description: |
                        Details for writing alerts as data documents for this rule type.
                      type: object
                      properties:
                        context:
                          description: |
                            The namespace for this rule type.
                          enum:
                            - ml.anomaly-detection
                            - observability.apm
                            - observability.logs
                            - observability.metrics
                            - observability.slo
                            - observability.threshold
                            - observability.uptime
                            - security
                            - stack
                          type: string
                        dynamic:
                          description: Indicates whether new fields are added dynamically.
                          enum:
                            - 'false'
                            - runtime
                            - strict
                            - 'true'
                          type: string
                        isSpaceAware:
                          description: |
                            Indicates whether the alerts are space-aware. If true, space-specific alert indices are used.
                          type: boolean
                        mappings:
                          type: object
                          properties:
                            fieldMap:
                              additionalProperties:
                                $ref: '#/components/schemas/Alerting_fieldmap_properties'
                              description: |
                                Mapping information for each field supported in alerts as data documents for this rule type. For more information about mapping parameters, refer to the Elasticsearch documentation.
                              type: object
                        secondaryAlias:
                          description: |
                            A secondary alias. It is typically used to support the signals alias for detection rules.
                          type: string
                        shouldWrite:
                          description: |
                            Indicates whether the rule should write out alerts as data.
                          type: boolean
                        useEcs:
                          description: |
                            Indicates whether to include the ECS component template for the alerts.
                          type: boolean
                        useLegacyAlerts:
                          default: false
                          description: |
                            Indicates whether to include the legacy component template for the alerts.
                          type: boolean
                    authorized_consumers:
                      description: The list of the plugins IDs that have access to the rule type.
                      type: object
                      properties:
                        alerts:
                          type: object
                          properties:
                            all:
                              type: boolean
                            read:
                              type: boolean
                        apm:
                          type: object
                          properties:
                            all:
                              type: boolean
                            read:
                              type: boolean
                        discover:
                          type: object
                          properties:
                            all:
                              type: boolean
                            read:
                              type: boolean
                        infrastructure:
                          type: object
                          properties:
                            all:
                              type: boolean
                            read:
                              type: boolean
                        logs:
                          type: object
                          properties:
                            all:
                              type: boolean
                            read:
                              type: boolean
                        ml:
                          type: object
                          properties:
                            all:
                              type: boolean
                            read:
                              type: boolean
                        monitoring:
                          type: object
                          properties:
                            all:
                              type: boolean
                            read:
                              type: boolean
                        siem:
                          type: object
                          properties:
                            all:
                              type: boolean
                            read:
                              type: boolean
                        slo:
                          type: object
                          properties:
                            all:
                              type: boolean
                            read:
                              type: boolean
                        stackAlerts:
                          type: object
                          properties:
                            all:
                              type: boolean
                            read:
                              type: boolean
                        uptime:
                          type: object
                          properties:
                            all:
                              type: boolean
                            read:
                              type: boolean
                    category:
                      description: The rule category, which is used by features such as category-specific maintenance windows.
                      enum:
                        - management
                        - observability
                        - securitySolution
                      type: string
                    default_action_group_id:
                      description: The default identifier for the rule type group.
                      type: string
                    does_set_recovery_context:
                      description: Indicates whether the rule passes context variables to its recovery action.
                      type: boolean
                    enabled_in_license:
                      description: Indicates whether the rule type is enabled or disabled based on the subscription.
                      type: boolean
                    has_alerts_mappings:
                      description: Indicates whether the rule type has custom mappings for the alert data.
                      type: boolean
                    has_fields_for_a_a_d:
                      type: boolean
                    id:
                      description: The unique identifier for the rule type.
                      type: string
                    is_exportable:
                      description: Indicates whether the rule type is exportable in **Stack Management > Saved Objects**.
                      type: boolean
                    minimum_license_required:
                      description: The subscriptions required to use the rule type.
                      example: basic
                      type: string
                    name:
                      description: The descriptive name of the rule type.
                      type: string
                    producer:
                      description: An identifier for the application that produces this rule type.
                      example: stackAlerts
                      type: string
                    recovery_action_group:
                      description: An action group to use when an alert goes from an active state to an inactive one.
                      type: object
                      properties:
                        id:
                          type: string
                        name:
                          type: string
                    rule_task_timeout:
                      example: 5m
                      type: string
                type: array
          description: Indicates a successful call.
        '401':
          content:
            application/json:
              examples:
                ruleTypesUnauthorizedResponse:
                  $ref: '#/components/examples/Alerting_401_rule_types_response'
              schema:
                $ref: '#/components/schemas/Alerting_401_response'
          description: Authorization information is missing or invalid.
      summary: Get the rule types
      tags:
        - alerting
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/alerting/rule/{id}:
    delete:
      operationId: delete-alerting-rule-id
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: The identifier for the rule.
          in: path
          name: id
          required: true
          schema:
            type: string
      responses:
        '204':
          description: Indicates a successful call.
        '400':
          description: Indicates an invalid schema or parameters.
        '403':
          description: Indicates that this call is forbidden.
        '404':
          description: Indicates a rule with the given ID does not exist.
      summary: Delete a rule
      tags:
        - alerting
      x-metaTags:
        - content: Kibana
          name: product_name
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb delete">delete</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/rule/{id}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
    get:
      operationId: get-alerting-rule-id
      parameters:
        - description: The identifier for the rule.
          in: path
          name: id
          required: true
          schema:
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                getRuleResponse:
                  description: A response that contains information about an index threshold rule.
                  summary: Get an index threshold rule
                  value:
                    actions: []
                    api_key_owner: elastic
                    consumer: alerts
                    created_at: '2022-12-05T23:40:33.132Z'
                    created_by: elastic
                    enabled: true
                    id: 3583a470-74f6-11ed-9801-35303b735aef
                    mute_all: false
                    muted_alert_ids: []
                    name: my alert
                    notify_when: onActionGroupChange
                    params:
                      aggField: sheet.version
                      aggType: avg
                      groupBy: top
                      index:
                        - test-index
                      termField: name.keyword
                      termSize: 6
                      threshold:
                        - 1000
                      thresholdComparator: '>'
                      timeField: '@timestamp'
                      timeWindowSize: 5
                      timeWindowUnit: m
                    revision: 0
                    rule_type_id: .index-threshold
                    schedule:
                      interval: 1m
                    tags:
                      - cpu
                    throttle: null
                    updated_at: '2022-12-05T23:40:33.132Z'
                    updated_by: elastic
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_rule_response'
          description: Indicates a successful call.
        '400':
          description: Indicates an invalid schema or parameters.
        '403':
          description: Indicates that this call is forbidden.
        '404':
          description: Indicates a rule with the given ID does not exist.
      summary: Get rule details
      tags:
        - alerting
      x-metaTags:
        - content: Kibana
          name: product_name
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/rule/{id}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
    post:
      operationId: post-alerting-rule-id
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: The identifier for the rule. If it is omitted, an ID is randomly generated.
          in: path
          name: id
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            examples:
              createEsQueryEsqlRuleRequest:
                description: |
                  Create an Elasticsearch query rule that uses Elasticsearch Query Language (ES|QL) to define its query and a server log connector to send notifications.
                summary: Elasticsearch query rule (ES|QL)
                value:
                  actions:
                    - frequency:
                        notify_when: onActiveAlert
                        summary: false
                      group: query matched
                      id: d0db1fe0-78d6-11ee-9177-f7d404c8c945
                      params:
                        level: info
                        message: |-
                          Elasticsearch query rule '{{rule.name}}' is active:
                          - Value: {{context.value}} - Conditions Met: {{context.conditions}} over {{rule.params.timeWindowSize}}{{rule.params.timeWindowUnit}} - Timestamp: {{context.date}} - Link: {{context.link}}
                  consumer: stackAlerts
                  name: my Elasticsearch query ESQL rule
                  params:
                    esqlQuery:
                      esql: FROM kibana_sample_data_logs | KEEP bytes, clientip, host, geo.dest | where geo.dest != "GB" | STATS sumbytes = sum(bytes) by clientip, host | WHERE sumbytes > 5000 | SORT sumbytes desc | LIMIT 10
                    searchType: esqlQuery
                    size: 0
                    threshold:
                      - 0
                    thresholdComparator: '>'
                    timeField: '@timestamp'
                    timeWindowSize: 1
                    timeWindowUnit: d
                  rule_type_id: .es-query
                  schedule:
                    interval: 1d
              createEsQueryKqlRuleRequest:
                description: Create an Elasticsearch query rule that uses Kibana query language (KQL).
                summary: Elasticsearch query rule (KQL)
                value:
                  consumer: alerts
                  name: my Elasticsearch query KQL rule
                  params:
                    aggType: count
                    excludeHitsFromPreviousRun: true
                    groupBy: all
                    searchConfiguration:
                      index: 90943e30-9a47-11e8-b64d-95841ca0b247
                      query:
                        language: kuery
                        query: '""geo.src : "US" ""'
                    searchType: searchSource
                    size: 100
                    threshold:
                      - 1000
                    thresholdComparator: '>'
                    timeWindowSize: 5
                    timeWindowUnit: m
                  rule_type_id: .es-query
                  schedule:
                    interval: 1m
              createEsQueryRuleRequest:
                description: |
                  Create an Elasticsearch query rule that uses Elasticsearch query domain specific language (DSL) to define its query and a server log connector to send notifications.
                summary: Elasticsearch query rule (DSL)
                value:
                  actions:
                    - frequency:
                        notify_when: onThrottleInterval
                        summary: true
                        throttle: 1d
                      group: query matched
                      id: fdbece50-406c-11ee-850e-c71febc4ca7f
                      params:
                        level: info
                        message: The system has detected {{alerts.new.count}} new, {{alerts.ongoing.count}} ongoing, and {{alerts.recovered.count}} recovered alerts.
                    - frequency:
                        notify_when: onActionGroupChange
                        summary: false
                      group: recovered
                      id: fdbece50-406c-11ee-850e-c71febc4ca7f
                      params:
                        level: info
                        message: Recovered
                  consumer: alerts
                  name: my Elasticsearch query rule
                  params:
                    esQuery: '"""{"query":{"match_all" : {}}}"""'
                    index:
                      - kibana_sample_data_logs
                    size: 100
                    threshold:
                      - 100
                    thresholdComparator: '>'
                    timeField: '@timestamp'
                    timeWindowSize: 1
                    timeWindowUnit: d
                  rule_type_id: .es-query
                  schedule:
                    interval: 1d
              createIndexThresholdRuleRequest:
                description: |
                  Create an index threshold rule that uses a server log connector to send notifications when the threshold is met.
                summary: Index threshold rule
                value:
                  actions:
                    - frequency:
                        notify_when: onActionGroupChange
                        summary: false
                      group: threshold met
                      id: 48de3460-f401-11ed-9f8e-399c75a2deeb
                      params:
                        level: info
                        message: |-
                          Rule '{{rule.name}}' is active for group '{{context.group}}':

                          - Value: {{context.value}}
                          - Conditions Met: {{context.conditions}} over {{rule.params.timeWindowSize}}{{rule.params.timeWindowUnit}}
                          - Timestamp: {{context.date}}
                  alert_delay:
                    active: 3
                  consumer: alerts
                  name: my rule
                  params:
                    aggField: sheet.version
                    aggType: avg
                    groupBy: top
                    index:
                      - .test-index
                    termField: name.keyword
                    termSize: 6
                    threshold:
                      - 1000
                    thresholdComparator: '>'
                    timeField: '@timestamp'
                    timeWindowSize: 5
                    timeWindowUnit: m
                  rule_type_id: .index-threshold
                  schedule:
                    interval: 1m
                  tags:
                    - cpu
              createTrackingContainmentRuleRequest:
                description: |
                  Create a tracking containment rule that checks when an entity is contained or no longer contained within a boundary.
                summary: Tracking containment rule
                value:
                  consumer: alerts
                  name: my tracking rule
                  params:
                    boundaryGeoField: location
                    boundaryIndexId: 0cd90abf-abe7-44c7-909a-f621bbbcfefc
                    boundaryIndexTitle: boundary*
                    boundaryNameField: name
                    boundaryType: entireIndex
                    dateField": '@timestamp'
                    entity: agent.keyword
                    geoField: geo.coordinates
                    index: kibana_sample_data_logs
                    indexId: 90943e30-9a47-11e8-b64d-95841ca0b247
                  rule_type_id: .geo-containment
                  schedule:
                    interval: 1h
            schema:
              anyOf:
                - discriminator:
                    mapping:
                      .es-query: '#/components/schemas/Kibana_HTTP_APIs_es-query-create-rule-body-alerting'
                      .geo-containment: '#/components/schemas/Kibana_HTTP_APIs_geo-containment-create-rule-body-alerting'
                      .index-threshold: '#/components/schemas/Kibana_HTTP_APIs_index-threshold-create-rule-body-alerting'
                      apm.anomaly: '#/components/schemas/Kibana_HTTP_APIs_apm-anomaly-create-rule-body-alerting'
                      apm.error_rate: '#/components/schemas/Kibana_HTTP_APIs_apm-error-rate-create-rule-body-alerting'
                      apm.transaction_duration: '#/components/schemas/Kibana_HTTP_APIs_apm-transaction-duration-create-rule-body-alerting'
                      apm.transaction_error_rate: '#/components/schemas/Kibana_HTTP_APIs_apm-transaction-error-rate-create-rule-body-alerting'
                      datasetQuality.degradedDocs: '#/components/schemas/Kibana_HTTP_APIs_datasetquality-degradeddocs-create-rule-body-alerting'
                      logs.alert.document.count: '#/components/schemas/Kibana_HTTP_APIs_logs-alert-document-count-create-rule-body-alerting'
                      metrics.alert.inventory.threshold: '#/components/schemas/Kibana_HTTP_APIs_metrics-alert-inventory-threshold-create-rule-body-alerting'
                      metrics.alert.threshold: '#/components/schemas/Kibana_HTTP_APIs_metrics-alert-threshold-create-rule-body-alerting'
                      monitoring_alert_cluster_health: '#/components/schemas/Kibana_HTTP_APIs_monitoring-alert-cluster-health-create-rule-body-alerting'
                      monitoring_alert_cpu_usage: '#/components/schemas/Kibana_HTTP_APIs_monitoring-alert-cpu-usage-create-rule-body-alerting'
                      monitoring_alert_disk_usage: '#/components/schemas/Kibana_HTTP_APIs_monitoring-alert-disk-usage-create-rule-body-alerting'
                      monitoring_alert_elasticsearch_version_mismatch: '#/components/schemas/Kibana_HTTP_APIs_monitoring-alert-elasticsearch-version-mismatch-create-rule-body-alerting'
                      monitoring_alert_jvm_memory_usage: '#/components/schemas/Kibana_HTTP_APIs_monitoring-alert-jvm-memory-usage-create-rule-body-alerting'
                      monitoring_alert_kibana_version_mismatch: '#/components/schemas/Kibana_HTTP_APIs_monitoring-alert-kibana-version-mismatch-create-rule-body-alerting'
                      monitoring_alert_license_expiration: '#/components/schemas/Kibana_HTTP_APIs_monitoring-alert-license-expiration-create-rule-body-alerting'
                      monitoring_alert_logstash_version_mismatch: '#/components/schemas/Kibana_HTTP_APIs_monitoring-alert-logstash-version-mismatch-create-rule-body-alerting'
                      monitoring_alert_missing_monitoring_data: '#/components/schemas/Kibana_HTTP_APIs_monitoring-alert-missing-monitoring-data-create-rule-body-alerting'
                      monitoring_alert_nodes_changed: '#/components/schemas/Kibana_HTTP_APIs_monitoring-alert-nodes-changed-create-rule-body-alerting'
                      monitoring_alert_thread_pool_search_rejections: '#/components/schemas/Kibana_HTTP_APIs_monitoring-alert-thread-pool-search-rejections-create-rule-body-alerting'
                      monitoring_alert_thread_pool_write_rejections: '#/components/schemas/Kibana_HTTP_APIs_monitoring-alert-thread-pool-write-rejections-create-rule-body-alerting'
                      monitoring_ccr_read_exceptions: '#/components/schemas/Kibana_HTTP_APIs_monitoring-ccr-read-exceptions-create-rule-body-alerting'
                      monitoring_shard_size: '#/components/schemas/Kibana_HTTP_APIs_monitoring-shard-size-create-rule-body-alerting'
                      observability.rules.custom_threshold: '#/components/schemas/Kibana_HTTP_APIs_observability-rules-custom-threshold-create-rule-body-alerting'
                      slo.rules.burnRate: '#/components/schemas/Kibana_HTTP_APIs_slo-rules-burnrate-create-rule-body-alerting'
                      transform_health: '#/components/schemas/Kibana_HTTP_APIs_transform-health-create-rule-body-alerting'
                      xpack.ml.anomaly_detection_alert: '#/components/schemas/Kibana_HTTP_APIs_xpack-ml-anomaly-detection-alert-create-rule-body-alerting'
                      xpack.ml.anomaly_detection_jobs_health: '#/components/schemas/Kibana_HTTP_APIs_xpack-ml-anomaly-detection-jobs-health-create-rule-body-alerting'
                      xpack.synthetics.alerts.monitorStatus: '#/components/schemas/Kibana_HTTP_APIs_xpack-synthetics-alerts-monitorstatus-create-rule-body-alerting'
                      xpack.synthetics.alerts.tls: '#/components/schemas/Kibana_HTTP_APIs_xpack-synthetics-alerts-tls-create-rule-body-alerting'
                      xpack.uptime.alerts.durationAnomaly: '#/components/schemas/Kibana_HTTP_APIs_xpack-uptime-alerts-durationanomaly-create-rule-body-alerting'
                      xpack.uptime.alerts.monitorStatus: '#/components/schemas/Kibana_HTTP_APIs_xpack-uptime-alerts-monitorstatus-create-rule-body-alerting'
                      xpack.uptime.alerts.tlsCertificate: '#/components/schemas/Kibana_HTTP_APIs_xpack-uptime-alerts-tlscertificate-create-rule-body-alerting'
                    propertyName: rule_type_id
                  oneOf:
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_monitoring-ccr-read-exceptions-create-rule-body-alerting'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_monitoring-alert-cluster-health-create-rule-body-alerting'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_monitoring-alert-cpu-usage-create-rule-body-alerting'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_monitoring-alert-disk-usage-create-rule-body-alerting'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_monitoring-alert-elasticsearch-version-mismatch-create-rule-body-alerting'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_monitoring-alert-kibana-version-mismatch-create-rule-body-alerting'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_monitoring-alert-license-expiration-create-rule-body-alerting'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_monitoring-alert-logstash-version-mismatch-create-rule-body-alerting'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_monitoring-alert-jvm-memory-usage-create-rule-body-alerting'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_monitoring-alert-missing-monitoring-data-create-rule-body-alerting'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_monitoring-alert-nodes-changed-create-rule-body-alerting'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_monitoring-shard-size-create-rule-body-alerting'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_monitoring-alert-thread-pool-search-rejections-create-rule-body-alerting'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_monitoring-alert-thread-pool-write-rejections-create-rule-body-alerting'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_xpack-ml-anomaly-detection-alert-create-rule-body-alerting'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_xpack-ml-anomaly-detection-jobs-health-create-rule-body-alerting'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_datasetquality-degradeddocs-create-rule-body-alerting'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_es-query-create-rule-body-alerting'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_index-threshold-create-rule-body-alerting'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_geo-containment-create-rule-body-alerting'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_transform-health-create-rule-body-alerting'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_apm-anomaly-create-rule-body-alerting'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_apm-error-rate-create-rule-body-alerting'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_apm-transaction-error-rate-create-rule-body-alerting'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_apm-transaction-duration-create-rule-body-alerting'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_xpack-synthetics-alerts-monitorstatus-create-rule-body-alerting'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_xpack-synthetics-alerts-tls-create-rule-body-alerting'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_xpack-uptime-alerts-monitorstatus-create-rule-body-alerting'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_xpack-uptime-alerts-tlscertificate-create-rule-body-alerting'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_xpack-uptime-alerts-durationanomaly-create-rule-body-alerting'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_metrics-alert-inventory-threshold-create-rule-body-alerting'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_metrics-alert-threshold-create-rule-body-alerting'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_observability-rules-custom-threshold-create-rule-body-alerting'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_logs-alert-document-count-create-rule-body-alerting'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_slo-rules-burnrate-create-rule-body-alerting'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_new_rule'
      responses:
        '200':
          content:
            application/json:
              examples:
                createEsQueryEsqlRuleResponse:
                  description: The response for successfully creating an Elasticsearch query rule that uses Elasticsearch Query Language (ES|QL).
                  summary: Elasticsearch query rule (ES|QL)
                  value:
                    actions:
                      - connector_type_id: .server-log
                        frequency:
                          notify_when: onActiveAlert
                          summary: false
                          throttle: null
                        group: query matched
                        id: d0db1fe0-78d6-11ee-9177-f7d404c8c945
                        params:
                          level: info
                          message: |-
                            Elasticsearch query rule '{{rule.name}}' is active:
                            - Value: {{context.value}} - Conditions Met: {{context.conditions}} over {{rule.params.timeWindowSize}}{{rule.params.timeWindowUnit}} - Timestamp: {{context.date}} - Link: {{context.link}}
                        uuid: bfe370a3-531b-4855-bbe6-ad739f578844
                    api_key_created_by_user: false
                    api_key_owner: elastic
                    consumer: stackAlerts
                    created_at: '2023-11-01T19:00:10.453Z'
                    created_by: elastic
                    enabled: true
                    execution_status:
                      last_execution_date: '2023-11-01T19:00:10.453Z'
                      status: pending
                    id: e0d62360-78e8-11ee-9177-f7d404c8c945
                    mute_all: false
                    muted_alert_ids: []
                    name: my Elasticsearch query ESQL rule
                    notify_when: null
                    params:
                      aggType: count
                      esqlQuery:
                        esql: FROM kibana_sample_data_logs | keep bytes, clientip, host, geo.dest | WHERE geo.dest != "GB" | stats sumbytes = sum(bytes) by clientip, host | WHERE sumbytes > 5000 | sort sumbytes desc | limit 10
                      excludeHitsFromPreviousRun": true,
                      groupBy: all
                      searchType: esqlQuery
                      size: 0
                      threshold:
                        - 0
                      thresholdComparator: '>'
                      timeField: '@timestamp'
                      timeWindowSize: 1
                      timeWindowUnit: d
                    revision: 0
                    rule_type_id: .es-query
                    running: false
                    schedule:
                      interval: 1d
                    scheduled_task_id: e0d62360-78e8-11ee-9177-f7d404c8c945
                    tags: []
                    throttle: null
                    updated_at: '2023-11-01T19:00:10.453Z'
                    updated_by: elastic",
                createEsQueryKqlRuleResponse:
                  description: The response for successfully creating an Elasticsearch query rule that uses Kibana query language (KQL).
                  summary: Elasticsearch query rule (KQL)
                  value:
                    actions: []
                    api_key_created_by_user: false
                    api_key_owner: elastic
                    consumer: alerts
                    created_at: '2023-07-14T20:24:50.729Z'
                    created_by: elastic
                    enabled: true
                    execution_status:
                      last_execution_date: '2023-07-14T20:24:50.729Z'
                      status: pending
                    id: 7bd506d0-2284-11ee-8fad-6101956ced88
                    mute_all: false
                    muted_alert_ids: []
                    name: my Elasticsearch query KQL rule"
                    notify_when: null
                    params:
                      aggType: count
                      excludeHitsFromPreviousRun: true
                      groupBy: all
                      searchConfiguration:
                        index: 90943e30-9a47-11e8-b64d-95841ca0b247
                        query:
                          language: kuery
                          query: '""geo.src : "US" ""'
                      searchType: searchSource
                      size: 100
                      threshold:
                        - 1000
                      thresholdComparator: '>'
                      timeWindowSize: 5
                      timeWindowUnit: m
                    revision: 0
                    rule_type_id: .es-query
                    running: false
                    schedule:
                      interval: 1m
                    scheduled_task_id: 7bd506d0-2284-11ee-8fad-6101956ced88
                    tags: []
                    throttle: null
                    updated_at: '2023-07-14T20:24:50.729Z'
                    updated_by: elastic
                createEsQueryRuleResponse:
                  description: The response for successfully creating an Elasticsearch query rule that uses Elasticsearch query domain specific language (DSL).
                  summary: Elasticsearch query rule (DSL)
                  value:
                    actions:
                      - connector_type_id: .server-log
                        frequency:
                          notify_when: onThrottleInterval
                          summary: true
                          throttle: 1d
                        group: query matched
                        id: fdbece50-406c-11ee-850e-c71febc4ca7f
                        params:
                          level: info
                          message: The system has detected {{alerts.new.count}} new, {{alerts.ongoing.count}} ongoing, and {{alerts.recovered.count}} recovered alerts.
                        uuid: 53f3c2a3-e5d0-4cfa-af3b-6f0881385e78
                      - connector_type_id: .server-log
                        frequency:
                          notify_when: onActionGroupChange
                          summary: false
                          throttle: null
                        group: recovered
                        id: fdbece50-406c-11ee-850e-c71febc4ca7f
                        params:
                          level: info
                          message: Recovered
                        uuid: 2324e45b-c0df-45c7-9d70-4993e30be758
                    api_key_created_by_user: false
                    api_key_owner: elastic
                    consumer: alerts
                    created_at: '2023-08-22T00:03:38.263Z'
                    created_by: elastic
                    enabled: true
                    execution_status:
                      last_execution_date: '2023-08-22T00:03:38.263Z'
                      status: pending
                    id: 58148c70-407f-11ee-850e-c71febc4ca7f
                    mute_all: false
                    muted_alert_ids: []
                    name: my Elasticsearch query rule
                    notify_when: null
                    params:
                      aggType: count
                      esQuery: '"""{"query":{"match_all" : {}}}"""'
                      excludeHitsFromPreviousRun: true
                      groupBy: all
                      index:
                        - kibana_sample_data_logs
                      searchType: esQuery
                      size: 100
                      threshold:
                        - 100
                      thresholdComparator: '>'
                      timeField: '@timestamp'
                      timeWindowSize: 1
                      timeWindowUnit: d
                    revision: 0
                    rule_type_id: .es-query
                    running: false
                    schedule:
                      interval: 1d
                    scheduled_task_id: 58148c70-407f-11ee-850e-c71febc4ca7f
                    tags: []
                    throttle: null
                    updated_at: '2023-08-22T00:03:38.263Z'
                    updated_by: elastic
                createIndexThresholdRuleResponse:
                  description: The response for successfully creating an index threshold rule.
                  summary: Index threshold rule
                  value:
                    actions:
                      - connector_type_id: .server-log
                        frequency:
                          notify_when: onActionGroupChange
                          summary: false
                          throttle: null
                        group: threshold met
                        id: dceeb5d0-6b41-11eb-802b-85b0c1bc8ba2
                        params:
                          level: info
                          message: |-
                            Rule {{rule.name}} is active for group {{context.group} :

                            - Value: {{context.value}}
                            - Conditions Met: {{context.conditions}} over {{rule.params.timeWindowSize}}{{rule.params.timeWindowUnit}}
                            - Timestamp: {{context.date}}
                        uuid: 07aef2a0-9eed-4ef9-94ec-39ba58eb609d
                    alert_delay:
                      active: 3
                    api_key_created_by_user: false
                    api_key_owner: elastic
                    consumer: alerts
                    created_at: '2022-06-08T17:20:31.632Z'
                    created_by: elastic
                    enabled: true
                    execution_status:
                      last_execution_date: '2022-06-08T17:20:31.632Z'
                      status: pending
                    id: 41893910-6bca-11eb-9e0d-85d233e3ee35
                    mute_all: false
                    muted_alert_ids: []
                    name: my rule
                    notify_when: null
                    params:
                      aggField: sheet.version
                      aggType: avg
                      groupBy: top
                      index:
                        - .test-index
                      termField: name.keyword
                      termSize: 6
                      threshold:
                        - 1000
                      thresholdComparator: '>'
                      timeField: '@timestamp'
                      timeWindowSize: 5
                      timeWindowUnit: m
                    revision: 0
                    rule_type_id: .index-threshold
                    running: false
                    schedule:
                      interval: 1m
                    scheduled_task_id: 425b0800-6bca-11eb-9e0d-85d233e3ee35
                    tags:
                      - cpu
                    throttle: null
                    updated_at: '2022-06-08T17:20:31.632Z'
                    updated_by: elastic
                createTrackingContainmentRuleResponse:
                  description: The response for successfully creating a tracking containment rule.
                  summary: Tracking containment rule
                  value:
                    actions: []
                    api_key_created_by_user: false
                    api_key_owner: elastic
                    consumer: alerts
                    created_at: '2024-02-14T19:52:55.920Z'
                    created_by: elastic
                    enabled: true
                    execution_status:
                      last_duration: 74
                      last_execution_date: '2024-02-15T03:25:38.125Z'
                      status: ok
                    id: b6883f9d-5f70-4758-a66e-369d7c26012f
                    last_run:
                      alerts_count:
                        active: 0
                        ignored: 0
                        new: 0
                        recovered: 0
                      outcome: succeeded
                      outcome_msg: null
                      outcome_order: 0
                      warning: null
                    mute_all: false
                    muted_alert_ids: []
                    name: my tracking rule
                    next_run: '2024-02-15T03:26:38.033Z'
                    notify_when: null
                    params:
                      boundaryGeoField: location
                      boundaryIndexId: 0cd90abf-abe7-44c7-909a-f621bbbcfefc
                      boundaryIndexTitle: boundary*
                      boundaryNameField: name
                      boundaryType: entireIndex
                      dateField: '@timestamp'
                      entity: agent.keyword
                      geoField: geo.coordinates
                      index: kibana_sample_data_logs
                      indexId: 90943e30-9a47-11e8-b64d-95841ca0b247
                    revision: 1
                    rule_type_id: .geo-containment
                    running: false
                    schedule:
                      interval: 1h
                    scheduled_task_id: b6883f9d-5f70-4758-a66e-369d7c26012f
                    tags: []
                    throttle: null
                    updated_at: '2024-02-15T03:24:32.574Z'
                    updated_by: elastic
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_rule_response'
          description: Indicates a successful call.
        '400':
          description: Indicates an invalid schema or parameters.
        '403':
          description: Indicates that this call is forbidden.
        '409':
          description: Indicates that the rule id is already in use.
      summary: Create a rule
      tags:
        - alerting
      x-metaTags:
        - content: Kibana
          name: product_name
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/rule/{id}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
    put:
      operationId: put-alerting-rule-id
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: The identifier for the rule.
          in: path
          name: id
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            examples:
              updateRuleRequest:
                description: Update an index threshold rule that uses a server log connector to send notifications when the threshold is met.
                summary: Index threshold rule
                value:
                  actions:
                    - frequency:
                        notify_when: onActionGroupChange
                        summary: false
                      group: threshold met
                      id: 96b668d0-a1b6-11ed-afdf-d39a49596974
                      params:
                        level: info
                        message: |-
                          Rule {{rule.name}} is active for group {{context.group}}:

                          - Value: {{context.value}}
                          - Conditions Met: {{context.conditions}} over {{rule.params.timeWindowSize}}{{rule.params.timeWindowUnit}}
                          - Timestamp: {{context.date}}
                  name: new name
                  params:
                    aggField: sheet.version
                    aggType: avg
                    groupBy: top
                    index:
                      - .updated-index
                    termField: name.keyword
                    termSize: 6
                    threshold:
                      - 1000
                    thresholdComparator: '>'
                    timeField: '@timestamp'
                    timeWindowSize: 5
                    timeWindowUnit: m
                  schedule:
                    interval: 1m
                  tags: []
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_update_rule'
      responses:
        '200':
          content:
            application/json:
              examples:
                updateRuleResponse:
                  description: The response for successfully updating an index threshold rule.
                  summary: Index threshold rule
                  value:
                    actions:
                      - connector_type_id: .server-log
                        frequency:
                          notify_when: onActionGroupChange
                          summary: false
                          throttle: null
                        group: threshold met
                        id: 96b668d0-a1b6-11ed-afdf-d39a49596974
                        params:
                          level: info
                          message: |-
                            Rule {{rule.name}} is active for group {{context.group}}:

                            - Value: {{context.value}}
                            - Conditions Met: {{context.conditions}} over {{rule.params.timeWindowSize}}{{rule.params.timeWindowUnit}}
                            - Timestamp: {{context.date}
                        uuid: 07aef2a0-9eed-4ef9-94ec-39ba58eb609d
                    api_key_created_by_user: false
                    api_key_owner: elastic
                    consumer: alerts
                    created_at: '2024-03-26T23:13:20.985Z'
                    created_by: elastic
                    enabled: true
                    execution_status:
                      last_duration: 52
                      last_execution_date: '2024-03-26T23:22:51.390Z'
                      status: ok
                    id: ac4e6b90-6be7-11eb-ba0d-9b1c1f912d74
                    last_run:
                      alerts_count:
                        active: 0
                        ignored: 0
                        new: 0
                        recovered: 0
                      outcome: succeeded
                      outcome_msg: null
                      warning: null
                    mute_all: false
                    muted_alert_ids: []
                    name: new name
                    next_run: '2024-03-26T23:23:51.316Z'
                    params:
                      aggField: sheet.version
                      aggType: avg
                      groupBy: top
                      index:
                        - .updated-index
                      termField: name.keyword
                      termSize: 6
                      threshold:
                        - 1000
                      thresholdComparator: '>'
                      timeField: '@timestamp'
                      timeWindowSize: 5
                      timeWindowUnit: m
                    revision: 1
                    rule_type_id: .index-threshold
                    running: false
                    schedule:
                      interval: 1m
                    scheduled_task_id: 4c5eda00-e74f-11ec-b72f-5b18752ff9ea
                    tags: []
                    throttle: null
                    updated_at: '2024-03-26T23:22:59.949Z'
                    updated_by: elastic
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_rule_response'
          description: Indicates a successful call.
        '400':
          description: Indicates an invalid schema or parameters.
        '403':
          description: Indicates that this call is forbidden.
        '404':
          description: Indicates a rule with the given ID does not exist.
        '409':
          description: Indicates that the rule has already been updated by another user.
      summary: Update a rule
      tags:
        - alerting
      x-metaTags:
        - content: Kibana
          name: product_name
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb put">put</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/rule/{id}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
  /api/alerting/rule/{id}/_disable:
    post:
      operationId: post-alerting-rule-id-disable
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: The identifier for the rule.
          in: path
          name: id
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            examples:
              disableRuleRequest:
                description: A request that disables a rule and untracks all alerts that were generated by the rule.
                summary: Disable a rule and untrack its alerts
                value:
                  untrack: true
            schema:
              additionalProperties: false
              default: null
              nullable: true
              type: object
              properties:
                untrack:
                  description: Defines whether this rule's alerts should be untracked.
                  type: boolean
      responses:
        '204':
          description: Indicates a successful call.
        '400':
          description: Indicates an invalid schema.
        '403':
          description: Indicates that this call is forbidden.
        '404':
          description: Indicates a rule with the given ID does not exist.
      summary: Disable a rule
      tags:
        - alerting
      x-metaTags:
        - content: Kibana
          name: product_name
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/rule/{id}/_disable</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
  /api/alerting/rule/{id}/_enable:
    post:
      operationId: post-alerting-rule-id-enable
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: The identifier for the rule.
          in: path
          name: id
          required: true
          schema:
            type: string
      responses:
        '204':
          description: Indicates a successful call.
        '400':
          description: Indicates an invalid schema or parameters.
        '403':
          description: Indicates that this call is forbidden.
        '404':
          description: Indicates a rule with the given ID does not exist.
      summary: Enable a rule
      tags:
        - alerting
      x-metaTags:
        - content: Kibana
          name: product_name
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/rule/{id}/_enable</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
  /api/alerting/rule/{id}/_mute_all:
    post:
      operationId: post-alerting-rule-id-mute-all
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: The identifier for the rule.
          in: path
          name: id
          required: true
          schema:
            type: string
      responses:
        '204':
          description: Indicates a successful call.
        '400':
          description: Indicates an invalid schema or parameters.
        '403':
          description: Indicates that this call is forbidden.
        '404':
          description: Indicates a rule with the given ID does not exist.
      summary: Mute all alerts
      tags:
        - alerting
      x-metaTags:
        - content: Kibana
          name: product_name
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/rule/{id}/_mute_all</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
  /api/alerting/rule/{id}/_unmute_all:
    post:
      operationId: post-alerting-rule-id-unmute-all
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: The identifier for the rule.
          in: path
          name: id
          required: true
          schema:
            type: string
      responses:
        '204':
          description: Indicates a successful call.
        '400':
          description: Indicates an invalid schema or parameters.
        '403':
          description: Indicates that this call is forbidden.
        '404':
          description: Indicates a rule with the given ID does not exist.
      summary: Unmute all alerts
      tags:
        - alerting
      x-metaTags:
        - content: Kibana
          name: product_name
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/rule/{id}/_unmute_all</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
  /api/alerting/rule/{id}/_update_api_key:
    post:
      operationId: post-alerting-rule-id-update-api-key
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: The identifier for the rule.
          in: path
          name: id
          required: true
          schema:
            type: string
      responses:
        '204':
          description: Indicates a successful call.
        '400':
          description: Indicates an invalid schema or parameters.
        '403':
          description: Indicates that this call is forbidden.
        '404':
          description: Indicates a rule with the given ID does not exist.
        '409':
          description: Indicates that the rule has already been updated by another user.
      summary: Update the API key for a rule
      tags:
        - alerting
      x-metaTags:
        - content: Kibana
          name: product_name
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/rule/{id}/_update_api_key</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
  /api/alerting/rule/{id}/query_inspector:
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/rule/{id}/query_inspector</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Returns the Elasticsearch query that a rule executes, and optionally its response.
      operationId: get-alerting-rule-id-query-inspector
      parameters:
        - description: The identifier for the rule.
          in: path
          name: id
          required: true
          schema:
            type: string
        - description: The inspection mode. Use "build" to return only the query, or "execute" to run the query and include the response.
          in: query
          name: mode
          required: false
          schema:
            default: build
            enum:
              - build
              - execute
            type: string
        - description: The alert document ID. When provided, the query inspector uses the evaluation time range from the alert instead of the current time.
          in: query
          name: alert_id
          required: false
          schema:
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                getRuleQueryInspectorResponse:
                  summary: A query inspector response for a custom threshold rule
                  value:
                    queries:
                      - index: metrics-*
                        request:
                          aggs:
                            groupings:
                              composite:
                                size: 500
                                sources: []
                          query:
                            bool:
                              filter:
                                - range:
                                    '@timestamp':
                                      gte: '2026-01-01T00:00:00.000Z'
                                      lte: '2026-01-01T00:05:00.000Z'
                          size: 0
              schema:
                additionalProperties: false
                type: object
                properties:
                  queries:
                    items:
                      additionalProperties: false
                      type: object
                      properties:
                        index:
                          type: string
                        label:
                          type: string
                        request:
                          additionalProperties:
                            nullable: true
                          type: object
                        response:
                          additionalProperties:
                            nullable: true
                          type: object
                      required:
                        - index
                        - request
                    maxItems: 1000
                    type: array
                required:
                  - queries
          description: Indicates a successful call.
        '400':
          description: Indicates the rule type is not supported or the request parameters are invalid.
        '404':
          description: Indicates a rule with the specified rule ID does not exist.
      summary: Get the Elasticsearch query for a rule
      tags:
        - alerting
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/alerting/rule/{id}/snooze_schedule:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/rule/{id}/snooze_schedule</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        When you snooze a rule, the rule checks continue to run but alerts will not generate actions. You can snooze for a specified period of time and schedule single or recurring downtimes.
      operationId: post-alerting-rule-id-snooze-schedule
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: Identifier of the rule.
          in: path
          name: id
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            examples:
              snoozeRuleRecurringRequest:
                description: A request that snoozes a rule every Monday for 8 hours, for 4 occurrences.
                summary: Snooze a rule on a recurring weekly schedule
                value:
                  schedule:
                    custom:
                      duration: 8h
                      recurring:
                        every: 1w
                        occurrences: 4
                        onWeekDay:
                          - MO
                      start: '2025-03-17T09:00:00.000Z'
                      timezone: UTC
              snoozeRuleRequest:
                description: A request that snoozes a rule for 24 hours starting now.
                summary: Snooze a rule for 24 hours
                value:
                  schedule:
                    custom:
                      duration: 24h
                      start: '2025-03-12T12:00:00.000Z'
                      timezone: UTC
            schema:
              additionalProperties: false
              type: object
              properties:
                schedule:
                  additionalProperties: false
                  type: object
                  properties:
                    custom:
                      $ref: '#/components/schemas/Kibana_HTTP_APIs_schedule_request'
              required:
                - schedule
      responses:
        '200':
          content:
            application/json:
              examples:
                snoozeRuleResponse:
                  description: A response that contains the created snooze schedule.
                  summary: Snooze schedule response
                  value:
                    schedule:
                      custom:
                        duration: 24h
                        start: '2025-03-12T12:00:00.000Z'
                        timezone: UTC
                      id: 9ac67950-6737-11ec-8ded-d7f6e1581b26
              schema:
                additionalProperties: false
                type: object
                properties:
                  body:
                    additionalProperties: false
                    type: object
                    properties:
                      schedule:
                        additionalProperties: false
                        type: object
                        properties:
                          custom:
                            $ref: '#/components/schemas/Kibana_HTTP_APIs_schedule_request'
                          id:
                            description: Identifier of the snooze schedule.
                            type: string
                        required:
                          - id
                    required:
                      - schedule
                required:
                  - body
          description: Indicates a successful call.
        '400':
          description: Indicates an invalid schema.
        '403':
          description: Indicates that this call is forbidden.
        '404':
          description: Indicates a rule with the given id does not exist.
      summary: Schedule a snooze for the rule
      tags:
        - alerting
      x-state: Generally available; added in 8.19.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/alerting/rule/{rule_id}/alert/{alert_id}/_mute:
    post:
      operationId: post-alerting-rule-rule-id-alert-alert-id-mute
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: The identifier for the rule.
          in: path
          name: rule_id
          required: true
          schema:
            type: string
        - description: The identifier for the alert.
          in: path
          name: alert_id
          required: true
          schema:
            type: string
        - description: Whether to validate the existence of the alert.
          in: query
          name: validate_alerts_existence
          required: false
          schema:
            type: boolean
      responses:
        '204':
          description: Indicates a successful call.
        '400':
          description: Indicates an invalid schema or parameters.
        '403':
          description: Indicates that this call is forbidden.
        '404':
          description: Indicates a rule or alert with the given ID does not exist.
      summary: Mute an alert
      tags:
        - alerting
      x-metaTags:
        - content: Kibana
          name: product_name
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/rule/{rule_id}/alert/{alert_id}/_mute</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
  /api/alerting/rule/{rule_id}/alert/{alert_id}/_snooze:
    post:
      operationId: post-alerting-rule-rule-id-alert-alert-id-snooze
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: The identifier for the rule.
          in: path
          name: rule_id
          required: true
          schema:
            maxLength: 256
            type: string
        - description: The identifier for the alert.
          in: path
          name: alert_id
          required: true
          schema:
            maxLength: 1000
            type: string
        - description: Set to `true` to validate that the specified alert exists. If a `400` error is returned, the specified alert does not exist. Defaults to `true`.
          in: query
          name: validate_alerts_existence
          required: false
          schema:
            type: boolean
      requestBody:
        content:
          application/json:
            schema:
              additionalProperties: false
              type: object
              properties:
                condition_operator:
                  description: Logical operator applied to the conditions array. "any" expires the snooze when at least one condition is met; "all" requires every condition to be met. When conditions are provided but this field is omitted, defaults to "any".
                  enum:
                    - any
                    - all
                  type: string
                conditions:
                  description: 'One or more conditions that, when met, automatically expire the snooze. Supported types: `field_change`, `severity_change`, `severity_equals`.'
                  items:
                    anyOf:
                      - additionalProperties: false
                        description: Expires the snooze when the value of the specified alert field changes.
                        type: object
                        properties:
                          field:
                            description: The alert field to watch, written as a dot-notation path. When the value of the specified alert field changes, the snooze expires
                            maxLength: 1000
                            type: string
                          type:
                            enum:
                              - field_change
                            type: string
                        required:
                          - type
                          - field
                      - additionalProperties: false
                        description: Expires the snooze when the severity of the specified alert changes.
                        type: object
                        properties:
                          type:
                            enum:
                              - severity_change
                            type: string
                        required:
                          - type
                      - additionalProperties: false
                        description: Expires the snooze when the severity of the specified alert equals a target level.
                        type: object
                        properties:
                          type:
                            enum:
                              - severity_equals
                            type: string
                          value:
                            description: 'The target severity level: critical, major, high, medium, minor, low, warning, or info.'
                            enum:
                              - critical
                              - major
                              - high
                              - medium
                              - minor
                              - low
                              - warning
                              - info
                            type: string
                        required:
                          - type
                          - value
                  maxItems: 10
                  type: array
                expires_at:
                  description: The datetime at which the snooze expires, in ISO 8601 format (`YYYY-MM-DDTHH:mm:ss.sssZ`). When omitted, the snooze persists indefinitely unless manually removed or a defined condition is met.
                  maxLength: 30
                  type: string
      responses:
        '204':
          description: Indicates a successful call.
        '400':
          description: Indicates an invalid schema or parameters.
        '403':
          description: Indicates that this call is forbidden.
        '404':
          description: Indicates the specified rule or alert doesn't exist.
      summary: Snooze an alert
      tags:
        - alerting
      x-state: Generally available; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/rule/{rule_id}/alert/{alert_id}/_snooze</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
  /api/alerting/rule/{rule_id}/alert/{alert_id}/_unmute:
    post:
      operationId: post-alerting-rule-rule-id-alert-alert-id-unmute
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: The identifier for the rule.
          in: path
          name: rule_id
          required: true
          schema:
            type: string
        - description: The identifier for the alert.
          in: path
          name: alert_id
          required: true
          schema:
            type: string
      responses:
        '204':
          description: Indicates a successful call.
        '400':
          description: Indicates an invalid schema or parameters.
        '403':
          description: Indicates that this call is forbidden.
        '404':
          description: Indicates a rule or alert with the given ID does not exist.
      summary: Unmute an alert
      tags:
        - alerting
      x-metaTags:
        - content: Kibana
          name: product_name
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/rule/{rule_id}/alert/{alert_id}/_unmute</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
  /api/alerting/rule/{rule_id}/alert/{alert_id}/_unsnooze:
    post:
      operationId: post-alerting-rule-rule-id-alert-alert-id-unsnooze
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: The identifier for the rule.
          in: path
          name: rule_id
          required: true
          schema:
            maxLength: 256
            type: string
        - description: The identifier for the alert.
          in: path
          name: alert_id
          required: true
          schema:
            maxLength: 1000
            type: string
      responses:
        '204':
          description: Indicates a successful call.
        '400':
          description: Indicates an invalid schema or parameters.
        '403':
          description: Indicates that this call is forbidden.
        '404':
          description: Indicates the specified rule or alert doesn't exist.
      summary: Unsnooze an alert
      tags:
        - alerting
      x-state: Generally available; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/rule/{rule_id}/alert/{alert_id}/_unsnooze</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
  /api/alerting/rule/{ruleId}/snooze_schedule/{scheduleId}:
    delete:
      operationId: delete-alerting-rule-ruleid-snooze-schedule-scheduleid
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: The identifier for the rule.
          in: path
          name: ruleId
          required: true
          schema:
            type: string
        - description: The identifier for the snooze schedule.
          in: path
          name: scheduleId
          required: true
          schema:
            type: string
      responses:
        '204':
          description: Indicates a successful call.
        '400':
          description: Indicates an invalid schema.
        '403':
          description: Indicates that this call is forbidden.
        '404':
          description: Indicates a rule with the given id does not exist.
      summary: Delete a snooze schedule for a rule
      tags:
        - alerting
      x-state: Generally available; added in 8.19.0
      x-metaTags:
        - content: Kibana
          name: product_name
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb delete">delete</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/rule/{ruleId}/snooze_schedule/{scheduleId}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
  /api/alerting/rules/_find:
    get:
      operationId: get-alerting-rules-find
      parameters:
        - description: The number of rules to return per page.
          in: query
          name: per_page
          required: false
          schema:
            default: 10
            minimum: 0
            type: number
        - description: The page number to return.
          in: query
          name: page
          required: false
          schema:
            default: 1
            minimum: 1
            type: number
        - description: An Elasticsearch simple_query_string query that filters the objects in the response.
          in: query
          name: search
          required: false
          schema:
            type: string
        - description: The default operator to use for the simple_query_string.
          in: query
          name: default_search_operator
          required: false
          schema:
            default: OR
            enum:
              - OR
              - AND
            type: string
        - description: The fields to perform the simple_query_string parsed query against.
          in: query
          name: search_fields
          required: false
          schema:
            items:
              type: string
            type: array
        - description: Determines which field is used to sort the results. The field must exist in the `attributes` key of the response.
          in: query
          name: sort_field
          required: false
          schema:
            type: string
        - description: Determines the sort order.
          in: query
          name: sort_order
          required: false
          schema:
            enum:
              - asc
              - desc
            type: string
        - description: Filters the rules that have a relation with the reference objects with a specific type and identifier.
          in: query
          name: has_reference
          required: false
          schema:
            additionalProperties: false
            nullable: true
            type: object
            properties:
              id:
                type: string
              type:
                type: string
            required:
              - type
              - id
        - description: The fields to return in the `attributes` key of the response.
          in: query
          name: fields
          required: false
          schema:
            items:
              type: string
            type: array
        - description: 'A KQL string that you filter with an attribute from your saved object. It should look like `savedObjectType.attributes.title: "myTitle"`. However, if you used a direct attribute of a saved object, such as `updatedAt`, you must define your filter, for example, `savedObjectType.updatedAt > 2018-12-22`.'
          in: query
          name: filter
          required: false
          schema:
            type: string
        - description: 'Filters the returned rules by the consumer (Kibana application) that owns them, for example: `siem`, `apm`, `infrastructure`.'
          in: query
          name: filter_consumers
          required: false
          schema:
            items:
              description: List of consumers to filter.
              type: string
            type: array
      responses:
        '200':
          content:
            application/json:
              examples:
                findConditionalActionRulesResponse:
                  description: A response that contains information about an index threshold rule.
                  summary: Index threshold rule
                  value:
                    data:
                      - actions:
                          - frequency:
                              notify_when: onActionGroupChange
                              summary: false
                              throttle: null
                            group: threshold met
                            id: 9dca3e00-74f5-11ed-9801-35303b735aef
                            params:
                              connector_type_id: .server-log
                              level: info
                              message: |-
                                Rule {{rule.name}} is active for group {{context.group}}:

                                - Value: {{context.value}}
                                - Conditions Met: {{context.conditions}} over {{rule.params.timeWindowSize}}{{rule.params.timeWindowUnit}}
                                - Timestamp: {{context.date}}
                            uuid: 1c7a1280-f28c-4e06-96b2-e4e5f05d1d61
                        api_key_created_by_user: false
                        api_key_owner: elastic
                        consumer: alerts
                        created_at: '2022-12-05T23:40:33.132Z'
                        created_by: elastic
                        enabled: true
                        execution_status:
                          last_duration: 48
                          last_execution_date: '2022-12-06T01:44:23.983Z'
                          status: ok
                        id: 3583a470-74f6-11ed-9801-35303b735aef
                        last_run:
                          alerts_count:
                            active: 0
                            ignored: 0
                            new: 0
                            recovered: 0
                          outcome: succeeded
                          outcome_msg: null
                          warning: null
                        mute_all: false
                        muted_alert_ids: []
                        name: my alert
                        next_run: '2022-12-06T01:45:23.912Z'
                        params:
                          aggField: sheet.version
                          aggType: avg
                          groupBy: top
                          index:
                            - test-index
                          termField: name.keyword
                          termSize: 6
                          threshold:
                            - 1000
                          thresholdComparator: '>'
                          timeField: '@timestamp'
                          timeWindowSize: 5
                          timeWindowUnit: m
                        revision: 1
                        rule_type_id: .index-threshold
                        schedule:
                          interval: 1m
                        scheduled_task_id: 3583a470-74f6-11ed-9801-35303b735aef
                        tags:
                          - cpu
                        throttle: null
                        updated_at: '2022-12-05T23:40:33.132Z'
                        updated_by: elastic
                    page: 1
                    per_page: 10
                    total: 1
                findRulesResponse:
                  description: A response that contains information about a security rule that has conditional actions.
                  summary: Security rule
                  value:
                    data:
                      - actions:
                          - alerts_filter:
                              query:
                                filters:
                                  - $state:
                                      store: appState
                                    meta:
                                      alias: null
                                      disabled: false
                                      field: client.geo.region_iso_code
                                      index: c4bdca79-e69e-4d80-82a1-e5192c621bea
                                      key: client.geo.region_iso_code
                                      negate: false
                                      params:
                                        query: CA-QC
                                        type: phrase
                                    query:
                                      match_phrase:
                                        client.geo.region_iso_code: CA-QC
                                kql: ''
                              timeframe:
                                days:
                                  - 7
                                hours:
                                  end: '17:00'
                                  start: '08:00'
                                timezone: UTC
                            connector_type_id: .index
                            frequency:
                              notify_when: onActiveAlert
                              summary: true
                              throttle: null
                            group: default
                            id: 49eae970-f401-11ed-9f8e-399c75a2deeb
                            params:
                              documents:
                                - alert_id:
                                    '[object Object]': null
                                  context_message:
                                    '[object Object]': null
                                  rule_id:
                                    '[object Object]': null
                                  rule_name:
                                    '[object Object]': null
                            uuid: 1c7a1280-f28c-4e06-96b2-e4e5f05d1d61
                        api_key_created_by_user: false
                        api_key_owner: elastic
                        consumer: siem
                        created_at: '2023-05-16T15:50:28.358Z'
                        created_by: elastic
                        enabled: true
                        execution_status:
                          last_duration: 166
                          last_execution_date: '2023-05-16T20:26:49.590Z'
                          status: ok
                        id: 6107a8f0-f401-11ed-9f8e-399c75a2deeb
                        last_run:
                          alerts_count:
                            active: 0
                            ignored: 0
                            new: 0
                            recovered: 0
                          outcome: succeeded
                          outcome_msg:
                            - Rule execution completed successfully
                          outcome_order: 0
                          warning: null
                        mute_all: false
                        muted_alert_ids: []
                        name: security_rule
                        next_run: '2023-05-16T20:27:49.507Z'
                        notify_when: null
                        params:
                          author: []
                          description: A security threshold rule.
                          exceptionsList: []
                          falsePositives: []
                          filters: []
                          from: now-3660s
                          immutable: false
                          index:
                            - kibana_sample_data_logs
                          language: kuery
                          license: ''
                          maxSignals: 100
                          meta:
                            from: 1h
                            kibana_siem_app_url: https://localhost:5601/app/security
                          outputIndex: ''
                          query: '*'
                          references: []
                          riskScore: 21
                          riskScoreMapping: []
                          ruleId: an_internal_rule_id
                          severity: low
                          severityMapping: []
                          threat: []
                          threshold:
                            cardinality: []
                            field:
                              - bytes
                            value: 1
                          to: now
                          type: threshold
                          version: 1
                        revision: 1
                        rule_type_id: siem.thresholdRule
                        running: false
                        schedule:
                          interval: 1m
                        scheduled_task_id: 6107a8f0-f401-11ed-9f8e-399c75a2deeb
                        tags: []
                        throttle: null
                        updated_at: '2023-05-16T20:25:42.559Z'
                        updated_by: elastic
                    page: 1
                    per_page: 10
                    total: 1
              schema:
                additionalProperties: false
                type: object
                properties:
                  data:
                    items:
                      $ref: '#/components/schemas/Kibana_HTTP_APIs_rule_response'
                    type: array
                  page:
                    type: number
                  per_page:
                    type: number
                  total:
                    type: number
                required:
                  - page
                  - per_page
                  - total
                  - data
          description: Indicates a successful call.
        '400':
          description: Indicates an invalid schema or parameters.
        '403':
          description: Indicates that this call is forbidden.
      summary: Get information about rules
      tags:
        - alerting
      x-metaTags:
        - content: Kibana
          name: product_name
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/rules/_find</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
  /api/alerting/rules/backfill/_find:
    post:
      operationId: post-alerting-rules-backfill-find
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: The end date for filtering backfills.
          in: query
          name: end
          required: false
          schema:
            type: string
        - description: The page number to return.
          in: query
          name: page
          required: false
          schema:
            default: 1
            minimum: 1
            type: number
        - description: The number of backfills to return per page.
          in: query
          name: per_page
          required: false
          schema:
            default: 10
            minimum: 0
            type: number
        - description: A comma-separated list of rule identifiers.
          in: query
          name: rule_ids
          required: false
          schema:
            type: string
        - description: The initiator of the backfill, either `user` for manual backfills or `system` for automatic gap fills.
          in: query
          name: initiator
          required: false
          schema:
            enum:
              - user
              - system
            type: string
        - description: The start date for filtering backfills.
          in: query
          name: start
          required: false
          schema:
            type: string
        - description: The field to sort backfills by.
          in: query
          name: sort_field
          required: false
          schema:
            enum:
              - createdAt
              - start
            type: string
        - description: The sort order.
          in: query
          name: sort_order
          required: false
          schema:
            enum:
              - asc
              - desc
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                findBackfillResponse:
                  summary: Find backfills response
                  value:
                    data:
                      - created_at: '2024-01-30T00:00:00.000Z'
                        duration: 12h
                        enabled: true
                        id: 85bdf571-f4fb-4666-a8d2-e05e1220ebc6
                        initiator: user
                        rule:
                          api_key_owner: elastic
                          consumer: alerts
                          created_at: '2022-12-05T23:40:33.132Z'
                          created_by: elastic
                          enabled: true
                          id: 3583a470-74f6-11ed-9801-35303b735aef
                          name: my alert
                          params:
                            aggField: sheet.version
                            aggType: avg
                            groupBy: top
                            index:
                              - test-index
                            termField: name.keyword
                            termSize: 6
                            threshold:
                              - 1000
                            thresholdComparator: '>'
                            timeField: '@timestamp'
                            timeWindowSize: 5
                            timeWindowUnit: m
                          revision: 0
                          rule_type_id: .index-threshold
                          schedule:
                            interval: 1m
                          tags:
                            - cpu
                          updated_at: '2022-12-05T23:40:33.132Z'
                          updated_by: elastic
                        schedule:
                          - interval: 12h
                            run_at: '2024-01-01T12:00:00.000Z'
                            status: pending
                          - interval: 12h
                            run_at: '2024-01-02T00:00:00.000Z'
                            status: pending
                        space_id: default
                        start: '2024-01-01T00:00:00.000Z'
                        status: pending
                    page: 1
                    per_page: 10
                    total: 1
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_find_backfill_response'
          description: Indicates a successful call.
        '400':
          description: Indicates an invalid schema or parameters.
        '403':
          description: Indicates that this call is forbidden.
      summary: Find backfills for rules
      tags:
        - alerting
      x-metaTags:
        - content: Kibana
          name: product_name
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/rules/backfill/_find</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
  /api/alerting/rules/backfill/_schedule:
    post:
      operationId: post-alerting-rules-backfill-schedule
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
      requestBody:
        content:
          application/json:
            examples:
              scheduleBackfillRequest:
                summary: Schedule a backfill for an index threshold rule
                value:
                  - ranges:
                      - end: '2024-01-02T00:00:00.000Z'
                        start: '2024-01-01T00:00:00.000Z'
                    rule_id: 3583a470-74f6-11ed-9801-35303b735aef
            schema:
              items:
                additionalProperties: false
                type: object
                properties:
                  ranges:
                    items:
                      additionalProperties: false
                      type: object
                      properties:
                        end:
                          type: string
                        start:
                          type: string
                      required:
                        - start
                        - end
                    type: array
                  rule_id:
                    type: string
                  run_actions:
                    type: boolean
                required:
                  - rule_id
                  - ranges
              maxItems: 100
              minItems: 1
              type: array
      responses:
        '200':
          content:
            application/json:
              examples:
                scheduleBackfillResponse:
                  summary: Schedule backfill response
                  value:
                    - created_at: '2024-01-30T00:00:00.000Z'
                      duration: 12h
                      enabled: true
                      id: 85bdf571-f4fb-4666-a8d2-e05e1220ebc6
                      initiator: user
                      rule:
                        api_key_owner: elastic
                        consumer: alerts
                        created_at: '2022-12-05T23:40:33.132Z'
                        created_by: elastic
                        enabled: true
                        id: 3583a470-74f6-11ed-9801-35303b735aef
                        name: my alert
                        params:
                          aggField: sheet.version
                          aggType: avg
                          groupBy: top
                          index:
                            - test-index
                          termField: name.keyword
                          termSize: 6
                          threshold:
                            - 1000
                          thresholdComparator: '>'
                          timeField: '@timestamp'
                          timeWindowSize: 5
                          timeWindowUnit: m
                        revision: 0
                        rule_type_id: .index-threshold
                        schedule:
                          interval: 1m
                        tags:
                          - cpu
                        updated_at: '2022-12-05T23:40:33.132Z'
                        updated_by: elastic
                      schedule:
                        - interval: 12h
                          run_at: '2024-01-01T12:00:00.000Z'
                          status: pending
                        - interval: 12h
                          run_at: '2024-01-02T00:00:00.000Z'
                          status: pending
                      space_id: default
                      start: '2024-01-01T00:00:00.000Z'
                      status: pending
              schema:
                items:
                  anyOf:
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_backfill_response'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_backfill_error_response'
                type: array
          description: Indicates a successful call.
        '400':
          description: Indicates an invalid schema or parameters.
        '403':
          description: Indicates that this call is forbidden.
        '404':
          description: Indicates a rule with the given ID does not exist.
      summary: Schedule a backfill for rules
      tags:
        - alerting
      x-metaTags:
        - content: Kibana
          name: product_name
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/rules/backfill/_schedule</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
  /api/alerting/rules/backfill/{id}:
    delete:
      operationId: delete-alerting-rules-backfill-id
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: The identifier for the backfill.
          in: path
          name: id
          required: true
          schema:
            type: string
      responses:
        '204':
          description: Indicates a successful call.
        '400':
          description: Indicates an invalid schema or parameters.
        '403':
          description: Indicates that this call is forbidden.
        '404':
          description: Indicates a backfill with the given ID does not exist.
      summary: Delete a backfill by ID
      tags:
        - alerting
      x-metaTags:
        - content: Kibana
          name: product_name
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb delete">delete</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/rules/backfill/{id}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
    get:
      operationId: get-alerting-rules-backfill-id
      parameters:
        - description: The identifier for the backfill.
          in: path
          name: id
          required: true
          schema:
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                getBackfillResponse:
                  summary: Get a backfill for an index threshold rule
                  value:
                    created_at: '2024-01-30T00:00:00.000Z'
                    duration: 12h
                    enabled: true
                    id: 85bdf571-f4fb-4666-a8d2-e05e1220ebc6
                    initiator: user
                    rule:
                      api_key_owner: elastic
                      consumer: alerts
                      created_at: '2022-12-05T23:40:33.132Z'
                      created_by: elastic
                      enabled: true
                      id: 3583a470-74f6-11ed-9801-35303b735aef
                      name: my alert
                      params:
                        aggField: sheet.version
                        aggType: avg
                        groupBy: top
                        index:
                          - test-index
                        termField: name.keyword
                        termSize: 6
                        threshold:
                          - 1000
                        thresholdComparator: '>'
                        timeField: '@timestamp'
                        timeWindowSize: 5
                        timeWindowUnit: m
                      revision: 0
                      rule_type_id: .index-threshold
                      schedule:
                        interval: 1m
                      tags:
                        - cpu
                      updated_at: '2022-12-05T23:40:33.132Z'
                      updated_by: elastic
                    schedule:
                      - interval: 12h
                        run_at: '2024-01-01T12:00:00.000Z'
                        status: pending
                      - interval: 12h
                        run_at: '2024-01-02T00:00:00.000Z'
                        status: pending
                    space_id: default
                    start: '2024-01-01T00:00:00.000Z'
                    status: pending
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_backfill_response'
          description: Indicates a successful call.
        '400':
          description: Indicates an invalid schema or parameters.
        '403':
          description: Indicates that this call is forbidden.
        '404':
          description: Indicates a backfill with the given ID does not exist.
      summary: Get a backfill by ID
      tags:
        - alerting
      x-metaTags:
        - content: Kibana
          name: product_name
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/rules/backfill/{id}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
  /api/alerting/v2/action_policies:
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/v2/action_policies</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Get a paginated list of action policies with optional filtering and sorting.<br/><br/>[Required authorization] Route required privileges: read_alerting-v2-action-policies.
      operationId: get-alerting-v2-action-policies
      parameters:
        - description: The page number to return. Defaults to 1.
          in: query
          name: page
          required: false
          schema:
            maximum: 10000
            minimum: 1
            type: integer
        - description: The number of action policies to return per page. Defaults to 20.
          in: query
          name: per_page
          required: false
          schema:
            maximum: 100
            minimum: 1
            type: integer
        - description: 'A KQL filter to apply to the action policies. Supported fields: id, name, description, enabled.'
          in: query
          name: filter
          required: false
          schema:
            maxLength: 4096
            type: string
        - description: A text string to search across action policy fields.
          in: query
          name: search
          required: false
          schema:
            maxLength: 256
            minLength: 1
            type: string
        - description: The field to sort action policies by.
          in: query
          name: sort_field
          required: false
          schema:
            enum:
              - name
              - created_at
              - updated_at
            type: string
        - description: The sort direction.
          in: query
          name: sort_order
          required: false
          schema:
            enum:
              - asc
              - desc
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                listActionPoliciesResponse:
                  summary: A page of action policies
                  value:
                    items:
                      - created_at: '2026-01-15T12:00:00.000Z'
                        created_by:
                          profile_uid: u_elastic_0
                        description: Sends notifications for alerts generated by rules with the production tag.
                        destinations:
                          - id: workflow-1
                            type: workflow
                        enabled: true
                        group_by: null
                        grouping_mode: per_alert
                        id: action-policy-1
                        matcher:
                          tags:
                            - production
                        name: Notify on production alerts
                        snoozed_until: null
                        throttle:
                          interval: null
                          strategy: on_status_change
                        updated_at: '2026-01-15T12:00:00.000Z'
                        updated_by:
                          profile_uid: u_elastic_0
                    page: 1
                    per_page: 20
                    total: 1
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_action_policy_list_response'
          description: Returns a paginated list of action policies.
        '400':
          content:
            application/json:
              examples:
                invalidRequest:
                  summary: Indicates an invalid schema or parameters.
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        errors: []
                        properties:
                          page:
                            errors:
                              - 'Too small: expected number to be >=1'
                    error: Bad Request
                    message: 'page: Too small: expected number to be >=1'
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an invalid schema or parameters.
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the request was not authenticated.
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the user does not have the required privileges to perform the request.
        '500':
          content:
            application/json:
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an unexpected server-side error.
        '503':
          content:
            application/json:
              examples:
                alertingDisabled:
                  summary: Alerting V2 is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
      summary: List action policies
      tags:
        - alerting-v2
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/v2/action_policies</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Creates an action policy with a server-generated identifier. To create or replace an action policy with a client-supplied identifier, use PUT /api/alerting/v2/action_policies/{id}/.<br/><br/>[Required authorization] Route required privileges: manage_alerting-v2-action-policies AND read_alerting-v2-rules.
      operationId: post-alerting-v2-action-policies
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
      requestBody:
        content:
          application/json:
            examples:
              createActionPolicyRequest:
                summary: Notification for alerts from rules with the production tag
                value:
                  description: Sends notifications for alerts generated by rules with the production tag.
                  destinations:
                    - id: workflow-1
                      type: workflow
                  grouping_mode: per_alert
                  matcher:
                    tags:
                      - production
                  name: Notify on production alerts
                  throttle:
                    strategy: on_status_change
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_new_action_policy'
      responses:
        '201':
          content:
            application/json:
              examples:
                createActionPolicyResponse:
                  summary: Newly created action policy
                  value:
                    created_at: '2026-01-15T12:00:00.000Z'
                    created_by:
                      profile_uid: u_elastic_0
                    description: Sends notifications for alerts generated by rules with the production tag.
                    destinations:
                      - id: workflow-1
                        type: workflow
                    enabled: true
                    group_by: null
                    grouping_mode: per_alert
                    id: action-policy-1
                    matcher:
                      tags:
                        - production
                    name: Notify on production alerts
                    snoozed_until: null
                    throttle:
                      interval: null
                      strategy: on_status_change
                    updated_at: '2026-01-15T12:00:00.000Z'
                    updated_by:
                      profile_uid: u_elastic_0
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_action_policy_response'
          description: Returns the newly created action policy.
        '400':
          content:
            application/json:
              examples:
                invalidRequest:
                  summary: Indicates an invalid schema or parameters.
                  value:
                    code: INVALID_ACTION_POLICY_DATA
                    details:
                      context: create
                      errors:
                        errors: []
                        properties:
                          name:
                            errors:
                              - 'Invalid input: expected string, received undefined'
                    error: Bad Request
                    message: 'Error validating create action policy data - name: Invalid input: expected string, received undefined'
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an invalid schema or parameters.
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the request was not authenticated.
        '403':
          content:
            application/json:
              examples:
                actionPolicyLicenseNotSupported:
                  summary: The current license does not support action policies
                  value:
                    code: ACTION_POLICY_LICENSE_NOT_SUPPORTED
                    details:
                      current_license: basic
                      license_status: active
                      required_license: enterprise
                    error: Forbidden
                    message: Action policies require an active enterprise license
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the user does not have the required privileges, or the current license does not support action policies. Creating, updating, and enabling action policies requires an active Enterprise license.
        '500':
          content:
            application/json:
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an unexpected server-side error.
        '503':
          content:
            application/json:
              examples:
                alertingDisabled:
                  summary: Alerting V2 is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
      summary: Create an action policy
      tags:
        - alerting-v2
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/alerting/v2/action_policies/_bulk_delete:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/v2/action_policies/_bulk_delete</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        [Required authorization] Route required privileges: manage_alerting-v2-action-policies.
      operationId: post-alerting-v2-action-policies-bulk-delete
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
      requestBody:
        content:
          application/json:
            examples:
              bulkDeleteActionPoliciesRequest:
                summary: Delete two action policies by ID
                value:
                  ids:
                    - action-policy-1
                    - action-policy-2
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_by_ids_request'
      responses:
        '200':
          content:
            application/json:
              examples:
                bulkDeleteActionPoliciesResponse:
                  summary: All targeted policies deleted
                  value:
                    affected_count: 2
                    errors: []
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_operation_response'
          description: Returns the result of the bulk delete operation.
        '400':
          content:
            application/json:
              examples:
                invalidRequest:
                  summary: Indicates an invalid schema or parameters.
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        errors: []
                        properties:
                          ids:
                            errors:
                              - 'Invalid input: expected array, received undefined'
                    error: Bad Request
                    message: 'ids: Invalid input: expected array, received undefined'
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an invalid schema or parameters.
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the request was not authenticated.
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the user does not have the required privileges to perform the request.
        '500':
          content:
            application/json:
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an unexpected server-side error.
        '503':
          content:
            application/json:
              examples:
                alertingDisabled:
                  summary: Alerting V2 is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
      summary: Delete action policies in bulk by ID
      tags:
        - alerting-v2
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/alerting/v2/action_policies/_bulk_disable:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/v2/action_policies/_bulk_disable</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        [Required authorization] Route required privileges: manage_alerting-v2-action-policies.
      operationId: post-alerting-v2-action-policies-bulk-disable
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
      requestBody:
        content:
          application/json:
            examples:
              bulkDisableActionPoliciesRequest:
                summary: Disable two action policies by ID
                value:
                  ids:
                    - action-policy-1
                    - action-policy-2
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_by_ids_request'
      responses:
        '200':
          content:
            application/json:
              examples:
                bulkDisableActionPoliciesResponse:
                  summary: All targeted policies disabled
                  value:
                    affected_count: 2
                    errors: []
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_operation_response'
          description: Returns the result of the bulk disable operation.
        '400':
          content:
            application/json:
              examples:
                invalidRequest:
                  summary: Indicates an invalid schema or parameters.
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        errors: []
                        properties:
                          ids:
                            errors:
                              - 'Invalid input: expected array, received undefined'
                    error: Bad Request
                    message: 'ids: Invalid input: expected array, received undefined'
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an invalid schema or parameters.
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the request was not authenticated.
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the user does not have the required privileges to perform the request.
        '500':
          content:
            application/json:
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an unexpected server-side error.
        '503':
          content:
            application/json:
              examples:
                alertingDisabled:
                  summary: Alerting V2 is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
      summary: Disable action policies in bulk by ID
      tags:
        - alerting-v2
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/alerting/v2/action_policies/_bulk_enable:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/v2/action_policies/_bulk_enable</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        [Required authorization] Route required privileges: manage_alerting-v2-action-policies.
      operationId: post-alerting-v2-action-policies-bulk-enable
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
      requestBody:
        content:
          application/json:
            examples:
              bulkEnableActionPoliciesRequest:
                summary: Enable two action policies by ID
                value:
                  ids:
                    - action-policy-1
                    - action-policy-2
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_by_ids_request'
      responses:
        '200':
          content:
            application/json:
              examples:
                bulkEnableActionPoliciesResponse:
                  summary: All targeted policies enabled
                  value:
                    affected_count: 2
                    errors: []
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_operation_response'
          description: Returns the result of the bulk enable operation.
        '400':
          content:
            application/json:
              examples:
                invalidRequest:
                  summary: Indicates an invalid schema or parameters.
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        errors: []
                        properties:
                          ids:
                            errors:
                              - 'Invalid input: expected array, received undefined'
                    error: Bad Request
                    message: 'ids: Invalid input: expected array, received undefined'
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an invalid schema or parameters.
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the request was not authenticated.
        '403':
          content:
            application/json:
              examples:
                actionPolicyLicenseNotSupported:
                  summary: The current license does not support action policies
                  value:
                    code: ACTION_POLICY_LICENSE_NOT_SUPPORTED
                    details:
                      current_license: basic
                      license_status: active
                      required_license: enterprise
                    error: Forbidden
                    message: Action policies require an active enterprise license
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the user does not have the required privileges, or the current license does not support action policies. Creating, updating, and enabling action policies requires an active Enterprise license.
        '500':
          content:
            application/json:
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an unexpected server-side error.
        '503':
          content:
            application/json:
              examples:
                alertingDisabled:
                  summary: Alerting V2 is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
      summary: Enable action policies in bulk by ID
      tags:
        - alerting-v2
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/alerting/v2/action_policies/_bulk_snooze:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/v2/action_policies/_bulk_snooze</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        [Required authorization] Route required privileges: manage_alerting-v2-action-policies.
      operationId: post-alerting-v2-action-policies-bulk-snooze
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
      requestBody:
        content:
          application/json:
            examples:
              bulkSnoozeActionPoliciesRequest:
                summary: Snooze two action policies until a specific timestamp
                value:
                  ids:
                    - action-policy-1
                    - action-policy-2
                  snoozed_until: '2026-01-16T12:00:00.000Z'
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_snooze_action_policies_request'
      responses:
        '200':
          content:
            application/json:
              examples:
                bulkSnoozeActionPoliciesResponse:
                  summary: All targeted policies snoozed
                  value:
                    affected_count: 2
                    errors: []
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_operation_response'
          description: Returns the result of the bulk snooze operation.
        '400':
          content:
            application/json:
              examples:
                invalidRequest:
                  summary: Indicates an invalid schema or parameters.
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        errors: []
                        properties:
                          snoozed_until:
                            errors:
                              - 'Invalid input: expected string, received undefined'
                    error: Bad Request
                    message: 'snoozed_until: Invalid input: expected string, received undefined'
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an invalid schema or parameters.
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the request was not authenticated.
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the user does not have the required privileges to perform the request.
        '500':
          content:
            application/json:
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an unexpected server-side error.
        '503':
          content:
            application/json:
              examples:
                alertingDisabled:
                  summary: Alerting V2 is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
      summary: Snooze action policies in bulk by ID
      tags:
        - alerting-v2
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/alerting/v2/action_policies/_bulk_unsnooze:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/v2/action_policies/_bulk_unsnooze</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        [Required authorization] Route required privileges: manage_alerting-v2-action-policies.
      operationId: post-alerting-v2-action-policies-bulk-unsnooze
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
      requestBody:
        content:
          application/json:
            examples:
              bulkUnsnoozeActionPoliciesRequest:
                summary: Cancel snooze for two action policies by ID
                value:
                  ids:
                    - action-policy-1
                    - action-policy-2
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_by_ids_request'
      responses:
        '200':
          content:
            application/json:
              examples:
                bulkUnsnoozeActionPoliciesResponse:
                  summary: All targeted policies unsnoozed
                  value:
                    affected_count: 2
                    errors: []
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_operation_response'
          description: Returns the result of the bulk unsnooze operation.
        '400':
          content:
            application/json:
              examples:
                invalidRequest:
                  summary: Indicates an invalid schema or parameters.
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        errors: []
                        properties:
                          ids:
                            errors:
                              - 'Invalid input: expected array, received undefined'
                    error: Bad Request
                    message: 'ids: Invalid input: expected array, received undefined'
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an invalid schema or parameters.
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the request was not authenticated.
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the user does not have the required privileges to perform the request.
        '500':
          content:
            application/json:
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an unexpected server-side error.
        '503':
          content:
            application/json:
              examples:
                alertingDisabled:
                  summary: Alerting V2 is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
      summary: Cancel snooze for action policies in bulk by ID
      tags:
        - alerting-v2
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/alerting/v2/action_policies/_bulk_update_api_key:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/v2/action_policies/_bulk_update_api_key</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        [Required authorization] Route required privileges: manage_alerting-v2-action-policies.
      operationId: post-alerting-v2-action-policies-bulk-update-api-key
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
      requestBody:
        content:
          application/json:
            examples:
              bulkUpdateApiKeyActionPoliciesRequest:
                summary: Rotate API keys for two action policies by ID
                value:
                  ids:
                    - action-policy-1
                    - action-policy-2
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_by_ids_request'
      responses:
        '200':
          content:
            application/json:
              examples:
                bulkUpdateApiKeyActionPoliciesResponse:
                  summary: All targeted policies had their API keys rotated
                  value:
                    affected_count: 2
                    errors: []
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_operation_response'
          description: Returns the result of the bulk API key rotation.
        '400':
          content:
            application/json:
              examples:
                invalidRequest:
                  summary: Indicates an invalid schema or parameters.
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        errors: []
                        properties:
                          ids:
                            errors:
                              - 'Invalid input: expected array, received undefined'
                    error: Bad Request
                    message: 'ids: Invalid input: expected array, received undefined'
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an invalid schema or parameters.
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the request was not authenticated.
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the user does not have the required privileges to perform the request.
        '500':
          content:
            application/json:
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an unexpected server-side error.
        '503':
          content:
            application/json:
              examples:
                alertingDisabled:
                  summary: Alerting V2 is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
      summary: Rotate API keys for action policies in bulk by ID
      tags:
        - alerting-v2
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/alerting/v2/action_policies/{id}:
    delete:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb delete">delete</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/v2/action_policies/{id}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Deletes the action policy whose ID you include in the URL path. Use the `id` returned when you created the policy, or from get or list. This request has no body.<br/><br/>[Required authorization] Route required privileges: manage_alerting-v2-action-policies.
      operationId: delete-alerting-v2-action-policies-id
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: 'The ID of the action policy. Copy it from the response when you create a policy, fetch one policy, or fetch the policy list. Chosen at creation and permanent — it cannot be changed afterwards. Re-using the id of a deleted resource is allowed but discouraged: execution history, change history, and alert episodes recorded under that id are retained and are attributed to the new resource. Ids appear in URLs and logs, so keep them free of sensitive data.'
          in: path
          name: id
          required: true
          schema:
            maxLength: 150
            minLength: 1
            pattern: ^[a-zA-Z0-9_-]+$
            type: string
      responses:
        '204':
          description: The action policy was deleted successfully.
        '400':
          content:
            application/json:
              examples:
                invalidRequest:
                  summary: Indicates an invalid schema or parameters.
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        errors: []
                        properties:
                          page:
                            errors:
                              - 'Too small: expected number to be >=1'
                    error: Bad Request
                    message: 'page: Too small: expected number to be >=1'
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the request failed schema validation.
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the request was not authenticated.
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the user does not have the required privileges to perform the request.
        '404':
          content:
            application/json:
              examples:
                actionPolicyNotFound:
                  summary: Indicates an action policy with the given ID does not exist.
                  value:
                    code: ACTION_POLICY_NOT_FOUND
                    details:
                      action_policy_id: action-policy-1
                    error: Not Found
                    message: Action policy with ID "action-policy-1" not found
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an action policy with the given ID does not exist.
        '500':
          content:
            application/json:
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an unexpected server-side error.
        '503':
          content:
            application/json:
              examples:
                alertingDisabled:
                  summary: Alerting V2 is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
      summary: Delete an action policy
      tags:
        - alerting-v2
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/v2/action_policies/{id}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Get an action policy by identifier.<br/><br/>[Required authorization] Route required privileges: read_alerting-v2-action-policies.
      operationId: get-alerting-v2-action-policies-id
      parameters:
        - description: 'The ID of the action policy. Copy it from the response when you create a policy, fetch one policy, or fetch the policy list. Chosen at creation and permanent — it cannot be changed afterwards. Re-using the id of a deleted resource is allowed but discouraged: execution history, change history, and alert episodes recorded under that id are retained and are attributed to the new resource. Ids appear in URLs and logs, so keep them free of sensitive data.'
          in: path
          name: id
          required: true
          schema:
            maxLength: 150
            minLength: 1
            pattern: ^[a-zA-Z0-9_-]+$
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                getActionPolicyResponse:
                  summary: An action policy
                  value:
                    created_at: '2026-01-15T12:00:00.000Z'
                    created_by:
                      profile_uid: u_elastic_0
                    description: Sends notifications for alerts generated by rules with the production tag.
                    destinations:
                      - id: workflow-1
                        type: workflow
                    enabled: true
                    group_by: null
                    grouping_mode: per_alert
                    id: action-policy-1
                    matcher:
                      tags:
                        - production
                    name: Notify on production alerts
                    snoozed_until: null
                    throttle:
                      interval: null
                      strategy: on_status_change
                    updated_at: '2026-01-15T12:00:00.000Z'
                    updated_by:
                      profile_uid: u_elastic_0
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_action_policy_response'
          description: Returns the requested action policy.
        '400':
          content:
            application/json:
              examples:
                invalidRequest:
                  summary: Indicates an invalid schema or parameters.
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        errors: []
                        properties:
                          page:
                            errors:
                              - 'Too small: expected number to be >=1'
                    error: Bad Request
                    message: 'page: Too small: expected number to be >=1'
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the request failed schema validation.
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the request was not authenticated.
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the user does not have the required privileges to perform the request.
        '404':
          content:
            application/json:
              examples:
                actionPolicyNotFound:
                  summary: Indicates an action policy with the given ID does not exist.
                  value:
                    code: ACTION_POLICY_NOT_FOUND
                    details:
                      action_policy_id: action-policy-1
                    error: Not Found
                    message: Action policy with ID "action-policy-1" not found
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an action policy with the given ID does not exist.
        '500':
          content:
            application/json:
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an unexpected server-side error.
        '503':
          content:
            application/json:
              examples:
                alertingDisabled:
                  summary: Alerting V2 is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
      summary: Get an action policy
      tags:
        - alerting-v2
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
    patch:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb patch">patch</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/v2/action_policies/{id}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Apply a partial update to an existing action policy. Fields not present in the body are left unchanged.<br/><br/>[Required authorization] Route required privileges: manage_alerting-v2-action-policies AND read_alerting-v2-rules.
      operationId: patch-alerting-v2-action-policies-id
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: 'The ID of the action policy. Copy it from the response when you create a policy, fetch one policy, or fetch the policy list. Chosen at creation and permanent — it cannot be changed afterwards. Re-using the id of a deleted resource is allowed but discouraged: execution history, change history, and alert episodes recorded under that id are retained and are attributed to the new resource. Ids appear in URLs and logs, so keep them free of sensitive data.'
          in: path
          name: id
          required: true
          schema:
            maxLength: 150
            minLength: 1
            pattern: ^[a-zA-Z0-9_-]+$
            type: string
      requestBody:
        content:
          application/json:
            examples:
              updateActionPolicyRequest:
                summary: Rename and update the description
                value:
                  description: Updated description.
                  name: Notify on production alerts (updated)
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_update_action_policy'
      responses:
        '200':
          content:
            application/json:
              examples:
                updateActionPolicyResponse:
                  summary: Updated action policy
                  value:
                    created_at: '2026-01-15T12:00:00.000Z'
                    created_by:
                      profile_uid: u_elastic_0
                    description: Updated description.
                    destinations:
                      - id: workflow-1
                        type: workflow
                    enabled: true
                    group_by: null
                    grouping_mode: per_alert
                    id: action-policy-1
                    matcher:
                      tags:
                        - production
                    name: Notify on production alerts (updated)
                    snoozed_until: null
                    throttle:
                      interval: null
                      strategy: on_status_change
                    updated_at: '2026-01-15T12:00:00.000Z'
                    updated_by:
                      profile_uid: u_elastic_0
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_action_policy_response'
          description: Returns the updated action policy.
        '400':
          content:
            application/json:
              examples:
                invalidRequest:
                  summary: Indicates an invalid schema or parameters.
                  value:
                    code: INVALID_ACTION_POLICY_DATA
                    details:
                      context: update
                      errors:
                        errors: []
                        properties:
                          name:
                            errors:
                              - 'Invalid input: expected string, received undefined'
                    error: Bad Request
                    message: 'Error validating update action policy data - name: Invalid input: expected string, received undefined'
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an invalid schema or parameters.
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the request was not authenticated.
        '403':
          content:
            application/json:
              examples:
                actionPolicyLicenseNotSupported:
                  summary: The current license does not support action policies
                  value:
                    code: ACTION_POLICY_LICENSE_NOT_SUPPORTED
                    details:
                      current_license: basic
                      license_status: active
                      required_license: enterprise
                    error: Forbidden
                    message: Action policies require an active enterprise license
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the user does not have the required privileges, or the current license does not support action policies. Creating, updating, and enabling action policies requires an active Enterprise license.
        '404':
          content:
            application/json:
              examples:
                actionPolicyNotFound:
                  summary: Indicates an action policy with the given ID does not exist.
                  value:
                    code: ACTION_POLICY_NOT_FOUND
                    details:
                      action_policy_id: action-policy-1
                    error: Not Found
                    message: Action policy with ID "action-policy-1" not found
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an action policy with the given ID does not exist.
        '409':
          content:
            application/json:
              examples:
                actionPolicyVersionConflict:
                  summary: Indicates the action policy was concurrently updated by another caller.
                  value:
                    code: ACTION_POLICY_VERSION_CONFLICT
                    details:
                      action_policy_id: action-policy-1
                    error: Conflict
                    message: Action policy with ID "action-policy-1" has already been updated by another user
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the action policy was concurrently updated by another caller.
        '500':
          content:
            application/json:
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an unexpected server-side error.
        '503':
          content:
            application/json:
              examples:
                alertingDisabled:
                  summary: Alerting V2 is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
      summary: Partially update an action policy.
      tags:
        - alerting-v2
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
    put:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb put">put</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/v2/action_policies/{id}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Creates an action policy with the given identifier, or fully replaces it if one already exists.<br/><br/>[Required authorization] Route required privileges: manage_alerting-v2-action-policies AND read_alerting-v2-rules.
      operationId: put-alerting-v2-action-policies-id
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: 'The ID of the action policy. Copy it from the response when you create a policy, fetch one policy, or fetch the policy list. Chosen at creation and permanent — it cannot be changed afterwards. Re-using the id of a deleted resource is allowed but discouraged: execution history, change history, and alert episodes recorded under that id are retained and are attributed to the new resource. Ids appear in URLs and logs, so keep them free of sensitive data.'
          in: path
          name: id
          required: true
          schema:
            maxLength: 150
            minLength: 1
            pattern: ^[a-zA-Z0-9_-]+$
            type: string
      requestBody:
        content:
          application/json:
            examples:
              upsertActionPolicyRequest:
                summary: Action policy to create or replace at the given ID
                value:
                  description: Sends notifications for alerts generated by rules with the production tag.
                  destinations:
                    - id: workflow-1
                      type: workflow
                  grouping_mode: per_alert
                  matcher:
                    tags:
                      - production
                  name: Notify on production alerts
                  throttle:
                    strategy: on_status_change
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_put_action_policy'
      responses:
        '200':
          content:
            application/json:
              examples:
                upsertActionPolicyReplacedResponse:
                  summary: Replaced an existing action policy
                  value:
                    created_at: '2026-01-15T12:00:00.000Z'
                    created_by:
                      profile_uid: u_elastic_0
                    description: Sends notifications for alerts generated by rules with the production tag.
                    destinations:
                      - id: workflow-1
                        type: workflow
                    enabled: true
                    group_by: null
                    grouping_mode: per_alert
                    id: action-policy-1
                    matcher:
                      tags:
                        - production
                    name: Notify on production alerts
                    snoozed_until: null
                    throttle:
                      interval: null
                      strategy: on_status_change
                    updated_at: '2026-01-15T12:00:00.000Z'
                    updated_by:
                      profile_uid: u_elastic_0
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_action_policy_response'
          description: Returns the replaced action policy.
        '201':
          content:
            application/json:
              examples:
                upsertActionPolicyCreatedResponse:
                  summary: Created a new action policy
                  value:
                    created_at: '2026-01-15T12:00:00.000Z'
                    created_by:
                      profile_uid: u_elastic_0
                    description: Sends notifications for alerts generated by rules with the production tag.
                    destinations:
                      - id: workflow-1
                        type: workflow
                    enabled: true
                    group_by: null
                    grouping_mode: per_alert
                    id: action-policy-1
                    matcher:
                      tags:
                        - production
                    name: Notify on production alerts
                    snoozed_until: null
                    throttle:
                      interval: null
                      strategy: on_status_change
                    updated_at: '2026-01-15T12:00:00.000Z'
                    updated_by:
                      profile_uid: u_elastic_0
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_action_policy_response'
          description: Returns the newly created action policy.
        '400':
          content:
            application/json:
              examples:
                invalidRequest:
                  summary: Indicates an invalid schema or parameters.
                  value:
                    code: INVALID_ACTION_POLICY_DATA
                    details:
                      context: upsert
                      errors:
                        errors: []
                        properties:
                          name:
                            errors:
                              - 'Invalid input: expected string, received undefined'
                    error: Bad Request
                    message: 'Error validating upsert action policy data - name: Invalid input: expected string, received undefined'
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an invalid schema or parameters.
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the request was not authenticated.
        '403':
          content:
            application/json:
              examples:
                actionPolicyLicenseNotSupported:
                  summary: The current license does not support action policies
                  value:
                    code: ACTION_POLICY_LICENSE_NOT_SUPPORTED
                    details:
                      current_license: basic
                      license_status: active
                      required_license: enterprise
                    error: Forbidden
                    message: Action policies require an active enterprise license
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the user does not have the required privileges, or the current license does not support action policies. Creating, updating, and enabling action policies requires an active Enterprise license.
        '409':
          content:
            application/json:
              examples:
                actionPolicyVersionConflict:
                  summary: Indicates the action policy was concurrently updated by another caller.
                  value:
                    code: ACTION_POLICY_VERSION_CONFLICT
                    details:
                      action_policy_id: action-policy-1
                    error: Conflict
                    message: Action policy with ID "action-policy-1" has already been updated by another user
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the action policy was created or updated concurrently by another caller.
        '500':
          content:
            application/json:
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an unexpected server-side error.
        '503':
          content:
            application/json:
              examples:
                alertingDisabled:
                  summary: Alerting V2 is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
      summary: Create or replace an action policy
      tags:
        - alerting-v2
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/alerting/v2/action_policies/{id}/_disable:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/v2/action_policies/{id}/_disable</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Disable an action policy by identifier.<br/><br/>[Required authorization] Route required privileges: manage_alerting-v2-action-policies.
      operationId: post-alerting-v2-action-policies-id-disable
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: 'The ID of the action policy. Copy it from the response when you create a policy, fetch one policy, or fetch the policy list. Chosen at creation and permanent — it cannot be changed afterwards. Re-using the id of a deleted resource is allowed but discouraged: execution history, change history, and alert episodes recorded under that id are retained and are attributed to the new resource. Ids appear in URLs and logs, so keep them free of sensitive data.'
          in: path
          name: id
          required: true
          schema:
            maxLength: 150
            minLength: 1
            pattern: ^[a-zA-Z0-9_-]+$
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                disableActionPolicyResponse:
                  summary: Disabled action policy
                  value:
                    created_at: '2026-01-15T12:00:00.000Z'
                    created_by:
                      profile_uid: u_elastic_0
                    description: Sends notifications for alerts generated by rules with the production tag.
                    destinations:
                      - id: workflow-1
                        type: workflow
                    enabled: false
                    group_by: null
                    grouping_mode: per_alert
                    id: action-policy-1
                    matcher:
                      tags:
                        - production
                    name: Notify on production alerts
                    snoozed_until: null
                    throttle:
                      interval: null
                      strategy: on_status_change
                    updated_at: '2026-01-15T12:00:00.000Z'
                    updated_by:
                      profile_uid: u_elastic_0
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_action_policy_response'
          description: Returns the disabled action policy.
        '400':
          content:
            application/json:
              examples:
                invalidRequest:
                  summary: Indicates an invalid schema or parameters.
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        errors: []
                        properties:
                          page:
                            errors:
                              - 'Too small: expected number to be >=1'
                    error: Bad Request
                    message: 'page: Too small: expected number to be >=1'
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an invalid schema or parameters.
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the request was not authenticated.
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the user does not have the required privileges to perform the request.
        '404':
          content:
            application/json:
              examples:
                actionPolicyNotFound:
                  summary: Indicates an action policy with the given ID does not exist.
                  value:
                    code: ACTION_POLICY_NOT_FOUND
                    details:
                      action_policy_id: action-policy-1
                    error: Not Found
                    message: Action policy with ID "action-policy-1" not found
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an action policy with the given ID does not exist.
        '409':
          content:
            application/json:
              examples:
                actionPolicyVersionConflict:
                  summary: Indicates the action policy was concurrently updated by another caller.
                  value:
                    code: ACTION_POLICY_VERSION_CONFLICT
                    details:
                      action_policy_id: action-policy-1
                    error: Conflict
                    message: Action policy with ID "action-policy-1" has already been updated by another user
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the action policy was concurrently updated by another caller.
        '500':
          content:
            application/json:
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an unexpected server-side error.
        '503':
          content:
            application/json:
              examples:
                alertingDisabled:
                  summary: Alerting V2 is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
      summary: Disable an action policy
      tags:
        - alerting-v2
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/alerting/v2/action_policies/{id}/_enable:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/v2/action_policies/{id}/_enable</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Enable an action policy by identifier.<br/><br/>[Required authorization] Route required privileges: manage_alerting-v2-action-policies.
      operationId: post-alerting-v2-action-policies-id-enable
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: 'The ID of the action policy. Copy it from the response when you create a policy, fetch one policy, or fetch the policy list. Chosen at creation and permanent — it cannot be changed afterwards. Re-using the id of a deleted resource is allowed but discouraged: execution history, change history, and alert episodes recorded under that id are retained and are attributed to the new resource. Ids appear in URLs and logs, so keep them free of sensitive data.'
          in: path
          name: id
          required: true
          schema:
            maxLength: 150
            minLength: 1
            pattern: ^[a-zA-Z0-9_-]+$
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                enableActionPolicyResponse:
                  summary: Enabled action policy
                  value:
                    created_at: '2026-01-15T12:00:00.000Z'
                    created_by:
                      profile_uid: u_elastic_0
                    description: Sends notifications for alerts generated by rules with the production tag.
                    destinations:
                      - id: workflow-1
                        type: workflow
                    enabled: true
                    group_by: null
                    grouping_mode: per_alert
                    id: action-policy-1
                    matcher:
                      tags:
                        - production
                    name: Notify on production alerts
                    snoozed_until: null
                    throttle:
                      interval: null
                      strategy: on_status_change
                    updated_at: '2026-01-15T12:00:00.000Z'
                    updated_by:
                      profile_uid: u_elastic_0
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_action_policy_response'
          description: Returns the enabled action policy.
        '400':
          content:
            application/json:
              examples:
                invalidRequest:
                  summary: Indicates an invalid schema or parameters.
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        errors: []
                        properties:
                          page:
                            errors:
                              - 'Too small: expected number to be >=1'
                    error: Bad Request
                    message: 'page: Too small: expected number to be >=1'
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an invalid schema or parameters.
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the request was not authenticated.
        '403':
          content:
            application/json:
              examples:
                actionPolicyLicenseNotSupported:
                  summary: The current license does not support action policies
                  value:
                    code: ACTION_POLICY_LICENSE_NOT_SUPPORTED
                    details:
                      current_license: basic
                      license_status: active
                      required_license: enterprise
                    error: Forbidden
                    message: Action policies require an active enterprise license
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the user does not have the required privileges, or the current license does not support action policies. Creating, updating, and enabling action policies requires an active Enterprise license.
        '404':
          content:
            application/json:
              examples:
                actionPolicyNotFound:
                  summary: Indicates an action policy with the given ID does not exist.
                  value:
                    code: ACTION_POLICY_NOT_FOUND
                    details:
                      action_policy_id: action-policy-1
                    error: Not Found
                    message: Action policy with ID "action-policy-1" not found
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an action policy with the given ID does not exist.
        '409':
          content:
            application/json:
              examples:
                actionPolicyVersionConflict:
                  summary: Indicates the action policy was concurrently updated by another caller.
                  value:
                    code: ACTION_POLICY_VERSION_CONFLICT
                    details:
                      action_policy_id: action-policy-1
                    error: Conflict
                    message: Action policy with ID "action-policy-1" has already been updated by another user
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the action policy was concurrently updated by another caller.
        '500':
          content:
            application/json:
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an unexpected server-side error.
        '503':
          content:
            application/json:
              examples:
                alertingDisabled:
                  summary: Alerting V2 is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
      summary: Enable an action policy
      tags:
        - alerting-v2
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/alerting/v2/action_policies/{id}/_snooze:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/v2/action_policies/{id}/_snooze</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Snooze an action policy until a specified time.<br/><br/>[Required authorization] Route required privileges: manage_alerting-v2-action-policies.
      operationId: post-alerting-v2-action-policies-id-snooze
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: 'The ID of the action policy. Copy it from the response when you create a policy, fetch one policy, or fetch the policy list. Chosen at creation and permanent — it cannot be changed afterwards. Re-using the id of a deleted resource is allowed but discouraged: execution history, change history, and alert episodes recorded under that id are retained and are attributed to the new resource. Ids appear in URLs and logs, so keep them free of sensitive data.'
          in: path
          name: id
          required: true
          schema:
            maxLength: 150
            minLength: 1
            pattern: ^[a-zA-Z0-9_-]+$
            type: string
      requestBody:
        content:
          application/json:
            examples:
              snoozeActionPolicyRequest:
                summary: Snooze until a specific timestamp
                value:
                  snoozed_until: '2026-01-16T12:00:00.000Z'
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_snooze_action_policy_request'
      responses:
        '200':
          content:
            application/json:
              examples:
                snoozeActionPolicyResponse:
                  summary: Snoozed action policy
                  value:
                    created_at: '2026-01-15T12:00:00.000Z'
                    created_by:
                      profile_uid: u_elastic_0
                    description: Sends notifications for alerts generated by rules with the production tag.
                    destinations:
                      - id: workflow-1
                        type: workflow
                    enabled: true
                    group_by: null
                    grouping_mode: per_alert
                    id: action-policy-1
                    matcher:
                      tags:
                        - production
                    name: Notify on production alerts
                    snoozed_until: '2026-01-16T12:00:00.000Z'
                    throttle:
                      interval: null
                      strategy: on_status_change
                    updated_at: '2026-01-15T12:00:00.000Z'
                    updated_by:
                      profile_uid: u_elastic_0
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_action_policy_response'
          description: Returns the snoozed action policy.
        '400':
          content:
            application/json:
              examples:
                invalidRequest:
                  summary: Indicates an invalid schema or parameters.
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        errors: []
                        properties:
                          snoozed_until:
                            errors:
                              - 'Invalid input: expected string, received undefined'
                    error: Bad Request
                    message: 'snoozed_until: Invalid input: expected string, received undefined'
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an invalid schema or parameters.
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the request was not authenticated.
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the user does not have the required privileges to perform the request.
        '404':
          content:
            application/json:
              examples:
                actionPolicyNotFound:
                  summary: Indicates an action policy with the given ID does not exist.
                  value:
                    code: ACTION_POLICY_NOT_FOUND
                    details:
                      action_policy_id: action-policy-1
                    error: Not Found
                    message: Action policy with ID "action-policy-1" not found
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an action policy with the given ID does not exist.
        '409':
          content:
            application/json:
              examples:
                actionPolicyVersionConflict:
                  summary: Indicates the action policy was concurrently updated by another caller.
                  value:
                    code: ACTION_POLICY_VERSION_CONFLICT
                    details:
                      action_policy_id: action-policy-1
                    error: Conflict
                    message: Action policy with ID "action-policy-1" has already been updated by another user
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the action policy was concurrently updated by another caller.
        '500':
          content:
            application/json:
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an unexpected server-side error.
        '503':
          content:
            application/json:
              examples:
                alertingDisabled:
                  summary: Alerting V2 is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
      summary: Snooze an action policy
      tags:
        - alerting-v2
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/alerting/v2/action_policies/{id}/_unsnooze:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/v2/action_policies/{id}/_unsnooze</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Remove the snooze from an action policy.<br/><br/>[Required authorization] Route required privileges: manage_alerting-v2-action-policies.
      operationId: post-alerting-v2-action-policies-id-unsnooze
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: 'The ID of the action policy. Copy it from the response when you create a policy, fetch one policy, or fetch the policy list. Chosen at creation and permanent — it cannot be changed afterwards. Re-using the id of a deleted resource is allowed but discouraged: execution history, change history, and alert episodes recorded under that id are retained and are attributed to the new resource. Ids appear in URLs and logs, so keep them free of sensitive data.'
          in: path
          name: id
          required: true
          schema:
            maxLength: 150
            minLength: 1
            pattern: ^[a-zA-Z0-9_-]+$
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                unsnoozeActionPolicyResponse:
                  summary: Unsnoozed action policy
                  value:
                    created_at: '2026-01-15T12:00:00.000Z'
                    created_by:
                      profile_uid: u_elastic_0
                    description: Sends notifications for alerts generated by rules with the production tag.
                    destinations:
                      - id: workflow-1
                        type: workflow
                    enabled: true
                    group_by: null
                    grouping_mode: per_alert
                    id: action-policy-1
                    matcher:
                      tags:
                        - production
                    name: Notify on production alerts
                    snoozed_until: null
                    throttle:
                      interval: null
                      strategy: on_status_change
                    updated_at: '2026-01-15T12:00:00.000Z'
                    updated_by:
                      profile_uid: u_elastic_0
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_action_policy_response'
          description: Returns the unsnoozed action policy.
        '400':
          content:
            application/json:
              examples:
                invalidRequest:
                  summary: Indicates an invalid schema or parameters.
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        errors: []
                        properties:
                          page:
                            errors:
                              - 'Too small: expected number to be >=1'
                    error: Bad Request
                    message: 'page: Too small: expected number to be >=1'
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an invalid schema or parameters.
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the request was not authenticated.
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the user does not have the required privileges to perform the request.
        '404':
          content:
            application/json:
              examples:
                actionPolicyNotFound:
                  summary: Indicates an action policy with the given ID does not exist.
                  value:
                    code: ACTION_POLICY_NOT_FOUND
                    details:
                      action_policy_id: action-policy-1
                    error: Not Found
                    message: Action policy with ID "action-policy-1" not found
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an action policy with the given ID does not exist.
        '409':
          content:
            application/json:
              examples:
                actionPolicyVersionConflict:
                  summary: Indicates the action policy was concurrently updated by another caller.
                  value:
                    code: ACTION_POLICY_VERSION_CONFLICT
                    details:
                      action_policy_id: action-policy-1
                    error: Conflict
                    message: Action policy with ID "action-policy-1" has already been updated by another user
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the action policy was concurrently updated by another caller.
        '500':
          content:
            application/json:
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an unexpected server-side error.
        '503':
          content:
            application/json:
              examples:
                alertingDisabled:
                  summary: Alerting V2 is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
      summary: Unsnooze an action policy
      tags:
        - alerting-v2
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/alerting/v2/action_policies/{id}/_update_api_key:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/v2/action_policies/{id}/_update_api_key</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Rotate the API key for an action policy.<br/><br/>[Required authorization] Route required privileges: manage_alerting-v2-action-policies.
      operationId: post-alerting-v2-action-policies-id-update-api-key
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: 'The ID of the action policy. Copy it from the response when you create a policy, fetch one policy, or fetch the policy list. Chosen at creation and permanent — it cannot be changed afterwards. Re-using the id of a deleted resource is allowed but discouraged: execution history, change history, and alert episodes recorded under that id are retained and are attributed to the new resource. Ids appear in URLs and logs, so keep them free of sensitive data.'
          in: path
          name: id
          required: true
          schema:
            maxLength: 150
            minLength: 1
            pattern: ^[a-zA-Z0-9_-]+$
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                updateActionPolicyApiKeyResponse:
                  summary: Action policy whose API key was rotated
                  value:
                    created_at: '2026-01-15T12:00:00.000Z'
                    created_by:
                      profile_uid: u_elastic_0
                    description: Sends notifications for alerts generated by rules with the production tag.
                    destinations:
                      - id: workflow-1
                        type: workflow
                    enabled: true
                    group_by: null
                    grouping_mode: per_alert
                    id: action-policy-1
                    matcher:
                      tags:
                        - production
                    name: Notify on production alerts
                    snoozed_until: null
                    throttle:
                      interval: null
                      strategy: on_status_change
                    updated_at: '2026-01-15T12:00:00.000Z'
                    updated_by:
                      profile_uid: u_elastic_0
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_action_policy_response'
          description: Returns the action policy whose API key was rotated.
        '400':
          content:
            application/json:
              examples:
                invalidRequest:
                  summary: Indicates an invalid schema or parameters.
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        errors: []
                        properties:
                          page:
                            errors:
                              - 'Too small: expected number to be >=1'
                    error: Bad Request
                    message: 'page: Too small: expected number to be >=1'
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an invalid schema or parameters.
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the request was not authenticated.
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the user does not have the required privileges to perform the request.
        '404':
          content:
            application/json:
              examples:
                actionPolicyNotFound:
                  summary: Indicates an action policy with the given ID does not exist.
                  value:
                    code: ACTION_POLICY_NOT_FOUND
                    details:
                      action_policy_id: action-policy-1
                    error: Not Found
                    message: Action policy with ID "action-policy-1" not found
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an action policy with the given ID does not exist.
        '409':
          content:
            application/json:
              examples:
                actionPolicyVersionConflict:
                  summary: Indicates the action policy was concurrently updated by another caller.
                  value:
                    code: ACTION_POLICY_VERSION_CONFLICT
                    details:
                      action_policy_id: action-policy-1
                    error: Conflict
                    message: Action policy with ID "action-policy-1" has already been updated by another user
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the action policy was concurrently updated by another caller.
        '500':
          content:
            application/json:
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an unexpected server-side error.
        '503':
          content:
            application/json:
              examples:
                alertingDisabled:
                  summary: Alerting V2 is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
      summary: Update an action policy API key
      tags:
        - alerting-v2
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/alerting/v2/alerts/_bulk_ack:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/v2/alerts/_bulk_ack</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Create the same action for multiple alert episodes in a single request.<br/><br/>[Required authorization] Route required privileges: manage_alerting-v2-alerts.
      operationId: post-alerting-v2-alerts-bulk-ack
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
      requestBody:
        content:
          application/json:
            examples:
              bulkAckEpisodeActionRequest:
                summary: Acknowledge two alert episodes
                value:
                  items:
                    - alert_id: episode-1
                    - alert_id: episode-2
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_ack_alerts_request'
      responses:
        '200':
          content:
            application/json:
              examples:
                bulkAckEpisodeActionResponse:
                  summary: One action created, one episode not found
                  value:
                    affected_count: 1
                    errors:
                      - error:
                          code: ALERT_NOT_FOUND
                          message: Alert with alert_id [episode-2] not found
                        id: episode-2
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_operation_response'
          description: Returns the number of created actions and per-item errors for actions that were not created.
        '400':
          content:
            application/json:
              examples:
                invalidRequest:
                  summary: Items list is empty
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        items:
                          - At least one action must be provided
                    error: Bad Request
                    message: 'items: At least one action must be provided'
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an invalid schema or parameters.
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the request was not authenticated.
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the user does not have the required privileges to perform the request.
        '500':
          content:
            application/json:
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an unexpected server-side error.
        '503':
          content:
            application/json:
              examples:
                alertingDisabled:
                  summary: Alerting V2 is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
      summary: Bulk acknowledge alert episodes
      tags:
        - alerting-v2
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/alerting/v2/alerts/_bulk_activate:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/v2/alerts/_bulk_activate</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Create the same action for multiple alert episodes in a single request.<br/><br/>[Required authorization] Route required privileges: manage_alerting-v2-alerts.
      operationId: post-alerting-v2-alerts-bulk-activate
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
      requestBody:
        content:
          application/json:
            examples:
              bulkActivateEpisodeActionRequest:
                summary: Reopen an alert episode with a reason
                value:
                  items:
                    - alert_id: episode-1
                      reason: manual reopen
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_activate_alerts_request'
      responses:
        '200':
          content:
            application/json:
              examples:
                bulkActivateEpisodeActionResponse:
                  summary: All actions created
                  value:
                    affected_count: 1
                    errors: []
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_operation_response'
          description: Returns the number of created actions and per-item errors for actions that were not created.
        '400':
          content:
            application/json:
              examples:
                invalidRequest:
                  summary: Items list is empty
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        items:
                          - At least one action must be provided
                    error: Bad Request
                    message: 'items: At least one action must be provided'
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an invalid schema or parameters.
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the request was not authenticated.
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the user does not have the required privileges to perform the request.
        '500':
          content:
            application/json:
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an unexpected server-side error.
        '503':
          content:
            application/json:
              examples:
                alertingDisabled:
                  summary: Alerting V2 is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
      summary: Bulk activate alert episodes
      tags:
        - alerting-v2
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/alerting/v2/alerts/_bulk_assign:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/v2/alerts/_bulk_assign</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Create the same action for multiple alert episodes in a single request.<br/><br/>[Required authorization] Route required privileges: manage_alerting-v2-alerts.
      operationId: post-alerting-v2-alerts-bulk-assign
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
      requestBody:
        content:
          application/json:
            examples:
              bulkAssignEpisodeActionRequest:
                summary: Assign one episode and clear the assignee of another
                value:
                  items:
                    - alert_id: episode-1
                      assignee_uid: u_abc123
                    - alert_id: episode-2
                      assignee_uid: null
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_assign_alerts_request'
      responses:
        '200':
          content:
            application/json:
              examples:
                bulkAssignEpisodeActionResponse:
                  summary: All actions created
                  value:
                    affected_count: 2
                    errors: []
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_operation_response'
          description: Returns the number of created actions and per-item errors for actions that were not created.
        '400':
          content:
            application/json:
              examples:
                invalidRequest:
                  summary: Items list is empty
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        items:
                          - At least one action must be provided
                    error: Bad Request
                    message: 'items: At least one action must be provided'
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an invalid schema or parameters.
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the request was not authenticated.
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the user does not have the required privileges to perform the request.
        '500':
          content:
            application/json:
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an unexpected server-side error.
        '503':
          content:
            application/json:
              examples:
                alertingDisabled:
                  summary: Alerting V2 is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
      summary: Bulk assign alert episodes
      tags:
        - alerting-v2
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/alerting/v2/alerts/_bulk_deactivate:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/v2/alerts/_bulk_deactivate</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Create the same action for multiple alert episodes in a single request.<br/><br/>[Required authorization] Route required privileges: manage_alerting-v2-alerts.
      operationId: post-alerting-v2-alerts-bulk-deactivate
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
      requestBody:
        content:
          application/json:
            examples:
              bulkDeactivateEpisodeActionRequest:
                summary: Close an alert episode with a reason
                value:
                  items:
                    - alert_id: episode-1
                      reason: false positive
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_deactivate_alerts_request'
      responses:
        '200':
          content:
            application/json:
              examples:
                bulkDeactivateEpisodeActionResponse:
                  summary: All actions created
                  value:
                    affected_count: 1
                    errors: []
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_operation_response'
          description: Returns the number of created actions and per-item errors for actions that were not created.
        '400':
          content:
            application/json:
              examples:
                invalidRequest:
                  summary: Items list is empty
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        items:
                          - At least one action must be provided
                    error: Bad Request
                    message: 'items: At least one action must be provided'
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an invalid schema or parameters.
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the request was not authenticated.
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the user does not have the required privileges to perform the request.
        '500':
          content:
            application/json:
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an unexpected server-side error.
        '503':
          content:
            application/json:
              examples:
                alertingDisabled:
                  summary: Alerting V2 is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
      summary: Bulk deactivate alert episodes
      tags:
        - alerting-v2
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/alerting/v2/alerts/_bulk_tag:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/v2/alerts/_bulk_tag</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Create the same action for multiple alert episodes in a single request.<br/><br/>[Required authorization] Route required privileges: manage_alerting-v2-alerts.
      operationId: post-alerting-v2-alerts-bulk-tag
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
      requestBody:
        content:
          application/json:
            examples:
              bulkTagEpisodeActionRequest:
                summary: Tag two alert episodes with production
                value:
                  items:
                    - alert_id: episode-1
                      tags:
                        - production
                    - alert_id: episode-2
                      tags:
                        - production
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_tag_alerts_request'
      responses:
        '200':
          content:
            application/json:
              examples:
                bulkTagEpisodeActionResponse:
                  summary: All actions created
                  value:
                    affected_count: 2
                    errors: []
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_operation_response'
          description: Returns the number of created actions and per-item errors for actions that were not created.
        '400':
          content:
            application/json:
              examples:
                invalidRequest:
                  summary: Items list is empty
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        items:
                          - At least one action must be provided
                    error: Bad Request
                    message: 'items: At least one action must be provided'
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an invalid schema or parameters.
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the request was not authenticated.
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the user does not have the required privileges to perform the request.
        '500':
          content:
            application/json:
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an unexpected server-side error.
        '503':
          content:
            application/json:
              examples:
                alertingDisabled:
                  summary: Alerting V2 is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
      summary: Bulk tag alert episodes
      tags:
        - alerting-v2
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/alerting/v2/alerts/_bulk_unack:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/v2/alerts/_bulk_unack</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Create the same action for multiple alert episodes in a single request.<br/><br/>[Required authorization] Route required privileges: manage_alerting-v2-alerts.
      operationId: post-alerting-v2-alerts-bulk-unack
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
      requestBody:
        content:
          application/json:
            examples:
              bulkUnackEpisodeActionRequest:
                summary: Unacknowledge two alert episodes
                value:
                  items:
                    - alert_id: episode-1
                    - alert_id: episode-2
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_unack_alerts_request'
      responses:
        '200':
          content:
            application/json:
              examples:
                bulkUnackEpisodeActionResponse:
                  summary: All actions created
                  value:
                    affected_count: 2
                    errors: []
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_operation_response'
          description: Returns the number of created actions and per-item errors for actions that were not created.
        '400':
          content:
            application/json:
              examples:
                invalidRequest:
                  summary: Items list is empty
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        items:
                          - At least one action must be provided
                    error: Bad Request
                    message: 'items: At least one action must be provided'
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an invalid schema or parameters.
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the request was not authenticated.
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the user does not have the required privileges to perform the request.
        '500':
          content:
            application/json:
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an unexpected server-side error.
        '503':
          content:
            application/json:
              examples:
                alertingDisabled:
                  summary: Alerting V2 is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
      summary: Bulk unacknowledge alert episodes
      tags:
        - alerting-v2
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/alerting/v2/alerts/{id}/_ack:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/v2/alerts/{id}/_ack</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Create an action for a specific alert episode.<br/><br/>[Required authorization] Route required privileges: manage_alerting-v2-alerts.
      operationId: post-alerting-v2-alerts-id-ack
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: Identifier of the alert to apply the action to.
          in: path
          name: id
          required: true
          schema:
            maxLength: 150
            minLength: 1
            type: string
      requestBody:
        content:
          application/json:
            examples:
              createAckEpisodeActionRequest:
                summary: Acknowledge the alert episode
                value: {}
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_new_ack_alert_action'
      responses:
        '204':
          description: Indicates the action was created.
        '400':
          content:
            application/json:
              examples:
                invalidRequest:
                  summary: Path is missing required id
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        id:
                          - Required
                    error: Bad Request
                    message: 'id: Required'
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an invalid schema or parameters.
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the request was not authenticated.
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the user does not have the required privileges to perform the request.
        '404':
          content:
            application/json:
              examples:
                alertEpisodeNotFound:
                  summary: No alert exists for the given alert_id
                  value:
                    code: ALERT_NOT_FOUND
                    details:
                      alert_id: episode-1
                    error: Not Found
                    message: Alert with alert_id [episode-1] not found
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the alert episode was not found.
        '500':
          content:
            application/json:
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an unexpected server-side error.
        '503':
          content:
            application/json:
              examples:
                alertingDisabled:
                  summary: Alerting V2 is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
      summary: Acknowledge an alert episode
      tags:
        - alerting-v2
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/alerting/v2/alerts/{id}/_activate:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/v2/alerts/{id}/_activate</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Create an action for a specific alert episode.<br/><br/>[Required authorization] Route required privileges: manage_alerting-v2-alerts.
      operationId: post-alerting-v2-alerts-id-activate
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: Identifier of the alert to apply the action to.
          in: path
          name: id
          required: true
          schema:
            maxLength: 150
            minLength: 1
            type: string
      requestBody:
        content:
          application/json:
            examples:
              createActivateEpisodeActionRequest:
                summary: Activate with a reason
                value:
                  reason: Issue reappeared after silence window.
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_new_activate_alert_action'
      responses:
        '204':
          description: Indicates the action was created.
        '400':
          content:
            application/json:
              examples:
                invalidRequest:
                  summary: Path is missing required id
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        id:
                          - Required
                    error: Bad Request
                    message: 'id: Required'
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an invalid schema or parameters.
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the request was not authenticated.
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the user does not have the required privileges to perform the request.
        '404':
          content:
            application/json:
              examples:
                alertEpisodeNotFound:
                  summary: No alert exists for the given alert_id
                  value:
                    code: ALERT_NOT_FOUND
                    details:
                      alert_id: episode-1
                    error: Not Found
                    message: Alert with alert_id [episode-1] not found
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the alert episode was not found.
        '409':
          content:
            application/json:
              examples:
                alertEpisodeNotLatest:
                  summary: The alert has been superseded by a newer alert of its series
                  value:
                    code: ALERT_NOT_LATEST
                    details:
                      alert_id: episode-1
                      group_hash: 98058cb569017ecb6b08b554ecbcb2524ff7dd8971828f4f2e5939c1e6667e56
                    error: Conflict
                    message: Alert [episode-1] is not the latest alert for group [98058cb569017ecb6b08b554ecbcb2524ff7dd8971828f4f2e5939c1e6667e56]
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the alert episode has been superseded by a newer episode of its series, or is already in the requested state.
        '500':
          content:
            application/json:
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an unexpected server-side error.
        '503':
          content:
            application/json:
              examples:
                alertingDisabled:
                  summary: Alerting V2 is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
      summary: Activate an alert episode
      tags:
        - alerting-v2
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/alerting/v2/alerts/{id}/_assign:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/v2/alerts/{id}/_assign</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Create an action for a specific alert episode.<br/><br/>[Required authorization] Route required privileges: manage_alerting-v2-alerts.
      operationId: post-alerting-v2-alerts-id-assign
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: Identifier of the alert to apply the action to.
          in: path
          name: id
          required: true
          schema:
            maxLength: 150
            minLength: 1
            type: string
      requestBody:
        content:
          application/json:
            examples:
              createAssignEpisodeActionRequest:
                summary: Assign the alert episode to user u_abc123
                value:
                  assignee_uid: u_abc123
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_new_assign_alert_action'
      responses:
        '204':
          description: Indicates the action was created.
        '400':
          content:
            application/json:
              examples:
                invalidRequest:
                  summary: Path is missing required id
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        id:
                          - Required
                    error: Bad Request
                    message: 'id: Required'
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an invalid schema or parameters.
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the request was not authenticated.
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the user does not have the required privileges to perform the request.
        '404':
          content:
            application/json:
              examples:
                alertEpisodeNotFound:
                  summary: No alert exists for the given alert_id
                  value:
                    code: ALERT_NOT_FOUND
                    details:
                      alert_id: episode-1
                    error: Not Found
                    message: Alert with alert_id [episode-1] not found
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the alert episode was not found.
        '500':
          content:
            application/json:
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an unexpected server-side error.
        '503':
          content:
            application/json:
              examples:
                alertingDisabled:
                  summary: Alerting V2 is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
      summary: Assign an alert episode to a user
      tags:
        - alerting-v2
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/alerting/v2/alerts/{id}/_deactivate:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/v2/alerts/{id}/_deactivate</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Create an action for a specific alert episode.<br/><br/>[Required authorization] Route required privileges: manage_alerting-v2-alerts.
      operationId: post-alerting-v2-alerts-id-deactivate
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: Identifier of the alert to apply the action to.
          in: path
          name: id
          required: true
          schema:
            maxLength: 150
            minLength: 1
            type: string
      requestBody:
        content:
          application/json:
            examples:
              createDeactivateEpisodeActionRequest:
                summary: Deactivate as a false positive
                value:
                  reason: False positive confirmed by on-call.
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_new_deactivate_alert_action'
      responses:
        '204':
          description: Indicates the action was created.
        '400':
          content:
            application/json:
              examples:
                invalidRequest:
                  summary: Path is missing required id
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        id:
                          - Required
                    error: Bad Request
                    message: 'id: Required'
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an invalid schema or parameters.
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the request was not authenticated.
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the user does not have the required privileges to perform the request.
        '404':
          content:
            application/json:
              examples:
                alertEpisodeNotFound:
                  summary: No alert exists for the given alert_id
                  value:
                    code: ALERT_NOT_FOUND
                    details:
                      alert_id: episode-1
                    error: Not Found
                    message: Alert with alert_id [episode-1] not found
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the alert episode was not found.
        '409':
          content:
            application/json:
              examples:
                alertEpisodeNotLatest:
                  summary: The alert has been superseded by a newer alert of its series
                  value:
                    code: ALERT_NOT_LATEST
                    details:
                      alert_id: episode-1
                      group_hash: 98058cb569017ecb6b08b554ecbcb2524ff7dd8971828f4f2e5939c1e6667e56
                    error: Conflict
                    message: Alert [episode-1] is not the latest alert for group [98058cb569017ecb6b08b554ecbcb2524ff7dd8971828f4f2e5939c1e6667e56]
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the alert episode has been superseded by a newer episode of its series, or is already in the requested state.
        '500':
          content:
            application/json:
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an unexpected server-side error.
        '503':
          content:
            application/json:
              examples:
                alertingDisabled:
                  summary: Alerting V2 is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
      summary: Deactivate an alert episode
      tags:
        - alerting-v2
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/alerting/v2/alerts/{id}/_tag:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/v2/alerts/{id}/_tag</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Create an action for a specific alert episode.<br/><br/>[Required authorization] Route required privileges: manage_alerting-v2-alerts.
      operationId: post-alerting-v2-alerts-id-tag
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: Identifier of the alert to apply the action to.
          in: path
          name: id
          required: true
          schema:
            maxLength: 150
            minLength: 1
            type: string
      requestBody:
        content:
          application/json:
            examples:
              createTagEpisodeActionRequest:
                summary: Tag the alert episode with production and investigating
                value:
                  tags:
                    - production
                    - investigating
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_new_tag_alert_action'
      responses:
        '204':
          description: Indicates the action was created.
        '400':
          content:
            application/json:
              examples:
                invalidRequest:
                  summary: Path is missing required id
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        id:
                          - Required
                    error: Bad Request
                    message: 'id: Required'
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an invalid schema or parameters.
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the request was not authenticated.
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the user does not have the required privileges to perform the request.
        '404':
          content:
            application/json:
              examples:
                alertEpisodeNotFound:
                  summary: No alert exists for the given alert_id
                  value:
                    code: ALERT_NOT_FOUND
                    details:
                      alert_id: episode-1
                    error: Not Found
                    message: Alert with alert_id [episode-1] not found
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the alert episode was not found.
        '500':
          content:
            application/json:
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an unexpected server-side error.
        '503':
          content:
            application/json:
              examples:
                alertingDisabled:
                  summary: Alerting V2 is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
      summary: Tag an alert episode
      tags:
        - alerting-v2
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/alerting/v2/alerts/{id}/_unack:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/v2/alerts/{id}/_unack</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Create an action for a specific alert episode.<br/><br/>[Required authorization] Route required privileges: manage_alerting-v2-alerts.
      operationId: post-alerting-v2-alerts-id-unack
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: Identifier of the alert to apply the action to.
          in: path
          name: id
          required: true
          schema:
            maxLength: 150
            minLength: 1
            type: string
      requestBody:
        content:
          application/json:
            examples:
              createUnackEpisodeActionRequest:
                summary: Unacknowledge the alert episode
                value: {}
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_new_unack_alert_action'
      responses:
        '204':
          description: Indicates the action was created.
        '400':
          content:
            application/json:
              examples:
                invalidRequest:
                  summary: Path is missing required id
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        id:
                          - Required
                    error: Bad Request
                    message: 'id: Required'
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an invalid schema or parameters.
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the request was not authenticated.
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the user does not have the required privileges to perform the request.
        '404':
          content:
            application/json:
              examples:
                alertEpisodeNotFound:
                  summary: No alert exists for the given alert_id
                  value:
                    code: ALERT_NOT_FOUND
                    details:
                      alert_id: episode-1
                    error: Not Found
                    message: Alert with alert_id [episode-1] not found
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the alert episode was not found.
        '500':
          content:
            application/json:
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an unexpected server-side error.
        '503':
          content:
            application/json:
              examples:
                alertingDisabled:
                  summary: Alerting V2 is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
      summary: Unacknowledge an alert episode
      tags:
        - alerting-v2
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/alerting/v2/execution_history/action_policies:
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/v2/execution_history/action_policies</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Get a paginated list of dispatcher summary events for action policies in the current space.<br/><br/>[Required authorization] Route required privileges: read_alerting-v2-execution-history.
      operationId: get-alerting-v2-execution-history-action-policies
      parameters:
        - description: Page number (1-indexed). Defaults to 1.
          in: query
          name: page
          required: true
          schema:
            default: 1
            maximum: 10000
            minimum: 1
            type: integer
        - description: Number of events per page. Defaults to 20.
          in: query
          name: per_page
          required: true
          schema:
            default: 20
            maximum: 100
            minimum: 1
            type: integer
        - description: Inclusive ISO datetime lower bound on the event timestamp; overrides the default 24-hour window. Independent of alert_ids — e.g. set it to an alert’s start time to scope results to that alert’s lifetime.
          in: query
          name: from
          required: false
          schema:
            format: date-time
            pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
            type: string
        - description: Inclusive ISO datetime upper bound on the event timestamp.
          in: query
          name: to
          required: false
          schema:
            format: date-time
            pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
            type: string
        - description: Alert filter. Narrows events to those referencing at least one of the provided alert IDs.
          in: query
          name: alert_ids
          required: false
          schema:
            items:
              maxLength: 150
              minLength: 1
              type: string
            maxItems: 50
            minItems: 1
            type: array
        - description: Sort field. Defaults to "dispatched_at".
          in: query
          name: sort_field
          required: true
          schema:
            default: dispatched_at
            enum:
              - dispatched_at
            type: string
        - description: Sort direction. Defaults to "desc".
          in: query
          name: sort_order
          required: true
          schema:
            default: desc
            enum:
              - asc
              - desc
            type: string
        - description: Free-text search. Matches policy name, rule name, policy/rule ID (case-insensitive).
          in: query
          name: search
          required: false
          schema:
            maxLength: 256
            minLength: 1
            type: string
        - description: Explicit rule filter. Narrows events to those referencing at least one of the provided rule IDs. Also unions with the search filter if both are provided.
          in: query
          name: rule_ids
          required: false
          schema:
            items:
              maxLength: 150
              minLength: 1
              type: string
            maxItems: 50
            minItems: 1
            type: array
        - description: Outcome filter. When omitted matches all outcomes. Pass one or more of "success", "throttled", "failure" to narrow.
          in: query
          name: outcomes
          required: false
          schema:
            items:
              enum:
                - success
                - throttled
                - failure
              type: string
            maxItems: 3
            minItems: 1
            type: array
      responses:
        '200':
          content:
            application/json:
              examples:
                listActionPolicyExecutionsResponse:
                  summary: A page of action policy execution events
                  value:
                    items:
                      - action_group_count: 1
                        alert_count: 1
                        alerts:
                          - id: episode-1
                        dispatched_at: '2026-01-15T12:05:00.000Z'
                        error: null
                        outcome: success
                        policy:
                          id: action-policy-1
                          name: Notify on production alerts
                        rule_count: 1
                        rules:
                          - id: rule-1
                            name: Host CPU high
                        workflows:
                          - id: workflow-1
                            name: Notify oncall
                    page: 1
                    per_page: 20
                    search_matches: null
                    total: 1
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_policy_execution_history_response'
          description: Returns a paginated list of execution history events.
        '400':
          content:
            application/json:
              examples:
                invalidRequest:
                  summary: Exceeds the max result window
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        page:
                          - page * per_page cannot exceed 10000.
                    error: Bad Request
                    message: page * per_page cannot exceed 10000.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an invalid schema or parameters.
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the request was not authenticated.
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the user does not have the required privileges to perform the request.
        '500':
          content:
            application/json:
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an unexpected server-side error.
        '503':
          content:
            application/json:
              examples:
                alertingDisabled:
                  summary: Alerting V2 is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
      summary: List action policy executions
      tags:
        - alerting-v2
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/alerting/v2/execution_history/rules:
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/v2/execution_history/rules</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Get a paginated list of rule execution events.<br/><br/>[Required authorization] Route required privileges: read_alerting-v2-execution-history.
      operationId: get-alerting-v2-execution-history-rules
      parameters:
        - description: 'Rule id filter. '
          in: query
          name: rule_ids
          required: false
          schema:
            items:
              maxLength: 150
              minLength: 1
              type: string
            maxItems: 50
            minItems: 1
            type: array
        - description: 'Outcome filter. '
          in: query
          name: outcomes
          required: false
          schema:
            items:
              enum:
                - success
                - failure
              type: string
            maxItems: 2
            minItems: 1
            type: array
        - description: Inclusive ISO datetime lower bound on event.start.
          in: query
          name: from
          required: false
          schema:
            format: date-time
            pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
            type: string
        - description: Inclusive ISO datetime upper bound on event.start.
          in: query
          name: to
          required: false
          schema:
            format: date-time
            pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
            type: string
        - description: Sort field. Defaults to started_at.
          in: query
          name: sort_field
          required: true
          schema:
            default: started_at
            enum:
              - started_at
              - duration_ms
            type: string
        - description: Sort direction.
          in: query
          name: sort_order
          required: true
          schema:
            default: desc
            enum:
              - asc
              - desc
            type: string
        - description: Page number.
          in: query
          name: page
          required: true
          schema:
            default: 1
            maximum: 10000
            minimum: 1
            type: integer
        - description: Number of results per page.
          in: query
          name: per_page
          required: true
          schema:
            default: 20
            maximum: 100
            minimum: 1
            type: integer
      responses:
        '200':
          content:
            application/json:
              examples:
                listRuleExecutionsResponse:
                  summary: One successful rule execution
                  value:
                    items:
                      - ended_at: '2026-01-15T12:00:01.250Z'
                        error: null
                        id: execution-1
                        outcome: success
                        reason: null
                        rule:
                          id: rule-1
                          version: 3
                        space_id: default
                        started_at: '2026-01-15T12:00:00.000Z'
                        timings:
                          duration_ms: 1250
                          scheduled_delay_ms: 40
                    page: 1
                    per_page: 20
                    total: 1
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_rule_executions_response'
          description: Returns a paginated list of rule execution events.
        '400':
          content:
            application/json:
              examples:
                invalidRequest:
                  summary: Exceeds the max result window
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        page:
                          - page * per_page cannot exceed 10000.
                    error: Bad Request
                    message: page * per_page cannot exceed 10000.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an invalid schema or parameters.
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the request was not authenticated.
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the user does not have the required privileges to perform the request.
        '500':
          content:
            application/json:
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an unexpected server-side error.
        '503':
          content:
            application/json:
              examples:
                alertingDisabled:
                  summary: Alerting V2 is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
      summary: List rule executions
      tags:
        - alerting-v2
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/alerting/v2/rules:
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/v2/rules</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        [Required authorization] Route required privileges: read_alerting-v2-rules.
      operationId: get-alerting-v2-rules
      parameters:
        - description: The page number to return. Defaults to 1. `page * per_page` cannot exceed 10000.
          in: query
          name: page
          required: false
          schema:
            maximum: 10000
            minimum: 1
            type: integer
        - description: The number of rules to return per page. Defaults to 20.
          in: query
          name: per_page
          required: false
          schema:
            maximum: 100
            minimum: 1
            type: integer
        - description: The filter to apply to the rules.
          in: query
          name: filter
          required: false
          schema:
            maxLength: 4096
            type: string
        - description: The field to sort rules by.
          in: query
          name: sort_field
          required: false
          schema:
            enum:
              - kind
              - enabled
              - name
            type: string
        - description: The direction to sort rules.
          in: query
          name: sort_order
          required: false
          schema:
            enum:
              - asc
              - desc
            type: string
        - description: A text string to search across rule fields.
          in: query
          name: search
          required: false
          schema:
            maxLength: 256
            minLength: 1
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                listRulesResponse:
                  summary: Paginated list containing one matching rule
                  value:
                    items:
                      - created_at: '2026-01-15T12:00:00.000Z'
                        created_by:
                          profile_uid: u_elastic_0
                        enabled: true
                        grouping:
                          fields:
                            - host.name
                        id: rule-1
                        kind: alert
                        metadata:
                          description: Alerts when average CPU usage exceeds a threshold.
                          name: Host CPU high
                          routing_tags:
                            - sre-oncall
                          tags:
                            - production
                            - infra
                        no_data:
                          strategy: keep_last
                        query:
                          base: FROM metrics-* | STATS avg_cpu = AVG(host.cpu.usage) BY host.name
                          breach:
                            segment: WHERE avg_cpu > 0.9
                        recovery:
                          strategy: no_breach
                        schedule:
                          every: 1m
                          lookback: 5m
                        state_transition:
                          pending:
                            count: 1
                          recovering:
                            count: 1
                        time_field: '@timestamp'
                        updated_at: '2026-01-15T12:00:00.000Z'
                        updated_by:
                          profile_uid: u_elastic_0
                        version: 1
                    page: 1
                    per_page: 20
                    total: 1
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_rule_list_response'
          description: Returns a paginated list of rules.
        '400':
          content:
            application/json:
              examples:
                invalidRequest:
                  summary: Indicates an invalid schema or parameters.
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        errors: []
                        properties:
                          page:
                            errors:
                              - 'Too small: expected number to be >=1'
                    error: Bad Request
                    message: 'page: Too small: expected number to be >=1'
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an invalid schema or parameters.
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the request was not authenticated.
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the user does not have the required privileges to perform the request.
        '500':
          content:
            application/json:
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an unexpected server-side error.
        '503':
          content:
            application/json:
              examples:
                alertingDisabled:
                  summary: Alerting V2 is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
      summary: List rules
      tags:
        - alerting-v2
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/v2/rules</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Creates a rule with a server-generated identifier. To create or replace a rule with a client-supplied identifier, use PUT /api/alerting/v2/rules/{id}/.<br/><br/>[Required authorization] Route required privileges: manage_alerting-v2-rules.
      operationId: post-alerting-v2-rules
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
      requestBody:
        content:
          application/json:
            examples:
              createRuleRequest:
                summary: Create a host CPU threshold rule
                value:
                  grouping:
                    fields:
                      - host.name
                  kind: alert
                  metadata:
                    description: Alerts when average CPU usage exceeds a threshold.
                    name: Host CPU high
                    routing_tags:
                      - sre-oncall
                    tags:
                      - production
                      - infra
                  no_data:
                    strategy: keep_last
                  query:
                    base: FROM metrics-* | STATS avg_cpu = AVG(host.cpu.usage) BY host.name
                    breach:
                      segment: WHERE avg_cpu > 0.9
                  recovery:
                    strategy: no_breach
                  schedule:
                    every: 1m
                    lookback: 5m
                  state_transition:
                    pending:
                      count: 1
                    recovering:
                      count: 1
                  time_field: '@timestamp'
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_new_rule'
      responses:
        '201':
          content:
            application/json:
              examples:
                createRuleResponse:
                  summary: Created host CPU threshold rule
                  value:
                    created_at: '2026-01-15T12:00:00.000Z'
                    created_by:
                      profile_uid: u_elastic_0
                    enabled: true
                    grouping:
                      fields:
                        - host.name
                    id: rule-1
                    kind: alert
                    metadata:
                      description: Alerts when average CPU usage exceeds a threshold.
                      name: Host CPU high
                      routing_tags:
                        - sre-oncall
                      tags:
                        - production
                        - infra
                    no_data:
                      strategy: keep_last
                    query:
                      base: FROM metrics-* | STATS avg_cpu = AVG(host.cpu.usage) BY host.name
                      breach:
                        segment: WHERE avg_cpu > 0.9
                    recovery:
                      strategy: no_breach
                    schedule:
                      every: 1m
                      lookback: 5m
                    state_transition:
                      pending:
                        count: 1
                      recovering:
                        count: 1
                    time_field: '@timestamp'
                    updated_at: '2026-01-15T12:00:00.000Z'
                    updated_by:
                      profile_uid: u_elastic_0
                    version: 1
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_rule_response'
          description: Returns the newly created rule.
        '400':
          content:
            application/json:
              examples:
                invalidRequest:
                  summary: Missing required rule metadata
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        metadata:
                          - Required
                    error: Bad Request
                    message: 'metadata: Required'
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an invalid schema or parameters.
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the request was not authenticated.
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the user does not have the required privileges to perform the request.
        '500':
          content:
            application/json:
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an unexpected server-side error.
        '503':
          content:
            application/json:
              examples:
                alertingDisabled:
                  summary: Alerting V2 is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
      summary: Create a rule
      tags:
        - alerting-v2
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/alerting/v2/rules/_bulk_create:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/v2/rules/_bulk_create</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Creates up to 100 rules in a single request. Each item can include a client-supplied `id`. Kibana generates an identifier when `id` is omitted. The request succeeds with HTTP 200 even when some rules fail. Created rules are returned in `items`. Failures are returned in `errors`. Check `errors` before treating the request as fully successful. To create a single rule, use POST /api/alerting/v2/rules.<br/><br/>[Required authorization] Route required privileges: manage_alerting-v2-rules.
      operationId: post-alerting-v2-rules-bulk-create
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
      requestBody:
        content:
          application/json:
            examples:
              bulkCreateRulesRequest:
                summary: Create two rules, one of them disabled
                value:
                  items:
                    - grouping:
                        fields:
                          - host.name
                      kind: alert
                      metadata:
                        description: Alerts when average CPU usage exceeds a threshold.
                        name: Host CPU high
                        routing_tags:
                          - sre-oncall
                        tags:
                          - production
                          - infra
                      no_data:
                        strategy: keep_last
                      query:
                        base: FROM metrics-* | STATS avg_cpu = AVG(host.cpu.usage) BY host.name
                        breach:
                          segment: WHERE avg_cpu > 0.9
                      recovery:
                        strategy: no_breach
                      schedule:
                        every: 1m
                        lookback: 5m
                      state_transition:
                        pending:
                          count: 1
                        recovering:
                          count: 1
                      time_field: '@timestamp'
                    - enabled: false
                      grouping:
                        fields:
                          - host.name
                      id: rule-disabled
                      kind: alert
                      metadata:
                        description: Alerts when average CPU usage exceeds a threshold.
                        name: Host CPU high (disabled)
                        routing_tags:
                          - sre-oncall
                        tags:
                          - production
                          - infra
                      no_data:
                        strategy: keep_last
                      query:
                        base: FROM metrics-* | STATS avg_cpu = AVG(host.cpu.usage) BY host.name
                        breach:
                          segment: WHERE avg_cpu > 0.9
                      recovery:
                        strategy: no_breach
                      schedule:
                        every: 1m
                        lookback: 5m
                      state_transition:
                        pending:
                          count: 1
                        recovering:
                          count: 1
                      time_field: '@timestamp'
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_create_rules_request'
      responses:
        '200':
          content:
            application/json:
              examples:
                bulkCreateRulesResponse:
                  summary: Created both requested rules
                  value:
                    errors: []
                    items:
                      - created_at: '2026-01-15T12:00:00.000Z'
                        created_by:
                          profile_uid: u_elastic_0
                        enabled: true
                        grouping:
                          fields:
                            - host.name
                        id: rule-1
                        kind: alert
                        metadata:
                          description: Alerts when average CPU usage exceeds a threshold.
                          name: Host CPU high
                          routing_tags:
                            - sre-oncall
                          tags:
                            - production
                            - infra
                        no_data:
                          strategy: keep_last
                        query:
                          base: FROM metrics-* | STATS avg_cpu = AVG(host.cpu.usage) BY host.name
                          breach:
                            segment: WHERE avg_cpu > 0.9
                        recovery:
                          strategy: no_breach
                        schedule:
                          every: 1m
                          lookback: 5m
                        state_transition:
                          pending:
                            count: 1
                          recovering:
                            count: 1
                        time_field: '@timestamp'
                        updated_at: '2026-01-15T12:00:00.000Z'
                        updated_by:
                          profile_uid: u_elastic_0
                        version: 1
                      - created_at: '2026-01-15T12:00:00.000Z'
                        created_by:
                          profile_uid: u_elastic_0
                        enabled: false
                        grouping:
                          fields:
                            - host.name
                        id: rule-disabled
                        kind: alert
                        metadata:
                          description: Alerts when average CPU usage exceeds a threshold.
                          name: Host CPU high (disabled)
                          routing_tags:
                            - sre-oncall
                          tags:
                            - production
                            - infra
                        no_data:
                          strategy: keep_last
                        query:
                          base: FROM metrics-* | STATS avg_cpu = AVG(host.cpu.usage) BY host.name
                          breach:
                            segment: WHERE avg_cpu > 0.9
                        recovery:
                          strategy: no_breach
                        schedule:
                          every: 1m
                          lookback: 5m
                        state_transition:
                          pending:
                            count: 1
                          recovering:
                            count: 1
                        time_field: '@timestamp'
                        updated_at: '2026-01-15T12:00:00.000Z'
                        updated_by:
                          profile_uid: u_elastic_0
                        version: 1
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_create_rules_response'
          description: Created rules are returned in `items`. Failures are returned in `errors`.
        '400':
          content:
            application/json:
              examples:
                invalidRequest:
                  summary: Request body is missing required items
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        items:
                          - Required
                    error: Bad Request
                    message: 'items: Required'
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an invalid schema or parameters.
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the request was not authenticated.
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the user does not have the required privileges to perform the request.
        '500':
          content:
            application/json:
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an unexpected server-side error.
        '503':
          content:
            application/json:
              examples:
                alertingDisabled:
                  summary: Alerting V2 is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
      summary: Create rules in bulk
      tags:
        - alerting-v2
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/alerting/v2/rules/_bulk_delete:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/v2/rules/_bulk_delete</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        [Required authorization] Route required privileges: manage_alerting-v2-rules.
      operationId: post-alerting-v2-rules-bulk-delete
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
      requestBody:
        content:
          application/json:
            examples:
              bulkDeleteRulesRequest:
                summary: Delete two rules by ID
                value:
                  ids:
                    - rule-1
                    - rule-2
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_by_ids_request'
      responses:
        '200':
          content:
            application/json:
              examples:
                bulkDeleteRulesResponse:
                  summary: Deleted both requested rules
                  value:
                    affected_count: 2
                    errors: []
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_operation_response'
          description: Returns the result of the bulk delete operation.
        '400':
          content:
            application/json:
              examples:
                invalidRequest:
                  summary: Request body is missing required rule ids
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        ids:
                          - Required
                    error: Bad Request
                    message: 'ids: Required'
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an invalid schema or parameters.
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the request was not authenticated.
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the user does not have the required privileges to perform the request.
        '500':
          content:
            application/json:
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an unexpected server-side error.
        '503':
          content:
            application/json:
              examples:
                alertingDisabled:
                  summary: Alerting V2 is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
      summary: Delete rules in bulk by ID
      tags:
        - alerting-v2
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/alerting/v2/rules/_bulk_disable:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/v2/rules/_bulk_disable</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        [Required authorization] Route required privileges: manage_alerting-v2-rules.
      operationId: post-alerting-v2-rules-bulk-disable
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
      requestBody:
        content:
          application/json:
            examples:
              bulkDisableRulesRequest:
                summary: Disable two rules by ID
                value:
                  ids:
                    - rule-1
                    - rule-2
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_by_ids_request'
      responses:
        '200':
          content:
            application/json:
              examples:
                bulkDisableRulesResponse:
                  summary: Disabled both requested rules
                  value:
                    affected_count: 2
                    errors: []
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_operation_response'
          description: Returns the result of the bulk disable operation.
        '400':
          content:
            application/json:
              examples:
                invalidRequest:
                  summary: Request body is missing required rule ids
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        ids:
                          - Required
                    error: Bad Request
                    message: 'ids: Required'
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an invalid schema or parameters.
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the request was not authenticated.
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the user does not have the required privileges to perform the request.
        '500':
          content:
            application/json:
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an unexpected server-side error.
        '503':
          content:
            application/json:
              examples:
                alertingDisabled:
                  summary: Alerting V2 is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
      summary: Disable rules in bulk by ID
      tags:
        - alerting-v2
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/alerting/v2/rules/_bulk_enable:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/v2/rules/_bulk_enable</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        [Required authorization] Route required privileges: manage_alerting-v2-rules.
      operationId: post-alerting-v2-rules-bulk-enable
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
      requestBody:
        content:
          application/json:
            examples:
              bulkEnableRulesRequest:
                summary: Enable two rules by ID
                value:
                  ids:
                    - rule-1
                    - rule-2
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_by_ids_request'
      responses:
        '200':
          content:
            application/json:
              examples:
                bulkEnableRulesResponse:
                  summary: Enabled both requested rules
                  value:
                    affected_count: 2
                    errors: []
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_operation_response'
          description: Returns the result of the bulk enable operation.
        '400':
          content:
            application/json:
              examples:
                invalidRequest:
                  summary: Request body is missing required rule ids
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        ids:
                          - Required
                    error: Bad Request
                    message: 'ids: Required'
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an invalid schema or parameters.
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the request was not authenticated.
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the user does not have the required privileges to perform the request.
        '500':
          content:
            application/json:
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an unexpected server-side error.
        '503':
          content:
            application/json:
              examples:
                alertingDisabled:
                  summary: Alerting V2 is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
      summary: Enable rules in bulk by ID
      tags:
        - alerting-v2
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/alerting/v2/rules/_bulk_get:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/v2/rules/_bulk_get</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        [Required authorization] Route required privileges: read_alerting-v2-rules.
      operationId: post-alerting-v2-rules-bulk-get
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
      requestBody:
        content:
          application/json:
            examples:
              bulkGetRulesRequest:
                summary: Fetch two rules by ID
                value:
                  ids:
                    - rule-1
                    - rule-2
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_by_ids_request'
      responses:
        '200':
          content:
            application/json:
              examples:
                bulkGetRulesResponse:
                  summary: Returned the requested rules
                  value:
                    items:
                      - created_at: '2026-01-15T12:00:00.000Z'
                        created_by:
                          profile_uid: u_elastic_0
                        enabled: true
                        grouping:
                          fields:
                            - host.name
                        id: rule-1
                        kind: alert
                        metadata:
                          description: Alerts when average CPU usage exceeds a threshold.
                          name: Host CPU high
                          routing_tags:
                            - sre-oncall
                          tags:
                            - production
                            - infra
                        no_data:
                          strategy: keep_last
                        query:
                          base: FROM metrics-* | STATS avg_cpu = AVG(host.cpu.usage) BY host.name
                          breach:
                            segment: WHERE avg_cpu > 0.9
                        recovery:
                          strategy: no_breach
                        schedule:
                          every: 1m
                          lookback: 5m
                        state_transition:
                          pending:
                            count: 1
                          recovering:
                            count: 1
                        time_field: '@timestamp'
                        updated_at: '2026-01-15T12:00:00.000Z'
                        updated_by:
                          profile_uid: u_elastic_0
                        version: 1
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_get_rules_response'
          description: Returns the requested rules.
        '400':
          content:
            application/json:
              examples:
                invalidRequest:
                  summary: Request body is missing required rule ids
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        ids:
                          - Required
                    error: Bad Request
                    message: 'ids: Required'
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an invalid schema or parameters.
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the request was not authenticated.
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the user does not have the required privileges to perform the request.
        '404':
          content:
            application/json:
              examples:
                rulesNotFound:
                  summary: One or more requested rule ids could not be found
                  value:
                    code: NOT_FOUND
                    error: Not Found
                    message: Saved object [alerting_rule/rule-1] not found
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: One or more rule ids could not be found.
        '500':
          content:
            application/json:
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an unexpected server-side error.
        '503':
          content:
            application/json:
              examples:
                alertingDisabled:
                  summary: Alerting V2 is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
      summary: Get rules in bulk
      tags:
        - alerting-v2
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/alerting/v2/rules/_bulk_update_api_key:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/v2/rules/_bulk_update_api_key</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Rotates each rule executor task API key to one derived from the current user’s credentials.<br/><br/>[Required authorization] Route required privileges: manage_alerting-v2-rules.
      operationId: post-alerting-v2-rules-bulk-update-api-key
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
      requestBody:
        content:
          application/json:
            examples:
              bulkUpdateApiKeyRequest:
                summary: Rotate API keys for two rules by ID
                value:
                  ids:
                    - rule-1
                    - rule-2
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_by_ids_request'
      responses:
        '200':
          content:
            application/json:
              examples:
                bulkUpdateApiKeyResponse:
                  summary: Rotated API keys for both requested rules
                  value:
                    affected_count: 2
                    errors: []
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_operation_response'
          description: Returns the result of the bulk update API key operation.
        '400':
          content:
            application/json:
              examples:
                invalidRequest:
                  summary: Request body is missing required rule ids
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        ids:
                          - Required
                    error: Bad Request
                    message: 'ids: Required'
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an invalid schema or parameters.
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the request was not authenticated.
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the user does not have the required privileges to perform the request.
        '500':
          content:
            application/json:
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an unexpected server-side error.
        '503':
          content:
            application/json:
              examples:
                alertingDisabled:
                  summary: Alerting V2 is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
      summary: Update the API key of rules in bulk by ID
      tags:
        - alerting-v2
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/alerting/v2/rules/_delete_by_query:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/v2/rules/_delete_by_query</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        [Required authorization] Route required privileges: manage_alerting-v2-rules.
      operationId: post-alerting-v2-rules-delete-by-query
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
      requestBody:
        content:
          application/json:
            examples:
              deleteRulesByQueryRequest:
                summary: 'Delete rules tagged production (dry-run by default, or set `force: true` to execute)'
                value:
                  filter: 'tags: production'
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_by_query_request'
      responses:
        '200':
          content:
            application/json:
              examples:
                deleteRulesByQueryDryRunResponse:
                  summary: 'Dry-run preview of matching rules; set `force: true` on the request to execute'
                  value:
                    match_count: 2
                    sample:
                      - rule-1
                      - rule-2
              schema:
                anyOf:
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_dry_run_response'
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_operation_response'
          description: Returns a dry-run preview by default, or the executed operation when `force` is true.
        '400':
          content:
            application/json:
              examples:
                invalidRequest:
                  summary: By-query body omits filter, search, and match_all
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        '':
                          - At least one of filter, search, or match_all must be provided.
                    error: Bad Request
                    message: At least one of filter, search, or match_all must be provided.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an invalid schema or parameters.
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the request was not authenticated.
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the user does not have the required privileges to perform the request.
        '500':
          content:
            application/json:
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an unexpected server-side error.
        '503':
          content:
            application/json:
              examples:
                alertingDisabled:
                  summary: Alerting V2 is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
      summary: Delete rules matching a query (dry-run by default)
      tags:
        - alerting-v2
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/alerting/v2/rules/_disable_by_query:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/v2/rules/_disable_by_query</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        [Required authorization] Route required privileges: manage_alerting-v2-rules.
      operationId: post-alerting-v2-rules-disable-by-query
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
      requestBody:
        content:
          application/json:
            examples:
              disableRulesByQueryRequest:
                summary: 'Disable rules tagged production (dry-run by default, or set `force: true` to execute)'
                value:
                  filter: 'tags: production'
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_by_query_request'
      responses:
        '200':
          content:
            application/json:
              examples:
                disableRulesByQueryDryRunResponse:
                  summary: 'Dry-run preview of matching rules; set `force: true` on the request to execute'
                  value:
                    match_count: 2
                    sample:
                      - rule-1
                      - rule-2
              schema:
                anyOf:
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_dry_run_response'
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_operation_response'
          description: Returns a dry-run preview by default, or the executed operation when `force` is true.
        '400':
          content:
            application/json:
              examples:
                invalidRequest:
                  summary: By-query body omits filter, search, and match_all
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        '':
                          - At least one of filter, search, or match_all must be provided.
                    error: Bad Request
                    message: At least one of filter, search, or match_all must be provided.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an invalid schema or parameters.
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the request was not authenticated.
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the user does not have the required privileges to perform the request.
        '500':
          content:
            application/json:
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an unexpected server-side error.
        '503':
          content:
            application/json:
              examples:
                alertingDisabled:
                  summary: Alerting V2 is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
      summary: Disable rules matching a query (dry-run by default)
      tags:
        - alerting-v2
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/alerting/v2/rules/_enable_by_query:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/v2/rules/_enable_by_query</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        [Required authorization] Route required privileges: manage_alerting-v2-rules.
      operationId: post-alerting-v2-rules-enable-by-query
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
      requestBody:
        content:
          application/json:
            examples:
              enableRulesByQueryRequest:
                summary: 'Enable rules tagged production (dry-run by default, or set `force: true` to execute)'
                value:
                  filter: 'tags: production'
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_by_query_request'
      responses:
        '200':
          content:
            application/json:
              examples:
                enableRulesByQueryDryRunResponse:
                  summary: 'Dry-run preview of matching rules; set `force: true` on the request to execute'
                  value:
                    match_count: 2
                    sample:
                      - rule-1
                      - rule-2
              schema:
                anyOf:
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_dry_run_response'
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_operation_response'
          description: Returns a dry-run preview by default, or the executed operation when `force` is true.
        '400':
          content:
            application/json:
              examples:
                invalidRequest:
                  summary: By-query body omits filter, search, and match_all
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        '':
                          - At least one of filter, search, or match_all must be provided.
                    error: Bad Request
                    message: At least one of filter, search, or match_all must be provided.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an invalid schema or parameters.
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the request was not authenticated.
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the user does not have the required privileges to perform the request.
        '500':
          content:
            application/json:
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an unexpected server-side error.
        '503':
          content:
            application/json:
              examples:
                alertingDisabled:
                  summary: Alerting V2 is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
      summary: Enable rules matching a query (dry-run by default)
      tags:
        - alerting-v2
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/alerting/v2/rules/_update_api_key_by_query:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/v2/rules/_update_api_key_by_query</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Rotates each matching rule executor task API key to one derived from the current user’s credentials.<br/><br/>[Required authorization] Route required privileges: manage_alerting-v2-rules.
      operationId: post-alerting-v2-rules-update-api-key-by-query
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
      requestBody:
        content:
          application/json:
            examples:
              updateApiKeyByQueryRequest:
                summary: 'Rotate API keys for rules tagged production (dry-run by default, or set `force: true` to execute)'
                value:
                  filter: 'tags: production'
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_by_query_request'
      responses:
        '200':
          content:
            application/json:
              examples:
                updateApiKeyByQueryDryRunResponse:
                  summary: 'Dry-run preview of matching rules; set `force: true` on the request to execute'
                  value:
                    match_count: 2
                    sample:
                      - rule-1
                      - rule-2
              schema:
                anyOf:
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_dry_run_response'
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_operation_response'
          description: Returns a dry-run preview by default, or the executed operation when `force` is true.
        '400':
          content:
            application/json:
              examples:
                invalidRequest:
                  summary: By-query body omits filter, search, and match_all
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        '':
                          - At least one of filter, search, or match_all must be provided.
                    error: Bad Request
                    message: At least one of filter, search, or match_all must be provided.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an invalid schema or parameters.
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the request was not authenticated.
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the user does not have the required privileges to perform the request.
        '500':
          content:
            application/json:
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an unexpected server-side error.
        '503':
          content:
            application/json:
              examples:
                alertingDisabled:
                  summary: Alerting V2 is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
      summary: Update the API key of rules matching a query (dry-run by default)
      tags:
        - alerting-v2
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/alerting/v2/rules/{id}:
    delete:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb delete">delete</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/v2/rules/{id}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        [Required authorization] Route required privileges: manage_alerting-v2-rules.
      operationId: delete-alerting-v2-rules-id
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: 'The identifier for the rule. Chosen at creation and permanent — it cannot be changed afterwards. Re-using the id of a deleted resource is allowed but discouraged: execution history, change history, and alert episodes recorded under that id are retained and are attributed to the new resource. Ids appear in URLs and logs, so keep them free of sensitive data.'
          in: path
          name: id
          required: true
          schema:
            maxLength: 150
            minLength: 1
            pattern: ^[a-zA-Z0-9_-]+$
            type: string
      responses:
        '204':
          description: The rule was deleted successfully.
        '400':
          content:
            application/json:
              examples:
                invalidRequest:
                  summary: Indicates an invalid schema or parameters.
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        errors: []
                        properties:
                          page:
                            errors:
                              - 'Too small: expected number to be >=1'
                    error: Bad Request
                    message: 'page: Too small: expected number to be >=1'
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the request failed schema validation.
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the request was not authenticated.
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the user does not have the required privileges to perform the request.
        '404':
          content:
            application/json:
              examples:
                ruleNotFound:
                  summary: No rule exists for the given ID
                  value:
                    code: RULE_NOT_FOUND
                    details:
                      rule_id: rule-1
                    error: Not Found
                    message: Rule with id "rule-1" not found
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates a rule with the given ID does not exist.
        '500':
          content:
            application/json:
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an unexpected server-side error.
        '503':
          content:
            application/json:
              examples:
                alertingDisabled:
                  summary: Alerting V2 is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
      summary: Delete a rule
      tags:
        - alerting-v2
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/v2/rules/{id}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        [Required authorization] Route required privileges: read_alerting-v2-rules.
      operationId: get-alerting-v2-rules-id
      parameters:
        - description: 'The identifier for the rule. Chosen at creation and permanent — it cannot be changed afterwards. Re-using the id of a deleted resource is allowed but discouraged: execution history, change history, and alert episodes recorded under that id are retained and are attributed to the new resource. Ids appear in URLs and logs, so keep them free of sensitive data.'
          in: path
          name: id
          required: true
          schema:
            maxLength: 150
            minLength: 1
            pattern: ^[a-zA-Z0-9_-]+$
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                getRuleResponse:
                  summary: Retrieved host CPU threshold rule
                  value:
                    created_at: '2026-01-15T12:00:00.000Z'
                    created_by:
                      profile_uid: u_elastic_0
                    enabled: true
                    grouping:
                      fields:
                        - host.name
                    id: rule-1
                    kind: alert
                    metadata:
                      description: Alerts when average CPU usage exceeds a threshold.
                      name: Host CPU high
                      routing_tags:
                        - sre-oncall
                      tags:
                        - production
                        - infra
                    no_data:
                      strategy: keep_last
                    query:
                      base: FROM metrics-* | STATS avg_cpu = AVG(host.cpu.usage) BY host.name
                      breach:
                        segment: WHERE avg_cpu > 0.9
                    recovery:
                      strategy: no_breach
                    schedule:
                      every: 1m
                      lookback: 5m
                    state_transition:
                      pending:
                        count: 1
                      recovering:
                        count: 1
                    time_field: '@timestamp'
                    updated_at: '2026-01-15T12:00:00.000Z'
                    updated_by:
                      profile_uid: u_elastic_0
                    version: 1
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_rule_response'
          description: Returns the requested rule.
        '400':
          content:
            application/json:
              examples:
                invalidRequest:
                  summary: Indicates an invalid schema or parameters.
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        errors: []
                        properties:
                          page:
                            errors:
                              - 'Too small: expected number to be >=1'
                    error: Bad Request
                    message: 'page: Too small: expected number to be >=1'
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the request failed schema validation.
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the request was not authenticated.
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the user does not have the required privileges to perform the request.
        '404':
          content:
            application/json:
              examples:
                ruleNotFound:
                  summary: No rule exists for the given ID
                  value:
                    code: RULE_NOT_FOUND
                    details:
                      rule_id: rule-1
                    error: Not Found
                    message: Rule with id "rule-1" not found
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates a rule with the given ID does not exist.
        '500':
          content:
            application/json:
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an unexpected server-side error.
        '503':
          content:
            application/json:
              examples:
                alertingDisabled:
                  summary: Alerting V2 is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
      summary: Get a rule
      tags:
        - alerting-v2
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
    patch:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb patch">patch</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/v2/rules/{id}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        [Required authorization] Route required privileges: manage_alerting-v2-rules.
      operationId: patch-alerting-v2-rules-id
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: 'The identifier for the rule. Chosen at creation and permanent — it cannot be changed afterwards. Re-using the id of a deleted resource is allowed but discouraged: execution history, change history, and alert episodes recorded under that id are retained and are attributed to the new resource. Ids appear in URLs and logs, so keep them free of sensitive data.'
          in: path
          name: id
          required: true
          schema:
            maxLength: 150
            minLength: 1
            pattern: ^[a-zA-Z0-9_-]+$
            type: string
      requestBody:
        content:
          application/json:
            examples:
              updateRuleRequest:
                summary: Update a rule name and description
                value:
                  metadata:
                    description: Updated description.
                    name: Host CPU high (updated)
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_update_rule'
      responses:
        '200':
          content:
            application/json:
              examples:
                updateRuleResponse:
                  summary: Updated rule metadata
                  value:
                    created_at: '2026-01-15T12:00:00.000Z'
                    created_by:
                      profile_uid: u_elastic_0
                    enabled: true
                    grouping:
                      fields:
                        - host.name
                    id: rule-1
                    kind: alert
                    metadata:
                      description: Updated description.
                      name: Host CPU high (updated)
                      routing_tags:
                        - sre-oncall
                      tags:
                        - production
                        - infra
                    no_data:
                      strategy: keep_last
                    query:
                      base: FROM metrics-* | STATS avg_cpu = AVG(host.cpu.usage) BY host.name
                      breach:
                        segment: WHERE avg_cpu > 0.9
                    recovery:
                      strategy: no_breach
                    schedule:
                      every: 1m
                      lookback: 5m
                    state_transition:
                      pending:
                        count: 1
                      recovering:
                        count: 1
                    time_field: '@timestamp'
                    updated_at: '2026-01-15T12:00:00.000Z'
                    updated_by:
                      profile_uid: u_elastic_0
                    version: 1
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_rule_response'
          description: Returns the updated rule.
        '400':
          content:
            application/json:
              examples:
                invalidRequest:
                  summary: Update body includes an unrecognized field
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        unknownField:
                          - Unrecognized key
                    error: Bad Request
                    message: "Unrecognized key(s) in object: 'unknownField'"
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an invalid schema or parameters.
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the request was not authenticated.
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the user does not have the required privileges to perform the request.
        '404':
          content:
            application/json:
              examples:
                ruleNotFound:
                  summary: No rule exists for the given ID
                  value:
                    code: RULE_NOT_FOUND
                    details:
                      rule_id: rule-1
                    error: Not Found
                    message: Rule with id "rule-1" not found
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates a rule with the given ID does not exist.
        '409':
          content:
            application/json:
              examples:
                ruleVersionConflict:
                  summary: Indicates the rule was concurrently updated by another caller.
                  value:
                    code: RULE_VERSION_CONFLICT
                    details:
                      rule_id: rule-1
                    error: Conflict
                    message: Rule with id "rule-1" has already been updated by another user
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the rule was concurrently updated by another caller.
        '500':
          content:
            application/json:
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an unexpected server-side error.
        '503':
          content:
            application/json:
              examples:
                alertingDisabled:
                  summary: Alerting V2 is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
      summary: Update a rule
      tags:
        - alerting-v2
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
    put:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb put">put</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/v2/rules/{id}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Creates a rule with the given identifier, or fully replaces it if one already exists.<br/><br/>[Required authorization] Route required privileges: manage_alerting-v2-rules.
      operationId: put-alerting-v2-rules-id
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: 'The identifier for the rule. Chosen at creation and permanent — it cannot be changed afterwards. Re-using the id of a deleted resource is allowed but discouraged: execution history, change history, and alert episodes recorded under that id are retained and are attributed to the new resource. Ids appear in URLs and logs, so keep them free of sensitive data.'
          in: path
          name: id
          required: true
          schema:
            maxLength: 150
            minLength: 1
            pattern: ^[a-zA-Z0-9_-]+$
            type: string
      requestBody:
        content:
          application/json:
            examples:
              upsertRuleRequest:
                summary: Create or replace a host CPU threshold rule
                value:
                  grouping:
                    fields:
                      - host.name
                  kind: alert
                  metadata:
                    description: Alerts when average CPU usage exceeds a threshold.
                    name: Host CPU high
                    routing_tags:
                      - sre-oncall
                    tags:
                      - production
                      - infra
                  no_data:
                    strategy: keep_last
                  query:
                    base: FROM metrics-* | STATS avg_cpu = AVG(host.cpu.usage) BY host.name
                    breach:
                      segment: WHERE avg_cpu > 0.9
                  recovery:
                    strategy: no_breach
                  schedule:
                    every: 1m
                    lookback: 5m
                  state_transition:
                    pending:
                      count: 1
                    recovering:
                      count: 1
                  time_field: '@timestamp'
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_new_rule'
      responses:
        '200':
          content:
            application/json:
              examples:
                upsertRuleReplacedResponse:
                  summary: Replaced an existing rule
                  value:
                    created_at: '2026-01-15T12:00:00.000Z'
                    created_by:
                      profile_uid: u_elastic_0
                    enabled: true
                    grouping:
                      fields:
                        - host.name
                    id: rule-1
                    kind: alert
                    metadata:
                      description: Alerts when average CPU usage exceeds a threshold.
                      name: Host CPU high
                      routing_tags:
                        - sre-oncall
                      tags:
                        - production
                        - infra
                    no_data:
                      strategy: keep_last
                    query:
                      base: FROM metrics-* | STATS avg_cpu = AVG(host.cpu.usage) BY host.name
                      breach:
                        segment: WHERE avg_cpu > 0.9
                    recovery:
                      strategy: no_breach
                    schedule:
                      every: 1m
                      lookback: 5m
                    state_transition:
                      pending:
                        count: 1
                      recovering:
                        count: 1
                    time_field: '@timestamp'
                    updated_at: '2026-01-15T12:00:00.000Z'
                    updated_by:
                      profile_uid: u_elastic_0
                    version: 1
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_rule_response'
          description: Returns the replaced rule.
        '201':
          content:
            application/json:
              examples:
                upsertRuleCreatedResponse:
                  summary: Created a new rule with the given ID
                  value:
                    created_at: '2026-01-15T12:00:00.000Z'
                    created_by:
                      profile_uid: u_elastic_0
                    enabled: true
                    grouping:
                      fields:
                        - host.name
                    id: rule-1
                    kind: alert
                    metadata:
                      description: Alerts when average CPU usage exceeds a threshold.
                      name: Host CPU high
                      routing_tags:
                        - sre-oncall
                      tags:
                        - production
                        - infra
                    no_data:
                      strategy: keep_last
                    query:
                      base: FROM metrics-* | STATS avg_cpu = AVG(host.cpu.usage) BY host.name
                      breach:
                        segment: WHERE avg_cpu > 0.9
                    recovery:
                      strategy: no_breach
                    schedule:
                      every: 1m
                      lookback: 5m
                    state_transition:
                      pending:
                        count: 1
                      recovering:
                        count: 1
                    time_field: '@timestamp'
                    updated_at: '2026-01-15T12:00:00.000Z'
                    updated_by:
                      profile_uid: u_elastic_0
                    version: 1
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_rule_response'
          description: Returns the newly created rule.
        '400':
          content:
            application/json:
              examples:
                invalidRequest:
                  summary: Upsert body is missing required rule metadata
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        metadata:
                          - Required
                    error: Bad Request
                    message: 'metadata: Required'
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an invalid schema or parameters.
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the request was not authenticated.
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the user does not have the required privileges to perform the request.
        '409':
          content:
            application/json:
              examples:
                ruleVersionConflict:
                  summary: Rule was changed concurrently by another caller
                  value:
                    code: RULE_VERSION_CONFLICT
                    details:
                      rule_id: rule-1
                    error: Conflict
                    message: Rule with id "rule-1" has already been updated by another user
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the rule was created or updated concurrently, or the request changes immutable fields.
        '500':
          content:
            application/json:
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an unexpected server-side error.
        '503':
          content:
            application/json:
              examples:
                alertingDisabled:
                  summary: Alerting V2 is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
      summary: Create or replace a rule
      tags:
        - alerting-v2
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/alerting/v2/rules/{id}/_disable:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/v2/rules/{id}/_disable</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Disable a rule by identifier.<br/><br/>[Required authorization] Route required privileges: manage_alerting-v2-rules.
      operationId: post-alerting-v2-rules-id-disable
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: 'The identifier for the rule. Chosen at creation and permanent — it cannot be changed afterwards. Re-using the id of a deleted resource is allowed but discouraged: execution history, change history, and alert episodes recorded under that id are retained and are attributed to the new resource. Ids appear in URLs and logs, so keep them free of sensitive data.'
          in: path
          name: id
          required: true
          schema:
            maxLength: 150
            minLength: 1
            pattern: ^[a-zA-Z0-9_-]+$
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                disableRuleResponse:
                  summary: Disabled host CPU threshold rule
                  value:
                    created_at: '2026-01-15T12:00:00.000Z'
                    created_by:
                      profile_uid: u_elastic_0
                    enabled: false
                    grouping:
                      fields:
                        - host.name
                    id: rule-1
                    kind: alert
                    metadata:
                      description: Alerts when average CPU usage exceeds a threshold.
                      name: Host CPU high
                      routing_tags:
                        - sre-oncall
                      tags:
                        - production
                        - infra
                    no_data:
                      strategy: keep_last
                    query:
                      base: FROM metrics-* | STATS avg_cpu = AVG(host.cpu.usage) BY host.name
                      breach:
                        segment: WHERE avg_cpu > 0.9
                    recovery:
                      strategy: no_breach
                    schedule:
                      every: 1m
                      lookback: 5m
                    state_transition:
                      pending:
                        count: 1
                      recovering:
                        count: 1
                    time_field: '@timestamp'
                    updated_at: '2026-01-15T12:00:00.000Z'
                    updated_by:
                      profile_uid: u_elastic_0
                    version: 1
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_rule_response'
          description: Returns the disabled rule.
        '400':
          content:
            application/json:
              examples:
                invalidRequest:
                  summary: Indicates an invalid schema or parameters.
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        errors: []
                        properties:
                          page:
                            errors:
                              - 'Too small: expected number to be >=1'
                    error: Bad Request
                    message: 'page: Too small: expected number to be >=1'
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the request failed schema validation.
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the request was not authenticated.
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the user does not have the required privileges to perform the request.
        '404':
          content:
            application/json:
              examples:
                ruleNotFound:
                  summary: No rule exists for the given ID
                  value:
                    code: RULE_NOT_FOUND
                    details:
                      rule_id: rule-1
                    error: Not Found
                    message: Rule with id "rule-1" not found
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates a rule with the given ID does not exist.
        '409':
          content:
            application/json:
              examples:
                ruleVersionConflict:
                  summary: Indicates the rule was concurrently updated by another caller.
                  value:
                    code: RULE_VERSION_CONFLICT
                    details:
                      rule_id: rule-1
                    error: Conflict
                    message: Rule with id "rule-1" has already been updated by another user
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the rule was concurrently updated by another caller.
        '500':
          content:
            application/json:
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an unexpected server-side error.
        '503':
          content:
            application/json:
              examples:
                alertingDisabled:
                  summary: Alerting V2 is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
      summary: Disable a rule
      tags:
        - alerting-v2
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/alerting/v2/rules/{id}/_enable:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/v2/rules/{id}/_enable</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Enable a rule by identifier.<br/><br/>[Required authorization] Route required privileges: manage_alerting-v2-rules.
      operationId: post-alerting-v2-rules-id-enable
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: 'The identifier for the rule. Chosen at creation and permanent — it cannot be changed afterwards. Re-using the id of a deleted resource is allowed but discouraged: execution history, change history, and alert episodes recorded under that id are retained and are attributed to the new resource. Ids appear in URLs and logs, so keep them free of sensitive data.'
          in: path
          name: id
          required: true
          schema:
            maxLength: 150
            minLength: 1
            pattern: ^[a-zA-Z0-9_-]+$
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                enableRuleResponse:
                  summary: Enabled host CPU threshold rule
                  value:
                    created_at: '2026-01-15T12:00:00.000Z'
                    created_by:
                      profile_uid: u_elastic_0
                    enabled: true
                    grouping:
                      fields:
                        - host.name
                    id: rule-1
                    kind: alert
                    metadata:
                      description: Alerts when average CPU usage exceeds a threshold.
                      name: Host CPU high
                      routing_tags:
                        - sre-oncall
                      tags:
                        - production
                        - infra
                    no_data:
                      strategy: keep_last
                    query:
                      base: FROM metrics-* | STATS avg_cpu = AVG(host.cpu.usage) BY host.name
                      breach:
                        segment: WHERE avg_cpu > 0.9
                    recovery:
                      strategy: no_breach
                    schedule:
                      every: 1m
                      lookback: 5m
                    state_transition:
                      pending:
                        count: 1
                      recovering:
                        count: 1
                    time_field: '@timestamp'
                    updated_at: '2026-01-15T12:00:00.000Z'
                    updated_by:
                      profile_uid: u_elastic_0
                    version: 1
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_rule_response'
          description: Returns the enabled rule.
        '400':
          content:
            application/json:
              examples:
                maxSchedulesPerMinuteExceeded:
                  summary: Indicates the request is invalid, for example enabling the rule would exceed the configured schedule limit.
                  value:
                    code: MAX_SCHEDULES_PER_MINUTE_EXCEEDED
                    details:
                      interval: 1m
                      max_scheduled_per_minute: 400
                    error: Bad Request
                    message: Rule schedule of "1m" would exceed the limit of 400 rule runs per minute
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the request is invalid, for example enabling the rule would exceed the configured schedule limit.
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the request was not authenticated.
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the user does not have the required privileges to perform the request.
        '404':
          content:
            application/json:
              examples:
                ruleNotFound:
                  summary: No rule exists for the given ID
                  value:
                    code: RULE_NOT_FOUND
                    details:
                      rule_id: rule-1
                    error: Not Found
                    message: Rule with id "rule-1" not found
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates a rule with the given ID does not exist.
        '409':
          content:
            application/json:
              examples:
                ruleVersionConflict:
                  summary: Indicates the rule was concurrently updated by another caller.
                  value:
                    code: RULE_VERSION_CONFLICT
                    details:
                      rule_id: rule-1
                    error: Conflict
                    message: Rule with id "rule-1" has already been updated by another user
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the rule was concurrently updated by another caller.
        '500':
          content:
            application/json:
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an unexpected server-side error.
        '503':
          content:
            application/json:
              examples:
                alertingDisabled:
                  summary: Alerting V2 is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
      summary: Enable a rule
      tags:
        - alerting-v2
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/alerting/v2/rules/{id}/_run:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/alerting/v2/rules/{id}/_run</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        [Required authorization] Route required privileges: manage_alerting-v2-rules.
      operationId: post-alerting-v2-rules-id-run
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: 'The identifier for the rule. Chosen at creation and permanent — it cannot be changed afterwards. Re-using the id of a deleted resource is allowed but discouraged: execution history, change history, and alert episodes recorded under that id are retained and are attributed to the new resource. Ids appear in URLs and logs, so keep them free of sensitive data.'
          in: path
          name: id
          required: true
          schema:
            maxLength: 150
            minLength: 1
            pattern: ^[a-zA-Z0-9_-]+$
            type: string
      responses:
        '202':
          description: 'The run was accepted: the rule is scheduled to run. Requests that arrive before the run starts are collapsed into a single run. Poll the rule execution history to observe the result.'
        '400':
          content:
            application/json:
              examples:
                ruleDisabled:
                  summary: Indicates the rule is disabled and cannot be run.
                  value:
                    code: RULE_DISABLED
                    details:
                      rule_id: rule-1
                    error: Bad Request
                    message: Rule with id "rule-1" is disabled and cannot be run
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the rule is disabled and cannot be run.
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the request was not authenticated.
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the user does not have the required privileges to perform the request.
        '404':
          content:
            application/json:
              examples:
                ruleNotFound:
                  summary: No rule exists for the given ID
                  value:
                    code: RULE_NOT_FOUND
                    details:
                      rule_id: rule-1
                    error: Not Found
                    message: Rule with id "rule-1" not found
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates a rule with the given ID does not exist.
        '409':
          content:
            application/json:
              examples:
                ruleAlreadyRunning:
                  summary: Indicates the rule is already running or the run request conflicted.
                  value:
                    code: RULE_ALREADY_RUNNING
                    details:
                      rule_id: rule-1
                    error: Conflict
                    message: Rule with id "rule-1" is already running
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the rule is already running or the run request conflicted.
        '500':
          content:
            application/json:
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates an unexpected server-side error.
        '503':
          content:
            application/json:
              examples:
                alertingDisabled:
                  summary: Alerting V2 is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
      summary: Run a rule now
      tags:
        - alerting-v2
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/apm/agent_keys:
    post:
      description: |
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/apm/agent_keys</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Create a new agent key for APM.
        The user creating an APM agent API key must have at least the `manage_own_api_key` cluster privilege and the APM application-level privileges that it wishes to grant.
        After it is created, you can copy the API key (Base64 encoded) and use it to to authorize requests from APM agents to the APM Server.
      operationId: createAgentKey
      parameters:
        - $ref: '#/components/parameters/APM_UI_elastic_api_version'
        - $ref: '#/components/parameters/APM_UI_kbn_xsrf'
      requestBody:
        content:
          application/json:
            examples:
              createAgentKeyRequest1:
                $ref: '#/components/examples/APM_UI_agent_keys_object_post_request1'
            schema:
              $ref: '#/components/schemas/APM_UI_agent_keys_object'
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                createAgentKeyResponse1:
                  $ref: '#/components/examples/APM_UI_agent_keys_object_post_200_response1'
              schema:
                $ref: '#/components/schemas/APM_UI_agent_keys_response'
          description: Agent key created successfully
        '400':
          content:
            application/json:
              examples:
                badRequestResponse:
                  $ref: '#/components/examples/APM_UI_error_400_response'
              schema:
                $ref: '#/components/schemas/APM_UI_400_response'
          description: Bad Request response
        '401':
          content:
            application/json:
              examples:
                unauthorizedResponse:
                  $ref: '#/components/examples/APM_UI_error_401_response'
              schema:
                $ref: '#/components/schemas/APM_UI_401_response'
          description: Unauthorized response
        '403':
          content:
            application/json:
              examples:
                forbiddenResponse:
                  $ref: '#/components/examples/APM_UI_error_403_response'
              schema:
                $ref: '#/components/schemas/APM_UI_403_response'
          description: Forbidden response
        '500':
          content:
            application/json:
              examples:
                internalServerErrorResponse:
                  $ref: '#/components/examples/APM_UI_error_500_response'
              schema:
                $ref: '#/components/schemas/APM_UI_500_response'
          description: Internal Server Error response
      summary: Create an APM agent key
      tags:
        - APM agent keys
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/apm/fleet/apm_server_schema:
    post:
      deprecated: true
      description: |
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/apm/fleet/apm_server_schema</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        DEPRECATED: This endpoint is intended for internal use by Fleet integrations to push the APM Server configuration schema. Do not use for new integrations. It stores the provided schema object as a Kibana saved object. If Fleet migration is not available on the current deployment, the API returns a 404.
      operationId: saveApmServerSchema
      parameters:
        - $ref: '#/components/parameters/APM_UI_elastic_api_version'
        - $ref: '#/components/parameters/APM_UI_kbn_xsrf'
      requestBody:
        content:
          application/json:
            examples:
              saveApmServerSchemaRequest:
                description: An example request payload for `POST /api/apm/fleet/apm_server_schema`.
                value:
                  schema:
                    foo: bar
            schema:
              type: object
              properties:
                schema:
                  additionalProperties: true
                  description: Schema object
                  example:
                    foo: bar
                  type: object
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                saveApmServerSchemaResponseExample1:
                  $ref: '#/components/examples/APM_UI_fleet_apm_server_schema_200_response1'
              schema:
                additionalProperties: false
                description: The response body is intentionally empty for this endpoint.
                type: object
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                badRequestResponse:
                  $ref: '#/components/examples/APM_UI_error_400_response'
              schema:
                $ref: '#/components/schemas/APM_UI_400_response'
          description: Bad Request response
        '401':
          content:
            application/json:
              examples:
                unauthorizedResponse:
                  $ref: '#/components/examples/APM_UI_error_401_response'
              schema:
                $ref: '#/components/schemas/APM_UI_401_response'
          description: Unauthorized response
        '403':
          content:
            application/json:
              examples:
                forbiddenResponse:
                  $ref: '#/components/examples/APM_UI_error_403_response'
              schema:
                $ref: '#/components/schemas/APM_UI_403_response'
          description: Forbidden response
        '404':
          content:
            application/json:
              examples:
                notFoundResponse:
                  $ref: '#/components/examples/APM_UI_error_404_response'
              schema:
                $ref: '#/components/schemas/APM_UI_404_response'
          description: Not found response
      summary: Save APM server schema
      tags:
        - APM server schema
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/apm/services/{serviceName}/annotation:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/apm/services/{serviceName}/annotation</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Create a new annotation for a specific service.
      operationId: createAnnotation
      parameters:
        - $ref: '#/components/parameters/APM_UI_elastic_api_version'
        - $ref: '#/components/parameters/APM_UI_kbn_xsrf'
        - description: The name of the service
          in: path
          name: serviceName
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            examples:
              createAnnotationRequest1:
                $ref: '#/components/examples/APM_UI_annotation_object_post_request1'
            schema:
              $ref: '#/components/schemas/APM_UI_create_annotation_object'
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                createAnnotationResponse1:
                  $ref: '#/components/examples/APM_UI_annotation_object_post_200_response1'
              schema:
                $ref: '#/components/schemas/APM_UI_create_annotation_response'
          description: Annotation created successfully
        '400':
          content:
            application/json:
              examples:
                badRequestResponse:
                  $ref: '#/components/examples/APM_UI_error_400_response'
              schema:
                $ref: '#/components/schemas/APM_UI_400_response'
          description: Bad Request response
        '401':
          content:
            application/json:
              examples:
                unauthorizedResponse:
                  $ref: '#/components/examples/APM_UI_error_401_response'
              schema:
                $ref: '#/components/schemas/APM_UI_401_response'
          description: Unauthorized response
        '403':
          content:
            application/json:
              examples:
                forbiddenResponse:
                  $ref: '#/components/examples/APM_UI_error_403_response'
              schema:
                $ref: '#/components/schemas/APM_UI_403_response'
          description: Forbidden response
        '404':
          content:
            application/json:
              examples:
                notFoundResponse:
                  $ref: '#/components/examples/APM_UI_error_404_response'
              schema:
                $ref: '#/components/schemas/APM_UI_404_response'
          description: Not found response
      summary: Create a service annotation
      tags:
        - APM annotations
      x-codeSamples:
        - lang: Curl
          source: |
            curl -X POST \
            http://localhost:5601/api/apm/services/opbeans-java/annotation \
            -H 'Content-Type: application/json' \
            -H 'kbn-xsrf: true' \
            -H 'Authorization: Basic YhUlubWZhM0FDbnlQeE6WRtaW49FQmSGZ4RUWXdX' \
            -d '{
                "@timestamp": "2020-05-08T10:31:30.452Z",
                "service": {
                    "version": "1.2"
                },
                "message": "Deployment 1.2"
                }'
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/apm/services/{serviceName}/annotation/search:
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/apm/services/{serviceName}/annotation/search</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Search for annotations related to a specific service.
      operationId: getAnnotation
      parameters:
        - $ref: '#/components/parameters/APM_UI_elastic_api_version'
        - description: The name of the service
          in: path
          name: serviceName
          required: true
          schema:
            type: string
        - description: The environment to filter annotations by
          in: query
          name: environment
          required: false
          schema:
            type: string
        - description: The start date for the search
          example: '2024-01-01T00:00:00.000Z'
          in: query
          name: start
          required: false
          schema:
            format: date-time
            type: string
        - description: The end date for the search
          example: '2024-01-31T23:59:59.999Z'
          in: query
          name: end
          required: false
          schema:
            format: date-time
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                getAnnotationResponse1:
                  $ref: '#/components/examples/APM_UI_annotation_search_get_200_response1'
              schema:
                $ref: '#/components/schemas/APM_UI_annotation_search_response'
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                badRequestResponse:
                  $ref: '#/components/examples/APM_UI_error_400_response'
              schema:
                $ref: '#/components/schemas/APM_UI_400_response'
          description: Bad Request response
        '401':
          content:
            application/json:
              examples:
                unauthorizedResponse:
                  $ref: '#/components/examples/APM_UI_error_401_response'
              schema:
                $ref: '#/components/schemas/APM_UI_401_response'
          description: Unauthorized response
        '500':
          content:
            application/json:
              examples:
                internalServerErrorResponse:
                  $ref: '#/components/examples/APM_UI_error_500_response'
              schema:
                $ref: '#/components/schemas/APM_UI_500_response'
          description: Internal Server Error response
      summary: Search for annotations
      tags:
        - APM annotations
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/apm/settings/agent-configuration:
    delete:
      description: |
        **Spaces method and path for this operation:**

        <div><span class="operation-verb delete">delete</span>&nbsp;<span class="operation-path">/s/{space_id}/api/apm/settings/agent-configuration</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Delete an existing agent configuration. You must have `all` privileges for the APM and User Experience feature in Kibana. When successful, the configuration is removed and, if Fleet is enabled, APM package policies are synchronized accordingly.
      operationId: deleteAgentConfiguration
      parameters:
        - $ref: '#/components/parameters/APM_UI_elastic_api_version'
        - $ref: '#/components/parameters/APM_UI_kbn_xsrf'
      requestBody:
        content:
          application/json:
            examples:
              deleteAgentConfigurationRequest1:
                $ref: '#/components/examples/APM_UI_agent_configuration_intake_object_delete_request1'
            schema:
              $ref: '#/components/schemas/APM_UI_delete_service_object'
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                deleteAgentConfigurationResponseExample1:
                  $ref: '#/components/examples/APM_UI_agent_configuration_intake_object_delete_200_response1'
              schema:
                $ref: '#/components/schemas/APM_UI_delete_agent_configurations_response'
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                badRequestResponse:
                  $ref: '#/components/examples/APM_UI_error_400_response'
              schema:
                $ref: '#/components/schemas/APM_UI_400_response'
          description: Bad Request response
        '401':
          content:
            application/json:
              examples:
                unauthorizedResponse:
                  $ref: '#/components/examples/APM_UI_error_401_response'
              schema:
                $ref: '#/components/schemas/APM_UI_401_response'
          description: Unauthorized response
        '403':
          content:
            application/json:
              examples:
                forbiddenResponse:
                  $ref: '#/components/examples/APM_UI_error_403_response'
              schema:
                $ref: '#/components/schemas/APM_UI_403_response'
          description: Forbidden response
        '404':
          content:
            application/json:
              examples:
                notFoundResponse:
                  $ref: '#/components/examples/APM_UI_error_404_response'
              schema:
                $ref: '#/components/schemas/APM_UI_404_response'
          description: Not found response
      summary: Delete agent configuration
      tags:
        - APM agent configuration
      x-metaTags:
        - content: Kibana
          name: product_name
    get:
      description: |
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/apm/settings/agent-configuration</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Retrieve all agent configurations. You must have `read` privileges for the APM and User Experience feature in Kibana. If agent configuration is not available on the current deployment, the API returns a 404.
      operationId: getAgentConfigurations
      parameters:
        - $ref: '#/components/parameters/APM_UI_elastic_api_version'
      responses:
        '200':
          content:
            application/json:
              examples:
                getAgentConfigurationsResponseExample1:
                  $ref: '#/components/examples/APM_UI_agent_configuration_intake_object_get_200_response1'
              schema:
                $ref: '#/components/schemas/APM_UI_agent_configurations_response'
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                badRequestResponse:
                  $ref: '#/components/examples/APM_UI_error_400_response'
              schema:
                $ref: '#/components/schemas/APM_UI_400_response'
          description: Bad Request response
        '401':
          content:
            application/json:
              examples:
                unauthorizedResponse:
                  $ref: '#/components/examples/APM_UI_error_401_response'
              schema:
                $ref: '#/components/schemas/APM_UI_401_response'
          description: Unauthorized response
        '404':
          content:
            application/json:
              examples:
                notFoundResponse:
                  $ref: '#/components/examples/APM_UI_error_404_response'
              schema:
                $ref: '#/components/schemas/APM_UI_404_response'
          description: Not found response
      summary: Get a list of agent configurations
      tags:
        - APM agent configuration
      x-metaTags:
        - content: Kibana
          name: product_name
    put:
      description: |
        **Spaces method and path for this operation:**

        <div><span class="operation-verb put">put</span>&nbsp;<span class="operation-path">/s/{space_id}/api/apm/settings/agent-configuration</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Create or update an agent configuration. You must have `all` privileges for the APM and User Experience feature in Kibana. When updating an existing configuration, the `?overwrite=true` query parameter is required. If the configuration already exists and `overwrite` is not set to `true`, the API returns a 400 error. When successful and Fleet is enabled, APM package policies are synchronized accordingly.
      operationId: createUpdateAgentConfiguration
      parameters:
        - $ref: '#/components/parameters/APM_UI_elastic_api_version'
        - $ref: '#/components/parameters/APM_UI_kbn_xsrf'
        - description: If the config exists ?overwrite=true is required
          in: query
          name: overwrite
          schema:
            type: boolean
      requestBody:
        content:
          application/json:
            examples:
              createUpdateAgentConfigurationRequestExample1:
                $ref: '#/components/examples/APM_UI_agent_configuration_intake_object_put_request1'
            schema:
              $ref: '#/components/schemas/APM_UI_agent_configuration_intake_object'
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                createUpdateAgentConfigurationResponseExample1:
                  $ref: '#/components/examples/APM_UI_agent_configuration_intake_object_put_200_response1'
              schema:
                additionalProperties: false
                description: The response body is intentionally empty for this endpoint.
                type: object
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                badRequestResponse:
                  $ref: '#/components/examples/APM_UI_error_400_response'
              schema:
                $ref: '#/components/schemas/APM_UI_400_response'
          description: Bad Request response
        '401':
          content:
            application/json:
              examples:
                unauthorizedResponse:
                  $ref: '#/components/examples/APM_UI_error_401_response'
              schema:
                $ref: '#/components/schemas/APM_UI_401_response'
          description: Unauthorized response
        '403':
          content:
            application/json:
              examples:
                forbiddenResponse:
                  $ref: '#/components/examples/APM_UI_error_403_response'
              schema:
                $ref: '#/components/schemas/APM_UI_403_response'
          description: Forbidden response
        '404':
          content:
            application/json:
              examples:
                notFoundResponse:
                  $ref: '#/components/examples/APM_UI_error_404_response'
              schema:
                $ref: '#/components/schemas/APM_UI_404_response'
          description: Not found response
      summary: Create or update agent configuration
      tags:
        - APM agent configuration
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/apm/settings/agent-configuration/agent_name:
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/apm/settings/agent-configuration/agent_name</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Retrieve `agentName` for a service.
      operationId: getAgentNameForService
      parameters:
        - $ref: '#/components/parameters/APM_UI_elastic_api_version'
        - description: The name of the service
          example: node
          in: query
          name: serviceName
          required: true
          schema:
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                getAgentNameForServiceResponse1:
                  $ref: '#/components/examples/APM_UI_service_agent_name_get_200_response1'
              schema:
                $ref: '#/components/schemas/APM_UI_service_agent_name_response'
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                badRequestResponse:
                  $ref: '#/components/examples/APM_UI_error_400_response'
              schema:
                $ref: '#/components/schemas/APM_UI_400_response'
          description: Bad Request response
        '401':
          content:
            application/json:
              examples:
                unauthorizedResponse:
                  $ref: '#/components/examples/APM_UI_error_401_response'
              schema:
                $ref: '#/components/schemas/APM_UI_401_response'
          description: Unauthorized response
        '404':
          content:
            application/json:
              examples:
                notFoundResponse:
                  $ref: '#/components/examples/APM_UI_error_404_response'
              schema:
                $ref: '#/components/schemas/APM_UI_404_response'
          description: Not found response
      summary: Get agent name for service
      tags:
        - APM agent configuration
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/apm/settings/agent-configuration/environments:
    get:
      description: |
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/apm/settings/agent-configuration/environments</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Retrieve the available environments for a given service, to be used in agent configuration. You must have `read` privileges for the APM and User Experience feature in Kibana. If `serviceName` is omitted, environments across all services are returned.
      operationId: getEnvironmentsForService
      parameters:
        - $ref: '#/components/parameters/APM_UI_elastic_api_version'
        - description: The name of the service. If omitted, environments across all services are returned.
          example: opbeans-node
          in: query
          name: serviceName
          schema:
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                getEnvironmentsForServiceResponseExample1:
                  $ref: '#/components/examples/APM_UI_agent_configuration_environments_200_response1'
              schema:
                $ref: '#/components/schemas/APM_UI_service_environments_response'
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                badRequestResponse:
                  $ref: '#/components/examples/APM_UI_error_400_response'
              schema:
                $ref: '#/components/schemas/APM_UI_400_response'
          description: Bad Request response
        '401':
          content:
            application/json:
              examples:
                unauthorizedResponse:
                  $ref: '#/components/examples/APM_UI_error_401_response'
              schema:
                $ref: '#/components/schemas/APM_UI_401_response'
          description: Unauthorized response
        '404':
          content:
            application/json:
              examples:
                notFoundResponse:
                  $ref: '#/components/examples/APM_UI_error_404_response'
              schema:
                $ref: '#/components/schemas/APM_UI_404_response'
          description: Not found response
      summary: Get environments for service
      tags:
        - APM agent configuration
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/apm/settings/agent-configuration/search:
    post:
      deprecated: true
      description: |
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/apm/settings/agent-configuration/search</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        DEPRECATED: This endpoint is intended for internal use by APM agents to fetch their configuration and mark it as applied. Do not use for new integrations. It searches for a single agent configuration matching the given service, and optionally updates the `applied_by_agent` field when the provided `etag` matches the current configuration.
      operationId: searchSingleConfiguration
      parameters:
        - $ref: '#/components/parameters/APM_UI_elastic_api_version'
        - $ref: '#/components/parameters/APM_UI_kbn_xsrf'
      requestBody:
        content:
          application/json:
            examples:
              searchSingleConfigurationRequest1:
                $ref: '#/components/examples/APM_UI_agent_configuration_intake_object_search_request1'
            schema:
              $ref: '#/components/schemas/APM_UI_search_agent_configuration_object'
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                searchSingleConfigurationResponse1:
                  $ref: '#/components/examples/APM_UI_agent_configuration_intake_object_search_200_response1'
              schema:
                $ref: '#/components/schemas/APM_UI_search_agent_configuration_response'
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                badRequestResponse:
                  $ref: '#/components/examples/APM_UI_error_400_response'
              schema:
                $ref: '#/components/schemas/APM_UI_400_response'
          description: Bad Request response
        '401':
          content:
            application/json:
              examples:
                unauthorizedResponse:
                  $ref: '#/components/examples/APM_UI_error_401_response'
              schema:
                $ref: '#/components/schemas/APM_UI_401_response'
          description: Unauthorized response
        '404':
          content:
            application/json:
              examples:
                notFoundResponse:
                  $ref: '#/components/examples/APM_UI_error_404_response'
              schema:
                $ref: '#/components/schemas/APM_UI_404_response'
          description: Not found response
      summary: Lookup single agent configuration
      tags:
        - APM agent configuration
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/apm/settings/agent-configuration/view:
    get:
      description: |
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/apm/settings/agent-configuration/view</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Retrieve a single agent configuration matching the given service name and environment. You must have `read` privileges for the APM and User Experience feature in Kibana. If no matching configuration is found, the API returns a 404.
      operationId: getSingleAgentConfiguration
      parameters:
        - $ref: '#/components/parameters/APM_UI_elastic_api_version'
        - description: Service name
          example: node
          in: query
          name: name
          schema:
            type: string
        - description: Service environment
          example: prod
          in: query
          name: environment
          schema:
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                getSingleAgentConfigurationResponseExample1:
                  $ref: '#/components/examples/APM_UI_agent_configuration_intake_object_view_200_response1'
              schema:
                $ref: '#/components/schemas/APM_UI_single_agent_configuration_response'
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                badRequestResponse:
                  $ref: '#/components/examples/APM_UI_error_400_response'
              schema:
                $ref: '#/components/schemas/APM_UI_400_response'
          description: Bad Request response
        '401':
          content:
            application/json:
              examples:
                unauthorizedResponse:
                  $ref: '#/components/examples/APM_UI_error_401_response'
              schema:
                $ref: '#/components/schemas/APM_UI_401_response'
          description: Unauthorized response
        '404':
          content:
            application/json:
              examples:
                notFoundResponse:
                  $ref: '#/components/examples/APM_UI_error_404_response'
              schema:
                $ref: '#/components/schemas/APM_UI_404_response'
          description: Not found response
      summary: Get single agent configuration
      tags:
        - APM agent configuration
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/apm/sourcemaps:
    get:
      description: |
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/apm/sourcemaps</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Get an array of Fleet artifacts, including source map uploads. You must have `read` or `all` Kibana privileges for the APM and User Experience feature.
      operationId: getSourceMaps
      parameters:
        - $ref: '#/components/parameters/APM_UI_elastic_api_version'
        - description: Page number
          in: query
          name: page
          schema:
            type: number
        - description: Number of records per page
          in: query
          name: perPage
          schema:
            type: number
      responses:
        '200':
          content:
            application/json:
              examples:
                getSourceMapsResponse1:
                  $ref: '#/components/examples/APM_UI_source_maps_get_200_response1'
              schema:
                $ref: '#/components/schemas/APM_UI_source_maps_response'
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                badRequestResponse:
                  $ref: '#/components/examples/APM_UI_error_400_response'
              schema:
                $ref: '#/components/schemas/APM_UI_400_response'
          description: Bad Request response
        '401':
          content:
            application/json:
              examples:
                unauthorizedResponse:
                  $ref: '#/components/examples/APM_UI_error_401_response'
              schema:
                $ref: '#/components/schemas/APM_UI_401_response'
          description: Unauthorized response
        '500':
          content:
            application/json:
              examples:
                internalServerErrorResponse:
                  $ref: '#/components/examples/APM_UI_error_500_response'
              schema:
                $ref: '#/components/schemas/APM_UI_500_response'
          description: Internal Server Error response
        '501':
          content:
            application/json:
              examples:
                notImplementedResponse:
                  $ref: '#/components/examples/APM_UI_error_501_response'
              schema:
                $ref: '#/components/schemas/APM_UI_501_response'
          description: Not Implemented response
      summary: Get source maps
      tags:
        - APM sourcemaps
      x-codeSamples:
        - lang: Curl
          source: |
            curl -X GET "http://localhost:5601/api/apm/sourcemaps" \
            -H 'Content-Type: application/json' \
            -H 'kbn-xsrf: true' \
            -H 'Authorization: ApiKey ${YOUR_API_KEY}'
      x-metaTags:
        - content: Kibana
          name: product_name
    post:
      description: |
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/apm/sourcemaps</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Upload a source map for a specific service and version. You must have `all` Kibana privileges for the APM and User Experience feature.
        The maximum payload size is `1mb`. If you attempt to upload a source map that exceeds the maximum payload size, you will get a 413 error. Before uploading source maps that exceed this default, change the maximum payload size allowed by Kibana with the `server.maxPayload` variable.
      operationId: uploadSourceMap
      parameters:
        - $ref: '#/components/parameters/APM_UI_elastic_api_version'
        - $ref: '#/components/parameters/APM_UI_kbn_xsrf'
      requestBody:
        content:
          multipart/form-data:
            examples:
              uploadSourceMapRequest:
                $ref: '#/components/examples/APM_UI_source_maps_upload_request1'
            schema:
              $ref: '#/components/schemas/APM_UI_upload_source_map_object'
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                uploadSourceMapResponse1:
                  $ref: '#/components/examples/APM_UI_source_maps_upload_200_response1'
              schema:
                $ref: '#/components/schemas/APM_UI_upload_source_maps_response'
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                badRequestResponse:
                  $ref: '#/components/examples/APM_UI_error_400_response'
              schema:
                $ref: '#/components/schemas/APM_UI_400_response'
          description: Bad Request response
        '401':
          content:
            application/json:
              examples:
                unauthorizedResponse:
                  $ref: '#/components/examples/APM_UI_error_401_response'
              schema:
                $ref: '#/components/schemas/APM_UI_401_response'
          description: Unauthorized response
        '403':
          content:
            application/json:
              examples:
                forbiddenResponse:
                  $ref: '#/components/examples/APM_UI_error_403_response'
              schema:
                $ref: '#/components/schemas/APM_UI_403_response'
          description: Forbidden response
        '500':
          content:
            application/json:
              examples:
                internalServerErrorResponse:
                  $ref: '#/components/examples/APM_UI_error_500_response'
              schema:
                $ref: '#/components/schemas/APM_UI_500_response'
          description: Internal Server Error response
        '501':
          content:
            application/json:
              examples:
                notImplementedResponse:
                  $ref: '#/components/examples/APM_UI_error_501_response'
              schema:
                $ref: '#/components/schemas/APM_UI_501_response'
          description: Not Implemented response
      summary: Upload a source map
      tags:
        - APM sourcemaps
      x-codeSamples:
        - lang: Curl
          source: |
            curl -X POST "http://localhost:5601/api/apm/sourcemaps" \
            -H 'Content-Type: multipart/form-data' \
            -H 'kbn-xsrf: true' \
            -H 'Authorization: ApiKey ${YOUR_API_KEY}' \
            -F 'service_name="foo"' \
            -F 'service_version="1.0.0"' \
            -F 'bundle_filepath="/test/e2e/general-usecase/bundle.js"' \
            -F 'sourcemap="{\"version\":3,\"file\":\"static/js/main.chunk.js\",\"sources\":[\"fleet-source-map-client/src/index.css\",\"fleet-source-map-client/src/App.js\",\"webpack:///./src/index.css?bb0a\",\"fleet-source-map-client/src/index.js\",\"fleet-source-map-client/src/reportWebVitals.js\"],\"sourcesContent\":[\"content\"],\"mappings\":\"mapping\",\"sourceRoot\":\"\"}"' 
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/apm/sourcemaps/{id}:
    delete:
      description: |
        **Spaces method and path for this operation:**

        <div><span class="operation-verb delete">delete</span>&nbsp;<span class="operation-path">/s/{space_id}/api/apm/sourcemaps/{id}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Delete a previously uploaded source map. You must have `all` Kibana privileges for the APM and User Experience feature.
      operationId: deleteSourceMap
      parameters:
        - $ref: '#/components/parameters/APM_UI_elastic_api_version'
        - $ref: '#/components/parameters/APM_UI_kbn_xsrf'
        - description: Source map identifier
          in: path
          name: id
          required: true
          schema:
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                deleteSourceMapResponseExample1:
                  $ref: '#/components/examples/APM_UI_source_maps_delete_200_response1'
              schema:
                additionalProperties: false
                description: The response body is intentionally empty for this endpoint.
                type: object
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                badRequestResponse:
                  $ref: '#/components/examples/APM_UI_error_400_response'
              schema:
                $ref: '#/components/schemas/APM_UI_400_response'
          description: Bad Request response
        '401':
          content:
            application/json:
              examples:
                unauthorizedResponse:
                  $ref: '#/components/examples/APM_UI_error_401_response'
              schema:
                $ref: '#/components/schemas/APM_UI_401_response'
          description: Unauthorized response
        '403':
          content:
            application/json:
              examples:
                forbiddenResponse:
                  $ref: '#/components/examples/APM_UI_error_403_response'
              schema:
                $ref: '#/components/schemas/APM_UI_403_response'
          description: Forbidden response
        '500':
          content:
            application/json:
              examples:
                internalServerErrorResponse:
                  $ref: '#/components/examples/APM_UI_error_500_response'
              schema:
                $ref: '#/components/schemas/APM_UI_500_response'
          description: Internal Server Error response
        '501':
          content:
            application/json:
              examples:
                notImplementedResponse:
                  $ref: '#/components/examples/APM_UI_error_501_response'
              schema:
                $ref: '#/components/schemas/APM_UI_501_response'
          description: Not Implemented response
      summary: Delete source map
      tags:
        - APM sourcemaps
      x-codeSamples:
        - lang: Curl
          source: |
            curl -X DELETE "http://localhost:5601/api/apm/sourcemaps/apm:foo-1.0.0-644fd5a9" \
            -H 'Content-Type: application/json' \
            -H 'kbn-xsrf: true' \
            -H 'Authorization: ApiKey ${YOUR_API_KEY}'
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/asset_criticality:
    delete:
      deprecated: true
      description: |
        **Spaces method and path for this operation:**

        <div><span class="operation-verb delete">delete</span>&nbsp;<span class="operation-path">/s/{space_id}/api/asset_criticality</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        **Deprecated in 9.4.0.** Use the Entity Store APIs to unassign asset criticality for a specific entity.

        Delete the asset criticality record for a specific entity.
      operationId: DeleteAssetCriticalityRecord
      parameters:
        - description: The ID value of the asset.
          example: my_host
          in: query
          name: id_value
          required: true
          schema:
            type: string
        - description: The field representing the ID.
          example: host.name
          in: query
          name: id_field
          required: true
          schema:
            $ref: '#/components/schemas/Security_Entity_Analytics_API_IdField'
        - description: If 'wait_for' the request will wait for the index refresh.
          in: query
          name: refresh
          required: false
          schema:
            enum:
              - wait_for
            type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                type: object
                properties:
                  deleted:
                    description: True if the record was deleted or false if the record did not exist.
                    type: boolean
                  record:
                    $ref: '#/components/schemas/Security_Entity_Analytics_API_AssetCriticalityRecord'
                    description: The deleted record if it existed.
                required:
                  - deleted
          description: Successful response
        '400':
          description: Invalid request
      summary: Delete an asset criticality record
      tags:
        - Security Entity Analytics API
      x-metaTags:
        - content: Kibana
          name: product_name
    get:
      deprecated: true
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/asset_criticality</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        **Deprecated in 9.4.0.** Get the asset criticality record for a specific entity.
      operationId: GetAssetCriticalityRecord
      parameters:
        - description: The ID value of the asset.
          example: my_host
          in: query
          name: id_value
          required: true
          schema:
            type: string
        - description: The field representing the ID.
          example: host.name
          in: query
          name: id_field
          required: true
          schema:
            $ref: '#/components/schemas/Security_Entity_Analytics_API_IdField'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Entity_Analytics_API_AssetCriticalityRecord'
          description: Successful response
        '400':
          description: Invalid request
        '404':
          description: Criticality record not found
      summary: Get an asset criticality record
      tags:
        - Security Entity Analytics API
      x-metaTags:
        - content: Kibana
          name: product_name
    post:
      deprecated: true
      description: |
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/asset_criticality</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        **Deprecated in 9.4.0.** Use the Entity Store APIs to assign asset criticality to an entity.

        Create or update an asset criticality record for a specific entity.

        If a record already exists for the specified entity, that record is overwritten with the specified value. If a record doesn't exist for the specified entity, a new record is created.
      operationId: CreateAssetCriticalityRecord
      requestBody:
        content:
          application/json:
            schema:
              allOf:
                - $ref: '#/components/schemas/Security_Entity_Analytics_API_CreateAssetCriticalityRecord'
                - type: object
                  properties:
                    refresh:
                      description: If 'wait_for' the request will wait for the index refresh.
                      enum:
                        - wait_for
                      type: string
              example:
                criticality_level: high_impact
                id_field: host.name
                id_value: my_host
        required: true
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Entity_Analytics_API_AssetCriticalityRecord'
          description: Successful response
        '400':
          description: Invalid request
      summary: Upsert an asset criticality record
      tags:
        - Security Entity Analytics API
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/asset_criticality/bulk:
    post:
      deprecated: true
      description: |
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/asset_criticality/bulk</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        **Deprecated in 9.4.0.** Use the Entity Store APIs to bulk assign asset criticality.

        Bulk upsert up to 1000 asset criticality records.

        If asset criticality records already exist for the specified entities, those records are overwritten with the specified values. If asset criticality records don't exist for the specified entities, new records are created.
      operationId: BulkUpsertAssetCriticalityRecords
      requestBody:
        content:
          application/json:
            schema:
              example:
                records:
                  - criticality_level: low_impact
                    id_field: host.name
                    id_value: host-1
                  - criticality_level: medium_impact
                    id_field: host.name
                    id_value: host-2
              type: object
              properties:
                records:
                  items:
                    allOf:
                      - $ref: '#/components/schemas/Security_Entity_Analytics_API_AssetCriticalityRecordIdParts'
                      - type: object
                        properties:
                          criticality_level:
                            $ref: '#/components/schemas/Security_Entity_Analytics_API_AssetCriticalityLevelsForBulkUpload'
                        required:
                          - criticality_level
                  maxItems: 1000
                  minItems: 1
                  type: array
              required:
                - records
      responses:
        '200':
          content:
            application/json:
              schema:
                example:
                  errors:
                    - index: 0
                      message: Invalid ID field
                  stats:
                    failed: 1
                    successful: 1
                    total: 2
                type: object
                properties:
                  errors:
                    items:
                      $ref: '#/components/schemas/Security_Entity_Analytics_API_AssetCriticalityBulkUploadErrorItem'
                    type: array
                  stats:
                    $ref: '#/components/schemas/Security_Entity_Analytics_API_AssetCriticalityBulkUploadStats'
                required:
                  - errors
                  - stats
          description: Bulk upload successful
        '413':
          description: File too large
      summary: Bulk upsert asset criticality records
      tags:
        - Security Entity Analytics API
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/asset_criticality/list:
    get:
      deprecated: true
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/asset_criticality/list</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        **Deprecated in 9.4.0.** List asset criticality records, paging, sorting and filtering as needed.
      operationId: FindAssetCriticalityRecords
      parameters:
        - description: The field to sort by.
          in: query
          name: sort_field
          required: false
          schema:
            enum:
              - id_value
              - id_field
              - criticality_level
              - '@timestamp'
            type: string
        - description: The order to sort by.
          in: query
          name: sort_direction
          required: false
          schema:
            enum:
              - asc
              - desc
            type: string
        - description: The page number to return.
          in: query
          name: page
          required: false
          schema:
            minimum: 1
            type: integer
        - description: The number of records to return per page.
          in: query
          name: per_page
          required: false
          schema:
            maximum: 1000
            minimum: 1
            type: integer
        - description: The kuery to filter by.
          in: query
          name: kuery
          required: false
          schema:
            type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                example:
                  page: 1
                  per_page: 10
                  records:
                    - '@timestamp': '2024-08-02T14:40:35.705Z'
                      asset:
                        criticality: medium_impact
                      criticality_level: medium_impact
                      host:
                        asset:
                          criticality: medium_impact
                        name: my_other_host
                      id_field: host.name
                      id_value: my_other_host
                    - '@timestamp': '2024-08-02T11:15:34.290Z'
                      asset:
                        criticality: high_impact
                      criticality_level: high_impact
                      host:
                        asset:
                          criticality: high_impact
                        name: my_host
                      id_field: host.name
                      id_value: my_host
                  total: 2
                type: object
                properties:
                  page:
                    minimum: 1
                    type: integer
                  per_page:
                    maximum: 1000
                    minimum: 1
                    type: integer
                  records:
                    items:
                      $ref: '#/components/schemas/Security_Entity_Analytics_API_AssetCriticalityRecord'
                    type: array
                  total:
                    minimum: 0
                    type: integer
                required:
                  - records
                  - page
                  - per_page
                  - total
          description: Successfully retrieved asset criticality records
      summary: List asset criticality records
      tags:
        - Security Entity Analytics API
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/attack_discovery/_bulk:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/attack_discovery/_bulk</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Performs bulk updates on multiple Attack discoveries, including workflow status changes and visibility settings. This endpoint allows efficient batch processing of alert modifications without requiring individual API calls for each alert.
      operationId: PostAttackDiscoveryBulk
      requestBody:
        content:
          application/json:
            examples:
              PostAttackDiscoveryBulkRequestBodyExample:
                summary: Acknowledge two Attack discoveries in bulk.
                value:
                  update:
                    enable_field_rendering: false
                    ids:
                      - c0c8a8bbb4a6561856a974ee9e461f0c82e673a1f0d83f86c5a8d80fc8de4c4f
                      - 5aa8f2900c0b03854b3b1a52a19558c5ea9893865c78235d4ad3dcc46196f4c7
                    kibana_alert_workflow_status: acknowledged
                    with_replacements: true
            schema:
              type: object
              properties:
                update:
                  description: Configuration object containing all parameters for the bulk update operation
                  type: object
                  properties:
                    enable_field_rendering:
                      default: false
                      description: Enables a markdown syntax used to render pivot fields, for example `{{ user.name james }}`. When disabled, the same example would be rendered as `james`. This is primarily used for Attack Discovery views within Kibana. Defaults to `false`.
                      example: false
                      type: boolean
                    ids:
                      description: Array of Attack Discovery IDs to update
                      example:
                        - c0c8a8bbb4a6561856a974ee9e461f0c82e673a1f0d83f86c5a8d80fc8de4c4f
                        - 5aa8f2900c0b03854b3b1a52a19558c5ea9893865c78235d4ad3dcc46196f4c7
                      items:
                        type: string
                      type: array
                    kibana_alert_workflow_status:
                      description: When provided, update the kibana.alert.workflow_status of the attack discovery alerts
                      enum:
                        - open
                        - acknowledged
                        - closed
                      example: acknowledged
                      type: string
                    visibility:
                      description: When provided, update the visibility of the alert, as determined by the kibana.alert.attack_discovery.users field
                      enum:
                        - not_shared
                        - shared
                      example: shared
                      type: string
                    with_replacements:
                      default: true
                      description: When true, returns the updated Attack discoveries with text replacements applied to the detailsMarkdown, entitySummaryMarkdown, summaryMarkdown, and title fields. This substitutes anonymized values with human-readable equivalents. Defaults to `true`.
                      example: true
                      type: boolean
                  required:
                    - ids
              required:
                - update
        description: Bulk update parameters for Attack discoveries
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                PostAttackDiscoveryBulkResponse200Example:
                  summary: A successful bulk update response containing the modified Attack discoveries.
                  value:
                    data:
                      - alert_ids:
                          - alert-abc-1
                        alert_workflow_status: acknowledged
                        connector_id: gen-ai-connector
                        connector_name: OpenAI GPT-4
                        details_markdown: '- **Host** `workstation-01` showed credential access patterns consistent with mimikatz.'
                        generation_uuid: 550e8400-e29b-41d4-a716-446655440000
                        id: c0c8a8bbb4a6561856a974ee9e461f0c82e673a1f0d83f86c5a8d80fc8de4c4f
                        summary_markdown: A user account was compromised using mimikatz to dump credentials.
                        timestamp: '2024-01-15T10:00:00.000Z'
                        title: Credential theft via mimikatz
              schema:
                type: object
                properties:
                  data:
                    description: Array of updated Attack Discovery alert objects. Each item includes the applied modifications from the bulk update request.
                    items:
                      $ref: '#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryApiAlert'
                    type: array
                required:
                  - data
          description: Indicates a successful call.
        '400':
          content:
            application/json:
              examples:
                PostAttackDiscoveryBulkResponse400Example:
                  summary: Bad Request error returned when the bulk update payload is invalid.
                  value:
                    error: Bad Request
                    message: Invalid request parameters.
                    status_code: 400
              schema:
                type: object
                properties:
                  error:
                    description: Error type
                    example: Bad Request
                    type: string
                  message:
                    description: Human-readable error message describing what went wrong with the bulk update request
                    example: Invalid request parameters.
                    type: string
                  status_code:
                    description: HTTP status code
                    example: 400
                    type: number
                required:
                  - status_code
                  - error
                  - message
          description: Bad Request response.
      summary: Bulk update Attack discoveries
      tags:
        - Security Attack discovery API
      x-codeSamples:
        - label: Example request
          lang: curl
          source: |
            curl \
             --request POST 'http://localhost:5601/api/attack_discovery/_bulk' \
             --header "Authorization: $API_KEY" \
             --header "Content-Type: application/json" \
             --data-raw '{
               "update": {
                 "ids": [
                   "c0c8a8bbb4a6561856a974ee9e461f0c82e673a1f0d83f86c5a8d80fc8de4c4f",
                   "5aa8f2900c0b03854b3b1a52a19558c5ea9893865c78235d4ad3dcc46196f4c7"
                 ],
                 "kibana_alert_workflow_status": "acknowledged"
               }
             }'
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/attack_discovery/_find:
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/attack_discovery/_find</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Find Attack discoveries that match the search criteria. Supports free text search, filtering, pagination, and sorting.
      operationId: AttackDiscoveryFind
      parameters:
        - description: Filter results to Attack discoveries that include any of the provided alert IDs
          in: query
          name: alert_ids
          required: false
          schema:
            items:
              type: string
            type: array
        - description: Filter results to Attack discoveries created by any of the provided human readable connector names. Note that values must match the human readable `connector_name` property of an Attack discovery, e.g. "GPT-5 Chat", which are distinct from `connector_id` values used to generate Attack discoveries.
          in: query
          name: connector_names
          required: false
          schema:
            items:
              type: string
            type: array
        - description: Enables a markdown syntax used to render pivot fields, for example `{{ user.name james }}`. When disabled, the same example would be rendered as `james`. This is primarily used for Attack Discovery views within Kibana. Defaults to `false`.
          example: false
          in: query
          name: enable_field_rendering
          required: false
          schema:
            default: false
            type: boolean
        - description: End of the time range for the search. Accepts absolute timestamps (ISO 8601) or relative date math (e.g. "now", "now-24h").
          example: now
          in: query
          name: end
          required: false
          schema:
            type: string
        - description: Filter results to the Attack discoveries with the specified IDs
          in: query
          name: ids
          required: false
          schema:
            items:
              type: string
            type: array
        - description: If `true`, the response will include `unique_alert_ids` and `unique_alert_ids_count` aggregated across the matched Attack discoveries
          example: false
          in: query
          name: include_unique_alert_ids
          required: false
          schema:
            type: boolean
        - description: Page number to return (used for pagination). Defaults to 1.
          example: 1
          in: query
          name: page
          required: false
          schema:
            default: 1
            minimum: 1
            type: integer
        - description: Number of Attack discoveries to return per page (used for pagination). Defaults to 10.
          example: 10
          in: query
          name: per_page
          required: false
          schema:
            default: 10
            minimum: 1
            type: integer
        - description: Free-text search query applied to relevant text fields of Attack discoveries (title, description, tags, etc.)
          example: ''
          in: query
          name: search
          required: false
          schema:
            type: string
        - description: Whether to filter by shared visibility. If omitted, both shared and privately visible Attack discoveries are returned. Use `true` to return only shared discoveries, `false` to return only those visible to the current user. Mutually exclusive with `include_all_authors`.
          in: query
          name: shared
          required: false
          schema:
            type: boolean
        - description: If `true`, the response will include all attack discoveries matching other criteria regardless of who created them. Mutually exclusive with `shared`.
          in: query
          name: include_all_authors
          required: false
          schema:
            type: boolean
        - description: Whether to filter by scheduled or ad-hoc attack discoveries. If omitted, both types of attack discoveries are returned. Use `true` to return only scheduled discoveries or `false` to return only ad-hoc discoveries.
          in: query
          name: scheduled
          required: false
          schema:
            type: boolean
        - description: Field used to sort results. See `AttackDiscoveryFindSortField` for allowed values.
          example: '@timestamp'
          in: query
          name: sort_field
          required: false
          schema:
            $ref: '#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryFindSortField'
            default: '@timestamp'
        - description: Sort order direction `asc` for ascending or `desc` for descending. Defaults to `desc`.
          example: desc
          in: query
          name: sort_order
          required: false
          schema:
            $ref: '#/components/schemas/Security_Attack_discovery_API_SortOrder'
            default: desc
        - description: Start of the time range for the search. Accepts absolute timestamps (ISO 8601) or relative date math (e.g. "now-7d").
          example: now-24h
          in: query
          name: start
          required: false
          schema:
            type: string
        - description: Filter by alert workflow status. Provide one or more of the allowed workflow states.
          example:
            - open
            - acknowledged
          in: query
          name: status
          required: false
          schema:
            items:
              enum:
                - acknowledged
                - closed
                - open
              type: string
            type: array
        - description: When true, return the created Attack discoveries with text replacements applied to the detailsMarkdown, entitySummaryMarkdown, summaryMarkdown, and title fields. Defaults to `true`.
          example: true
          in: query
          name: with_replacements
          required: false
          schema:
            default: true
            type: boolean
      responses:
        '200':
          content:
            application/json:
              examples:
                AttackDiscoveryFindResponse200Example:
                  summary: Paginated list of Attack discoveries matching the search criteria.
                  value:
                    connector_names:
                      - GPT-5 Chat
                    data:
                      - connector_name: GPT-5 Chat
                        id: c0c8a8bbb4a6561856a974ee9e461f0c82e673a1f0d83f86c5a8d80fc8de4c4f
                        title: Suspicious process execution on host-01
                    page: 1
                    per_page: 10
                    total: 1
                    unique_alert_ids_count: 0
              schema:
                type: object
                properties:
                  connector_names:
                    description: List of human readable connector names that are present in the matched Attack discoveries. Useful for building client filters or summaries.
                    items:
                      type: string
                    type: array
                  data:
                    description: Array of matched Attack discovery objects. Each item follows the `AttackDiscoveryApiAlert` schema.
                    items:
                      $ref: '#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryApiAlert'
                    type: array
                  page:
                    description: Current page number of the paginated result set.
                    type: integer
                  per_page:
                    description: Number of items requested per page.
                    type: integer
                  total:
                    description: Total number of Attack discoveries matching the query (across all pages).
                    type: integer
                  unique_alert_ids:
                    description: List of unique alert IDs aggregated from the matched Attack discoveries. Only present if `include_unique_alert_ids=true` in the request.
                    items:
                      type: string
                    type: array
                  unique_alert_ids_count:
                    description: Number of unique alert IDs across all matched Attack discoveries. Only present if `include_unique_alert_ids=true` in the request.
                    type: integer
                required:
                  - connector_names
                  - data
                  - page
                  - per_page
                  - total
                  - unique_alert_ids_count
          description: Indicates a successful call.
        '400':
          content:
            application/json:
              examples:
                AttackDiscoveryFindResponse400Example:
                  summary: Bad Request error returned when find query parameters are invalid.
                  value:
                    error: Bad Request
                    message: Invalid request payload.
                    status_code: 400
              schema:
                type: object
                properties:
                  error:
                    description: Error type
                    example: Bad Request
                    type: string
                  message:
                    description: Human-readable error message
                    example: Invalid request payload.
                    type: string
                  status_code:
                    description: HTTP status code
                    example: 400
                    type: number
          description: Bad Request response.
      summary: Find Attack discoveries that match the search criteria
      tags:
        - Security Attack discovery API
      x-codeSamples:
        - label: Example request
          lang: curl
          source: |
            curl \
             --request GET 'http://localhost:5601/api/attack_discovery/_find?end=now&include_unique_alert_ids=false&page=1&per_page=10&search=&sort_field=%40timestamp&sort_order=desc&start=now-24h&status=open&status=acknowledged' \
             --header "Authorization: $API_KEY" \
             --header "Content-Type: application/json"
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/attack_discovery/_generate:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/attack_discovery/_generate</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Initiates the generation of attack discoveries by analyzing security alerts using AI. Returns an execution UUID that can be used to track the generation progress and retrieve results. Results may also be retrieved via the find endpoint.
      operationId: PostAttackDiscoveryGenerate
      requestBody:
        content:
          application/json:
            examples:
              PostAttackDiscoveryGenerateRequestBodyExample:
                summary: Generate Attack discoveries from alerts in the last 24 hours.
                value:
                  alertsIndexPattern: .alerts-security.alerts-default
                  anonymizationFields:
                    - allowed: true
                      anonymized: true
                      field: host.name
                    - allowed: true
                      anonymized: true
                      field: user.name
                    - allowed: true
                      anonymized: false
                      field: process.name
                  apiConfig:
                    actionTypeId: .gen-ai
                    connectorId: 12345678-1234-1234-1234-123456789012
                  connectorName: GPT-5 Chat
                  end: now
                  replacements: {}
                  size: 100
                  start: now-24h
                  subAction: invokeAI
            schema:
              $ref: '#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryGenerationConfig'
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                PostAttackDiscoveryGenerateResponse200Example:
                  summary: Generation started; use the returned execution UUID to track progress.
                  value:
                    execution_uuid: edd26039-0990-4d9f-9829-2a1fcacb77b5
              schema:
                type: object
                properties:
                  execution_uuid:
                    $ref: '#/components/schemas/Security_Attack_discovery_API_NonEmptyString'
                    description: The unique identifier for the attack discovery generation process. Use this UUID to track the generation progress and retrieve results via the find endpoint.
                    example: edd26039-0990-4d9f-9829-2a1fcacb77b5
                required:
                  - execution_uuid
          description: Indicates a successful call.
        '400':
          content:
            application/json:
              examples:
                PostAttackDiscoveryGenerateResponse400Example:
                  summary: Bad Request error returned when the generate payload is invalid.
                  value:
                    error: Bad Request
                    message: Invalid request parameters.
                    status_code: 400
              schema:
                type: object
                properties:
                  error:
                    description: Error type
                    example: Bad Request
                    type: string
                  message:
                    description: Human-readable error message describing what went wrong
                    example: Invalid request parameters.
                    type: string
                  status_code:
                    description: HTTP status code
                    example: 400
                    type: number
                required:
                  - status_code
                  - error
                  - message
          description: Bad Request response.
      summary: Generate attack discoveries from alerts
      tags:
        - Security Attack discovery API
      x-codeSamples:
        - label: Example request
          lang: curl
          source: |
            curl \
             --request POST 'http://localhost:5601/api/attack_discovery/_generate' \
             --header "Authorization: $API_KEY" \
             --header "Content-Type: application/json" \
             --data '{
                "alertsIndexPattern": ".alerts-security.alerts-default",
                "anonymizationFields": [
                  {
                    "timestamp": "2025-07-30T13:33:44.029Z",
                    "createdAt": "2025-07-30T13:33:44.029Z",
                    "field": "@timestamp",
                    "allowed": true,
                    "anonymized": false,
                    "namespace": "default",
                    "id": "aKiJW5gB4U27o8XO8oLf"
                  },
                  {
                    "timestamp": "2025-07-30T13:33:44.029Z",
                    "createdAt": "2025-07-30T13:33:44.029Z",
                    "field": "Ransomware.feature",
                    "allowed": true,
                    "anonymized": false,
                    "namespace": "default",
                    "id": "saiJW5gB4U27o8XO8oLg"
                  },
                  {
                    "timestamp": "2025-07-30T13:33:44.029Z",
                    "createdAt": "2025-07-30T13:33:44.029Z",
                    "field": "Ransomware.files.data",
                    "allowed": true,
                    "anonymized": false,
                    "namespace": "default",
                    "id": "sqiJW5gB4U27o8XO8oLg"
                  },
                  {
                    "timestamp": "2025-07-30T13:33:44.029Z",
                    "createdAt": "2025-07-30T13:33:44.029Z",
                    "field": "Ransomware.files.entropy",
                    "allowed": true,
                    "anonymized": false,
                    "namespace": "default",
                    "id": "s6iJW5gB4U27o8XO8oLg"
                  },
                  {
                    "timestamp": "2025-07-30T13:33:44.029Z",
                    "createdAt": "2025-07-30T13:33:44.029Z",
                    "field": "Ransomware.files.extension",
                    "allowed": true,
                    "anonymized": false,
                    "namespace": "default",
                    "id": "tKiJW5gB4U27o8XO8oLg"
                  },
                  {
                    "timestamp": "2025-07-30T13:33:44.029Z",
                    "createdAt": "2025-07-30T13:33:44.029Z",
                    "field": "Ransomware.files.metrics",
                    "allowed": true,
                    "anonymized": false,
                    "namespace": "default",
                    "id": "taiJW5gB4U27o8XO8oLg"
                  },
                  {
                    "timestamp": "2025-07-30T13:33:44.029Z",
                    "createdAt": "2025-07-30T13:33:44.029Z",
                    "field": "Ransomware.files.operation",
                    "allowed": true,
                    "anonymized": false,
                    "namespace": "default",
                    "id": "tqiJW5gB4U27o8XO8oLg"
                  },
                  {
                    "timestamp": "2025-07-30T13:33:44.029Z",
                    "createdAt": "2025-07-30T13:33:44.029Z",
                    "field": "Ransomware.files.path",
                    "allowed": true,
                    "anonymized": false,
                    "namespace": "default",
                    "id": "t6iJW5gB4U27o8XO8oLg"
                  },
                  {
                    "timestamp": "2025-07-30T13:33:44.029Z",
                    "createdAt": "2025-07-30T13:33:44.029Z",
                    "field": "Ransomware.files.score",
                    "allowed": true,
                    "anonymized": false,
                    "namespace": "default",
                    "id": "uKiJW5gB4U27o8XO8oLg"
                  },
                  {
                    "timestamp": "2025-07-30T13:33:44.029Z",
                    "createdAt": "2025-07-30T13:33:44.029Z",
                    "field": "Ransomware.version",
                    "allowed": true,
                    "anonymized": false,
                    "namespace": "default",
                    "id": "uaiJW5gB4U27o8XO8oLg"
                  },
                  {
                    "timestamp": "2025-07-30T13:33:44.029Z",
                    "createdAt": "2025-07-30T13:33:44.029Z",
                    "field": "_id",
                    "allowed": true,
                    "anonymized": false,
                    "namespace": "default",
                    "id": "Z6iJW5gB4U27o8XO8oLf"
                  },
                  {
                    "timestamp": "2025-07-30T13:33:44.029Z",
                    "createdAt": "2025-07-30T13:33:44.029Z",
                    "field": "agent.id",
                    "allowed": true,
                    "anonymized": false,
                    "namespace": "default",
                    "id": "aaiJW5gB4U27o8XO8oLf"
                  },
                  {
                    "timestamp": "2025-07-30T13:33:44.029Z",
                    "createdAt": "2025-07-30T13:33:44.029Z",
                    "field": "cloud.availability_zone",
                    "allowed": true,
                    "anonymized": false,
                    "namespace": "default",
                    "id": "aqiJW5gB4U27o8XO8oLf"
                  },
                  {
                    "timestamp": "2025-07-30T13:33:44.029Z",
                    "createdAt": "2025-07-30T13:33:44.029Z",
                    "field": "cloud.provider",
                    "allowed": true,
                    "anonymized": false,
                    "namespace": "default",
                    "id": "a6iJW5gB4U27o8XO8oLf"
                  },
                  {
                    "timestamp": "2025-07-30T13:33:44.029Z",
                    "createdAt": "2025-07-30T13:33:44.029Z",
                    "field": "cloud.region",
                    "allowed": true,
                    "anonymized": false,
                    "namespace": "default",
                    "id": "bKiJW5gB4U27o8XO8oLf"
                  },
                  {
                    "timestamp": "2025-07-30T13:33:44.029Z",
                    "createdAt": "2025-07-30T13:33:44.029Z",
                    "field": "destination.ip",
                    "allowed": true,
                    "anonymized": false,
                    "namespace": "default",
                    "id": "baiJW5gB4U27o8XO8oLf"
                  },
                  {
                    "timestamp": "2025-07-30T13:33:44.029Z",
                    "createdAt": "2025-07-30T13:33:44.029Z",
                    "field": "dns.question.name",
                    "allowed": true,
                    "anonymized": false,
                    "namespace": "default",
                    "id": "bqiJW5gB4U27o8XO8oLf"
                  },
                  {
                    "timestamp": "2025-07-30T13:33:44.029Z",
                    "createdAt": "2025-07-30T13:33:44.029Z",
                    "field": "dns.question.type",
                    "allowed": true,
                    "anonymized": false,
                    "namespace": "default",
                    "id": "b6iJW5gB4U27o8XO8oLf"
                  },
                  {
                    "timestamp": "2025-07-30T13:33:44.029Z",
                    "createdAt": "2025-07-30T13:33:44.029Z",
                    "field": "event.category",
                    "allowed": true,
                    "anonymized": false,
                    "namespace": "default",
                    "id": "cKiJW5gB4U27o8XO8oLf"
                  },
                  {
                    "timestamp": "2025-07-30T13:33:44.029Z",
                    "createdAt": "2025-07-30T13:33:44.029Z",
                    "field": "event.dataset",
                    "allowed": true,
                    "anonymized": false,
                    "namespace": "default",
                    "id": "caiJW5gB4U27o8XO8oLf"
                  },
                  {
                    "timestamp": "2025-07-30T13:33:44.029Z",
                    "createdAt": "2025-07-30T13:33:44.029Z",
                    "field": "event.module",
                    "allowed": true,
                    "anonymized": false,
                    "namespace": "default",
                    "id": "cqiJW5gB4U27o8XO8oLf"
                  },
                  {
                    "timestamp": "2025-07-30T13:33:44.029Z",
                    "createdAt": "2025-07-30T13:33:44.029Z",
                    "field": "event.outcome",
                    "allowed": true,
                    "anonymized": false,
                    "namespace": "default",
                    "id": "c6iJW5gB4U27o8XO8oLf"
                  },
                  {
                    "timestamp": "2025-07-30T13:33:44.029Z",
                    "createdAt": "2025-07-30T13:33:44.029Z",
                    "field": "file.Ext.original.path",
                    "allowed": true,
                    "anonymized": false,
                    "namespace": "default",
                    "id": "dKiJW5gB4U27o8XO8oLg"
                  },
                  {
                    "timestamp": "2025-07-30T13:33:44.029Z",
                    "createdAt": "2025-07-30T13:33:44.029Z",
                    "field": "file.hash.sha256",
                    "allowed": true,
                    "anonymized": false,
                    "namespace": "default",
                    "id": "daiJW5gB4U27o8XO8oLg"
                  },
                  {
                    "timestamp": "2025-07-30T13:33:44.029Z",
                    "createdAt": "2025-07-30T13:33:44.029Z",
                    "field": "file.name",
                    "allowed": true,
                    "anonymized": false,
                    "namespace": "default",
                    "id": "dqiJW5gB4U27o8XO8oLg"
                  },
                  {
                    "timestamp": "2025-07-30T13:33:44.029Z",
                    "createdAt": "2025-07-30T13:33:44.029Z",
                    "field": "file.path",
                    "allowed": true,
                    "anonymized": false,
                    "namespace": "default",
                    "id": "d6iJW5gB4U27o8XO8oLg"
                  },
                  {
                    "timestamp": "2025-07-30T13:33:44.029Z",
                    "createdAt": "2025-07-30T13:33:44.029Z",
                    "field": "group.id",
                    "allowed": true,
                    "anonymized": false,
                    "namespace": "default",
                    "id": "eKiJW5gB4U27o8XO8oLg"
                  },
                  {
                    "timestamp": "2025-07-30T13:33:44.029Z",
                    "createdAt": "2025-07-30T13:33:44.029Z",
                    "field": "group.name",
                    "allowed": true,
                    "anonymized": false,
                    "namespace": "default",
                    "id": "eaiJW5gB4U27o8XO8oLg"
                  },
                  {
                    "timestamp": "2025-07-30T13:33:44.029Z",
                    "createdAt": "2025-07-30T13:33:44.029Z",
                    "field": "host.asset.criticality",
                    "allowed": true,
                    "anonymized": false,
                    "namespace": "default",
                    "id": "eqiJW5gB4U27o8XO8oLg"
                  },
                  {
                    "timestamp": "2025-07-30T13:33:44.029Z",
                    "createdAt": "2025-07-30T13:33:44.029Z",
                    "field": "host.name",
                    "allowed": true,
                    "anonymized": true,
                    "namespace": "default",
                    "id": "e6iJW5gB4U27o8XO8oLg"
                  },
                  {
                    "timestamp": "2025-07-30T13:33:44.029Z",
                    "createdAt": "2025-07-30T13:33:44.029Z",
                    "field": "host.os.name",
                    "allowed": true,
                    "anonymized": false,
                    "namespace": "default",
                    "id": "fKiJW5gB4U27o8XO8oLg"
                  },
                  {
                    "timestamp": "2025-07-30T13:33:44.029Z",
                    "createdAt": "2025-07-30T13:33:44.029Z",
                    "field": "host.os.version",
                    "allowed": true,
                    "anonymized": false,
                    "namespace": "default",
                    "id": "faiJW5gB4U27o8XO8oLg"
                  },
                  {
                    "timestamp": "2025-07-30T13:33:44.029Z",
                    "createdAt": "2025-07-30T13:33:44.029Z",
                    "field": "host.risk.calculated_level",
                    "allowed": true,
                    "anonymized": false,
                    "namespace": "default",
                    "id": "fqiJW5gB4U27o8XO8oLg"
                  },
                  {
                    "timestamp": "2025-07-30T13:33:44.029Z",
                    "createdAt": "2025-07-30T13:33:44.029Z",
                    "field": "host.risk.calculated_score_norm",
                    "allowed": true,
                    "anonymized": false,
                    "namespace": "default",
                    "id": "f6iJW5gB4U27o8XO8oLg"
                  },
                  {
                    "timestamp": "2025-07-30T13:33:44.029Z",
                    "createdAt": "2025-07-30T13:33:44.029Z",
                    "field": "kibana.alert.original_time",
                    "allowed": true,
                    "anonymized": false,
                    "namespace": "default",
                    "id": "gKiJW5gB4U27o8XO8oLg"
                  },
                  {
                    "timestamp": "2025-07-30T13:33:44.029Z",
                    "createdAt": "2025-07-30T13:33:44.029Z",
                    "field": "kibana.alert.risk_score",
                    "allowed": true,
                    "anonymized": false,
                    "namespace": "default",
                    "id": "gaiJW5gB4U27o8XO8oLg"
                  },
                  {
                    "timestamp": "2025-07-30T13:33:44.029Z",
                    "createdAt": "2025-07-30T13:33:44.029Z",
                    "field": "kibana.alert.rule.description",
                    "allowed": true,
                    "anonymized": false,
                    "namespace": "default",
                    "id": "gqiJW5gB4U27o8XO8oLg"
                  },
                  {
                    "timestamp": "2025-07-30T13:33:44.029Z",
                    "createdAt": "2025-07-30T13:33:44.029Z",
                    "field": "kibana.alert.rule.name",
                    "allowed": true,
                    "anonymized": false,
                    "namespace": "default",
                    "id": "g6iJW5gB4U27o8XO8oLg"
                  },
                  {
                    "timestamp": "2025-07-30T13:33:44.029Z",
                    "createdAt": "2025-07-30T13:33:44.029Z",
                    "field": "kibana.alert.rule.references",
                    "allowed": true,
                    "anonymized": false,
                    "namespace": "default",
                    "id": "hKiJW5gB4U27o8XO8oLg"
                  },
                  {
                    "timestamp": "2025-07-30T13:33:44.029Z",
                    "createdAt": "2025-07-30T13:33:44.029Z",
                    "field": "kibana.alert.rule.threat.framework",
                    "allowed": true,
                    "anonymized": false,
                    "namespace": "default",
                    "id": "haiJW5gB4U27o8XO8oLg"
                  },
                  {
                    "timestamp": "2025-07-30T13:33:44.029Z",
                    "createdAt": "2025-07-30T13:33:44.029Z",
                    "field": "kibana.alert.rule.threat.tactic.id",
                    "allowed": true,
                    "anonymized": false,
                    "namespace": "default",
                    "id": "hqiJW5gB4U27o8XO8oLg"
                  },
                  {
                    "timestamp": "2025-07-30T13:33:44.029Z",
                    "createdAt": "2025-07-30T13:33:44.029Z",
                    "field": "kibana.alert.rule.threat.tactic.name",
                    "allowed": true,
                    "anonymized": false,
                    "namespace": "default",
                    "id": "h6iJW5gB4U27o8XO8oLg"
                  },
                  {
                    "timestamp": "2025-07-30T13:33:44.029Z",
                    "createdAt": "2025-07-30T13:33:44.029Z",
                    "field": "kibana.alert.rule.threat.tactic.reference",
                    "allowed": true,
                    "anonymized": false,
                    "namespace": "default",
                    "id": "iKiJW5gB4U27o8XO8oLg"
                  },
                  {
                    "timestamp": "2025-07-30T13:33:44.029Z",
                    "createdAt": "2025-07-30T13:33:44.029Z",
                    "field": "kibana.alert.rule.threat.technique.id",
                    "allowed": true,
                    "anonymized": false,
                    "namespace": "default",
                    "id": "iaiJW5gB4U27o8XO8oLg"
                  },
                  {
                    "timestamp": "2025-07-30T13:33:44.029Z",
                    "createdAt": "2025-07-30T13:33:44.029Z",
                    "field": "kibana.alert.rule.threat.technique.name",
                    "allowed": true,
                    "anonymized": false,
                    "namespace": "default",
                    "id": "iqiJW5gB4U27o8XO8oLg"
                  },
                  {
                    "timestamp": "2025-07-30T13:33:44.029Z",
                    "createdAt": "2025-07-30T13:33:44.029Z",
                    "field": "kibana.alert.rule.threat.technique.reference",
                    "allowed": true,
                    "anonymized": false,
                    "namespace": "default",
                    "id": "i6iJW5gB4U27o8XO8oLg"
                  },
                  {
                    "timestamp": "2025-07-30T13:33:44.029Z",
                    "createdAt": "2025-07-30T13:33:44.029Z",
                    "field": "kibana.alert.rule.threat.technique.subtechnique.id",
                    "allowed": true,
                    "anonymized": false,
                    "namespace": "default",
                    "id": "jKiJW5gB4U27o8XO8oLg"
                  },
                  {
                    "timestamp": "2025-07-30T13:33:44.029Z",
                    "createdAt": "2025-07-30T13:33:44.029Z",
                    "field": "kibana.alert.rule.threat.technique.subtechnique.name",
                    "allowed": true,
                    "anonymized": false,
                    "namespace": "default",
                    "id": "jaiJW5gB4U27o8XO8oLg"
                  },
                  {
                    "timestamp": "2025-07-30T13:33:44.029Z",
                    "createdAt": "2025-07-30T13:33:44.029Z",
                    "field": "kibana.alert.rule.threat.technique.subtechnique.reference",
                    "allowed": true,
                    "anonymized": false,
                    "namespace": "default",
                    "id": "jqiJW5gB4U27o8XO8oLg"
                  },
                  {
                    "timestamp": "2025-07-30T13:33:44.029Z",
                    "createdAt": "2025-07-30T13:33:44.029Z",
                    "field": "kibana.alert.severity",
                    "allowed": true,
                    "anonymized": false,
                    "namespace": "default",
                    "id": "j6iJW5gB4U27o8XO8oLg"
                  },
                  {
                    "timestamp": "2025-07-30T13:33:44.029Z",
                    "createdAt": "2025-07-30T13:33:44.029Z",
                    "field": "kibana.alert.workflow_status",
                    "allowed": true,
                    "anonymized": false,
                    "namespace": "default",
                    "id": "kKiJW5gB4U27o8XO8oLg"
                  },
                  {
                    "timestamp": "2025-07-30T13:33:44.029Z",
                    "createdAt": "2025-07-30T13:33:44.029Z",
                    "field": "message",
                    "allowed": true,
                    "anonymized": false,
                    "namespace": "default",
                    "id": "kaiJW5gB4U27o8XO8oLg"
                  },
                  {
                    "timestamp": "2025-07-30T13:33:44.029Z",
                    "createdAt": "2025-07-30T13:33:44.029Z",
                    "field": "network.protocol",
                    "allowed": true,
                    "anonymized": false,
                    "namespace": "default",
                    "id": "kqiJW5gB4U27o8XO8oLg"
                  },
                  {
                    "timestamp": "2025-07-30T13:33:44.029Z",
                    "createdAt": "2025-07-30T13:33:44.029Z",
                    "field": "process.Ext.memory_region.bytes_compressed_present",
                    "allowed": true,
                    "anonymized": false,
                    "namespace": "default",
                    "id": "nKiJW5gB4U27o8XO8oLg"
                  },
                  {
                    "timestamp": "2025-07-30T13:33:44.029Z",
                    "createdAt": "2025-07-30T13:33:44.029Z",
                    "field": "process.Ext.memory_region.malware_signature.all_names",
                    "allowed": true,
                    "anonymized": false,
                    "namespace": "default",
                    "id": "naiJW5gB4U27o8XO8oLg"
                  },
                  {
                    "timestamp": "2025-07-30T13:33:44.029Z",
                    "createdAt": "2025-07-30T13:33:44.029Z",
                    "field": "process.Ext.memory_region.malware_signature.primary.matches",
                    "allowed": true,
                    "anonymized": false,
                    "namespace": "default",
                    "id": "nqiJW5gB4U27o8XO8oLg"
                  },
                  {
                    "timestamp": "2025-07-30T13:33:44.029Z",
                    "createdAt": "2025-07-30T13:33:44.029Z",
                    "field": "process.Ext.memory_region.malware_signature.primary.signature.name",
                    "allowed": true,
                    "anonymized": false,
                    "namespace": "default",
                    "id": "n6iJW5gB4U27o8XO8oLg"
                  },
                  {
                    "timestamp": "2025-07-30T13:33:44.029Z",
                    "createdAt": "2025-07-30T13:33:44.029Z",
                    "field": "process.Ext.token.integrity_level_name",
                    "allowed": true,
                    "anonymized": false,
                    "namespace": "default",
                    "id": "oKiJW5gB4U27o8XO8oLg"
                  },
                  {
                    "timestamp": "2025-07-30T13:33:44.029Z",
                    "createdAt": "2025-07-30T13:33:44.029Z",
                    "field": "process.args",
                    "allowed": true,
                    "anonymized": false,
                    "namespace": "default",
                    "id": "k6iJW5gB4U27o8XO8oLg"
                  },
                  {
                    "timestamp": "2025-07-30T13:33:44.029Z",
                    "createdAt": "2025-07-30T13:33:44.029Z",
                    "field": "process.code_signature.exists",
                    "allowed": true,
                    "anonymized": false,
                    "namespace": "default",
                    "id": "lKiJW5gB4U27o8XO8oLg"
                  },
                  {
                    "timestamp": "2025-07-30T13:33:44.029Z",
                    "createdAt": "2025-07-30T13:33:44.029Z",
                    "field": "process.code_signature.signing_id",
                    "allowed": true,
                    "anonymized": false,
                    "namespace": "default",
                    "id": "laiJW5gB4U27o8XO8oLg"
                  },
                  {
                    "timestamp": "2025-07-30T13:33:44.029Z",
                    "createdAt": "2025-07-30T13:33:44.029Z",
                    "field": "process.code_signature.status",
                    "allowed": true,
                    "anonymized": false,
                    "namespace": "default",
                    "id": "lqiJW5gB4U27o8XO8oLg"
                  },
                  {
                    "timestamp": "2025-07-30T13:33:44.029Z",
                    "createdAt": "2025-07-30T13:33:44.029Z",
                    "field": "process.code_signature.subject_name",
                    "allowed": true,
                    "anonymized": false,
                    "namespace": "default",
                    "id": "l6iJW5gB4U27o8XO8oLg"
                  },
                  {
                    "timestamp": "2025-07-30T13:33:44.029Z",
                    "createdAt": "2025-07-30T13:33:44.029Z",
                    "field": "process.code_signature.trusted",
                    "allowed": true,
                    "anonymized": false,
                    "namespace": "default",
                    "id": "mKiJW5gB4U27o8XO8oLg"
                  },
                  {
                    "timestamp": "2025-07-30T13:33:44.029Z",
                    "createdAt": "2025-07-30T13:33:44.029Z",
                    "field": "process.command_line",
                    "allowed": true,
                    "anonymized": false,
                    "namespace": "default",
                    "id": "maiJW5gB4U27o8XO8oLg"
                  },
                  {
                    "timestamp": "2025-07-30T13:33:44.029Z",
                    "createdAt": "2025-07-30T13:33:44.029Z",
                    "field": "process.executable",
                    "allowed": true,
                    "anonymized": false,
                    "namespace": "default",
                    "id": "mqiJW5gB4U27o8XO8oLg"
                  },
                  {
                    "timestamp": "2025-07-30T13:33:44.029Z",
                    "createdAt": "2025-07-30T13:33:44.029Z",
                    "field": "process.exit_code",
                    "allowed": true,
                    "anonymized": false,
                    "namespace": "default",
                    "id": "m6iJW5gB4U27o8XO8oLg"
                  },
                  {
                    "timestamp": "2025-07-30T13:33:44.029Z",
                    "createdAt": "2025-07-30T13:33:44.029Z",
                    "field": "process.hash.md5",
                    "allowed": true,
                    "anonymized": false,
                    "namespace": "default",
                    "id": "oaiJW5gB4U27o8XO8oLg"
                  },
                  {
                    "timestamp": "2025-07-30T13:33:44.029Z",
                    "createdAt": "2025-07-30T13:33:44.029Z",
                    "field": "process.hash.sha1",
                    "allowed": true,
                    "anonymized": false,
                    "namespace": "default",
                    "id": "oqiJW5gB4U27o8XO8oLg"
                  },
                  {
                    "timestamp": "2025-07-30T13:33:44.029Z",
                    "createdAt": "2025-07-30T13:33:44.029Z",
                    "field": "process.hash.sha256",
                    "allowed": true,
                    "anonymized": false,
                    "namespace": "default",
                    "id": "o6iJW5gB4U27o8XO8oLg"
                  },
                  {
                    "timestamp": "2025-07-30T13:33:44.029Z",
                    "createdAt": "2025-07-30T13:33:44.029Z",
                    "field": "process.name",
                    "allowed": true,
                    "anonymized": false,
                    "namespace": "default",
                    "id": "pKiJW5gB4U27o8XO8oLg"
                  },
                  {
                    "timestamp": "2025-07-30T13:33:44.029Z",
                    "createdAt": "2025-07-30T13:33:44.029Z",
                    "field": "process.parent.args",
                    "allowed": true,
                    "anonymized": false,
                    "namespace": "default",
                    "id": "paiJW5gB4U27o8XO8oLg"
                  },
                  {
                    "timestamp": "2025-07-30T13:33:44.029Z",
                    "createdAt": "2025-07-30T13:33:44.029Z",
                    "field": "process.parent.args_count",
                    "allowed": true,
                    "anonymized": false,
                    "namespace": "default",
                    "id": "pqiJW5gB4U27o8XO8oLg"
                  },
                  {
                    "timestamp": "2025-07-30T13:33:44.029Z",
                    "createdAt": "2025-07-30T13:33:44.029Z",
                    "field": "process.parent.code_signature.exists",
                    "allowed": true,
                    "anonymized": false,
                    "namespace": "default",
                    "id": "p6iJW5gB4U27o8XO8oLg"
                  },
                  {
                    "timestamp": "2025-07-30T13:33:44.029Z",
                    "createdAt": "2025-07-30T13:33:44.029Z",
                    "field": "process.parent.code_signature.status",
                    "allowed": true,
                    "anonymized": false,
                    "namespace": "default",
                    "id": "qKiJW5gB4U27o8XO8oLg"
                  },
                  {
                    "timestamp": "2025-07-30T13:33:44.029Z",
                    "createdAt": "2025-07-30T13:33:44.029Z",
                    "field": "process.parent.code_signature.subject_name",
                    "allowed": true,
                    "anonymized": false,
                    "namespace": "default",
                    "id": "qaiJW5gB4U27o8XO8oLg"
                  },
                  {
                    "timestamp": "2025-07-30T13:33:44.029Z",
                    "createdAt": "2025-07-30T13:33:44.029Z",
                    "field": "process.parent.code_signature.trusted",
                    "allowed": true,
                    "anonymized": false,
                    "namespace": "default",
                    "id": "qqiJW5gB4U27o8XO8oLg"
                  },
                  {
                    "timestamp": "2025-07-30T13:33:44.029Z",
                    "createdAt": "2025-07-30T13:33:44.029Z",
                    "field": "process.parent.command_line",
                    "allowed": true,
                    "anonymized": false,
                    "namespace": "default",
                    "id": "q6iJW5gB4U27o8XO8oLg"
                  },
                  {
                    "timestamp": "2025-07-30T13:33:44.029Z",
                    "createdAt": "2025-07-30T13:33:44.029Z",
                    "field": "process.parent.executable",
                    "allowed": true,
                    "anonymized": false,
                    "namespace": "default",
                    "id": "rKiJW5gB4U27o8XO8oLg"
                  },
                  {
                    "timestamp": "2025-07-30T13:33:44.029Z",
                    "createdAt": "2025-07-30T13:33:44.029Z",
                    "field": "process.parent.name",
                    "allowed": true,
                    "anonymized": false,
                    "namespace": "default",
                    "id": "raiJW5gB4U27o8XO8oLg"
                  },
                  {
                    "timestamp": "2025-07-30T13:33:44.029Z",
                    "createdAt": "2025-07-30T13:33:44.029Z",
                    "field": "process.pe.original_file_name",
                    "allowed": true,
                    "anonymized": false,
                    "namespace": "default",
                    "id": "rqiJW5gB4U27o8XO8oLg"
                  },
                  {
                    "timestamp": "2025-07-30T13:33:44.029Z",
                    "createdAt": "2025-07-30T13:33:44.029Z",
                    "field": "process.pid",
                    "allowed": true,
                    "anonymized": false,
                    "namespace": "default",
                    "id": "r6iJW5gB4U27o8XO8oLg"
                  },
                  {
                    "timestamp": "2025-07-30T13:33:44.029Z",
                    "createdAt": "2025-07-30T13:33:44.029Z",
                    "field": "process.working_directory",
                    "allowed": true,
                    "anonymized": false,
                    "namespace": "default",
                    "id": "sKiJW5gB4U27o8XO8oLg"
                  },
                  {
                    "timestamp": "2025-07-30T13:33:44.029Z",
                    "createdAt": "2025-07-30T13:33:44.029Z",
                    "field": "rule.name",
                    "allowed": true,
                    "anonymized": false,
                    "namespace": "default",
                    "id": "uqiJW5gB4U27o8XO8oLg"
                  },
                  {
                    "timestamp": "2025-07-30T13:33:44.029Z",
                    "createdAt": "2025-07-30T13:33:44.029Z",
                    "field": "rule.reference",
                    "allowed": true,
                    "anonymized": false,
                    "namespace": "default",
                    "id": "u6iJW5gB4U27o8XO8oLg"
                  },
                  {
                    "timestamp": "2025-07-30T13:33:44.029Z",
                    "createdAt": "2025-07-30T13:33:44.029Z",
                    "field": "source.ip",
                    "allowed": true,
                    "anonymized": false,
                    "namespace": "default",
                    "id": "vKiJW5gB4U27o8XO8oLg"
                  },
                  {
                    "timestamp": "2025-07-30T13:33:44.029Z",
                    "createdAt": "2025-07-30T13:33:44.029Z",
                    "field": "threat.framework",
                    "allowed": true,
                    "anonymized": false,
                    "namespace": "default",
                    "id": "vaiJW5gB4U27o8XO8oLg"
                  },
                  {
                    "timestamp": "2025-07-30T13:33:44.029Z",
                    "createdAt": "2025-07-30T13:33:44.029Z",
                    "field": "threat.tactic.id",
                    "allowed": true,
                    "anonymized": false,
                    "namespace": "default",
                    "id": "vqiJW5gB4U27o8XO8oLg"
                  },
                  {
                    "timestamp": "2025-07-30T13:33:44.029Z",
                    "createdAt": "2025-07-30T13:33:44.029Z",
                    "field": "threat.tactic.name",
                    "allowed": true,
                    "anonymized": false,
                    "namespace": "default",
                    "id": "v6iJW5gB4U27o8XO8oLg"
                  },
                  {
                    "timestamp": "2025-07-30T13:33:44.029Z",
                    "createdAt": "2025-07-30T13:33:44.029Z",
                    "field": "threat.tactic.reference",
                    "allowed": true,
                    "anonymized": false,
                    "namespace": "default",
                    "id": "wKiJW5gB4U27o8XO8oLg"
                  },
                  {
                    "timestamp": "2025-07-30T13:33:44.029Z",
                    "createdAt": "2025-07-30T13:33:44.029Z",
                    "field": "threat.technique.id",
                    "allowed": true,
                    "anonymized": false,
                    "namespace": "default",
                    "id": "waiJW5gB4U27o8XO8oLg"
                  },
                  {
                    "timestamp": "2025-07-30T13:33:44.029Z",
                    "createdAt": "2025-07-30T13:33:44.029Z",
                    "field": "threat.technique.name",
                    "allowed": true,
                    "anonymized": false,
                    "namespace": "default",
                    "id": "wqiJW5gB4U27o8XO8oLg"
                  },
                  {
                    "timestamp": "2025-07-30T13:33:44.029Z",
                    "createdAt": "2025-07-30T13:33:44.029Z",
                    "field": "threat.technique.reference",
                    "allowed": true,
                    "anonymized": false,
                    "namespace": "default",
                    "id": "w6iJW5gB4U27o8XO8oLg"
                  },
                  {
                    "timestamp": "2025-07-30T13:33:44.029Z",
                    "createdAt": "2025-07-30T13:33:44.029Z",
                    "field": "threat.technique.subtechnique.id",
                    "allowed": true,
                    "anonymized": false,
                    "namespace": "default",
                    "id": "xKiJW5gB4U27o8XO8oLg"
                  },
                  {
                    "timestamp": "2025-07-30T13:33:44.029Z",
                    "createdAt": "2025-07-30T13:33:44.029Z",
                    "field": "threat.technique.subtechnique.name",
                    "allowed": true,
                    "anonymized": false,
                    "namespace": "default",
                    "id": "xaiJW5gB4U27o8XO8oLg"
                  },
                  {
                    "timestamp": "2025-07-30T13:33:44.029Z",
                    "createdAt": "2025-07-30T13:33:44.029Z",
                    "field": "threat.technique.subtechnique.reference",
                    "allowed": true,
                    "anonymized": false,
                    "namespace": "default",
                    "id": "xqiJW5gB4U27o8XO8oLg"
                  },
                  {
                    "timestamp": "2025-07-30T13:33:44.029Z",
                    "createdAt": "2025-07-30T13:33:44.029Z",
                    "field": "user.asset.criticality",
                    "allowed": true,
                    "anonymized": false,
                    "namespace": "default",
                    "id": "x6iJW5gB4U27o8XO8oLg"
                  },
                  {
                    "timestamp": "2025-07-30T13:33:44.029Z",
                    "createdAt": "2025-07-30T13:33:44.029Z",
                    "field": "user.domain",
                    "allowed": true,
                    "anonymized": false,
                    "namespace": "default",
                    "id": "yKiJW5gB4U27o8XO8oLg"
                  },
                  {
                    "timestamp": "2025-07-30T13:33:44.029Z",
                    "createdAt": "2025-07-30T13:33:44.029Z",
                    "field": "user.name",
                    "allowed": true,
                    "anonymized": true,
                    "namespace": "default",
                    "id": "yaiJW5gB4U27o8XO8oLg"
                  },
                  {
                    "timestamp": "2025-07-30T13:33:44.029Z",
                    "createdAt": "2025-07-30T13:33:44.029Z",
                    "field": "user.risk.calculated_level",
                    "allowed": true,
                    "anonymized": false,
                    "namespace": "default",
                    "id": "yqiJW5gB4U27o8XO8oLg"
                  },
                  {
                    "timestamp": "2025-07-30T13:33:44.029Z",
                    "createdAt": "2025-07-30T13:33:44.029Z",
                    "field": "user.risk.calculated_score_norm",
                    "allowed": true,
                    "anonymized": false,
                    "namespace": "default",
                    "id": "y6iJW5gB4U27o8XO8oLg"
                  },
                  {
                    "timestamp": "2025-07-30T13:33:44.029Z",
                    "createdAt": "2025-07-30T13:33:44.029Z",
                    "field": "user.target.name",
                    "allowed": true,
                    "anonymized": true,
                    "namespace": "default",
                    "id": "zKiJW5gB4U27o8XO8oLg"
                  }
                ],
                "replacements": {},
                "size": 100,
                "subAction": "invokeAI",
                "apiConfig": {
                  "connectorId": "12345678-1234-1234-1234-123456789012",
                  "actionTypeId": ".gen-ai"
                },
                "connectorName": "GPT-5 Chat",
                "end": "now",
                "start": "now-24h"
              }'
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/attack_discovery/generations:
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/attack_discovery/generations</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Get the latest Attack Discovery generations metadata (that are not dismissed) for the current user. This endpoint retrieves generation metadata including execution status and statistics for Attack Discovery generations.
      operationId: GetAttackDiscoveryGenerations
      parameters:
        - description: End of the time range for filtering generations. Accepts absolute timestamps (ISO 8601) or relative date math (e.g. "now", "now-24h").
          example: now
          in: query
          name: end
          required: false
          schema:
            type: string
        - description: The maximum number of generations to retrieve
          example: 50
          in: query
          name: size
          required: false
          schema:
            default: 50
            minimum: 1
            type: number
        - description: Whether to filter by scheduled or ad-hoc attack discovery generations. If omitted, both types are returned. Use `true` to return only scheduled generations or `false` to return only ad-hoc (interactive or action-triggered) generations.
          in: query
          name: scheduled
          required: false
          schema:
            type: boolean
        - description: Start of the time range for filtering generations. Accepts absolute timestamps (ISO 8601) or relative date math (e.g. "now-7d").
          example: now-24h
          in: query
          name: start
          required: false
          schema:
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                GetAttackDiscoveryGenerationsResponse200Example:
                  summary: Latest Attack Discovery generation metadata for the current user.
                  value:
                    generations:
                      - alerts_context_count: 75
                        connector_id: chatGpt5_0ChatAzure
                        discoveries: 3
                        end: '2025-09-29T06:42:44.810Z'
                        execution_uuid: 46b218d5-535d-4329-be56-d0f6af6986b7
                        loading_message: AI is analyzing up to 100 alerts in the last 24 hours to generate discoveries.
                        start: '2025-09-29T06:42:08.962Z'
                        status: succeeded
              schema:
                type: object
                properties:
                  generations:
                    description: List of Attack Discovery generations
                    items:
                      $ref: '#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryGeneration'
                    type: array
                required:
                  - generations
          description: Indicates a successful call.
        '400':
          content:
            application/json:
              examples:
                GetAttackDiscoveryGenerationsResponse400Example:
                  summary: Bad Request error returned when the size parameter is invalid.
                  value:
                    error: Bad Request
                    message: Invalid size parameter. Must be a positive number.
                    status_code: 400
              schema:
                type: object
                properties:
                  error:
                    description: Error type
                    example: Bad Request
                    type: string
                  message:
                    description: Human-readable error message
                    example: Invalid size parameter. Must be a positive number.
                    type: string
                  status_code:
                    description: HTTP status code
                    example: 400
                    type: number
          description: Bad Request response.
      summary: Get the latest Attack Discovery generations metadata for the current user
      tags:
        - Security Attack discovery API
      x-codeSamples:
        - label: Example request
          lang: curl
          source: |
            curl \
             --request GET 'http://localhost:5601/api/attack_discovery/generations?size=50&start=now-24h&end=now' \
             --header "Authorization: $API_KEY" \
             --header "Content-Type: application/json"
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/attack_discovery/generations/{execution_uuid}:
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/attack_discovery/generations/{execution_uuid}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Returns a specific Attack Discovery generation, including all generated Attack discoveries and associated metadata, including execution status and statistics.
      operationId: GetAttackDiscoveryGeneration
      parameters:
        - description: The unique identifier for the Attack Discovery generation execution. This UUID is returned at the start of an Attack Discovery generation.
          example: 2e13f386-46cf-4d65-9e2b-68609e132ba5
          in: path
          name: execution_uuid
          required: true
          schema:
            $ref: '#/components/schemas/Security_Attack_discovery_API_NonEmptyString'
        - description: Enables a markdown syntax used to render pivot fields, for example `{{ user.name james }}`. When disabled, the same example would be rendered as `james`. This is primarily used for Attack Discovery views within Kibana. Defaults to `false`.
          example: false
          in: query
          name: enable_field_rendering
          required: false
          schema:
            default: false
            type: boolean
        - description: When true, return the created Attack discoveries with text replacements applied to the detailsMarkdown, entitySummaryMarkdown, summaryMarkdown, and title fields. Defaults to `true`.
          example: true
          in: query
          name: with_replacements
          required: false
          schema:
            default: true
            type: boolean
      responses:
        '200':
          content:
            application/json:
              examples:
                GetAttackDiscoveryGenerationResponse200Example:
                  summary: Single Attack Discovery generation with its discoveries and metadata.
                  value:
                    data:
                      - id: c0c8a8bbb4a6561856a974ee9e461f0c82e673a1f0d83f86c5a8d80fc8de4c4f
                        title: Suspicious process execution on host-01
                    generation:
                      alerts_context_count: 50
                      discoveries: 1
                      end: '2025-09-29T06:42:44.810Z'
                      execution_uuid: 2e13f386-46cf-4d65-9e2b-68609e132ba5
                      start: '2025-09-29T06:42:08.962Z'
                      status: succeeded
              schema:
                type: object
                properties:
                  data:
                    description: Array of Attack discoveries generated during this execution.
                    items:
                      $ref: '#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryApiAlert'
                    type: array
                  generation:
                    $ref: '#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryGeneration'
                    description: Optional metadata about the attack discovery generation process, metadata including execution status and statistics. This metadata may not be available for all generations.
                required:
                  - data
          description: Indicates a successful call.
        '400':
          content:
            application/json:
              examples:
                GetAttackDiscoveryGenerationResponse400Example:
                  summary: Bad Request error returned when the get-generation request is invalid.
                  value:
                    error: Bad Request
                    message: Invalid request parameters.
                    status_code: 400
              schema:
                type: object
                properties:
                  error:
                    description: Error type
                    example: Bad Request
                    type: string
                  message:
                    description: Human-readable error message describing what went wrong with the request
                    example: Invalid request parameters.
                    type: string
                  status_code:
                    description: HTTP status code
                    example: 400
                    type: number
                required:
                  - status_code
                  - error
                  - message
          description: Bad Request response.
      summary: Get a single Attack Discovery generation, including its discoveries and (optional) generation metadata
      tags:
        - Security Attack discovery API
      x-codeSamples:
        - label: Example request
          lang: curl
          source: |
            curl \
             --request GET 'http://localhost:5601/api/attack_discovery/generations/2e13f386-46cf-4d65-9e2b-68609e132ba5' \
             --header "Authorization: $API_KEY" \
             --header "Content-Type: application/json"
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/attack_discovery/generations/{execution_uuid}/_dismiss:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/attack_discovery/generations/{execution_uuid}/_dismiss</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Dismisses an Attack Discovery generation for the current user, indicating that its status should not be reported in the UI. This sets the generation's status to "dismissed" and affects how the generation appears in subsequent queries.
      operationId: PostAttackDiscoveryGenerationsDismiss
      parameters:
        - description: The unique identifier for the Attack Discovery generation execution. This UUID is returned when an Attack Discovery generation is created and can be found in generation responses.
          example: 46b218d5-535d-4329-be56-d0f6af6986b7
          in: path
          name: execution_uuid
          required: true
          schema:
            $ref: '#/components/schemas/Security_Attack_discovery_API_NonEmptyString'
      responses:
        '200':
          content:
            application/json:
              examples:
                PostAttackDiscoveryGenerationsDismissResponse200Example:
                  summary: Successfully dismissed an Attack Discovery generation.
                  value:
                    alerts_context_count: 75
                    connector_id: chatGpt5_0ChatAzure
                    discoveries: 3
                    end: '2025-09-29T06:42:44.810Z'
                    execution_uuid: 46b218d5-535d-4329-be56-d0f6af6986b7
                    loading_message: AI is analyzing up to 100 alerts in the last 24 hours to generate discoveries.
                    start: '2025-09-29T06:42:08.962Z'
                    status: dismissed
              schema:
                type: object
                properties:
                  alerts_context_count:
                    description: The number of alerts that were sent as context to the LLM for this generation.
                    example: 75
                    type: number
                  connector_id:
                    description: The unique identifier of the connector used to generate the attack discoveries.
                    example: chatGpt5_0ChatAzure
                    type: string
                  connector_stats:
                    description: Statistical information about the connector's performance for this user, providing insights into usage patterns and success rates.
                    type: object
                    properties:
                      average_successful_duration_nanoseconds:
                        description: The average duration in nanoseconds for successful generations using this connector by the current user.
                        example: 47958500000
                        type: number
                      successful_generations:
                        description: The total number of Attack discoveries successfully created for this generation
                        example: 2
                        type: number
                  discoveries:
                    description: The number of attack discoveries that were generated during this execution.
                    example: 3
                    type: number
                  end:
                    description: The timestamp when the generation process completed, in ISO 8601 format. This field may be absent for generations that haven't finished.
                    example: '2025-09-29T06:42:44.810Z'
                    type: string
                  execution_uuid:
                    description: The unique identifier for this attack discovery generation execution. This UUID can be used to reference this specific generation in other API calls.
                    example: 46b218d5-535d-4329-be56-d0f6af6986b7
                    type: string
                  loading_message:
                    description: A human-readable message describing the current state or progress of the generation process. Provides context about what the AI is analyzing.
                    example: AI is analyzing up to 100 alerts in the last 24 hours to generate discoveries.
                    type: string
                  reason:
                    description: Additional context or reasoning provided when a generation fails or encounters issues. This field helps diagnose problems with the generation process.
                    example: Connection timeout to AI service
                    type: string
                  start:
                    description: The timestamp when the generation process began, in ISO 8601 format. This marks the beginning of the AI analysis.
                    example: '2025-09-29T06:42:08.962Z'
                    type: string
                  status:
                    description: The current status of the attack discovery generation. After dismissing, this will be set to "dismissed".
                    enum:
                      - canceled
                      - dismissed
                      - failed
                      - started
                      - succeeded
                    example: dismissed
                    type: string
                required:
                  - connector_id
                  - discoveries
                  - execution_uuid
                  - start
                  - status
          description: Indicates a successful call.
        '400':
          content:
            application/json:
              examples:
                PostAttackDiscoveryGenerationsDismissResponse400Example:
                  summary: Bad Request error returned when the dismiss request is invalid.
                  value:
                    error: Bad Request
                    message: Invalid request parameters.
                    status_code: 400
              schema:
                type: object
                properties:
                  error:
                    description: Error type or category
                    example: Bad Request
                    type: string
                  message:
                    description: Human-readable error message describing what went wrong with the request.
                    example: Invalid request parameters.
                    type: string
                  status_code:
                    description: HTTP status code indicating the type of client error
                    example: 400
                    type: number
                required:
                  - status_code
                  - error
                  - message
          description: Bad Request response.
      summary: Dismiss an Attack Discovery generation
      tags:
        - Security Attack discovery API
      x-codeSamples:
        - label: Example request
          lang: curl
          source: |
            curl \
             --request POST 'http://localhost:5601/api/attack_discovery/generations/46b218d5-535d-4329-be56-d0f6af6986b7/_dismiss' \
             --header "Authorization: $API_KEY" \
             --header "Content-Type: application/json"
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/attack_discovery/schedules:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/attack_discovery/schedules</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Creates a new Attack Discovery schedule that analyzes security alerts at specified intervals. The schedule defines when and how Attack Discovery analysis should run, including which alerts to analyze, which AI connector to use, and what actions to take when discoveries are found.
      operationId: CreateAttackDiscoverySchedules
      requestBody:
        content:
          application/json:
            examples:
              CreateAttackDiscoverySchedulesRequestBodyExample:
                summary: Create a daily Attack Discovery schedule that runs every 24 hours.
                value:
                  actions: []
                  enabled: true
                  name: Daily Security Analysis
                  params:
                    alerts_index_pattern: .alerts-security.alerts-default
                    api_config:
                      actionTypeId: bedrock
                      connectorId: my-bedrock-connector
                      name: Claude 3.5 Sonnet
                    end: now
                    size: 100
                    start: now-24h
                  schedule:
                    interval: 24h
            schema:
              $ref: '#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryApiScheduleCreateProps'
        description: Attack Discovery schedule configuration including name, parameters, schedule interval, and actions
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                CreateAttackDiscoverySchedulesResponse200Example:
                  summary: A newly created Attack Discovery schedule.
                  value:
                    actions: []
                    created_at: '2023-10-31T10:00:00.000Z'
                    created_by: elastic
                    enabled: true
                    id: 12345678-1234-1234-1234-123456789012
                    name: Daily Security Analysis
                    params:
                      alerts_index_pattern: .alerts-security.alerts-default
                      api_config:
                        actionTypeId: bedrock
                        connectorId: my-bedrock-connector
                        name: Claude 3.5 Sonnet
                      end: now
                      size: 100
                      start: now-24h
                    schedule:
                      interval: 24h
                    updated_at: '2023-10-31T10:00:00.000Z'
                    updated_by: elastic
              schema:
                $ref: '#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryApiSchedule'
          description: The Attack Discovery schedule was successfully created.
        '400':
          content:
            application/json:
              examples:
                CreateAttackDiscoverySchedulesResponse400Example:
                  summary: Bad Request error returned when the create schedule payload is invalid.
                  value:
                    error: Bad Request
                    message: Invalid request parameters.
                    status_code: 400
              schema:
                $ref: '#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryGenericError'
          description: Bad Request response.
      summary: Create Attack Discovery schedule
      tags:
        - Security Attack discovery API
      x-codeSamples:
        - label: Create an Attack Discovery schedule
          lang: curl
          source: |
            curl \
             --request POST 'http://localhost:5601/api/attack_discovery/schedules' \
             --header "Authorization: $API_KEY" \
             --header "Content-Type: application/json" \
             --data '{
               "name": "Daily Security Analysis",
               "enabled": true,
               "params": {
                 "alerts_index_pattern": ".alerts-security.alerts-default",
                 "api_config": {
                   "actionTypeId": "bedrock",
                   "connectorId": "my-bedrock-connector",
                   "name": "Claude 3.5 Sonnet"
                 },
                 "size": 100,
                 "start": "now-24h",
                 "end": "now"
               },
               "schedule": {
                 "interval": "24h"
               },
               "actions": [
                  {
                     "action_type_id": ".cases",
                     "id": "system-connector-.cases",
                     "params": {
                       "subAction": "run",
                       "subActionParams": {
                         "timeWindow": "7d",
                         "reopenClosedCases": false,
                         "groupingBy": [],
                         "templateId": null
                       }
                     },
                     "uuid": "12345678-1234-1234-1234-123456789012"
                   }
               ]
             }'
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/attack_discovery/schedules/_bulk_delete:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/attack_discovery/schedules/_bulk_delete</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Deletes multiple Attack Discovery schedules by ID.
      operationId: BulkDeleteAttackDiscoverySchedules
      requestBody:
        content:
          application/json:
            examples:
              BulkDeleteAttackDiscoverySchedulesRequestBodyExample:
                summary: Delete two Attack Discovery schedules.
                value:
                  ids:
                    - 12345678-1234-1234-1234-123456789012
                    - 98765432-1234-1234-1234-123456789012
            schema:
              $ref: '#/components/schemas/Security_Attack_discovery_API_BulkActionAttackDiscoverySchedulesRequestBody'
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                BulkDeleteAttackDiscoverySchedulesResponse200Example:
                  summary: Bulk delete response for two successfully deleted schedules.
                  value:
                    errors: []
                    ids:
                      - 12345678-1234-1234-1234-123456789012
                      - 98765432-1234-1234-1234-123456789012
                    total: 2
              schema:
                $ref: '#/components/schemas/Security_Attack_discovery_API_BulkActionAttackDiscoverySchedulesResponse'
          description: Successfully processed the bulk delete request.
        '400':
          content:
            application/json:
              examples:
                BulkDeleteAttackDiscoverySchedulesResponse400Example:
                  summary: Bad Request error returned when the bulk delete payload is invalid.
                  value:
                    error: Bad Request
                    message: Invalid request parameters.
                    status_code: 400
              schema:
                $ref: '#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryGenericError'
          description: Bad Request response.
      summary: Bulk delete Attack Discovery schedules
      tags:
        - Security Attack discovery API
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/attack_discovery/schedules/_bulk_disable:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/attack_discovery/schedules/_bulk_disable</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Disables multiple Attack Discovery schedules by ID.
      operationId: BulkDisableAttackDiscoverySchedules
      requestBody:
        content:
          application/json:
            examples:
              BulkDisableAttackDiscoverySchedulesRequestBodyExample:
                summary: Disable two Attack Discovery schedules.
                value:
                  ids:
                    - 12345678-1234-1234-1234-123456789012
                    - 98765432-1234-1234-1234-123456789012
            schema:
              $ref: '#/components/schemas/Security_Attack_discovery_API_BulkActionAttackDiscoverySchedulesRequestBody'
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                BulkDisableAttackDiscoverySchedulesResponse200Example:
                  summary: Bulk disable response for two successfully disabled schedules.
                  value:
                    errors: []
                    ids:
                      - 12345678-1234-1234-1234-123456789012
                      - 98765432-1234-1234-1234-123456789012
                    total: 2
              schema:
                $ref: '#/components/schemas/Security_Attack_discovery_API_BulkActionAttackDiscoverySchedulesResponse'
          description: Successfully processed the bulk disable request.
        '400':
          content:
            application/json:
              examples:
                BulkDisableAttackDiscoverySchedulesResponse400Example:
                  summary: Bad Request error returned when the bulk disable payload is invalid.
                  value:
                    error: Bad Request
                    message: Invalid request parameters.
                    status_code: 400
              schema:
                $ref: '#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryGenericError'
          description: Bad Request response.
      summary: Bulk disable Attack Discovery schedules
      tags:
        - Security Attack discovery API
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/attack_discovery/schedules/_bulk_enable:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/attack_discovery/schedules/_bulk_enable</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Enables multiple Attack Discovery schedules by ID.
      operationId: BulkEnableAttackDiscoverySchedules
      requestBody:
        content:
          application/json:
            examples:
              BulkEnableAttackDiscoverySchedulesRequestBodyExample:
                summary: Enable two Attack Discovery schedules.
                value:
                  ids:
                    - 12345678-1234-1234-1234-123456789012
                    - 98765432-1234-1234-1234-123456789012
            schema:
              $ref: '#/components/schemas/Security_Attack_discovery_API_BulkActionAttackDiscoverySchedulesRequestBody'
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                BulkEnableAttackDiscoverySchedulesResponse200Example:
                  summary: Bulk enable response for two successfully enabled schedules.
                  value:
                    errors: []
                    ids:
                      - 12345678-1234-1234-1234-123456789012
                      - 98765432-1234-1234-1234-123456789012
                    total: 2
              schema:
                $ref: '#/components/schemas/Security_Attack_discovery_API_BulkActionAttackDiscoverySchedulesResponse'
          description: Successfully processed the bulk enable request.
        '400':
          content:
            application/json:
              examples:
                BulkEnableAttackDiscoverySchedulesResponse400Example:
                  summary: Bad Request error returned when the bulk enable payload is invalid.
                  value:
                    error: Bad Request
                    message: Invalid request parameters.
                    status_code: 400
              schema:
                $ref: '#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryGenericError'
          description: Bad Request response.
      summary: Bulk enable Attack Discovery schedules
      tags:
        - Security Attack discovery API
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/attack_discovery/schedules/_find:
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/attack_discovery/schedules/_find</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Find Attack Discovery schedules that match the search criteria. Supports pagination and sorting by various fields.
      operationId: FindAttackDiscoverySchedules
      parameters:
        - description: Page number to return (used for pagination). Defaults to 1.
          example: 1
          in: query
          name: page
          required: false
          schema:
            type: number
        - description: Number of Attack Discovery schedules to return per page (used for pagination). Defaults to 10.
          example: 10
          in: query
          name: per_page
          required: false
          schema:
            type: number
        - description: Field used to sort results. Common fields include 'name', 'created_at', 'updated_at', and 'enabled'.
          example: name
          in: query
          name: sort_field
          required: false
          schema:
            $ref: '#/components/schemas/Security_Attack_discovery_API_NonEmptyString'
        - description: Sort order direction. Use 'asc' for ascending or 'desc' for descending. Defaults to 'asc'.
          example: asc
          in: query
          name: sort_direction
          required: false
          schema:
            enum:
              - asc
              - desc
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                FindAttackDiscoverySchedulesResponse200Example:
                  summary: Paginated list of Attack Discovery schedules matching the search criteria.
                  value:
                    data:
                      - actions: []
                        created_at: '2023-10-31T10:00:00.000Z'
                        created_by: elastic
                        enabled: true
                        id: 12345678-1234-1234-1234-123456789012
                        name: Daily Security Analysis
                        params:
                          alerts_index_pattern: .alerts-security.alerts-default
                          api_config:
                            actionTypeId: bedrock
                            connectorId: my-bedrock-connector
                            name: Claude 3.5 Sonnet
                          end: now
                          size: 100
                          start: now-24h
                        schedule:
                          interval: 24h
                        updated_at: '2023-10-31T10:00:00.000Z'
                        updated_by: elastic
                    page: 1
                    per_page: 10
                    total: 1
              schema:
                type: object
                properties:
                  data:
                    description: Array of matched Attack Discovery schedule objects.
                    items:
                      $ref: '#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryApiSchedule'
                    type: array
                  page:
                    description: Current page number of the paginated result set.
                    type: number
                  per_page:
                    description: Number of items requested per page.
                    type: number
                  total:
                    description: Total number of Attack Discovery schedules matching the query (across all pages).
                    type: number
                required:
                  - page
                  - per_page
                  - total
                  - data
          description: Indicates a successful call.
        '400':
          content:
            application/json:
              examples:
                FindAttackDiscoverySchedulesResponse400Example:
                  summary: Bad Request error returned when find-schedules query parameters are invalid.
                  value:
                    error: Bad Request
                    message: Invalid request payload.
                    status_code: 400
              schema:
                type: object
                properties:
                  error:
                    description: Error type
                    example: Bad Request
                    type: string
                  message:
                    description: Human-readable error message
                    example: Invalid request payload.
                    type: string
                  status_code:
                    description: HTTP status code
                    example: 400
                    type: number
          description: Bad Request response.
      summary: Find Attack Discovery schedules that match the search criteria
      tags:
        - Security Attack discovery API
      x-codeSamples:
        - label: Example request
          lang: curl
          source: |
            curl \
             --request GET 'http://localhost:5601/api/attack_discovery/schedules/_find' \
             --header "Authorization: $API_KEY" \
             --header "Content-Type: application/json"
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/attack_discovery/schedules/{id}:
    delete:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb delete">delete</span>&nbsp;<span class="operation-path">/s/{space_id}/api/attack_discovery/schedules/{id}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Permanently deletes an Attack Discovery schedule and all associated configuration.
      operationId: DeleteAttackDiscoverySchedules
      parameters:
        - description: The unique identifier (UUID) of the Attack Discovery schedule to delete. This ID is returned when creating a schedule and can be found in schedule listings.
          example: 12345678-1234-1234-1234-123456789012
          in: path
          name: id
          required: true
          schema:
            $ref: '#/components/schemas/Security_Attack_discovery_API_NonEmptyString'
      responses:
        '200':
          content:
            application/json:
              examples:
                DeleteAttackDiscoverySchedulesResponse200Example:
                  summary: Confirmation returned after deleting an Attack Discovery schedule.
                  value:
                    id: 12345678-1234-1234-1234-123456789012
              schema:
                type: object
                properties:
                  id:
                    $ref: '#/components/schemas/Security_Attack_discovery_API_NonEmptyString'
                    description: The unique identifier of the deleted Attack Discovery schedule
                required:
                  - id
          description: Successfully deleted Attack Discovery schedule, returning the ID of the deleted schedule for confirmation
        '400':
          content:
            application/json:
              examples:
                DeleteAttackDiscoverySchedulesResponse400Example:
                  summary: Bad Request error returned when the delete schedule request is invalid.
                  value:
                    error: Bad Request
                    message: Invalid request parameters.
                    status_code: 400
              schema:
                $ref: '#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryGenericError'
          description: Bad Request response.
      summary: Delete Attack Discovery schedule
      tags:
        - Security Attack discovery API
      x-codeSamples:
        - label: Delete an Attack Discovery schedule
          lang: curl
          source: |
            curl \
             --request DELETE 'http://localhost:5601/api/attack_discovery/schedules/12345678-1234-1234-1234-123456789012' \
             --header "Authorization: $API_KEY" \
             --header "Content-Type: application/json"
      x-metaTags:
        - content: Kibana
          name: product_name
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/attack_discovery/schedules/{id}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Retrieves a specific Attack Discovery schedule by its unique identifier. Returns complete schedule configuration including parameters, interval settings, associated actions, and execution history.
      operationId: GetAttackDiscoverySchedules
      parameters:
        - description: The unique identifier (UUID) of the Attack Discovery schedule to retrieve. This ID is returned when creating a schedule and can be found in schedule listings.
          example: 12345678-1234-1234-1234-123456789012
          in: path
          name: id
          required: true
          schema:
            $ref: '#/components/schemas/Security_Attack_discovery_API_NonEmptyString'
      responses:
        '200':
          content:
            application/json:
              examples:
                GetAttackDiscoverySchedulesResponse200Example:
                  summary: An Attack Discovery schedule retrieved by ID, including last execution metadata.
                  value:
                    actions: []
                    created_at: '2023-10-31T10:00:00.000Z'
                    created_by: elastic
                    enabled: true
                    id: 12345678-1234-1234-1234-123456789012
                    last_execution:
                      date: '2023-10-31T10:00:00.000Z'
                      last_duration: 45.2
                      status: ok
                    name: Daily Security Analysis
                    params:
                      alerts_index_pattern: .alerts-security.alerts-default
                      api_config:
                        actionTypeId: bedrock
                        connectorId: my-bedrock-connector
                        name: Claude 3.5 Sonnet
                      end: now
                      size: 100
                      start: now-24h
                    schedule:
                      interval: 24h
                    updated_at: '2023-10-31T10:00:00.000Z'
                    updated_by: elastic
              schema:
                $ref: '#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryApiSchedule'
          description: Successfully retrieved Attack Discovery schedule with complete configuration and metadata
        '400':
          content:
            application/json:
              examples:
                GetAttackDiscoverySchedulesResponse400Example:
                  summary: Bad Request error returned when the get-schedule request is invalid.
                  value:
                    error: Bad Request
                    message: Invalid request parameters.
                    status_code: 400
              schema:
                $ref: '#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryGenericError'
          description: Bad Request response.
      summary: Get Attack Discovery schedule by ID
      tags:
        - Security Attack discovery API
      x-codeSamples:
        - label: Get an Attack Discovery schedule by ID
          lang: curl
          source: |
            curl \
             --request GET 'http://localhost:5601/api/attack_discovery/schedules/12345678-1234-1234-1234-123456789012' \
             --header "Authorization: $API_KEY" \
             --header "Content-Type: application/json"
      x-metaTags:
        - content: Kibana
          name: product_name
    put:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb put">put</span>&nbsp;<span class="operation-path">/s/{space_id}/api/attack_discovery/schedules/{id}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Updates an existing Attack Discovery schedule with new configuration. All schedule properties can be modified including name, parameters, interval, and actions. The update operation replaces the entire schedule configuration with the provided values.
      operationId: UpdateAttackDiscoverySchedules
      parameters:
        - description: The unique identifier (UUID) of the Attack Discovery schedule to update. This ID is returned when creating a schedule and can be found in schedule listings.
          example: 12345678-1234-1234-1234-123456789012
          in: path
          name: id
          required: true
          schema:
            $ref: '#/components/schemas/Security_Attack_discovery_API_NonEmptyString'
      requestBody:
        content:
          application/json:
            examples:
              UpdateAttackDiscoverySchedulesRequestBodyExample:
                summary: Update an Attack Discovery schedule to run every 12 hours over a 48-hour window.
                value:
                  actions: []
                  name: Updated Daily Security Analysis
                  params:
                    alerts_index_pattern: .alerts-security.alerts-default
                    api_config:
                      actionTypeId: bedrock
                      connectorId: my-bedrock-connector
                      name: Claude 3.5 Sonnet
                    end: now
                    size: 200
                    start: now-48h
                  schedule:
                    interval: 12h
            schema:
              $ref: '#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryApiScheduleUpdateProps'
        description: Updated Attack Discovery schedule configuration. All fields are required as this replaces the entire schedule configuration.
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                UpdateAttackDiscoverySchedulesResponse200Example:
                  summary: An Attack Discovery schedule after being updated.
                  value:
                    actions: []
                    created_at: '2023-10-31T10:00:00.000Z'
                    created_by: elastic
                    enabled: true
                    id: 12345678-1234-1234-1234-123456789012
                    name: Updated Daily Security Analysis
                    params:
                      alerts_index_pattern: .alerts-security.alerts-default
                      api_config:
                        actionTypeId: bedrock
                        connectorId: my-bedrock-connector
                        name: Claude 3.5 Sonnet
                      end: now
                      size: 200
                      start: now-48h
                    schedule:
                      interval: 12h
                    updated_at: '2023-10-31T12:00:00.000Z'
                    updated_by: elastic
              schema:
                $ref: '#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryApiSchedule'
          description: Successfully updated Attack Discovery schedule with the new configuration and metadata
        '400':
          content:
            application/json:
              examples:
                UpdateAttackDiscoverySchedulesResponse400Example:
                  summary: Bad Request error returned when the update schedule payload is invalid.
                  value:
                    error: Bad Request
                    message: Invalid request parameters.
                    status_code: 400
              schema:
                $ref: '#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryGenericError'
          description: Bad Request response.
      summary: Update Attack Discovery schedule
      tags:
        - Security Attack discovery API
      x-codeSamples:
        - label: Update an Attack Discovery schedule
          lang: curl
          source: |
            curl \
             --request PUT 'http://localhost:5601/api/attack_discovery/schedules/12345678-1234-1234-1234-123456789012' \
             --header "Authorization: $API_KEY" \
             --header "Content-Type: application/json" \
             --data '{
               "name": "Updated Daily Security Analysis",
               "params": {
                 "alerts_index_pattern": ".alerts-security.alerts-default",
                 "api_config": {
                   "actionTypeId": "bedrock",
                   "connectorId": "my-bedrock-connector",
                   "name": "Claude 3.5 Sonnet"
                 },
                 "size": 200,
                 "start": "now-48h",
                 "end": "now"
               },
               "schedule": {
                 "interval": "12h"
               },
               "actions": []
             }'
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/attack_discovery/schedules/{id}/_disable:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/attack_discovery/schedules/{id}/_disable</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Disables an Attack Discovery schedule, preventing it from running according to its configured interval. The schedule configuration is preserved and can be re-enabled later. Any currently running executions will complete, but no new executions will be started.
      operationId: DisableAttackDiscoverySchedules
      parameters:
        - description: The unique identifier (UUID) of the Attack Discovery schedule to disable. This ID is returned when creating a schedule and can be found in schedule listings.
          example: 12345678-1234-1234-1234-123456789012
          in: path
          name: id
          required: true
          schema:
            $ref: '#/components/schemas/Security_Attack_discovery_API_NonEmptyString'
      responses:
        '200':
          content:
            application/json:
              examples:
                DisableAttackDiscoverySchedulesResponse200Example:
                  summary: Confirmation returned after disabling an Attack Discovery schedule.
                  value:
                    id: 12345678-1234-1234-1234-123456789012
              schema:
                type: object
                properties:
                  id:
                    $ref: '#/components/schemas/Security_Attack_discovery_API_NonEmptyString'
                    description: The unique identifier of the disabled Attack Discovery schedule
                required:
                  - id
          description: Successfully disabled Attack Discovery schedule, returning the schedule ID for confirmation
        '400':
          content:
            application/json:
              examples:
                DisableAttackDiscoverySchedulesResponse400Example:
                  summary: Bad Request error returned when the disable schedule request is invalid.
                  value:
                    error: Bad Request
                    message: Invalid request parameters.
                    status_code: 400
              schema:
                $ref: '#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryGenericError'
          description: Bad Request response.
      summary: Disable Attack Discovery schedule
      tags:
        - Security Attack discovery API
      x-codeSamples:
        - label: Disable an Attack Discovery schedule
          lang: curl
          source: |
            curl \
             --request POST 'http://localhost:5601/api/attack_discovery/schedules/12345678-1234-1234-1234-123456789012/_disable' \
             --header "Authorization: $API_KEY" \
             --header "Content-Type: application/json"
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/attack_discovery/schedules/{id}/_enable:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/attack_discovery/schedules/{id}/_enable</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Enables a previously disabled Attack Discovery schedule, allowing it to run according to its configured interval. Once enabled, the schedule will begin executing at the next scheduled time based on its interval configuration.
      operationId: EnableAttackDiscoverySchedules
      parameters:
        - description: The unique identifier (UUID) of the Attack Discovery schedule to enable. This ID is returned when creating a schedule and can be found in schedule listings.
          example: 12345678-1234-1234-1234-123456789012
          in: path
          name: id
          required: true
          schema:
            $ref: '#/components/schemas/Security_Attack_discovery_API_NonEmptyString'
      responses:
        '200':
          content:
            application/json:
              examples:
                EnableAttackDiscoverySchedulesResponse200Example:
                  summary: Confirmation returned after enabling an Attack Discovery schedule.
                  value:
                    id: 12345678-1234-1234-1234-123456789012
              schema:
                type: object
                properties:
                  id:
                    $ref: '#/components/schemas/Security_Attack_discovery_API_NonEmptyString'
                    description: The unique identifier of the enabled Attack Discovery schedule
                required:
                  - id
          description: Successfully enabled Attack Discovery schedule, returning the schedule ID for confirmation
        '400':
          content:
            application/json:
              examples:
                EnableAttackDiscoverySchedulesResponse400Example:
                  summary: Bad Request error returned when the enable schedule request is invalid.
                  value:
                    error: Bad Request
                    message: Invalid request parameters.
                    status_code: 400
              schema:
                $ref: '#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryGenericError'
          description: Bad Request response.
      summary: Enable Attack Discovery schedule
      tags:
        - Security Attack discovery API
      x-codeSamples:
        - label: Enable an Attack Discovery schedule
          lang: curl
          source: |
            curl \
             --request POST 'http://localhost:5601/api/attack_discovery/schedules/12345678-1234-1234-1234-123456789012/_enable' \
             --header "Authorization: $API_KEY" \
             --header "Content-Type: application/json"
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/cases:
    delete:
      description: |
        **Spaces method and path for this operation:**

        <div><span class="operation-verb delete">delete</span>&nbsp;<span class="operation-path">/s/{space_id}/api/cases</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        You must have `read` or `all` privileges and the `delete` sub-feature privilege for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the cases you're deleting.
      operationId: deleteCaseDefaultSpace
      parameters:
        - $ref: '#/components/parameters/Cases_kbn_xsrf'
        - $ref: '#/components/parameters/Cases_ids'
      responses:
        '204':
          description: Indicates a successful call.
        '401':
          content:
            application/json:
              examples:
                response401:
                  $ref: '#/components/examples/Cases_response_401'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: Authorization information is missing or invalid.
      summary: Delete cases
      tags:
        - cases
      x-codeSamples:
        - label: curl
          lang: curl
          source: |
            curl \
              --request DELETE 'https://localhost:5601/api/cases?ids=%5B%22030e6e34-6470-4001-864f-b229511ad188%22%2C%22e662ff34-0493-4538-b9d1-6706ced02ff2%22%5D' \
              --header "Authorization: $API_KEY" \
              --header "Content-Type: application/json" \
              --header "kbn-xsrf: true"
        - label: Console
          lang: console
          source: |
            DELETE kbn:/api/cases?ids=["030e6e34-6470-4001-864f-b229511ad188","e662ff34-0493-4538-b9d1-6706ced02ff2"]
      x-metaTags:
        - content: Kibana
          name: product_name
    patch:
      description: |
        **Spaces method and path for this operation:**

        <div><span class="operation-verb patch">patch</span>&nbsp;<span class="operation-path">/s/{space_id}/api/cases</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        You must have `all` privileges for the **Cases** feature in the  **Management**, **Observability**, or **Security** section of the Kibana  feature privileges, depending on the owner of the case you're updating.
      operationId: updateCaseDefaultSpace
      parameters:
        - $ref: '#/components/parameters/Cases_kbn_xsrf'
      requestBody:
        content:
          application/json:
            examples:
              updateCaseRequest:
                $ref: '#/components/examples/Cases_update_case_request'
            schema:
              $ref: '#/components/schemas/Cases_update_case_request'
      responses:
        '200':
          content:
            application/json:
              examples:
                updateCaseResponse:
                  $ref: '#/components/examples/Cases_update_case_response'
              schema:
                items:
                  $ref: '#/components/schemas/Cases_case_response_properties'
                type: array
          description: Indicates a successful call.
        '401':
          content:
            application/json:
              examples:
                response401:
                  $ref: '#/components/examples/Cases_response_401'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: Authorization information is missing or invalid.
      summary: Update cases
      tags:
        - cases
      x-metaTags:
        - content: Kibana
          name: product_name
    post:
      description: |
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/cases</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        You must have `all` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana  feature privileges, depending on the owner of the case you're creating.
      operationId: createCaseDefaultSpace
      parameters:
        - $ref: '#/components/parameters/Cases_kbn_xsrf'
      requestBody:
        content:
          application/json:
            examples:
              createCaseRequest:
                $ref: '#/components/examples/Cases_create_case_request'
            schema:
              $ref: '#/components/schemas/Cases_create_case_request'
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                createCaseResponse:
                  $ref: '#/components/examples/Cases_create_case_response'
              schema:
                $ref: '#/components/schemas/Cases_case_response_properties'
          description: Indicates a successful call.
        '401':
          content:
            application/json:
              examples:
                response401:
                  $ref: '#/components/examples/Cases_response_401'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: Authorization information is missing or invalid.
      summary: Create a case
      tags:
        - cases
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/cases/_find:
    get:
      description: |
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/cases/_find</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        You must have `read` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the cases you're seeking.
      operationId: findCasesDefaultSpace
      parameters:
        - $ref: '#/components/parameters/Cases_assignees_filter'
        - $ref: '#/components/parameters/Cases_category'
        - $ref: '#/components/parameters/Cases_defaultSearchOperator'
        - $ref: '#/components/parameters/Cases_from'
        - $ref: '#/components/parameters/Cases_owner_filter'
        - $ref: '#/components/parameters/Cases_page_index'
        - $ref: '#/components/parameters/Cases_page_size'
        - $ref: '#/components/parameters/Cases_reporters'
        - $ref: '#/components/parameters/Cases_search'
        - $ref: '#/components/parameters/Cases_searchFields'
        - $ref: '#/components/parameters/Cases_severity'
        - $ref: '#/components/parameters/Cases_sortField'
        - $ref: '#/components/parameters/Cases_sort_order'
        - $ref: '#/components/parameters/Cases_status'
        - $ref: '#/components/parameters/Cases_tags'
        - $ref: '#/components/parameters/Cases_to'
      responses:
        '200':
          content:
            application/json:
              examples:
                findCaseResponse:
                  $ref: '#/components/examples/Cases_find_case_response'
              schema:
                type: object
                properties:
                  cases:
                    items:
                      $ref: '#/components/schemas/Cases_case_response_properties'
                    maxItems: 10000
                    type: array
                  count_closed_cases:
                    type: integer
                  count_in_progress_cases:
                    type: integer
                  count_open_cases:
                    type: integer
                  page:
                    type: integer
                  per_page:
                    type: integer
                  total:
                    type: integer
          description: Indicates a successful call.
        '401':
          content:
            application/json:
              examples:
                response401:
                  $ref: '#/components/examples/Cases_response_401'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: Authorization information is missing or invalid.
      summary: Search cases
      tags:
        - cases
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/cases/{caseId}:
    get:
      description: |
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/cases/{caseId}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Returns case details. The response does not include a comments property;  use the find case comments API to retrieve comments. The totalComment field  reflects the actual number of user comments on the case. You must have `read` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the case you're seeking.
      operationId: getCaseDefaultSpace
      parameters:
        - $ref: '#/components/parameters/Cases_case_id'
      responses:
        '200':
          content:
            application/json:
              examples:
                getDefaultCaseResponse:
                  $ref: '#/components/examples/Cases_get_case_response'
                getDefaultObservabilityCaseResponse:
                  $ref: '#/components/examples/Cases_get_case_observability_response'
              schema:
                $ref: '#/components/schemas/Cases_case_response_get_case'
          description: Indicates a successful call.
        '401':
          content:
            application/json:
              examples:
                response401:
                  $ref: '#/components/examples/Cases_response_401'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: Authorization information is missing or invalid.
      summary: Get case information
      tags:
        - cases
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/cases/{caseId}/alerts:
    get:
      description: |
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/cases/{caseId}/alerts</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        You must have `read` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the cases you're seeking.
      operationId: getCaseAlertsDefaultSpace
      parameters:
        - $ref: '#/components/parameters/Cases_case_id'
      responses:
        '200':
          content:
            application/json:
              examples:
                getCaseAlertsResponse:
                  $ref: '#/components/examples/Cases_get_case_alerts_response'
              schema:
                items:
                  $ref: '#/components/schemas/Cases_alert_response_properties'
                type: array
          description: Indicates a successful call.
        '401':
          content:
            application/json:
              examples:
                response401:
                  $ref: '#/components/examples/Cases_response_401'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: Authorization information is missing or invalid.
      summary: Get all alerts for a case
      tags:
        - cases
      x-state: Technical preview
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/cases/{caseId}/comments:
    delete:
      description: |
        **Spaces method and path for this operation:**

        <div><span class="operation-verb delete">delete</span>&nbsp;<span class="operation-path">/s/{space_id}/api/cases/{caseId}/comments</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Deletes all comments and alerts from a case. You must have `all` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the cases you're deleting.
      operationId: deleteCaseCommentsDefaultSpace
      parameters:
        - $ref: '#/components/parameters/Cases_kbn_xsrf'
        - $ref: '#/components/parameters/Cases_case_id'
      responses:
        '204':
          description: Indicates a successful call.
        '401':
          content:
            application/json:
              examples:
                response401:
                  $ref: '#/components/examples/Cases_response_401'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: Authorization information is missing or invalid.
      summary: Delete all case comments and alerts
      tags:
        - cases
      x-codeSamples:
        - label: curl
          lang: curl
          source: |
            curl \
              --request DELETE 'https://localhost:5601/api/cases/9c235210-6834-11ea-a78c-6ffb38a34414/comments' \
              --header "Authorization: $API_KEY" \
              --header "kbn-xsrf: true"
        - label: Console
          lang: console
          source: |
            DELETE kbn:/api/cases/9c235210-6834-11ea-a78c-6ffb38a34414/comments
      x-metaTags:
        - content: Kibana
          name: product_name
    patch:
      description: |
        **Spaces method and path for this operation:**

        <div><span class="operation-verb patch">patch</span>&nbsp;<span class="operation-path">/s/{space_id}/api/cases/{caseId}/comments</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        You must have `all` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the case you're updating. NOTE: You cannot change the comment type or the owner of a comment.
      operationId: updateCaseCommentDefaultSpace
      parameters:
        - $ref: '#/components/parameters/Cases_kbn_xsrf'
        - $ref: '#/components/parameters/Cases_case_id'
      requestBody:
        content:
          application/json:
            examples:
              updateCaseCommentRequest:
                $ref: '#/components/examples/Cases_update_comment_request'
            schema:
              $ref: '#/components/schemas/Cases_update_case_comment_request'
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                updateCaseCommentResponse:
                  $ref: '#/components/examples/Cases_update_comment_response'
              schema:
                $ref: '#/components/schemas/Cases_case_response_properties'
          description: Indicates a successful call.
        '401':
          content:
            application/json:
              examples:
                response401:
                  $ref: '#/components/examples/Cases_response_401'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: Authorization information is missing or invalid.
      summary: Update a case comment or alert
      tags:
        - cases
      x-metaTags:
        - content: Kibana
          name: product_name
    post:
      description: |
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/cases/{caseId}/comments</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        You must have `all` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the case you're creating. NOTE: Each case can have a maximum of 1,000 alerts.
      operationId: addCaseCommentDefaultSpace
      parameters:
        - $ref: '#/components/parameters/Cases_kbn_xsrf'
        - $ref: '#/components/parameters/Cases_case_id'
      requestBody:
        content:
          application/json:
            examples:
              createCaseCommentRequest:
                $ref: '#/components/examples/Cases_add_comment_request'
            schema:
              $ref: '#/components/schemas/Cases_add_case_comment_request'
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                createCaseCommentResponse:
                  $ref: '#/components/examples/Cases_add_comment_response'
              schema:
                $ref: '#/components/schemas/Cases_case_response_properties'
          description: Indicates a successful call.
        '401':
          content:
            application/json:
              examples:
                response401:
                  $ref: '#/components/examples/Cases_response_401'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: Authorization information is missing or invalid.
      summary: Add a case comment or alert
      tags:
        - cases
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/cases/{caseId}/comments/_find:
    get:
      description: |
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/cases/{caseId}/comments/_find</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Retrieves a paginated list of comments for a case. You must have `read` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the cases with the comments you're seeking.
      operationId: findCaseCommentsDefaultSpace
      parameters:
        - $ref: '#/components/parameters/Cases_case_id'
        - $ref: '#/components/parameters/Cases_page_index'
        - $ref: '#/components/parameters/Cases_page_size'
        - $ref: '#/components/parameters/Cases_sort_order'
      responses:
        '200':
          content:
            application/json:
              examples:
                findCaseCommentsResponse:
                  $ref: '#/components/examples/Cases_find_case_comments_response'
              schema:
                $ref: '#/components/schemas/Cases_find_comments_response'
          description: Indicates a successful call.
        '401':
          content:
            application/json:
              examples:
                response401:
                  $ref: '#/components/examples/Cases_response_401'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: Authorization information is missing or invalid.
      summary: Find case comments
      tags:
        - cases
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/cases/{caseId}/comments/{commentId}:
    delete:
      description: |
        **Spaces method and path for this operation:**

        <div><span class="operation-verb delete">delete</span>&nbsp;<span class="operation-path">/s/{space_id}/api/cases/{caseId}/comments/{commentId}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        You must have `all` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the cases you're deleting.
      operationId: deleteCaseCommentDefaultSpace
      parameters:
        - $ref: '#/components/parameters/Cases_kbn_xsrf'
        - $ref: '#/components/parameters/Cases_case_id'
        - $ref: '#/components/parameters/Cases_comment_id'
      responses:
        '204':
          description: Indicates a successful call.
        '401':
          content:
            application/json:
              examples:
                response401:
                  $ref: '#/components/examples/Cases_response_401'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: Authorization information is missing or invalid.
      summary: Delete a case comment or alert
      tags:
        - cases
      x-codeSamples:
        - label: curl
          lang: curl
          source: |
            curl \
              --request DELETE 'https://localhost:5601/api/cases/9c235210-6834-11ea-a78c-6ffb38a34414/comments/71ec1870-725b-11ea-a0b2-c51ea50a58e2' \
              --header "Authorization: $API_KEY" \
              --header "kbn-xsrf: true"
        - label: Console
          lang: console
          source: |
            DELETE kbn:/api/cases/9c235210-6834-11ea-a78c-6ffb38a34414/comments/71ec1870-725b-11ea-a0b2-c51ea50a58e2
      x-metaTags:
        - content: Kibana
          name: product_name
    get:
      description: |
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/cases/{caseId}/comments/{commentId}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        You must have `read` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the cases with the comments you're seeking.
      operationId: getCaseCommentDefaultSpace
      parameters:
        - $ref: '#/components/parameters/Cases_case_id'
        - $ref: '#/components/parameters/Cases_comment_id'
      responses:
        '200':
          content:
            application/json:
              examples:
                getCaseCommentResponse:
                  $ref: '#/components/examples/Cases_get_comment_response'
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Cases_alert_comment_response_properties'
                  - $ref: '#/components/schemas/Cases_user_comment_response_properties'
          description: Indicates a successful call.
        '401':
          content:
            application/json:
              examples:
                response401:
                  $ref: '#/components/examples/Cases_response_401'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: Authorization information is missing or invalid.
      summary: Get a case comment or alert
      tags:
        - cases
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/cases/{caseId}/connector/{connectorId}/_push:
    post:
      description: |
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/cases/{caseId}/connector/{connectorId}/_push</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        You must have `all` privileges for the **Actions and Connectors** feature in the **Management** section of the Kibana feature privileges. You must also have `all` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the case you're pushing.
      operationId: pushCaseDefaultSpace
      parameters:
        - $ref: '#/components/parameters/Cases_case_id'
        - $ref: '#/components/parameters/Cases_connector_id'
        - $ref: '#/components/parameters/Cases_kbn_xsrf'
      requestBody:
        content:
          application/json:
            examples:
              pushCaseRequest:
                summary: Push a case to an external service. No request body is required.
                value: null
            schema:
              nullable: true
              type: object
      responses:
        '200':
          content:
            application/json:
              examples:
                pushCaseResponse:
                  $ref: '#/components/examples/Cases_push_case_response'
              schema:
                $ref: '#/components/schemas/Cases_case_response_properties'
          description: Indicates a successful call.
        '401':
          content:
            application/json:
              examples:
                response401:
                  $ref: '#/components/examples/Cases_response_401'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: Authorization information is missing or invalid.
      summary: Push a case to an external service
      tags:
        - cases
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/cases/{caseId}/fields:
    get:
      description: |
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/cases/{caseId}/fields</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Returns the fields you can write to the case's `extended_fields`. The case determines the owner and any applied template. The response includes the owner's global fields (library-wide) and, if the case has a template, that template's fields. Requires the Cases feature to be enabled in the space.
      operationId: getCaseApplicableFieldsDefaultSpace
      parameters:
        - $ref: '#/components/parameters/Cases_case_id'
      responses:
        '200':
          content:
            application/json:
              examples:
                getCaseApplicableFieldsResponse:
                  $ref: '#/components/examples/Cases_get_case_applicable_fields_response'
              schema:
                $ref: '#/components/schemas/Cases_applicable_fields_response'
          description: Indicates a successful call.
        '401':
          content:
            application/json:
              examples:
                response401:
                  $ref: '#/components/examples/Cases_response_401'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: Authorization information is missing or invalid.
        '403':
          content:
            application/json:
              examples:
                response403:
                  $ref: '#/components/examples/Cases_response_403'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: The user does not have access to the case.
        '404':
          content:
            application/json:
              examples:
                response404:
                  $ref: '#/components/examples/Cases_response_404'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: The case was not found.
      summary: Get the fields applicable to an existing case
      tags:
        - cases
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/cases/{caseId}/files:
    post:
      description: |
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/cases/{caseId}/files</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Attach a file to a case. You must have `all` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the case you're updating. The request must include:
        - The `Content-Type: multipart/form-data` HTTP header.
        - The location of the file that is being uploaded.
      operationId: addCaseFileDefaultSpace
      parameters:
        - $ref: '#/components/parameters/Cases_kbn_xsrf'
        - $ref: '#/components/parameters/Cases_case_id'
      requestBody:
        content:
          multipart/form-data:
            examples:
              addCaseFileRequest:
                summary: Attach a plain text file named "my_attachment".
                value:
                  filename: my_attachment
            schema:
              $ref: '#/components/schemas/Cases_add_case_file_request'
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                addCaseFileResponse:
                  $ref: '#/components/examples/Cases_add_comment_response'
              schema:
                $ref: '#/components/schemas/Cases_case_response_properties'
          description: Indicates a successful call.
        '401':
          content:
            application/json:
              examples:
                response401:
                  $ref: '#/components/examples/Cases_response_401'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: Authorization information is missing or invalid.
      summary: Attach a file to a case
      tags:
        - cases
      x-codeSamples:
        - label: curl
          lang: curl
          source: |
            curl \
              --request POST 'https://localhost:5601/api/cases/9c235210-6834-11ea-a78c-6ffb38a34414/files' \
              --header "Authorization: $API_KEY" \
              --header "kbn-xsrf: true" \
              --form "file=@/path/to/my_attachment.txt" \
              --form "filename=my_attachment"
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/cases/{caseId}/user_actions/_find:
    get:
      description: |
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/cases/{caseId}/user_actions/_find</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Retrieves a paginated list of user activity for a case. You must have `read` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the case you're seeking.
      operationId: findCaseActivityDefaultSpace
      parameters:
        - $ref: '#/components/parameters/Cases_case_id'
        - $ref: '#/components/parameters/Cases_page_index'
        - $ref: '#/components/parameters/Cases_page_size'
        - $ref: '#/components/parameters/Cases_sort_order'
        - $ref: '#/components/parameters/Cases_user_action_types'
      responses:
        '200':
          content:
            application/json:
              examples:
                findCaseActivityResponse:
                  $ref: '#/components/examples/Cases_find_case_activity_response'
              schema:
                type: object
                properties:
                  page:
                    type: integer
                  perPage:
                    type: integer
                  total:
                    type: integer
                  userActions:
                    items:
                      $ref: '#/components/schemas/Cases_user_actions_find_response_properties'
                    maxItems: 10000
                    type: array
          description: Indicates a successful call.
        '401':
          content:
            application/json:
              examples:
                response401:
                  $ref: '#/components/examples/Cases_response_401'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: Authorization information is missing or invalid.
      summary: Find case activity
      tags:
        - cases
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/cases/alerts/{alertId}:
    get:
      description: |
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/cases/alerts/{alertId}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        You must have `read` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the cases you're seeking.
      operationId: getCasesByAlertDefaultSpace
      parameters:
        - $ref: '#/components/parameters/Cases_alert_id'
        - $ref: '#/components/parameters/Cases_owner_filter'
      responses:
        '200':
          content:
            application/json:
              examples:
                getCasesByAlertResponse:
                  summary: Cases associated with a given alert.
                  value:
                    - createdAt: '2020-02-19T23:06:33.798Z'
                      description: Investigating suspicious activity
                      id: 06116b80-e1c3-11ec-be9b-9b1838238ee6
                      status: open
                      title: security_case
                      totals:
                        alerts: 1
                        events: 0
                        userComments: 0
              schema:
                items:
                  $ref: '#/components/schemas/Cases_related_case'
                maxItems: 10000
                type: array
          description: Indicates a successful call.
        '401':
          content:
            application/json:
              examples:
                response401:
                  $ref: '#/components/examples/Cases_response_401'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: Authorization information is missing or invalid.
      summary: Get cases for an alert
      tags:
        - cases
      x-state: Technical preview
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/cases/configure:
    get:
      description: |
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/cases/configure</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Get setting details such as the closure type, custom fields, templates, and the default connector for cases. You must have `read` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on where the cases were created.
      operationId: getCaseConfigurationDefaultSpace
      parameters:
        - $ref: '#/components/parameters/Cases_owner_filter'
      responses:
        '200':
          content:
            application/json:
              examples:
                getConfigurationResponse:
                  $ref: '#/components/examples/Cases_get_case_configuration_response'
              schema:
                items:
                  type: object
                  properties:
                    closure_type:
                      $ref: '#/components/schemas/Cases_closure_types'
                    connector:
                      type: object
                      properties:
                        fields:
                          description: The fields specified in the case configuration are not used and are not propagated to individual cases, therefore it is recommended to set it to `null`.
                          nullable: true
                          type: object
                        id:
                          description: The identifier for the connector. If you do not want a default connector, use `none`. To retrieve connector IDs, use the find connectors API.
                          example: none
                          type: string
                        name:
                          description: The name of the connector. If you do not want a default connector, use `none`. To retrieve connector names, use the find connectors API.
                          example: none
                          type: string
                        type:
                          $ref: '#/components/schemas/Cases_connector_types'
                    created_at:
                      example: '2022-06-01T17:07:17.767Z'
                      format: date-time
                      type: string
                    created_by:
                      type: object
                      properties:
                        email:
                          example: null
                          nullable: true
                          type: string
                        full_name:
                          example: null
                          nullable: true
                          type: string
                        profile_uid:
                          example: u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0
                          type: string
                        username:
                          example: elastic
                          nullable: true
                          type: string
                      required:
                        - email
                        - full_name
                        - username
                    customFields:
                      description: Custom fields configuration details.
                      items:
                        type: object
                        properties:
                          defaultValue:
                            description: |
                              A default value for the custom field. If the `type` is `text`, the default value must be a string. If the `type` is `toggle`, the default value must be boolean.
                            oneOf:
                              - type: string
                              - type: boolean
                          key:
                            description: |
                              A unique key for the custom field. Must be lower case and composed only of a-z, 0-9, '_', and '-' characters. It is used in API calls to refer to a specific custom field.
                            maxLength: 36
                            minLength: 1
                            type: string
                          label:
                            description: The custom field label that is displayed in the case.
                            maxLength: 50
                            minLength: 1
                            type: string
                          type:
                            description: The type of the custom field.
                            enum:
                              - text
                              - toggle
                            type: string
                          required:
                            description: |
                              Indicates whether the field is required. If `false`, the custom field can be set to null or omitted when a case is created or updated.
                            type: boolean
                      type: array
                    error:
                      example: null
                      nullable: true
                      type: string
                    extractObservables:
                      description: |
                        Indicates whether observables (for example, IPs, hashes, and URLs) are automatically extracted from case comments and events.
                      example: true
                      type: boolean
                    id:
                      example: 4a97a440-e1cd-11ec-be9b-9b1838238ee6
                      type: string
                    mappings:
                      items:
                        type: object
                        properties:
                          action_type:
                            example: overwrite
                            type: string
                          source:
                            example: title
                            type: string
                          target:
                            example: summary
                            type: string
                      type: array
                    observableTypes:
                      description: Custom observable type configuration details.
                      items:
                        type: object
                        properties:
                          key:
                            description: The observable type key.
                            example: d312efda-ec2b-42ec-9e2c-84981795c581
                            type: string
                          label:
                            description: The observable type label.
                            example: My observable type
                            type: string
                      type: array
                    owner:
                      $ref: '#/components/schemas/Cases_owner'
                    templates:
                      $ref: '#/components/schemas/Cases_templates'
                    updated_at:
                      example: '2022-06-01T19:58:48.169Z'
                      format: date-time
                      nullable: true
                      type: string
                    updated_by:
                      nullable: true
                      type: object
                      properties:
                        email:
                          example: null
                          nullable: true
                          type: string
                        full_name:
                          example: null
                          nullable: true
                          type: string
                        profile_uid:
                          example: u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0
                          type: string
                        username:
                          example: elastic
                          nullable: true
                          type: string
                      required:
                        - email
                        - full_name
                        - username
                    version:
                      example: WzIwNzMsMV0=
                      type: string
                    workflowTags:
                      description: |
                        Workflow tags that limit which workflows appear in Cases workflow selectors. An empty array shows all workflows.
                      items:
                        maxLength: 1024
                        minLength: 1
                        type: string
                      maxItems: 100
                      type: array
                type: array
          description: Indicates a successful call.
        '401':
          content:
            application/json:
              examples:
                response401:
                  $ref: '#/components/examples/Cases_response_401'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: Authorization information is missing or invalid.
      summary: Get case settings
      tags:
        - cases
      x-metaTags:
        - content: Kibana
          name: product_name
    post:
      description: |
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/cases/configure</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Case settings include external connection details, custom fields, and templates. Connectors are used to interface with external systems. You must create a connector before you can use it in your cases. If you set a default connector, it is automatically selected when you create cases in Kibana. If you use the create case API, however, you must still specify all of the connector details. You must have `all` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on where you are creating cases.
      operationId: setCaseConfigurationDefaultSpace
      parameters:
        - $ref: '#/components/parameters/Cases_kbn_xsrf'
      requestBody:
        content:
          application/json:
            examples:
              setCaseConfigRequest:
                $ref: '#/components/examples/Cases_set_case_configuration_request'
            schema:
              $ref: '#/components/schemas/Cases_set_case_configuration_request'
      responses:
        '200':
          content:
            application/json:
              examples:
                setCaseConfigResponse:
                  $ref: '#/components/examples/Cases_set_case_configuration_response'
              schema:
                type: object
                properties:
                  closure_type:
                    $ref: '#/components/schemas/Cases_closure_types'
                  connector:
                    type: object
                    properties:
                      fields:
                        description: The fields specified in the case configuration are not used and are not propagated to individual cases, therefore it is recommended to set it to `null`.
                        nullable: true
                        type: object
                      id:
                        description: The identifier for the connector. If you do not want a default connector, use `none`. To retrieve connector IDs, use the find connectors API.
                        example: none
                        type: string
                      name:
                        description: The name of the connector. If you do not want a default connector, use `none`. To retrieve connector names, use the find connectors API.
                        example: none
                        type: string
                      type:
                        $ref: '#/components/schemas/Cases_connector_types'
                  created_at:
                    example: '2022-06-01T17:07:17.767Z'
                    format: date-time
                    type: string
                  created_by:
                    type: object
                    properties:
                      email:
                        example: null
                        nullable: true
                        type: string
                      full_name:
                        example: null
                        nullable: true
                        type: string
                      profile_uid:
                        example: u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0
                        type: string
                      username:
                        example: elastic
                        nullable: true
                        type: string
                    required:
                      - email
                      - full_name
                      - username
                  customFields:
                    description: Custom fields configuration details.
                    items:
                      type: object
                      properties:
                        defaultValue:
                          description: |
                            A default value for the custom field. If the `type` is `text`, the default value must be a string. If the `type` is `toggle`, the default value must be boolean.
                          oneOf:
                            - type: string
                            - type: boolean
                        key:
                          description: |
                            A unique key for the custom field. Must be lower case and composed only of a-z, 0-9, '_', and '-' characters. It is used in API calls to refer to a specific custom field.
                          maxLength: 36
                          minLength: 1
                          type: string
                        label:
                          description: The custom field label that is displayed in the case.
                          maxLength: 50
                          minLength: 1
                          type: string
                        type:
                          description: The type of the custom field.
                          enum:
                            - text
                            - toggle
                          type: string
                        required:
                          description: |
                            Indicates whether the field is required. If `false`, the custom field can be set to null or omitted when a case is created or updated.
                          type: boolean
                    type: array
                  error:
                    example: null
                    nullable: true
                    type: string
                  extractObservables:
                    description: |
                      Indicates whether observables (for example, IPs, hashes, and URLs) are automatically extracted from case comments and events.
                    example: true
                    type: boolean
                  id:
                    example: 4a97a440-e1cd-11ec-be9b-9b1838238ee6
                    type: string
                  mappings:
                    items:
                      type: object
                      properties:
                        action_type:
                          example: overwrite
                          type: string
                        source:
                          example: title
                          type: string
                        target:
                          example: summary
                          type: string
                    type: array
                  observableTypes:
                    description: Custom observable type configuration details.
                    items:
                      type: object
                      properties:
                        key:
                          description: The observable type key.
                          example: d312efda-ec2b-42ec-9e2c-84981795c581
                          type: string
                        label:
                          description: The observable type label.
                          example: My observable type
                          type: string
                    type: array
                  owner:
                    $ref: '#/components/schemas/Cases_owner'
                  templates:
                    $ref: '#/components/schemas/Cases_templates'
                  updated_at:
                    example: '2022-06-01T19:58:48.169Z'
                    format: date-time
                    nullable: true
                    type: string
                  updated_by:
                    nullable: true
                    type: object
                    properties:
                      email:
                        example: null
                        nullable: true
                        type: string
                      full_name:
                        example: null
                        nullable: true
                        type: string
                      profile_uid:
                        example: u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0
                        type: string
                      username:
                        example: elastic
                        nullable: true
                        type: string
                    required:
                      - email
                      - full_name
                      - username
                  version:
                    example: WzIwNzMsMV0=
                    type: string
                  workflowTags:
                    description: |
                      Workflow tags that limit which workflows appear in Cases workflow selectors. An empty array shows all workflows.
                    items:
                      maxLength: 1024
                      minLength: 1
                      type: string
                    maxItems: 100
                    type: array
          description: Indicates a successful call.
        '401':
          content:
            application/json:
              examples:
                response401:
                  $ref: '#/components/examples/Cases_response_401'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: Authorization information is missing or invalid.
      summary: Add case settings
      tags:
        - cases
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/cases/configure/{configurationId}:
    patch:
      description: |
        **Spaces method and path for this operation:**

        <div><span class="operation-verb patch">patch</span>&nbsp;<span class="operation-path">/s/{space_id}/api/cases/configure/{configurationId}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Updates setting details such as the closure type, custom fields, templates, and the default connector for cases. Connectors are used to interface with external systems. You must create a connector before you can use it in your cases. You must have `all` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on where the case was created.
      operationId: updateCaseConfigurationDefaultSpace
      parameters:
        - $ref: '#/components/parameters/Cases_kbn_xsrf'
        - $ref: '#/components/parameters/Cases_configuration_id'
      requestBody:
        content:
          application/json:
            examples:
              updateCaseConfigurationRequest:
                $ref: '#/components/examples/Cases_update_case_configuration_request'
            schema:
              $ref: '#/components/schemas/Cases_update_case_configuration_request'
      responses:
        '200':
          content:
            application/json:
              examples:
                updateCaseConfigurationResponse:
                  $ref: '#/components/examples/Cases_update_case_configuration_response'
              schema:
                type: object
                properties:
                  closure_type:
                    $ref: '#/components/schemas/Cases_closure_types'
                  connector:
                    type: object
                    properties:
                      fields:
                        description: The fields specified in the case configuration are not used and are not propagated to individual cases, therefore it is recommended to set it to `null`.
                        nullable: true
                        type: object
                      id:
                        description: The identifier for the connector. If you do not want a default connector, use `none`. To retrieve connector IDs, use the find connectors API.
                        example: none
                        type: string
                      name:
                        description: The name of the connector. If you do not want a default connector, use `none`. To retrieve connector names, use the find connectors API.
                        example: none
                        type: string
                      type:
                        $ref: '#/components/schemas/Cases_connector_types'
                  created_at:
                    example: '2022-06-01T17:07:17.767Z'
                    format: date-time
                    type: string
                  created_by:
                    type: object
                    properties:
                      email:
                        example: null
                        nullable: true
                        type: string
                      full_name:
                        example: null
                        nullable: true
                        type: string
                      profile_uid:
                        example: u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0
                        type: string
                      username:
                        example: elastic
                        nullable: true
                        type: string
                    required:
                      - email
                      - full_name
                      - username
                  customFields:
                    description: Custom fields configuration details.
                    items:
                      type: object
                      properties:
                        defaultValue:
                          description: |
                            A default value for the custom field. If the `type` is `text`, the default value must be a string. If the `type` is `toggle`, the default value must be boolean.
                          oneOf:
                            - type: string
                            - type: boolean
                        key:
                          description: |
                            A unique key for the custom field. Must be lower case and composed only of a-z, 0-9, '_', and '-' characters. It is used in API calls to refer to a specific custom field.
                          maxLength: 36
                          minLength: 1
                          type: string
                        label:
                          description: The custom field label that is displayed in the case.
                          maxLength: 50
                          minLength: 1
                          type: string
                        type:
                          description: The type of the custom field.
                          enum:
                            - text
                            - toggle
                          type: string
                        required:
                          description: |
                            Indicates whether the field is required. If `false`, the custom field can be set to null or omitted when a case is created or updated.
                          type: boolean
                    type: array
                  error:
                    example: null
                    nullable: true
                    type: string
                  extractObservables:
                    description: |
                      Indicates whether observables (for example, IPs, hashes, and URLs) are automatically extracted from case comments and events.
                    example: true
                    type: boolean
                  id:
                    example: 4a97a440-e1cd-11ec-be9b-9b1838238ee6
                    type: string
                  mappings:
                    items:
                      type: object
                      properties:
                        action_type:
                          example: overwrite
                          type: string
                        source:
                          example: title
                          type: string
                        target:
                          example: summary
                          type: string
                    type: array
                  observableTypes:
                    description: Custom observable type configuration details.
                    items:
                      type: object
                      properties:
                        key:
                          description: The observable type key.
                          example: d312efda-ec2b-42ec-9e2c-84981795c581
                          type: string
                        label:
                          description: The observable type label.
                          example: My observable type
                          type: string
                    type: array
                  owner:
                    $ref: '#/components/schemas/Cases_owner'
                  templates:
                    $ref: '#/components/schemas/Cases_templates'
                  updated_at:
                    example: '2022-06-01T19:58:48.169Z'
                    format: date-time
                    nullable: true
                    type: string
                  updated_by:
                    nullable: true
                    type: object
                    properties:
                      email:
                        example: null
                        nullable: true
                        type: string
                      full_name:
                        example: null
                        nullable: true
                        type: string
                      profile_uid:
                        example: u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0
                        type: string
                      username:
                        example: elastic
                        nullable: true
                        type: string
                    required:
                      - email
                      - full_name
                      - username
                  version:
                    example: WzIwNzMsMV0=
                    type: string
                  workflowTags:
                    description: |
                      Workflow tags that limit which workflows appear in Cases workflow selectors. An empty array shows all workflows.
                    items:
                      maxLength: 1024
                      minLength: 1
                      type: string
                    maxItems: 100
                    type: array
          description: Indicates a successful call.
        '401':
          content:
            application/json:
              examples:
                response401:
                  $ref: '#/components/examples/Cases_response_401'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: Authorization information is missing or invalid.
      summary: Update case settings
      tags:
        - cases
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/cases/configure/connectors/_find:
    get:
      description: |
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/cases/configure/connectors/_find</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Get information about connectors that are supported for use in cases. You must have `read` privileges for the **Actions and Connectors** feature in the **Management** section of the Kibana feature privileges.
      operationId: findCaseConnectorsDefaultSpace
      responses:
        '200':
          content:
            application/json:
              examples:
                findConnectorResponse:
                  $ref: '#/components/examples/Cases_find_connector_response'
              schema:
                items:
                  type: object
                  properties:
                    actionTypeId:
                      $ref: '#/components/schemas/Cases_connector_types'
                    config:
                      additionalProperties: true
                      type: object
                      properties:
                        apiUrl:
                          type: string
                        projectKey:
                          type: string
                    id:
                      type: string
                    isDeprecated:
                      type: boolean
                    isMissingSecrets:
                      type: boolean
                    isPreconfigured:
                      type: boolean
                    name:
                      type: string
                    referencedByCount:
                      type: integer
                maxItems: 1000
                type: array
          description: Indicates a successful call.
        '401':
          content:
            application/json:
              examples:
                response401:
                  $ref: '#/components/examples/Cases_response_401'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: Authorization information is missing or invalid.
      summary: Get case connectors
      tags:
        - cases
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/cases/field_definitions:
    get:
      description: |
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/cases/field_definitions</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Returns a paginated list of field definitions (field library entries) for the given owner. Requires the Cases feature to be enabled in the space.
      operationId: getCaseFieldDefinitionsDefaultSpace
      parameters:
        - description: |
            The application that owns the field definitions (for example `cases`, `observability`, or `securitySolution`). Required.
          in: query
          name: owner
          required: true
          schema:
            oneOf:
              - maxLength: 50
                type: string
              - items:
                  maxLength: 50
                  type: string
                maxItems: 10
                type: array
        - description: |
            When true, returns only global field definitions (rendered on every case). When false, returns all definitions. Omit to return all.
          in: query
          name: isGlobal
          required: false
          schema:
            type: boolean
        - $ref: '#/components/parameters/Cases_page_index'
        - $ref: '#/components/parameters/Cases_page_size'
        - description: |
            The field to sort by. When omitted, results are sorted by `fieldDefinitionId` ascending and `sortOrder` is ignored.
          in: query
          name: sortField
          required: false
          schema:
            enum:
              - name
              - owner
              - isGlobal
              - displayOrder
            type: string
        - $ref: '#/components/parameters/Cases_sort_order'
        - description: |
            A case-insensitive substring to match against each definition's `name` and `description` fields. Definitions where neither field contains the substring are excluded.
          in: query
          name: search
          required: false
          schema:
            maxLength: 1000
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                getCaseFieldDefinitionsResponse:
                  $ref: '#/components/examples/Cases_get_case_field_definitions_response'
              schema:
                $ref: '#/components/schemas/Cases_get_case_field_definitions_response'
          description: Indicates a successful call.
        '400':
          content:
            application/json:
              examples:
                response400:
                  $ref: '#/components/examples/Cases_response_400_invalid_template'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: The request is invalid. For example, the `owner` query parameter is missing or `page`/`perPage` are not integers.
        '401':
          content:
            application/json:
              examples:
                response401:
                  $ref: '#/components/examples/Cases_response_401'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: Authorization information is missing or invalid.
        '403':
          content:
            application/json:
              examples:
                response403:
                  $ref: '#/components/examples/Cases_response_403'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: The user does not have permission to read field definitions for the owner.
      summary: Get all field definitions
      tags:
        - cases
      x-state: Technical preview
      x-metaTags:
        - content: Kibana
          name: product_name
    post:
      description: |
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/cases/field_definitions</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Creates a field definition in the field library. You must have the "Manage templates" sub-privilege for the Cases feature of the owning solution. Requires the Cases feature to be enabled in the space. Use `dry_run=true` to validate the request without writing anything.
      operationId: createCaseFieldDefinitionDefaultSpace
      parameters:
        - description: |
            When true, runs authorization, body, and name-uniqueness validation without creating the field definition. Returns `{ "valid": true }` on success.
          in: query
          name: dry_run
          required: false
          schema:
            default: false
            type: boolean
      requestBody:
        content:
          application/json:
            examples:
              createCaseFieldDefinitionRequest:
                $ref: '#/components/examples/Cases_field_definition_write_request'
            schema:
              $ref: '#/components/schemas/Cases_field_definition_write_request'
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                createCaseFieldDefinitionResponse:
                  $ref: '#/components/examples/Cases_get_case_field_definition_response'
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Cases_field_definition_response'
                  - type: object
                    properties:
                      valid:
                        type: boolean
                    required:
                      - valid
          description: |
            Indicates a successful call. Returns the created field definition, or `{ "valid": true }` when `dry_run=true`.
        '400':
          content:
            application/json:
              examples:
                response400:
                  $ref: '#/components/examples/Cases_response_400_invalid_template'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: |
            The request body is invalid, the YAML definition is malformed, the `name` does not match the YAML definition's `name`, or the owner already has 200 field definitions.
        '401':
          content:
            application/json:
              examples:
                response401:
                  $ref: '#/components/examples/Cases_response_401'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: Authorization information is missing or invalid.
        '403':
          content:
            application/json:
              examples:
                response403:
                  $ref: '#/components/examples/Cases_response_403'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: The user does not have the manage templates privilege for the owner.
        '409':
          content:
            application/json:
              examples:
                response409:
                  $ref: '#/components/examples/Cases_response_409'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: A field definition with the same name already exists for the owner.
      summary: Create a field definition
      tags:
        - cases
      x-state: Technical preview
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/cases/field_definitions/{field_definition_id}:
    delete:
      description: |
        **Spaces method and path for this operation:**

        <div><span class="operation-verb delete">delete</span>&nbsp;<span class="operation-path">/s/{space_id}/api/cases/field_definitions/{field_definition_id}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Deletes a field definition. You must have the "Manage templates" sub-privilege for the Cases feature of the owning solution. A field definition cannot be deleted while it is referenced by an active template or linked to an active custom field in the Cases configuration. Requires the Cases feature to be enabled in the space.
      operationId: deleteCaseFieldDefinitionDefaultSpace
      parameters:
        - $ref: '#/components/parameters/Cases_field_definition_id'
      responses:
        '204':
          description: The field definition was deleted.
        '401':
          content:
            application/json:
              examples:
                response401:
                  $ref: '#/components/examples/Cases_response_401'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: Authorization information is missing or invalid.
        '403':
          content:
            application/json:
              examples:
                response403:
                  $ref: '#/components/examples/Cases_response_403'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: The user does not have the manage templates privilege for the owner.
        '404':
          content:
            application/json:
              examples:
                response404:
                  $ref: '#/components/examples/Cases_response_404'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: The field definition was not found.
        '409':
          content:
            application/json:
              examples:
                response409:
                  $ref: '#/components/examples/Cases_response_409'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: |
            The field definition is referenced by one or more active templates, or is linked to an active custom field in the Cases configuration.
      summary: Delete a field definition
      tags:
        - cases
      x-state: Technical preview
      x-metaTags:
        - content: Kibana
          name: product_name
    get:
      description: |
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/cases/field_definitions/{field_definition_id}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Returns a single field definition by its ID. Requires the Cases feature to be enabled in the space.
      operationId: getCaseFieldDefinitionDefaultSpace
      parameters:
        - $ref: '#/components/parameters/Cases_field_definition_id'
      responses:
        '200':
          content:
            application/json:
              examples:
                getCaseFieldDefinitionResponse:
                  $ref: '#/components/examples/Cases_get_case_field_definition_response'
              schema:
                $ref: '#/components/schemas/Cases_field_definition_response'
          description: Indicates a successful call. Returns the field definition.
        '401':
          content:
            application/json:
              examples:
                response401:
                  $ref: '#/components/examples/Cases_response_401'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: Authorization information is missing or invalid.
        '403':
          content:
            application/json:
              examples:
                response403:
                  $ref: '#/components/examples/Cases_response_403'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: The user does not have permission to read field definitions for the owner.
        '404':
          content:
            application/json:
              examples:
                response404:
                  $ref: '#/components/examples/Cases_response_404'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: The field definition was not found.
      summary: Get a field definition by ID
      tags:
        - cases
      x-state: Technical preview
      x-metaTags:
        - content: Kibana
          name: product_name
    put:
      description: |
        **Spaces method and path for this operation:**

        <div><span class="operation-verb put">put</span>&nbsp;<span class="operation-path">/s/{space_id}/api/cases/field_definitions/{field_definition_id}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Updates editable attributes of a field definition. Server-managed attributes (`displayOrder`, `legacyKey`) are preserved. You must have the "Manage templates" sub-privilege for the Cases feature of the owning solution. A field's `name` and YAML `type` are immutable after creation — an attempt to change either returns `409` with `attributes.code = "field_identity_immutable"` and `attributes.changed` listing which identity attributes were modified. Setting `isGlobal` to `false` when the field is linked to an active custom field in the Cases configuration returns `409`; otherwise demotion is allowed. Requires the Cases feature to be enabled in the space. Use `dry_run=true` to validate the request without writing anything.
      operationId: updateCaseFieldDefinitionDefaultSpace
      parameters:
        - $ref: '#/components/parameters/Cases_field_definition_id'
        - description: |
            When true, runs authorization, body, and identity-immutability validation without updating the field definition. Returns `{ "valid": true }` on success.
          in: query
          name: dry_run
          required: false
          schema:
            default: false
            type: boolean
      requestBody:
        content:
          application/json:
            examples:
              updateCaseFieldDefinitionRequest:
                $ref: '#/components/examples/Cases_field_definition_write_request'
            schema:
              $ref: '#/components/schemas/Cases_field_definition_put_request'
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                updateCaseFieldDefinitionResponse:
                  $ref: '#/components/examples/Cases_get_case_field_definition_response'
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Cases_field_definition_response'
                  - type: object
                    properties:
                      valid:
                        type: boolean
                    required:
                      - valid
          description: |
            Indicates a successful call. Returns the updated field definition, or `{ "valid": true }` when `dry_run=true`.
        '400':
          content:
            application/json:
              examples:
                response400:
                  $ref: '#/components/examples/Cases_response_400_invalid_template'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: |
            The request body is invalid, the YAML definition is malformed, the `name` does not match the YAML definition's `name`, or the owner would be changed.
        '401':
          content:
            application/json:
              examples:
                response401:
                  $ref: '#/components/examples/Cases_response_401'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: Authorization information is missing or invalid.
        '403':
          content:
            application/json:
              examples:
                response403:
                  $ref: '#/components/examples/Cases_response_403'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: The user does not have the manage templates privilege for the owner.
        '404':
          content:
            application/json:
              examples:
                response404:
                  $ref: '#/components/examples/Cases_response_404'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: The field definition was not found.
        '409':
          content:
            application/json:
              examples:
                response409:
                  $ref: '#/components/examples/Cases_response_409'
              schema:
                anyOf:
                  - description: Identity-immutable conflict — name or type was changed.
                    type: object
                    properties:
                      attributes:
                        type: object
                        properties:
                          changed:
                            items:
                              type: string
                            type: array
                          code:
                            enum:
                              - field_identity_immutable
                            type: string
                        required:
                          - code
                          - changed
                      error:
                        type: string
                      message:
                        type: string
                      statusCode:
                        type: integer
                    required:
                      - statusCode
                      - error
                      - message
                      - attributes
                  - $ref: '#/components/schemas/Cases_response_4xx'
          description: |
            A field's name or type cannot be changed after creation, or a global field cannot be demoted while linked to an active custom field.
      summary: Update a field definition
      tags:
        - cases
      x-state: Technical preview
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/cases/fields:
    get:
      description: |
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/cases/fields</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Returns the fields you can write to a case's `extended_fields` when creating a case for the given owner. Includes the owner's global (library-wide) fields and, when `templateId` is supplied, that template's fields. Migrated legacy custom fields appear as `global` fields. Requires the Cases feature to be enabled in the space.
      operationId: getApplicableFieldsDefaultSpace
      parameters:
        - description: The application that owns the cases (for example `cases`, `observability`, or `securitySolution`).
          example: cases
          in: query
          name: owner
          required: true
          schema:
            maxLength: 30
            type: string
        - description: The identifier of a template to include the template's fields in the response.
          in: query
          name: templateId
          required: false
          schema:
            maxLength: 36
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                getCaseApplicableFieldsResponse:
                  $ref: '#/components/examples/Cases_get_case_applicable_fields_response'
              schema:
                $ref: '#/components/schemas/Cases_applicable_fields_response'
          description: Indicates a successful call.
        '400':
          content:
            application/json:
              examples:
                response400:
                  $ref: '#/components/examples/Cases_response_400_invalid_template'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: The request is invalid, for example when the `templateId` does not exist for the owner or its definition is invalid.
        '401':
          content:
            application/json:
              examples:
                response401:
                  $ref: '#/components/examples/Cases_response_401'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: Authorization information is missing or invalid.
        '403':
          content:
            application/json:
              examples:
                response403:
                  $ref: '#/components/examples/Cases_response_403'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: The user does not have access to the requested owner.
      summary: Get the fields applicable to a case
      tags:
        - cases
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/cases/reporters:
    get:
      description: |
        Returns information about the users who opened cases. You must have read privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the cases. The API returns information about the users as they existed at the time of the case creation, including their name, full name, and email address. If any of those details change thereafter or if a user is deleted, the information returned by this API is unchanged.
      operationId: getCaseReportersDefaultSpace
      parameters:
        - $ref: '#/components/parameters/Cases_owner_filter'
      responses:
        '200':
          content:
            application/json:
              examples:
                getReportersResponse:
                  $ref: '#/components/examples/Cases_get_reporters_response'
              schema:
                items:
                  type: object
                  properties:
                    email:
                      example: null
                      nullable: true
                      type: string
                    full_name:
                      example: null
                      nullable: true
                      type: string
                    profile_uid:
                      example: u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0
                      type: string
                    username:
                      example: elastic
                      nullable: true
                      type: string
                  required:
                    - email
                    - full_name
                    - username
                maxItems: 10000
                type: array
          description: Indicates a successful call.
        '401':
          content:
            application/json:
              examples:
                response401:
                  $ref: '#/components/examples/Cases_response_401'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: Authorization information is missing or invalid.
      summary: Get case creators
      tags:
        - cases
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/cases/tags:
    get:
      description: |
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/cases/tags</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Aggregates and returns a list of case tags. You must have read privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the cases you're seeking.
      operationId: getCaseTagsDefaultSpace
      parameters:
        - $ref: '#/components/parameters/Cases_owner_filter'
      responses:
        '200':
          content:
            application/json:
              examples:
                getTagsResponse:
                  $ref: '#/components/examples/Cases_get_tags_response'
              schema:
                items:
                  type: string
                maxItems: 10000
                type: array
          description: Indicates a successful call.
        '401':
          content:
            application/json:
              examples:
                response401:
                  $ref: '#/components/examples/Cases_response_401'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: Authorization information is missing or invalid.
      summary: Get case tags
      tags:
        - cases
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/cases/templates:
    get:
      description: |
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/cases/templates</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Returns a paginated list of case templates. Requires the Cases feature to be enabled in the space.
      operationId: getCaseTemplatesDefaultSpace
      parameters:
        - $ref: '#/components/parameters/Cases_page_index'
        - $ref: '#/components/parameters/Cases_page_size'
        - $ref: '#/components/parameters/Cases_template_sort_field'
        - $ref: '#/components/parameters/Cases_sort_order'
        - $ref: '#/components/parameters/Cases_search'
        - $ref: '#/components/parameters/Cases_owner_filter'
        - $ref: '#/components/parameters/Cases_template_tags'
        - $ref: '#/components/parameters/Cases_template_author'
        - $ref: '#/components/parameters/Cases_template_is_enabled'
      responses:
        '200':
          content:
            application/json:
              examples:
                getCaseTemplatesResponse:
                  $ref: '#/components/examples/Cases_get_case_templates_response'
              schema:
                $ref: '#/components/schemas/Cases_get_case_templates_response'
          description: Indicates a successful call.
        '401':
          content:
            application/json:
              examples:
                response401:
                  $ref: '#/components/examples/Cases_response_401'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: Authorization information is missing or invalid.
      summary: Get all case templates
      tags:
        - cases
      x-metaTags:
        - content: Kibana
          name: product_name
    post:
      description: |
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/cases/templates</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Creates a case template from a YAML definition. You must have the "Manage templates" sub-privilege for the Cases feature of the owning solution. Set `dry_run=true` to run the full validation (body, YAML definition, name uniqueness, authorization) without creating anything. Requires the Cases feature to be enabled in the space.
      operationId: createCaseTemplateDefaultSpace
      parameters:
        - description: 'When true, validates the request without creating the template and returns `{"valid": true}`.'
          in: query
          name: dry_run
          required: false
          schema:
            default: false
            type: boolean
      requestBody:
        content:
          application/json:
            examples:
              createCaseTemplateRequest:
                $ref: '#/components/examples/Cases_template_write_request'
            schema:
              $ref: '#/components/schemas/Cases_template_write_request'
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                createCaseTemplateResponse:
                  $ref: '#/components/examples/Cases_get_case_template_response'
                dryRunResponse:
                  $ref: '#/components/examples/Cases_template_dry_run_response'
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Cases_template_v2_response'
                  - $ref: '#/components/schemas/Cases_template_dry_run_response'
          description: 'Indicates a successful call. Returns the created template, or `{"valid": true}` for a dry run.'
        '400':
          content:
            application/json:
              examples:
                response400:
                  $ref: '#/components/examples/Cases_response_400_template_limit'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: |
            The request body, YAML definition, or template name is invalid, or a resource limit was exceeded (max 200 templates per owner, max 200 fields per template).
        '401':
          content:
            application/json:
              examples:
                response401:
                  $ref: '#/components/examples/Cases_response_401'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: Authorization information is missing or invalid.
        '403':
          content:
            application/json:
              examples:
                response403:
                  $ref: '#/components/examples/Cases_response_403'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: The user does not have the manage templates privilege for the owner.
        '409':
          content:
            application/json:
              examples:
                response409:
                  $ref: '#/components/examples/Cases_response_409'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: A template with the same name already exists for the owner.
      summary: Create a case template
      tags:
        - cases
      x-state: Technical preview
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/cases/templates/{template_id}:
    delete:
      description: |
        **Spaces method and path for this operation:**

        <div><span class="operation-verb delete">delete</span>&nbsp;<span class="operation-path">/s/{space_id}/api/cases/templates/{template_id}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Soft-deletes a case template (all versions). Existing cases keep their pinned template reference; the template stops appearing in the case creation flow and in find responses. You must have the "Manage templates" sub-privilege for the Cases feature of the owning solution. Requires the Cases feature to be enabled in the space.
      operationId: deleteCaseTemplateDefaultSpace
      parameters:
        - $ref: '#/components/parameters/Cases_template_id'
      responses:
        '204':
          description: The template was deleted.
        '401':
          content:
            application/json:
              examples:
                response401:
                  $ref: '#/components/examples/Cases_response_401'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: Authorization information is missing or invalid.
        '403':
          content:
            application/json:
              examples:
                response403:
                  $ref: '#/components/examples/Cases_response_403'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: The user does not have the manage templates privilege for the owner.
        '404':
          content:
            application/json:
              examples:
                response404:
                  $ref: '#/components/examples/Cases_response_404'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: The template was not found.
      summary: Delete a case template
      tags:
        - cases
      x-state: Technical preview
      x-metaTags:
        - content: Kibana
          name: product_name
    get:
      description: |
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/cases/templates/{template_id}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Returns the details of a case template. Requires the Cases feature to be enabled in the space.
      operationId: getCaseTemplateDefaultSpace
      parameters:
        - $ref: '#/components/parameters/Cases_template_id'
        - $ref: '#/components/parameters/Cases_template_version'
      responses:
        '200':
          content:
            application/json:
              examples:
                getCaseTemplateResponse:
                  $ref: '#/components/examples/Cases_get_case_template_response'
              schema:
                $ref: '#/components/schemas/Cases_template_v2_response'
          description: Indicates a successful call.
        '401':
          content:
            application/json:
              examples:
                response401:
                  $ref: '#/components/examples/Cases_response_401'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: Authorization information is missing or invalid.
        '404':
          content:
            application/json:
              examples:
                response404:
                  $ref: '#/components/examples/Cases_response_404'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: The template was not found.
      summary: Get a case template by ID
      tags:
        - cases
      x-metaTags:
        - content: Kibana
          name: product_name
    put:
      description: |
        **Spaces method and path for this operation:**

        <div><span class="operation-verb put">put</span>&nbsp;<span class="operation-path">/s/{space_id}/api/cases/templates/{template_id}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Fully replaces a case template. Every accepted update creates a new template version; previous versions stay retrievable with the `version` query parameter of the get template API, and cases keep the version they were created with. You must have the "Manage templates" sub-privilege for the Cases feature of the owning solution. Set `dry_run=true` to run the full validation without writing. Requires the Cases feature to be enabled in the space.
      operationId: updateCaseTemplateDefaultSpace
      parameters:
        - $ref: '#/components/parameters/Cases_template_id'
        - description: 'When true, validates the request without updating the template and returns `{"valid": true}`.'
          in: query
          name: dry_run
          required: false
          schema:
            default: false
            type: boolean
      requestBody:
        content:
          application/json:
            examples:
              updateCaseTemplateRequest:
                $ref: '#/components/examples/Cases_template_write_request'
            schema:
              $ref: '#/components/schemas/Cases_template_write_request'
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                dryRunResponse:
                  $ref: '#/components/examples/Cases_template_dry_run_response'
                updateCaseTemplateResponse:
                  $ref: '#/components/examples/Cases_get_case_template_response'
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Cases_template_v2_response'
                  - $ref: '#/components/schemas/Cases_template_dry_run_response'
          description: 'Indicates a successful call. Returns the new template version, or `{"valid": true}` for a dry run.'
        '400':
          content:
            application/json:
              examples:
                response400:
                  $ref: '#/components/examples/Cases_response_400_template_limit'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: |
            The request body, YAML definition, or template name is invalid, or a resource limit was exceeded (max 200 fields per template).
        '401':
          content:
            application/json:
              examples:
                response401:
                  $ref: '#/components/examples/Cases_response_401'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: Authorization information is missing or invalid.
        '403':
          content:
            application/json:
              examples:
                response403:
                  $ref: '#/components/examples/Cases_response_403'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: The user does not have the manage templates privilege for the owner.
        '404':
          content:
            application/json:
              examples:
                response404:
                  $ref: '#/components/examples/Cases_response_404'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: The template was not found.
        '409':
          content:
            application/json:
              examples:
                response409:
                  $ref: '#/components/examples/Cases_response_409'
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
          description: A template with the same name already exists for the owner.
      summary: Update a case template
      tags:
        - cases
      x-state: Technical preview
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/chat/message:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/chat/message</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Send a message to an agent and get its text answer. Use this synchronous endpoint in scripts and command-line tools. The response contains only the answer and the conversation ID. To continue the conversation, include the returned `conversation_id` in the next request.

        The agent runs without a user, so the endpoint declines every prompt that the agent raises, such as a tool confirmation, a question, or a destructive API approval. The `declined_prompts` property lists these prompts. This endpoint does not support attachments.

        The `agentBuilder:experimentalFeatures` advanced setting must be enabled. If it is disabled, the endpoint returns a 404 response.<br/><br/>[Required authorization] Route required privileges: agentBuilder:read.
      operationId: post-chat-message
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
      requestBody:
        content:
          application/json:
            examples:
              messageContinueConversationRequestExample:
                description: Continue a conversation with the `conversation_id` returned by a previous call
                value:
                  agent_id: elastic-ai-agent
                  conversation_id: 696ccd6d-4bff-4b26-a62e-522ccf2dcd16
                  message: And how does it differ from Kibana?
              messageRequestExample:
                description: Send a message to the default agent and start a new conversation.
                value:
                  message: What is Elasticsearch?
              messageToAgentRequestExample:
                description: Send a message to a specific agent
                value:
                  agent_id: elastic-ai-agent
                  message: What is Elasticsearch?
            schema:
              additionalProperties: false
              type: object
              properties:
                agent_id:
                  default: elastic-ai-agent
                  description: The ID of the agent to send the message to. Defaults to the default Elastic AI agent.
                  maxLength: 64
                  minLength: 1
                  type: string
                conversation_id:
                  description: The ID of an existing conversation to continue. Omit it to start a new conversation; the response carries the ID to reuse on the next call.
                  maxLength: 256
                  type: string
                message:
                  description: The user message to send to the agent.
                  maxLength: 100000
                  minLength: 1
                  type: string
              required:
                - message
      responses:
        '200':
          content:
            application/json:
              examples:
                messageDeclinedPromptResponseExample:
                  description: The agent tried to call a tool that requires user confirmation. There is no user to ask on this endpoint, so the call was declined and the agent answered with what it could
                  value:
                    answer: I could not run the reindex because it requires confirmation, which is not available here. You can run it from a conversation in Kibana instead.
                    conversation_id: 696ccd6d-4bff-4b26-a62e-522ccf2dcd16
                    declined_prompts:
                      - message: Agent running in non-interactive mode, user input not available - execution was declined
                        tool_id: reindex-logs
                messageResponseExample:
                  description: The agent's answer and the ID of the conversation it was stored in. `declined_prompts` is absent because the agent asked for nothing.
                  value:
                    answer: Elasticsearch is a distributed, RESTful search and analytics engine capable of addressing a growing number of use cases. As the heart of the Elastic Stack, it centrally stores your data for lightning fast search, fine‑tuned relevancy, and powerful analytics that scale with ease.
                    conversation_id: 696ccd6d-4bff-4b26-a62e-522ccf2dcd16
              schema:
                additionalProperties: false
                type: object
                properties:
                  answer:
                    description: The agent's final text answer. Empty when the agent finished without a message.
                    type: string
                  conversation_id:
                    description: 'The conversation the message was added to: the one requested, or the one created for it.'
                    type: string
                  declined_prompts:
                    description: The prompts that the endpoint declined. In an interactive conversation, these prompts pause the agent until the user answers. Examples are tool confirmations, questions to the user, and destructive API approvals. This endpoint has no user, so it declines each prompt and tells the agent why. The property is absent if the agent raised no prompts.
                    items:
                      additionalProperties: false
                      type: object
                      properties:
                        message:
                          description: The explanation the agent received in place of the prompt.
                          type: string
                        tool_id:
                          description: The tool whose call was declined.
                          type: string
                      required:
                        - tool_id
                        - message
                    minItems: 1
                    type: array
                required:
                  - conversation_id
                  - answer
          description: The agent answered. The response contains the answer and the ID of the conversation that stores the exchange.
        '400':
          content:
            application/json:
              examples:
                messageEmptyExample:
                  description: The `message` is empty
                  value:
                    error: Bad Request
                    message: '[request body.message]: value has length [0] but it must have a minimum length of [1].'
                    statusCode: 400
                messageUnexpectedKeyExample:
                  description: The body carries a key this endpoint does not accept
                  value:
                    error: Bad Request
                    message: "[request body.connector_id]: Additional properties are not allowed ('connector_id' was unexpected)"
                    statusCode: 400
          description: 'Bad Request: the request body is not valid. Possible causes are an empty or too long `message`, a `conversation_id` that is not a UUID, or an unsupported property such as `connector_id` or `attachments`.'
        '404':
          content:
            application/json:
              examples:
                messageNotFoundExample:
                  description: The `conversation_id` is unknown, or the `agent_id` is unknown or not usable by the caller
                  value:
                    attributes:
                      trace_id: 8d4f2a3b-1c5e-4a9b-9f0d-2e6c1a3d4f5e
                    error: Not Found
                    message: Conversation 696ccd6d-4bff-4b26-a62e-522ccf2dcd16 not found
                    statusCode: 404
          description: 'Not Found: the conversation or agent was not found. Possible causes are a `conversation_id` that does not exist, an `agent_id` that the caller cannot use, or a disabled `agentBuilder:experimentalFeatures` advanced setting. If the caller cannot use the agent, the error says that the conversation was not found. This prevents callers from discovering hidden agents.'
      summary: Send a message and get the answer
      tags:
        - agent builder
      x-codeSamples:
        - lang: curl
          source: |
            curl \
              -X POST "${KIBANA_URL}/api/chat/message" \
              -H "Authorization: ApiKey ${API_KEY}" \
              -H "kbn-xsrf: true" \
              -H "Content-Type: application/json" \
              -d '{
                "message": "What is Elasticsearch?",
                "agent_id": "elastic-ai-agent"
              }'
        - lang: Console
          source: |
            POST kbn://api/chat/message
            {
              "message": "What is Elasticsearch?",
              "agent_id": "elastic-ai-agent"
            }
      x-state: Experimental; added in 9.6.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/context_engine/ai_index:
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/context_engine/ai_index</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Lists up to 100 AI Indices in the current space that the caller can read. The response omits an AI Index when the caller cannot read its backing index. Empty AI Indices are still included. A caller with no read privilege on any index gets a 403 response.

        The space comes from the request URL (`/s/{spaceId}/…`) or defaults to the default space. It cannot be specified in any other way.

        Returns a 404 response when Context Engine is turned off in this space (`contextEngine:enabled`).

        **For more information, refer to the [Context Engine documentation](https://www.elastic.co/docs/explore-analyze/ai-features/context-engine).**<br/><br/>[Required authorization] Route required privileges: contextEngine:read.
      operationId: get-context-engine-ai-index
      parameters: []
      responses:
        '200':
          content:
            application/json:
              examples:
                listAiIndicesResponseExample:
                  description: Example response listing the AI Indices the caller can read
                  summary: AI Indices the caller can read
                  value:
                    ai_indices:
                      - automations: []
                        date_created: '2026-09-22T12:00:00.000Z'
                        date_modified: '2026-09-22T12:00:00.000Z'
                        description: Knowledge about customer support cases.
                        dest:
                          type: data_stream
                          value: ai-index-ds-customer-support
                        id: customer_support
                        managed: false
                        memory_enabled: true
                        sources:
                          - type: esql
                            value: FROM support-cases | LIMIT 100
                        traces: []
              schema:
                additionalProperties: false
                type: object
                properties:
                  ai_indices:
                    description: The AI Indices available to the caller in the current space.
                    items:
                      additionalProperties: false
                      type: object
                      properties:
                        automations:
                          description: Automations associated with the AI Index.
                          items:
                            additionalProperties: false
                            type: object
                            properties:
                              type:
                                enum:
                                  - workflow
                                type: string
                              value:
                                description: The workflow ID.
                                type: string
                            required:
                              - type
                              - value
                          type: array
                        date_created:
                          description: ISO 8601 timestamp of when the AI Index was created.
                          type: string
                        date_modified:
                          description: ISO 8601 timestamp of when the AI Index was last modified.
                          type: string
                        description:
                          description: Human-readable description of the AI Index.
                          type: string
                        dest:
                          additionalProperties: false
                          description: The data stream or index that backs the AI Index.
                          type: object
                          properties:
                            type:
                              description: The type of the backing store.
                              enum:
                                - data_stream
                                - index
                              type: string
                            value:
                              description: The data stream or index the AI Index is attached to.
                              type: string
                          required:
                            - type
                            - value
                        feedback_analysis:
                          additionalProperties: false
                          description: The recurring feedback analysis, which reads agent signals and proposes improvement actions for the AI Index.
                          type: object
                          properties:
                            agent_id:
                              description: Agent Builder agent ID that runs the analysis.
                              type: string
                            allowed_actions:
                              description: Improvement actions the analysis may propose.
                              items:
                                description: Add, edit, or remove a Knowledge Indicator (`*_ki`), a workflow automation (`*_workflow`), or a source (`*_source`).
                                enum:
                                  - add_ki
                                  - edit_ki
                                  - remove_ki
                                  - add_workflow
                                  - edit_workflow
                                  - remove_workflow
                                  - add_source
                                  - edit_source
                                  - remove_source
                                type: string
                              type: array
                            enabled:
                              description: Whether the recurring feedback analysis is desired to run.
                              type: boolean
                            schedule:
                              additionalProperties: false
                              description: When the analysis runs.
                              type: object
                              properties:
                                interval:
                                  description: How often to analyze, for example `1h`.
                                  type: string
                              required:
                                - interval
                            signal_filter:
                              description: KQL narrowing which signals the analysis reads.
                              type: string
                            signal_time_range:
                              anyOf:
                                - additionalProperties: false
                                  type: object
                                  properties:
                                    from:
                                      description: Date math relative to now, for example `now-30d`.
                                      type: string
                                    type:
                                      enum:
                                        - relative
                                      type: string
                                  required:
                                    - type
                                    - from
                                - additionalProperties: false
                                  type: object
                                  properties:
                                    from:
                                      description: ISO 8601 date to analyze signals since.
                                      type: string
                                    type:
                                      enum:
                                        - absolute
                                      type: string
                                  required:
                                    - type
                                    - from
                          required:
                            - enabled
                        id:
                          description: The unique identifier of the AI Index.
                          type: string
                        managed:
                          description: Whether the AI Index is managed by a plugin and therefore immutable.
                          type: boolean
                        memory_enabled:
                          description: Whether this AI Index accepts memory writes.
                          type: boolean
                        sources:
                          description: Additional sources that provide context for the AI Index.
                          items:
                            additionalProperties: false
                            type: object
                            properties:
                              type:
                                description: '`esql` for an ES|QL query, or `connector` for a data connector.'
                                enum:
                                  - esql
                                  - connector
                                type: string
                              value:
                                description: An ES|QL query for `esql`, or a connector ID for `connector`.
                                type: string
                            required:
                              - type
                              - value
                          type: array
                        traces:
                          description: Trace sources linked to this AI Index, each with its derived ES|QL query.
                          items:
                            additionalProperties: false
                            type: object
                            properties:
                              query:
                                description: The ES|QL query derived from this trace source at read time.
                                type: string
                              type:
                                description: '`elastic_agent` for an Agent Builder agent, `index` for an index or data stream name or pattern, or `esql` for an ES|QL query.'
                                enum:
                                  - elastic_agent
                                  - index
                                  - esql
                                type: string
                              value:
                                description: The trace source value.
                                type: string
                            required:
                              - type
                              - value
                              - query
                          type: array
                      required:
                        - id
                        - managed
                        - memory_enabled
                        - date_created
                        - date_modified
                        - dest
                        - automations
                        - sources
                        - traces
                    type: array
                required:
                  - ai_indices
          description: The AI Indices available to the caller in the current space.
        '403':
          content:
            application/json:
              examples:
                forbiddenExample:
                  description: The caller has no read privilege on any index
                  summary: No index read privileges
                  value:
                    error: Forbidden
                    message: |-
                      security_exception
                      	Root causes:
                      		security_exception: action [indices:data/read/msearch] is unauthorized for user [jdoe] with effective roles [support_reader], this action is granted by the index privileges [read,all]
                    statusCode: 403
              schema:
                additionalProperties: false
                description: Generic error response.
                type: object
                properties:
                  error:
                    description: The HTTP status text.
                    type: string
                  message:
                    description: A human-readable error message.
                    type: string
                  statusCode:
                    description: The HTTP status code.
                    type: number
                required:
                  - message
          description: The caller has no read privilege on any index, so Elasticsearch rejected the request.
        '404':
          content:
            application/json:
              examples:
                contextEngineDisabledExample:
                  description: Context Engine is turned off in this space
                  summary: Context Engine turned off
                  value:
                    error: Not Found
                    message: Not Found
                    statusCode: 404
              schema:
                additionalProperties: false
                description: Generic error response.
                type: object
                properties:
                  error:
                    description: The HTTP status text.
                    type: string
                  message:
                    description: A human-readable error message.
                    type: string
                  statusCode:
                    description: The HTTP status code.
                    type: number
                required:
                  - message
          description: Context Engine is turned off in this space.
      summary: List AI Indices
      tags:
        - context engine
      x-codeSamples:
        - lang: curl
          source: |
            curl \
              -X GET "https://${KIBANA_URL}/api/context_engine/ai_index" \
              -H "Authorization: ApiKey ${API_KEY}"
        - lang: Console
          source: |
            GET kbn:/api/context_engine/ai_index
      x-state: Experimental; added in 9.6.0
      x-metaTags:
        - content: Kibana
          name: product_name
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/context_engine/ai_index</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Creates an AI Index record attached to a data stream or index. Fails with a 409 if an AI Index with the same ID already exists.

        Returns a 404 response when Context Engine is turned off in this space (`contextEngine:enabled`).

        **For more information, refer to the [Context Engine documentation](https://www.elastic.co/docs/explore-analyze/ai-features/context-engine).**<br/><br/>[Required authorization] Route required privileges: contextEngine:write.
      operationId: post-context-engine-ai-index
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
      requestBody:
        content:
          application/json:
            examples:
              createAiIndexRequestExample:
                description: Example request to create an AI Index attached to a data stream
                summary: Create an AI Index
                value:
                  automations:
                    - type: workflow
                      value: 8f1c2d3e-4b5a-6c7d-8e9f-0a1b2c3d4e5f
                  description: Knowledge about customer support cases.
                  dest:
                    type: data_stream
                    value: ai-index-ds-customer-support
                  id: customer_support
                  sources:
                    - type: esql
                      value: FROM support-cases | LIMIT 100
                  traces:
                    - type: elastic_agent
                      value: elastic-ai-agent
                    - type: index
                      value: traces-support
            schema:
              additionalProperties: false
              type: object
              properties:
                automations:
                  default: []
                  description: Automations associated with the AI Index. Defaults to an empty array when omitted.
                  items:
                    additionalProperties: false
                    type: object
                    properties:
                      type:
                        enum:
                          - workflow
                        type: string
                      value:
                        description: The workflow ID.
                        maxLength: 1024
                        minLength: 1
                        type: string
                    required:
                      - type
                      - value
                  maxItems: 100
                  type: array
                description:
                  description: Human-readable description of the AI Index.
                  maxLength: 2048
                  type: string
                dest:
                  additionalProperties: false
                  description: The data stream or index that backs the AI Index.
                  type: object
                  properties:
                    type:
                      description: The type of the backing store. `data_stream` for a data stream, or `index` for an index.
                      enum:
                        - data_stream
                        - index
                      type: string
                    value:
                      description: The data stream or index (e.g. `ai-index-ds-foo`, `ai-index-idx-foo`) the AI Index is attached to. Must name a single data stream or index (no wildcards or comma-separated lists), match `type`, and start with `ai-index-ds-` (for `data_stream`) or `ai-index-idx-` (for `index`). The rest of the value must be a valid AI Index ID. System indices are not allowed.
                      maxLength: 1024
                      minLength: 1
                      type: string
                  required:
                    - type
                    - value
                feedback_analysis:
                  additionalProperties: false
                  description: The recurring feedback analysis, which reads agent signals and proposes improvement actions for the AI Index.
                  type: object
                  properties:
                    agent_id:
                      description: Agent Builder agent ID that runs this index’s feedback-loop analysis.
                      maxLength: 256
                      type: string
                    allowed_actions:
                      default:
                        - add_ki
                        - edit_ki
                        - remove_ki
                        - add_workflow
                        - edit_workflow
                        - remove_workflow
                        - add_source
                        - edit_source
                        - remove_source
                      description: Improvement actions the analysis may propose. An empty list is observe-only.
                      items:
                        description: Add, edit, or remove a Knowledge Indicator (`*_ki`), a workflow automation (`*_workflow`), or a source (`*_source`).
                        enum:
                          - add_ki
                          - edit_ki
                          - remove_ki
                          - add_workflow
                          - edit_workflow
                          - remove_workflow
                          - add_source
                          - edit_source
                          - remove_source
                        type: string
                      maxItems: 9
                      type: array
                    enabled:
                      description: Desired state of the recurring analysis. The scheduler stays authoritative for whether it is actually running.
                      type: boolean
                    schedule:
                      additionalProperties: false
                      default:
                        interval: 24h
                      description: When the analysis runs.
                      type: object
                      properties:
                        interval:
                          description: How often to analyze, for example `1h` or `24h`. At least 15 minutes.
                          maxLength: 16
                          type: string
                      required:
                        - interval
                    signal_filter:
                      description: 'KQL narrowing which signals this index analyzes, for example `tags: query_error`.'
                      maxLength: 4096
                      type: string
                    signal_time_range:
                      anyOf:
                        - additionalProperties: false
                          type: object
                          properties:
                            from:
                              description: Date math relative to now, for example `now-30d`.
                              maxLength: 64
                              type: string
                            type:
                              enum:
                                - relative
                              type: string
                          required:
                            - type
                            - from
                        - additionalProperties: false
                          type: object
                          properties:
                            from:
                              description: ISO 8601 date to analyze signals since.
                              maxLength: 64
                              type: string
                            type:
                              enum:
                                - absolute
                              type: string
                          required:
                            - type
                            - from
                      default:
                        from: now-30d
                        type: relative
                      description: Which signals the analysis reads. A read filter only.
                  required:
                    - enabled
                id:
                  description: The unique identifier of the AI Index.
                  maxLength: 256
                  minLength: 1
                  type: string
                memory_enabled:
                  description: Whether this AI index accepts memory writes. Defaults to true when omitted.
                  type: boolean
                sources:
                  default: []
                  description: Additional sources that provide context for the AI Index. Defaults to an empty array when omitted.
                  items:
                    anyOf:
                      - additionalProperties: false
                        type: object
                        properties:
                          type:
                            enum:
                              - esql
                            type: string
                          value:
                            description: The source value; an ES|QL query when `type` is `esql`. Must be valid ES|QL.
                            maxLength: 10240
                            minLength: 1
                            type: string
                        required:
                          - type
                          - value
                      - additionalProperties: false
                        type: object
                        properties:
                          type:
                            enum:
                              - connector
                            type: string
                          value:
                            description: The source value; a connector ID when `type` is `connector`.
                            maxLength: 10240
                            minLength: 1
                            type: string
                        required:
                          - type
                          - value
                  maxItems: 100
                  type: array
                traces:
                  default: []
                  description: Trace sources linked to this AI Index. A write replaces the whole array. Defaults to an empty array when omitted.
                  items:
                    anyOf:
                      - additionalProperties: false
                        type: object
                        properties:
                          type:
                            enum:
                              - elastic_agent
                            type: string
                          value:
                            description: The Agent Builder agent ID.
                            maxLength: 10240
                            minLength: 1
                            type: string
                        required:
                          - type
                          - value
                      - additionalProperties: false
                        type: object
                        properties:
                          type:
                            enum:
                              - index
                            type: string
                          value:
                            description: An index or data stream name or pattern to read traces from.
                            maxLength: 10240
                            minLength: 1
                            type: string
                        required:
                          - type
                          - value
                      - additionalProperties: false
                        type: object
                        properties:
                          type:
                            enum:
                              - esql
                            type: string
                          value:
                            description: An ES|QL query to select traces.
                            maxLength: 10240
                            minLength: 1
                            type: string
                        required:
                          - type
                          - value
                  maxItems: 100
                  type: array
              required:
                - id
                - dest
      responses:
        '201':
          content:
            application/json:
              examples:
                createAiIndexResponseExample:
                  description: Example response after the AI Index is created
                  summary: AI Index created
                  value:
                    status: created
              schema:
                additionalProperties: false
                description: Confirms that the AI Index was created.
                type: object
                properties:
                  status:
                    enum:
                      - created
                    type: string
                required:
                  - status
          description: The AI Index was created.
        '400':
          content:
            application/json:
              examples:
                invalidDestExample:
                  description: The dest value does not follow the naming convention
                  summary: Invalid dest
                  value:
                    error: Bad Request
                    message: "dest.value 'support-cases' is not allowed: it must start with 'ai-index-ds-'"
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic error response.
                type: object
                properties:
                  error:
                    description: The HTTP status text.
                    type: string
                  message:
                    description: A human-readable error message.
                    type: string
                  statusCode:
                    description: The HTTP status code.
                    type: number
                required:
                  - message
          description: The request was invalid, for example a malformed `dest`, an invalid ES|QL source, or an unresolvable connector source or trace.
        '403':
          content:
            application/json:
              examples:
                forbiddenTraceExample:
                  description: The caller lacks Elasticsearch index privileges to look up an index trace
                  summary: Index trace lookup denied
                  value:
                    error: Forbidden
                    message: 'security_exception: action [indices:admin/resolve/index] is unauthorized for user [jdoe] with effective roles [support_reader] on indices [traces-support], this action is granted by the index privileges [view_index_metadata,manage,read,all]'
                    statusCode: 403
              schema:
                additionalProperties: false
                description: Generic error response.
                type: object
                properties:
                  error:
                    description: The HTTP status text.
                    type: string
                  message:
                    description: A human-readable error message.
                    type: string
                  statusCode:
                    description: The HTTP status code.
                    type: number
                required:
                  - message
          description: Elasticsearch denied the `index` trace lookup outright; the caller lacks index privileges for it.
        '404':
          content:
            application/json:
              examples:
                contextEngineDisabledExample:
                  description: Context Engine is turned off in this space
                  summary: Context Engine turned off
                  value:
                    error: Not Found
                    message: Not Found
                    statusCode: 404
              schema:
                additionalProperties: false
                description: Generic error response.
                type: object
                properties:
                  error:
                    description: The HTTP status text.
                    type: string
                  message:
                    description: A human-readable error message.
                    type: string
                  statusCode:
                    description: The HTTP status code.
                    type: number
                required:
                  - message
          description: Context Engine is turned off in this space.
        '409':
          content:
            application/json:
              examples:
                alreadyExistsExample:
                  description: An AI Index with the same ID already exists
                  summary: AI Index already exists
                  value:
                    error: Conflict
                    message: AI index 'customer_support' already exists
                    statusCode: 409
              schema:
                additionalProperties: false
                description: Generic error response.
                type: object
                properties:
                  error:
                    description: The HTTP status text.
                    type: string
                  message:
                    description: A human-readable error message.
                    type: string
                  statusCode:
                    description: The HTTP status code.
                    type: number
                required:
                  - message
          description: An AI Index with the same ID already exists, or the write conflicted.
      summary: Create an AI Index
      tags:
        - context engine
      x-codeSamples:
        - lang: curl
          source: |
            curl \
              -X POST "https://${KIBANA_URL}/api/context_engine/ai_index" \
              -H "Authorization: ApiKey ${API_KEY}" \
              -H "kbn-xsrf: true" \
              -H "Content-Type: application/json" \
              -d '{
                "id": "customer_support",
                "description": "Knowledge about customer support cases.",
                "dest": { "type": "data_stream", "value": "ai-index-ds-customer-support" },
                "automations": [{ "type": "workflow", "value": "8f1c2d3e-4b5a-6c7d-8e9f-0a1b2c3d4e5f" }],
                "sources": [{ "type": "esql", "value": "FROM support-cases | LIMIT 100" }],
                "traces": [
                  { "type": "elastic_agent", "value": "elastic-ai-agent" },
                  { "type": "index", "value": "traces-support" }
                ]
              }'
        - lang: Console
          source: |
            POST kbn:/api/context_engine/ai_index
            {
              "id": "customer_support",
              "description": "Knowledge about customer support cases.",
              "dest": { "type": "data_stream", "value": "ai-index-ds-customer-support" },
              "automations": [{ "type": "workflow", "value": "8f1c2d3e-4b5a-6c7d-8e9f-0a1b2c3d4e5f" }],
              "sources": [{ "type": "esql", "value": "FROM support-cases | LIMIT 100" }],
              "traces": [
                { "type": "elastic_agent", "value": "elastic-ai-agent" },
                { "type": "index", "value": "traces-support" }
              ]
            }
      x-state: Experimental; added in 9.6.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/context_engine/ai_index/_query:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/context_engine/ai_index/_query</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Runs an ES|QL query as the current user. The server applies a space filter and limits the response to at most 1000 rows.

        The query determines which indices it reads. Elasticsearch index privileges limit which indices the current user can access.

        The space comes from the request URL (`/s/{spaceId}/…`) or defaults to the default space. The request body cannot change the space or replace the space filter.

        Returns a 404 response when Context Engine is turned off in this space (`contextEngine:enabled`).

        **For more information, refer to the [Context Engine documentation](https://www.elastic.co/docs/explore-analyze/ai-features/context-engine).**<br/><br/>[Required authorization] Route required privileges: contextEngine:read.
      operationId: post-context-engine-ai-index-query
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
      requestBody:
        content:
          application/json:
            examples:
              queryAiIndicesRequestExample:
                description: Example ES|QL query with a named parameter and a row limit
                summary: Query with a parameter and a limit
                value:
                  limit: 10
                  params:
                    type: faq
                  query: FROM ai-index-* | WHERE type == ?type | KEEP title, type, attributes | LIMIT 10
            schema:
              additionalProperties: false
              type: object
              properties:
                limit:
                  description: Maximum rows to return. Defaults to 100; a trailing `LIMIT` in the query is capped to this value.
                  maximum: 1000
                  minimum: 1
                  type: number
                params:
                  additionalProperties:
                    anyOf:
                      - maxLength: 4096
                        type: string
                      - type: number
                      - type: boolean
                  description: Values for `?name` placeholders in the query.
                  type: object
                query:
                  description: The ES|QL query to run. Its FROM decides which Elasticsearch indices are read (normally `ai-index-*`); the server adds the space filter and a row limit.
                  maxLength: 10000
                  minLength: 1
                  type: string
              required:
                - query
      responses:
        '200':
          content:
            application/json:
              examples:
                queryAiIndicesResponseExample:
                  description: Example response with column metadata and matching rows. `flattened` columns such as `attributes` are returned as objects.
                  summary: Columns and rows
                  value:
                    columns:
                      - name: title
                        type: text
                      - name: type
                        type: keyword
                      - name: attributes
                        type: flattened
                    values:
                      - - How to reset a password
                        - faq
                        - source: zendesk
                      - - Billing cycle explained
                        - faq
                        - source: zendesk
              schema:
                additionalProperties: false
                type: object
                properties:
                  columns:
                    description: Column metadata for the returned rows.
                    items:
                      additionalProperties: true
                      type: object
                      properties:
                        name:
                          description: Column name.
                          type: string
                        type:
                          description: Column ES|QL type.
                          type: string
                      required:
                        - name
                        - type
                    type: array
                  values:
                    description: Row values, aligned positionally with `columns`, as Elasticsearch returns them. A multi-valued field is an array; `_source` and `flattened` columns are objects.
                    items:
                      items:
                        nullable: true
                      type: array
                    type: array
                required:
                  - columns
                  - values
          description: The columns and rows returned by the ES|QL query.
        '400':
          content:
            application/json:
              examples:
                invalidQueryExample:
                  description: The ES|QL query references a column that does not exist
                  summary: Unknown column
                  value:
                    error: Bad Request
                    message: |-
                      verification_exception
                      	Root causes:
                      		verification_exception: Found 1 problem
                      line 1:46: Unknown column [titel], did you mean [title]?
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic error response.
                type: object
                properties:
                  error:
                    description: The HTTP status text.
                    type: string
                  message:
                    description: A human-readable error message.
                    type: string
                  statusCode:
                    description: The HTTP status code.
                    type: number
                required:
                  - message
          description: The ES|QL query was invalid, or its response exceeded the size limit.
        '403':
          content:
            application/json:
              examples:
                forbiddenExample:
                  description: The caller lacks Elasticsearch index privileges
                  summary: Missing index privileges
                  value:
                    error: Forbidden
                    message: |-
                      security_exception
                      	Root causes:
                      		security_exception: action [indices:data/read/esql] is unauthorized for user [jdoe] with effective roles [support_reader], this action is granted by the index privileges [read_cross_cluster,read,all]
                    statusCode: 403
              schema:
                additionalProperties: false
                description: Generic error response.
                type: object
                properties:
                  error:
                    description: The HTTP status text.
                    type: string
                  message:
                    description: A human-readable error message.
                    type: string
                  statusCode:
                    description: The HTTP status code.
                    type: number
                required:
                  - message
          description: Elasticsearch rejected the read; the caller lacks index privileges.
        '404':
          content:
            application/json:
              examples:
                contextEngineDisabledExample:
                  description: Context Engine is turned off in this space
                  summary: Context Engine turned off
                  value:
                    error: Not Found
                    message: Not Found
                    statusCode: 404
              schema:
                additionalProperties: false
                description: Generic error response.
                type: object
                properties:
                  error:
                    description: The HTTP status text.
                    type: string
                  message:
                    description: A human-readable error message.
                    type: string
                  statusCode:
                    description: The HTTP status code.
                    type: number
                required:
                  - message
          description: Context Engine is turned off in this space.
      summary: Query AI Indices
      tags:
        - context engine
      x-codeSamples:
        - lang: curl
          source: |
            curl \
              -X POST "https://${KIBANA_URL}/api/context_engine/ai_index/_query" \
              -H "Authorization: ApiKey ${API_KEY}" \
              -H "kbn-xsrf: true" \
              -H "Content-Type: application/json" \
              -d '{
                "query": "FROM ai-index-* | WHERE type == ?type | KEEP title, type, attributes | LIMIT 10",
                "params": { "type": "faq" },
                "limit": 10
              }'
        - lang: Console
          source: |
            POST kbn:/api/context_engine/ai_index/_query
            {
              "query": "FROM ai-index-* | WHERE type == ?type | KEEP title, type, attributes | LIMIT 10",
              "params": { "type": "faq" },
              "limit": 10
            }
      x-state: Experimental; added in 9.6.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/context_engine/ai_index/{aiIndexId}:
    delete:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb delete">delete</span>&nbsp;<span class="operation-path">/s/{space_id}/api/context_engine/ai_index/{aiIndexId}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Deletes an AI Index by ID.

        By default, the API preserves the backing data stream or index, its Knowledge Indicators, and attached workflow automations. Set `delete_knowledge_indicators` to `true` to delete the backing data stream or index and its Knowledge Indicators. Set `delete_automations` to `true` to delete the attached workflow automations.

        The API does not delete the backing data stream or index when another AI Index uses the same destination.

        Returns a 404 response when Context Engine is turned off in this space (`contextEngine:enabled`).

        **For more information, refer to the [Context Engine documentation](https://www.elastic.co/docs/explore-analyze/ai-features/context-engine).**<br/><br/>[Required authorization] Route required privileges: contextEngine:write. Extended privileges (optional, expand functionality when granted): workflowsManagement:delete.
      operationId: delete-context-engine-ai-index-aiindexid
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: The unique identifier of the AI Index.
          in: path
          name: aiIndexId
          required: true
          schema:
            maxLength: 256
            minLength: 1
            type: string
        - description: When true, also delete the backing data stream/index, which removes its Knowledge Indicators. Skipped when another AI Index still uses the same dest. Defaults to false.
          in: query
          name: delete_knowledge_indicators
          required: false
          schema:
            default: false
            type: boolean
        - description: When true, also delete the attached workflow automations. Defaults to false.
          in: query
          name: delete_automations
          required: false
          schema:
            default: false
            type: boolean
      responses:
        '200':
          content:
            application/json:
              examples:
                deleteAiIndexPartialFailureExample:
                  description: The entry was deleted but a best-effort cleanup step failed
                  summary: Deleted with a cleanup error
                  value:
                    acknowledged: true
                    errors:
                      - 'Failed to delete automations: Workflows management is unavailable.'
                deleteAiIndexResponseExample:
                  description: Example response after the AI Index entry is deleted
                  summary: AI Index deleted
                  value:
                    acknowledged: true
                    errors: []
              schema:
                additionalProperties: false
                type: object
                properties:
                  acknowledged:
                    description: Whether the AI Index entry was deleted.
                    type: boolean
                  errors:
                    description: Best-effort cleanup errors after the entry was deleted, if any.
                    items:
                      type: string
                    type: array
                required:
                  - acknowledged
                  - errors
          description: The AI Index entry was deleted. `errors` lists any best-effort cleanup failures.
        '404':
          content:
            application/json:
              examples:
                contextEngineDisabledExample:
                  description: Context Engine is turned off in this space
                  summary: Context Engine turned off
                  value:
                    error: Not Found
                    message: Not Found
                    statusCode: 404
                notFoundExample:
                  description: No AI Index with the given ID exists in the current space
                  summary: AI Index not found
                  value:
                    error: Not Found
                    message: AI index 'customer_support' not found
                    statusCode: 404
              schema:
                additionalProperties: false
                description: Generic error response.
                type: object
                properties:
                  error:
                    description: The HTTP status text.
                    type: string
                  message:
                    description: A human-readable error message.
                    type: string
                  statusCode:
                    description: The HTTP status code.
                    type: number
                required:
                  - message
          description: No AI Index with the given ID exists in the current space, or Context Engine is turned off in this space.
        '409':
          content:
            application/json:
              examples:
                managedExample:
                  description: The AI Index is managed by a plugin and cannot be deleted
                  summary: Managed AI Index
                  value:
                    error: Conflict
                    message: AI index 'customer_support' is managed and cannot be modified via the API
                    statusCode: 409
              schema:
                additionalProperties: false
                description: Generic error response.
                type: object
                properties:
                  error:
                    description: The HTTP status text.
                    type: string
                  message:
                    description: A human-readable error message.
                    type: string
                  statusCode:
                    description: The HTTP status code.
                    type: number
                required:
                  - message
          description: The AI Index is managed and cannot be deleted.
      summary: Delete an AI Index
      tags:
        - context engine
      x-codeSamples:
        - lang: curl
          source: |
            curl \
              -X DELETE "https://${KIBANA_URL}/api/context_engine/ai_index/customer_support?delete_knowledge_indicators=true" \
              -H "Authorization: ApiKey ${API_KEY}" \
              -H "kbn-xsrf: true"
        - lang: Console
          source: |
            DELETE kbn:/api/context_engine/ai_index/customer_support?delete_knowledge_indicators=true
      x-state: Experimental; added in 9.6.0
      x-metaTags:
        - content: Kibana
          name: product_name
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/context_engine/ai_index/{aiIndexId}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Fetches an AI Index by ID from the current space, including the ES|QL query derived from each trace.

        Returns a 404 response when Context Engine is turned off in this space (`contextEngine:enabled`).

        **For more information, refer to the [Context Engine documentation](https://www.elastic.co/docs/explore-analyze/ai-features/context-engine).**<br/><br/>[Required authorization] Route required privileges: contextEngine:read.
      operationId: get-context-engine-ai-index-aiindexid
      parameters:
        - description: The unique identifier of the AI Index.
          in: path
          name: aiIndexId
          required: true
          schema:
            maxLength: 256
            minLength: 1
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                getAiIndexResponseExample:
                  description: Example response returning an AI Index by ID
                  summary: An AI Index
                  value:
                    automations:
                      - type: workflow
                        value: 8f1c2d3e-4b5a-6c7d-8e9f-0a1b2c3d4e5f
                    date_created: '2026-09-22T12:00:00.000Z'
                    date_modified: '2026-09-22T12:00:00.000Z'
                    description: Knowledge about customer support cases.
                    dest:
                      type: data_stream
                      value: ai-index-ds-customer-support
                    id: customer_support
                    managed: false
                    memory_enabled: true
                    sources:
                      - type: esql
                        value: FROM support-cases | LIMIT 100
                    traces:
                      - query: |-
                          FROM traces-agent_builder.otel-default
                          | WHERE attributes.gen_ai.agent.id IN ("elastic-ai-agent")
                        type: elastic_agent
                        value: elastic-ai-agent
              schema:
                additionalProperties: false
                type: object
                properties:
                  automations:
                    description: Automations associated with the AI Index.
                    items:
                      additionalProperties: false
                      type: object
                      properties:
                        type:
                          enum:
                            - workflow
                          type: string
                        value:
                          description: The workflow ID.
                          type: string
                      required:
                        - type
                        - value
                    type: array
                  date_created:
                    description: ISO 8601 timestamp of when the AI Index was created.
                    type: string
                  date_modified:
                    description: ISO 8601 timestamp of when the AI Index was last modified.
                    type: string
                  description:
                    description: Human-readable description of the AI Index.
                    type: string
                  dest:
                    additionalProperties: false
                    description: The data stream or index that backs the AI Index.
                    type: object
                    properties:
                      type:
                        description: The type of the backing store.
                        enum:
                          - data_stream
                          - index
                        type: string
                      value:
                        description: The data stream or index the AI Index is attached to.
                        type: string
                    required:
                      - type
                      - value
                  feedback_analysis:
                    additionalProperties: false
                    description: The recurring feedback analysis, which reads agent signals and proposes improvement actions for the AI Index.
                    type: object
                    properties:
                      agent_id:
                        description: Agent Builder agent ID that runs the analysis.
                        type: string
                      allowed_actions:
                        description: Improvement actions the analysis may propose.
                        items:
                          description: Add, edit, or remove a Knowledge Indicator (`*_ki`), a workflow automation (`*_workflow`), or a source (`*_source`).
                          enum:
                            - add_ki
                            - edit_ki
                            - remove_ki
                            - add_workflow
                            - edit_workflow
                            - remove_workflow
                            - add_source
                            - edit_source
                            - remove_source
                          type: string
                        type: array
                      enabled:
                        description: Whether the recurring feedback analysis is desired to run.
                        type: boolean
                      schedule:
                        additionalProperties: false
                        description: When the analysis runs.
                        type: object
                        properties:
                          interval:
                            description: How often to analyze, for example `1h`.
                            type: string
                        required:
                          - interval
                      signal_filter:
                        description: KQL narrowing which signals the analysis reads.
                        type: string
                      signal_time_range:
                        anyOf:
                          - additionalProperties: false
                            type: object
                            properties:
                              from:
                                description: Date math relative to now, for example `now-30d`.
                                type: string
                              type:
                                enum:
                                  - relative
                                type: string
                            required:
                              - type
                              - from
                          - additionalProperties: false
                            type: object
                            properties:
                              from:
                                description: ISO 8601 date to analyze signals since.
                                type: string
                              type:
                                enum:
                                  - absolute
                                type: string
                            required:
                              - type
                              - from
                    required:
                      - enabled
                  id:
                    description: The unique identifier of the AI Index.
                    type: string
                  managed:
                    description: Whether the AI Index is managed by a plugin and therefore immutable.
                    type: boolean
                  memory_enabled:
                    description: Whether this AI Index accepts memory writes.
                    type: boolean
                  sources:
                    description: Additional sources that provide context for the AI Index.
                    items:
                      additionalProperties: false
                      type: object
                      properties:
                        type:
                          description: '`esql` for an ES|QL query, or `connector` for a data connector.'
                          enum:
                            - esql
                            - connector
                          type: string
                        value:
                          description: An ES|QL query for `esql`, or a connector ID for `connector`.
                          type: string
                      required:
                        - type
                        - value
                    type: array
                  traces:
                    description: Trace sources linked to this AI Index, each with its derived ES|QL query.
                    items:
                      additionalProperties: false
                      type: object
                      properties:
                        query:
                          description: The ES|QL query derived from this trace source at read time.
                          type: string
                        type:
                          description: '`elastic_agent` for an Agent Builder agent, `index` for an index or data stream name or pattern, or `esql` for an ES|QL query.'
                          enum:
                            - elastic_agent
                            - index
                            - esql
                          type: string
                        value:
                          description: The trace source value.
                          type: string
                      required:
                        - type
                        - value
                        - query
                    type: array
                required:
                  - id
                  - managed
                  - memory_enabled
                  - date_created
                  - date_modified
                  - dest
                  - automations
                  - sources
                  - traces
          description: The requested AI Index.
        '404':
          content:
            application/json:
              examples:
                contextEngineDisabledExample:
                  description: Context Engine is turned off in this space
                  summary: Context Engine turned off
                  value:
                    error: Not Found
                    message: Not Found
                    statusCode: 404
                notFoundExample:
                  description: No AI Index with the given ID exists in the current space
                  summary: AI Index not found
                  value:
                    error: Not Found
                    message: AI index 'customer_support' not found
                    statusCode: 404
              schema:
                additionalProperties: false
                description: Generic error response.
                type: object
                properties:
                  error:
                    description: The HTTP status text.
                    type: string
                  message:
                    description: A human-readable error message.
                    type: string
                  statusCode:
                    description: The HTTP status code.
                    type: number
                required:
                  - message
          description: No AI Index with the given ID exists in the current space, or Context Engine is turned off in this space.
      summary: Get an AI Index
      tags:
        - context engine
      x-codeSamples:
        - lang: curl
          source: |
            curl \
              -X GET "https://${KIBANA_URL}/api/context_engine/ai_index/customer_support" \
              -H "Authorization: ApiKey ${API_KEY}"
        - lang: Console
          source: |
            GET kbn:/api/context_engine/ai_index/customer_support
      x-state: Experimental; added in 9.6.0
      x-metaTags:
        - content: Kibana
          name: product_name
    put:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb put">put</span>&nbsp;<span class="operation-path">/s/{space_id}/api/context_engine/ai_index/{aiIndexId}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Creates an AI Index with the given ID, or replaces an existing one. The request body replaces the whole record: omitted fields are removed, and omitted arrays become empty. A managed AI Index cannot be replaced and returns a 409.

        Returns a 404 response when Context Engine is turned off in this space (`contextEngine:enabled`).

        **For more information, refer to the [Context Engine documentation](https://www.elastic.co/docs/explore-analyze/ai-features/context-engine).**<br/><br/>[Required authorization] Route required privileges: contextEngine:write.
      operationId: put-context-engine-ai-index-aiindexid
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: The unique identifier of the AI Index.
          in: path
          name: aiIndexId
          required: true
          schema:
            maxLength: 256
            minLength: 1
            type: string
      requestBody:
        content:
          application/json:
            examples:
              putAiIndexRequestExample:
                description: Example request to create or fully replace an AI Index
                summary: Create or replace an AI Index
                value:
                  automations:
                    - type: workflow
                      value: 8f1c2d3e-4b5a-6c7d-8e9f-0a1b2c3d4e5f
                  description: Knowledge about customer support cases.
                  dest:
                    type: data_stream
                    value: ai-index-ds-customer-support
                  sources:
                    - type: esql
                      value: FROM support-cases | LIMIT 100
                  traces:
                    - type: index
                      value: traces-support
            schema:
              additionalProperties: false
              type: object
              properties:
                automations:
                  default: []
                  description: Automations associated with the AI Index. Defaults to an empty array when omitted.
                  items:
                    additionalProperties: false
                    type: object
                    properties:
                      type:
                        enum:
                          - workflow
                        type: string
                      value:
                        description: The workflow ID.
                        maxLength: 1024
                        minLength: 1
                        type: string
                    required:
                      - type
                      - value
                  maxItems: 100
                  type: array
                description:
                  description: Human-readable description of the AI Index.
                  maxLength: 2048
                  type: string
                dest:
                  additionalProperties: false
                  description: The data stream or index that backs the AI Index.
                  type: object
                  properties:
                    type:
                      description: The type of the backing store. `data_stream` for a data stream, or `index` for an index.
                      enum:
                        - data_stream
                        - index
                      type: string
                    value:
                      description: The data stream or index (e.g. `ai-index-ds-foo`, `ai-index-idx-foo`) the AI Index is attached to. Must name a single data stream or index (no wildcards or comma-separated lists), match `type`, and start with `ai-index-ds-` (for `data_stream`) or `ai-index-idx-` (for `index`). The rest of the value must be a valid AI Index ID. System indices are not allowed.
                      maxLength: 1024
                      minLength: 1
                      type: string
                  required:
                    - type
                    - value
                feedback_analysis:
                  additionalProperties: false
                  description: The recurring feedback analysis, which reads agent signals and proposes improvement actions for the AI Index.
                  type: object
                  properties:
                    agent_id:
                      description: Agent Builder agent ID that runs this index’s feedback-loop analysis.
                      maxLength: 256
                      type: string
                    allowed_actions:
                      default:
                        - add_ki
                        - edit_ki
                        - remove_ki
                        - add_workflow
                        - edit_workflow
                        - remove_workflow
                        - add_source
                        - edit_source
                        - remove_source
                      description: Improvement actions the analysis may propose. An empty list is observe-only.
                      items:
                        description: Add, edit, or remove a Knowledge Indicator (`*_ki`), a workflow automation (`*_workflow`), or a source (`*_source`).
                        enum:
                          - add_ki
                          - edit_ki
                          - remove_ki
                          - add_workflow
                          - edit_workflow
                          - remove_workflow
                          - add_source
                          - edit_source
                          - remove_source
                        type: string
                      maxItems: 9
                      type: array
                    enabled:
                      description: Desired state of the recurring analysis. The scheduler stays authoritative for whether it is actually running.
                      type: boolean
                    schedule:
                      additionalProperties: false
                      default:
                        interval: 24h
                      description: When the analysis runs.
                      type: object
                      properties:
                        interval:
                          description: How often to analyze, for example `1h` or `24h`. At least 15 minutes.
                          maxLength: 16
                          type: string
                      required:
                        - interval
                    signal_filter:
                      description: 'KQL narrowing which signals this index analyzes, for example `tags: query_error`.'
                      maxLength: 4096
                      type: string
                    signal_time_range:
                      anyOf:
                        - additionalProperties: false
                          type: object
                          properties:
                            from:
                              description: Date math relative to now, for example `now-30d`.
                              maxLength: 64
                              type: string
                            type:
                              enum:
                                - relative
                              type: string
                          required:
                            - type
                            - from
                        - additionalProperties: false
                          type: object
                          properties:
                            from:
                              description: ISO 8601 date to analyze signals since.
                              maxLength: 64
                              type: string
                            type:
                              enum:
                                - absolute
                              type: string
                          required:
                            - type
                            - from
                      default:
                        from: now-30d
                        type: relative
                      description: Which signals the analysis reads. A read filter only.
                  required:
                    - enabled
                memory_enabled:
                  description: Whether this AI index accepts memory writes. Defaults to true when omitted.
                  type: boolean
                sources:
                  default: []
                  description: Additional sources that provide context for the AI Index. Defaults to an empty array when omitted.
                  items:
                    anyOf:
                      - additionalProperties: false
                        type: object
                        properties:
                          type:
                            enum:
                              - esql
                            type: string
                          value:
                            description: The source value; an ES|QL query when `type` is `esql`. Must be valid ES|QL.
                            maxLength: 10240
                            minLength: 1
                            type: string
                        required:
                          - type
                          - value
                      - additionalProperties: false
                        type: object
                        properties:
                          type:
                            enum:
                              - connector
                            type: string
                          value:
                            description: The source value; a connector ID when `type` is `connector`.
                            maxLength: 10240
                            minLength: 1
                            type: string
                        required:
                          - type
                          - value
                  maxItems: 100
                  type: array
                traces:
                  default: []
                  description: Trace sources linked to this AI Index. A write replaces the whole array. Defaults to an empty array when omitted.
                  items:
                    anyOf:
                      - additionalProperties: false
                        type: object
                        properties:
                          type:
                            enum:
                              - elastic_agent
                            type: string
                          value:
                            description: The Agent Builder agent ID.
                            maxLength: 10240
                            minLength: 1
                            type: string
                        required:
                          - type
                          - value
                      - additionalProperties: false
                        type: object
                        properties:
                          type:
                            enum:
                              - index
                            type: string
                          value:
                            description: An index or data stream name or pattern to read traces from.
                            maxLength: 10240
                            minLength: 1
                            type: string
                        required:
                          - type
                          - value
                      - additionalProperties: false
                        type: object
                        properties:
                          type:
                            enum:
                              - esql
                            type: string
                          value:
                            description: An ES|QL query to select traces.
                            maxLength: 10240
                            minLength: 1
                            type: string
                        required:
                          - type
                          - value
                  maxItems: 100
                  type: array
              required:
                - dest
      responses:
        '200':
          content:
            application/json:
              examples:
                putAiIndexUpdatedExample:
                  description: Example response after an existing AI Index is replaced
                  summary: AI Index updated
                  value:
                    status: updated
              schema:
                additionalProperties: false
                description: Confirms that the AI Index was updated.
                type: object
                properties:
                  status:
                    enum:
                      - updated
                    type: string
                required:
                  - status
          description: The AI Index was updated.
        '201':
          content:
            application/json:
              examples:
                putAiIndexCreatedExample:
                  description: Example response after a new AI Index is created
                  summary: AI Index created
                  value:
                    status: created
              schema:
                additionalProperties: false
                description: Confirms that the AI Index was created.
                type: object
                properties:
                  status:
                    enum:
                      - created
                    type: string
                required:
                  - status
          description: The AI Index was created.
        '400':
          content:
            application/json:
              examples:
                invalidDestExample:
                  description: The dest value does not follow the naming convention
                  summary: Invalid dest
                  value:
                    error: Bad Request
                    message: "dest.value 'support-cases' is not allowed: it must start with 'ai-index-ds-'"
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic error response.
                type: object
                properties:
                  error:
                    description: The HTTP status text.
                    type: string
                  message:
                    description: A human-readable error message.
                    type: string
                  statusCode:
                    description: The HTTP status code.
                    type: number
                required:
                  - message
          description: The request was invalid, for example a malformed `dest`, an invalid ES|QL source, or an unresolvable connector source or trace.
        '403':
          content:
            application/json:
              examples:
                forbiddenTraceExample:
                  description: The caller lacks Elasticsearch index privileges to look up an index trace
                  summary: Index trace lookup denied
                  value:
                    error: Forbidden
                    message: 'security_exception: action [indices:admin/resolve/index] is unauthorized for user [jdoe] with effective roles [support_reader] on indices [traces-support], this action is granted by the index privileges [view_index_metadata,manage,read,all]'
                    statusCode: 403
              schema:
                additionalProperties: false
                description: Generic error response.
                type: object
                properties:
                  error:
                    description: The HTTP status text.
                    type: string
                  message:
                    description: A human-readable error message.
                    type: string
                  statusCode:
                    description: The HTTP status code.
                    type: number
                required:
                  - message
          description: Elasticsearch denied the `index` trace lookup outright; the caller lacks index privileges for it.
        '404':
          content:
            application/json:
              examples:
                contextEngineDisabledExample:
                  description: Context Engine is turned off in this space
                  summary: Context Engine turned off
                  value:
                    error: Not Found
                    message: Not Found
                    statusCode: 404
              schema:
                additionalProperties: false
                description: Generic error response.
                type: object
                properties:
                  error:
                    description: The HTTP status text.
                    type: string
                  message:
                    description: A human-readable error message.
                    type: string
                  statusCode:
                    description: The HTTP status code.
                    type: number
                required:
                  - message
          description: Context Engine is turned off in this space.
        '409':
          content:
            application/json:
              examples:
                managedExample:
                  description: The AI Index is managed by a plugin and cannot be replaced
                  summary: Managed AI Index
                  value:
                    error: Conflict
                    message: AI index 'customer_support' is managed and cannot be modified via the API
                    statusCode: 409
              schema:
                additionalProperties: false
                description: Generic error response.
                type: object
                properties:
                  error:
                    description: The HTTP status text.
                    type: string
                  message:
                    description: A human-readable error message.
                    type: string
                  statusCode:
                    description: The HTTP status code.
                    type: number
                required:
                  - message
          description: The AI Index is managed and immutable, or the write conflicted.
      summary: Create or update an AI Index
      tags:
        - context engine
      x-codeSamples:
        - lang: curl
          source: |
            curl \
              -X PUT "https://${KIBANA_URL}/api/context_engine/ai_index/customer_support" \
              -H "Authorization: ApiKey ${API_KEY}" \
              -H "kbn-xsrf: true" \
              -H "Content-Type: application/json" \
              -d '{
                "description": "Knowledge about customer support cases.",
                "dest": { "type": "data_stream", "value": "ai-index-ds-customer-support" },
                "automations": [{ "type": "workflow", "value": "8f1c2d3e-4b5a-6c7d-8e9f-0a1b2c3d4e5f" }],
                "sources": [{ "type": "esql", "value": "FROM support-cases | LIMIT 100" }],
                "traces": [{ "type": "index", "value": "traces-support" }]
              }'
        - lang: Console
          source: |
            PUT kbn:/api/context_engine/ai_index/customer_support
            {
              "description": "Knowledge about customer support cases.",
              "dest": { "type": "data_stream", "value": "ai-index-ds-customer-support" },
              "automations": [{ "type": "workflow", "value": "8f1c2d3e-4b5a-6c7d-8e9f-0a1b2c3d4e5f" }],
              "sources": [{ "type": "esql", "value": "FROM support-cases | LIMIT 100" }],
              "traces": [{ "type": "index", "value": "traces-support" }]
            }
      x-state: Experimental; added in 9.6.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/context_engine/ai_index/{aiIndexId}/_describe:
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/context_engine/ai_index/{aiIndexId}/_describe</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Returns a free-form text context block for an agent. The block describes the AI Index and its ES|QL target. It also includes up to 500 fields exposed by the backing indices, identifies which fields are semantic, provides knowledge item type and tag counts for the current space, and includes example ES|QL queries.

        The API reads data as the current user. Elasticsearch index privileges limit which indices the current user can access. A caller who cannot read the backing indices gets a 403 response.

        The space comes from the request URL (`/s/{spaceId}/…`) or defaults to the default space. It cannot be specified in any other way.

        Returns a 404 response when Context Engine is turned off in this space (`contextEngine:enabled`).

        **For more information, refer to the [Context Engine documentation](https://www.elastic.co/docs/explore-analyze/ai-features/context-engine).**<br/><br/>[Required authorization] Route required privileges: contextEngine:read.
      operationId: get-context-engine-ai-index-aiindexid-describe
      parameters:
        - description: The unique identifier of the AI Index.
          in: path
          name: aiIndexId
          required: true
          schema:
            maxLength: 256
            minLength: 1
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                describeAiIndexResponseExample:
                  description: Example response with a context block for an agent
                  summary: Context block for an agent
                  value:
                    response: |-
                      AI index: customer_support
                      Knowledge about customer support cases.
                      Query with ES|QL against: ai-index-ds-customer-support

                      Fields
                      @timestamp: date, searchable, aggregatable
                      content: text, searchable
                      content.semantic: semantic_text, searchable
                      description: text, searchable
                      description.semantic: semantic_text, searchable
                      tags: keyword, searchable, aggregatable
                      title: text, searchable
                      title.semantic: semantic_text, searchable
                      type: keyword, searchable, aggregatable

                      Semantic fields
                      content.semantic
                      description.semantic
                      title.semantic

                      Knowledge item types
                      "faq": 12
                      "runbook": 4

                      Tags
                      "billing": 7
                      "password": 5

                      Example queries (adapt field names for non-canonical indices)

                      Full text search, lexical and semantic fused together (?query)
                      FROM ai-index-ds-customer-support METADATA _id, _index, _score
                      | FORK
                          ( WHERE MATCH(title, ?query) OR MATCH(description, ?query) OR MATCH(content, ?query) | SORT _score DESC | LIMIT 20 )
                          ( WHERE MATCH(title.semantic, ?query) OR MATCH(description.semantic, ?query) OR MATCH(content.semantic, ?query) | SORT _score DESC | LIMIT 20 )
                      | FUSE
                      | SORT _score DESC, _id ASC
                      | KEEP title, description, content, type, tags
                      | LIMIT 5

                      Filter by knowledge item type and tag (?type, ?tag; tags is multi-valued, so MATCH)
                      FROM ai-index-ds-customer-support
                      | WHERE type == ?type AND MATCH(tags, ?tag)
                      | KEEP title, description, content, type, tags
                      | LIMIT 20

                      Count by type
                      FROM ai-index-ds-customer-support
                      | STATS count = COUNT(*) BY type
                      | SORT count DESC
                      | LIMIT 20
              schema:
                additionalProperties: false
                type: object
                properties:
                  response:
                    description: Free-form text context block describing the AI Index for an agent.
                    type: string
                required:
                  - response
          description: A free-form text context block describing the AI Index.
        '400':
          content:
            application/json:
              examples:
                tooLargeExample:
                  description: The field metadata for the backing indices exceeded the size limit
                  summary: Response too large
                  value:
                    error: Bad Request
                    message: Field metadata for the AI index exceeded the maximum allowed size of 20MB. Point the AI index at fewer or smaller indices.
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic error response.
                type: object
                properties:
                  error:
                    description: The HTTP status text.
                    type: string
                  message:
                    description: A human-readable error message.
                    type: string
                  statusCode:
                    description: The HTTP status code.
                    type: number
                required:
                  - message
          description: The description response exceeded the size limit.
        '403':
          content:
            application/json:
              examples:
                forbiddenExample:
                  description: The caller can read the backing indices but cannot read their mappings
                  summary: Missing view_index_metadata privilege
                  value:
                    error: Forbidden
                    message: |-
                      security_exception
                      	Root causes:
                      		security_exception: action [indices:admin/mappings/get] is unauthorized for user [jdoe] with effective roles [support_reader] on indices [ai-index-ds-customer-support], this action is granted by the index privileges [view_index_metadata,manage,all]
                    statusCode: 403
                notReadableExample:
                  description: The caller cannot read the backing indices of the AI Index
                  summary: Backing indices not readable
                  value:
                    error: Forbidden
                    message: AI index 'customer_support' is not readable. Reading it needs the Elasticsearch 'read' and 'view_index_metadata' privileges on its backing indices.
                    statusCode: 403
              schema:
                additionalProperties: false
                description: Generic error response.
                type: object
                properties:
                  error:
                    description: The HTTP status text.
                    type: string
                  message:
                    description: A human-readable error message.
                    type: string
                  statusCode:
                    description: The HTTP status code.
                    type: number
                required:
                  - message
          description: The caller cannot read the backing indices. Describing an AI Index requires the `read` and `view_index_metadata` index privileges on them.
        '404':
          content:
            application/json:
              examples:
                contextEngineDisabledExample:
                  description: Context Engine is turned off in this space
                  summary: Context Engine turned off
                  value:
                    error: Not Found
                    message: Not Found
                    statusCode: 404
                notFoundExample:
                  description: No AI Index with the given ID exists in the current space
                  summary: AI Index not found
                  value:
                    error: Not Found
                    message: AI index 'customer_support' not found
                    statusCode: 404
              schema:
                additionalProperties: false
                description: Generic error response.
                type: object
                properties:
                  error:
                    description: The HTTP status text.
                    type: string
                  message:
                    description: A human-readable error message.
                    type: string
                  statusCode:
                    description: The HTTP status code.
                    type: number
                required:
                  - message
          description: No AI Index with the given ID exists in the current space, or Context Engine is turned off in this space.
      summary: Describe an AI Index
      tags:
        - context engine
      x-codeSamples:
        - lang: curl
          source: |
            curl \
              -X GET "https://${KIBANA_URL}/api/context_engine/ai_index/customer_support/_describe" \
              -H "Authorization: ApiKey ${API_KEY}"
        - lang: Console
          source: |
            GET kbn:/api/context_engine/ai_index/customer_support/_describe
      x-state: Experimental; added in 9.6.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/dashboards:
    get:
      tags:
        - Dashboards
      summary: Search dashboards
      operationId: search-dashboards
      description: |
        > This documentation is temporarily hosted at a separate location.
        >
        > **[View the full Dashboards API reference →](https://elastic.github.io/dashboards-api-spec/dashboards#tag/Dashboards)**
      responses:
        '200':
          description: See the full Dashboards API reference for detailed response schemas.
    post:
      tags:
        - Dashboards
      summary: Create a dashboard
      operationId: create-dashboard
      description: |
        > This documentation is temporarily hosted at a separate location.
        >
        > **[View the full Dashboards API reference →](https://elastic.github.io/dashboards-api-spec/dashboards#tag/Dashboards)**
      responses:
        '200':
          description: See the full Dashboards API reference for detailed response schemas.
  /api/dashboards/{id}:
    get:
      tags:
        - Dashboards
      summary: Get a dashboard
      operationId: get-dashboard
      description: |
        > This documentation is temporarily hosted at a separate location.
        >
        > **[View the full Dashboards API reference →](https://elastic.github.io/dashboards-api-spec/dashboards#tag/Dashboards)**
      responses:
        '200':
          description: See the full Dashboards API reference for detailed response schemas.
    put:
      tags:
        - Dashboards
      summary: Upsert a dashboard
      operationId: upsert-dashboard
      description: |
        > This documentation is temporarily hosted at a separate location.
        >
        > **[View the full Dashboards API reference →](https://elastic.github.io/dashboards-api-spec/dashboards#tag/Dashboards)**
      responses:
        '200':
          description: See the full Dashboards API reference for detailed response schemas.
    delete:
      tags:
        - Dashboards
      summary: Delete a dashboard
      operationId: delete-dashboard
      description: |
        > This documentation is temporarily hosted at a separate location.
        >
        > **[View the full Dashboards API reference →](https://elastic.github.io/dashboards-api-spec/dashboards#tag/Dashboards)**
      responses:
        '200':
          description: See the full Dashboards API reference for detailed response schemas.
  /api/data_views:
    get:
      description: |
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/data_views</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Retrieve a list of all data views. Use this endpoint to identify available data views in the current Kibana space.
      operationId: getAllDataViewsDefault
      responses:
        '200':
          content:
            application/json:
              examples:
                getAllDataViewsResponse:
                  $ref: '#/components/examples/Data_views_get_data_views_response'
              schema:
                type: object
                properties:
                  data_view:
                    items:
                      type: object
                      properties:
                        id:
                          type: string
                        name:
                          type: string
                        namespaces:
                          items:
                            type: string
                          type: array
                        title:
                          type: string
                        typeMeta:
                          type: object
                    type: array
          description: Indicates a successful call.
        '400':
          content:
            application/json:
              examples:
                getAllDataViewsBadRequest:
                  $ref: '#/components/examples/Data_views_error_400_response'
              schema:
                $ref: '#/components/schemas/Data_views_400_response'
          description: Bad request
      summary: Get all data views
      tags:
        - data views
      x-codeSamples:
        - lang: curl
          source: |
            curl \
              -X GET "${KIBANA_URL}/api/data_views" \
              -H "Authorization: ApiKey ${API_KEY}"
        - lang: Console
          source: |
            GET kbn://api/data_views
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/data_views/data_view:
    post:
      description: |
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/data_views/data_view</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Create a data view. Data views identify the Elasticsearch data you want to explore and visualize. They can point to one or more data streams, indices, or index aliases, and use optional runtime fields to compute values at query time. Note that data views are not required for ES|QL-based visualizations. To learn more, refer to the [data views documentation](https://www.elastic.co/docs/explore-analyze/find-and-organize/data-views).
      operationId: createDataViewDefaultw
      parameters:
        - $ref: '#/components/parameters/Data_views_kbn_xsrf'
      requestBody:
        content:
          application/json:
            examples:
              createDataViewRequest:
                $ref: '#/components/examples/Data_views_create_data_view_request'
            schema:
              $ref: '#/components/schemas/Data_views_create_data_view_request_object'
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                createDataViewResponse:
                  $ref: '#/components/examples/Data_views_create_data_view_response'
              schema:
                $ref: '#/components/schemas/Data_views_data_view_response_object'
          description: Indicates a successful call.
        '400':
          content:
            application/json:
              examples:
                createDataViewBadRequest:
                  $ref: '#/components/examples/Data_views_error_400_response'
              schema:
                $ref: '#/components/schemas/Data_views_400_response'
          description: Bad request
      summary: Create a data view
      tags:
        - data views
      x-codeSamples:
        - lang: curl
          source: |
            curl \
              -X POST "${KIBANA_URL}/api/data_views/data_view" \
              -H "Authorization: ApiKey ${API_KEY}" \
              -H "kbn-xsrf: true" \
              -H "Content-Type: application/json" \
              -d '{"data_view":{"title":"logstash-*","name":"My Logstash data view"}}'
        - lang: Console
          source: |
            POST kbn://api/data_views/data_view
            {"data_view":{"title":"logstash-*","name":"My Logstash data view"}}
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/data_views/data_view/{viewId}:
    delete:
      description: |
        **Spaces method and path for this operation:**

        <div><span class="operation-verb delete">delete</span>&nbsp;<span class="operation-path">/s/{space_id}/api/data_views/data_view/{viewId}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Delete a data view by its identifier. WARNING: When you delete a data view, it cannot be recovered.
      operationId: deleteDataViewDefault
      parameters:
        - $ref: '#/components/parameters/Data_views_kbn_xsrf'
        - $ref: '#/components/parameters/Data_views_view_id'
      responses:
        '204':
          description: Indicates a successful call.
        '404':
          content:
            application/json:
              examples:
                deleteDataViewNotFound:
                  $ref: '#/components/examples/Data_views_error_404_response'
              schema:
                $ref: '#/components/schemas/Data_views_404_response'
          description: Object is not found.
      summary: Delete a data view
      tags:
        - data views
      x-codeSamples:
        - lang: curl
          source: |
            curl \
              -X DELETE "${KIBANA_URL}/api/data_views/data_view/${DATA_VIEW_ID}" \
              -H "Authorization: ApiKey ${API_KEY}" \
              -H "kbn-xsrf: true"
        - lang: Console
          source: |
            DELETE kbn://api/data_views/data_view/{viewId}
      x-metaTags:
        - content: Kibana
          name: product_name
    get:
      description: |
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/data_views/data_view/{viewId}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Retrieve a single data view by its identifier. Data views identify the Elasticsearch data you want to explore and visualize. They can point to one or more data streams, indices, or index aliases, and use optional runtime fields to compute values at query time. Note that data views are not required for ES|QL-based visualizations. To learn more, refer to the [data views documentation](https://www.elastic.co/docs/explore-analyze/find-and-organize/data-views).
      operationId: getDataViewDefault
      parameters:
        - $ref: '#/components/parameters/Data_views_view_id'
      responses:
        '200':
          content:
            application/json:
              examples:
                getDataViewResponse:
                  $ref: '#/components/examples/Data_views_get_data_view_response'
              schema:
                $ref: '#/components/schemas/Data_views_data_view_response_object'
          description: Indicates a successful call.
        '404':
          content:
            application/json:
              examples:
                getDataViewNotFound:
                  $ref: '#/components/examples/Data_views_error_404_response'
              schema:
                $ref: '#/components/schemas/Data_views_404_response'
          description: Object is not found.
      summary: Get a data view
      tags:
        - data views
      x-codeSamples:
        - lang: curl
          source: |
            curl \
              -X GET "${KIBANA_URL}/api/data_views/data_view/${DATA_VIEW_ID}" \
              -H "Authorization: ApiKey ${API_KEY}"
        - lang: Console
          source: |
            GET kbn://api/data_views/data_view/{viewId}
      x-metaTags:
        - content: Kibana
          name: product_name
    post:
      description: |
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/data_views/data_view/{viewId}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Update an existing data view. Only the fields provided in the request body are updated.
      operationId: updateDataViewDefault
      parameters:
        - $ref: '#/components/parameters/Data_views_kbn_xsrf'
        - $ref: '#/components/parameters/Data_views_view_id'
      requestBody:
        content:
          application/json:
            examples:
              updateDataViewRequest:
                $ref: '#/components/examples/Data_views_update_data_view_request'
            schema:
              $ref: '#/components/schemas/Data_views_update_data_view_request_object'
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                updateDataViewResponse:
                  $ref: '#/components/examples/Data_views_get_data_view_response'
              schema:
                $ref: '#/components/schemas/Data_views_data_view_response_object'
          description: Indicates a successful call.
        '400':
          content:
            application/json:
              examples:
                updateDataViewBadRequest:
                  $ref: '#/components/examples/Data_views_error_400_response'
              schema:
                $ref: '#/components/schemas/Data_views_400_response'
          description: Bad request
      summary: Update a data view
      tags:
        - data views
      x-codeSamples:
        - lang: curl
          source: |
            curl \
              -X POST "${KIBANA_URL}/api/data_views/data_view/${DATA_VIEW_ID}" \
              -H "Authorization: ApiKey ${API_KEY}" \
              -H "kbn-xsrf: true" \
              -H "Content-Type: application/json" \
              -d '{"data_view":{"name":"Updated data view name"}}'
        - lang: Console
          source: |
            POST kbn://api/data_views/data_view/{viewId}
            {"data_view":{"name":"Updated data view name"}}
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/data_views/data_view/{viewId}/fields:
    post:
      description: |
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/data_views/data_view/{viewId}/fields</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Update field metadata for a data view. Use this endpoint to set custom labels, custom descriptions, and format overrides for individual fields.
      operationId: updateFieldsMetadataDefault
      parameters:
        - $ref: '#/components/parameters/Data_views_kbn_xsrf'
        - $ref: '#/components/parameters/Data_views_view_id'
      requestBody:
        content:
          application/json:
            examples:
              updateFieldsMetadataRequest:
                $ref: '#/components/examples/Data_views_update_field_metadata_request'
            schema:
              type: object
              properties:
                fields:
                  description: The field object.
                  type: object
              required:
                - fields
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                updateFieldsMetadataResponse:
                  $ref: '#/components/examples/Data_views_update_field_metadata_response'
              schema:
                type: object
                properties:
                  acknowledged:
                    type: boolean
          description: Indicates a successful call.
        '400':
          content:
            application/json:
              examples:
                updateFieldsMetadataBadRequest:
                  $ref: '#/components/examples/Data_views_error_400_response'
              schema:
                $ref: '#/components/schemas/Data_views_400_response'
          description: Bad request
      summary: Update field metadata
      tags:
        - data views
      x-codeSamples:
        - lang: curl
          source: |
            curl \
              -X POST "${KIBANA_URL}/api/data_views/data_view/${DATA_VIEW_ID}/fields" \
              -H "Authorization: ApiKey ${API_KEY}" \
              -H "kbn-xsrf: true" \
              -H "Content-Type: application/json" \
              -d '{"fields":{"field_name":{"customLabel":"My custom label"}}}'
        - lang: Console
          source: |
            POST kbn://api/data_views/data_view/{viewId}/fields
            {"fields":{"field_name":{"customLabel":"My custom label"}}}
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/data_views/data_view/{viewId}/runtime_field:
    post:
      description: |
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/data_views/data_view/{viewId}/runtime_field</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Create a runtime field for a data view. Runtime fields are computed at query time using a [Painless script](https://www.elastic.co/docs/explore-analyze/scripting/modules-scripting-painless) and do not require reindexing. If no `script` is provided, the runtime field returns the corresponding value from the document `_source`.
      operationId: createRuntimeFieldDefault
      parameters:
        - $ref: '#/components/parameters/Data_views_kbn_xsrf'
        - $ref: '#/components/parameters/Data_views_view_id'
      requestBody:
        content:
          application/json:
            examples:
              createRuntimeFieldRequest:
                $ref: '#/components/examples/Data_views_create_runtime_field_request'
            schema:
              type: object
              properties:
                name:
                  description: |
                    The name for a runtime field.
                  type: string
                runtimeField:
                  description: |
                    The runtime field definition object.
                  type: object
              required:
                - name
                - runtimeField
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                createRuntimeFieldResponse:
                  $ref: '#/components/examples/Data_views_create_runtime_field_response'
              schema:
                type: object
          description: Indicates a successful call.
      summary: Create a runtime field
      tags:
        - data views
      x-codeSamples:
        - lang: curl
          source: |
            curl \
              -X POST "${KIBANA_URL}/api/data_views/data_view/${DATA_VIEW_ID}/runtime_field" \
              -H "Authorization: ApiKey ${API_KEY}" \
              -H "kbn-xsrf: true" \
              -H "Content-Type: application/json" \
              -d '{"name":"hour_of_day","runtimeField":{"type":"long","script":{"source":"emit(doc['"'"'timestamp'"'"'].value.getHour())"}}}'
        - lang: Console
          source: |
            POST kbn://api/data_views/data_view/{viewId}/runtime_field
            {"name":"hour_of_day","runtimeField":{"type":"long","script":{"source":"emit(doc['timestamp'].value.getHour())"}}}
      x-metaTags:
        - content: Kibana
          name: product_name
    put:
      description: |
        **Spaces method and path for this operation:**

        <div><span class="operation-verb put">put</span>&nbsp;<span class="operation-path">/s/{space_id}/api/data_views/data_view/{viewId}/runtime_field</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Create or update a runtime field for a data view. If the runtime field already exists, it is replaced with the new definition.
      operationId: createUpdateRuntimeFieldDefault
      parameters:
        - $ref: '#/components/parameters/Data_views_kbn_xsrf'
        - description: |
            The ID of the data view fields you want to update.
          in: path
          name: viewId
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            examples:
              updateRuntimeFieldRequest:
                $ref: '#/components/examples/Data_views_create_runtime_field_request'
            schema:
              type: object
              properties:
                name:
                  description: |
                    The name for a runtime field.
                  type: string
                runtimeField:
                  description: |
                    The runtime field definition object.
                  type: object
              required:
                - name
                - runtimeField
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                createUpdateRuntimeFieldResponse:
                  $ref: '#/components/examples/Data_views_create_runtime_field_response'
              schema:
                type: object
                properties:
                  data_view:
                    type: object
                  fields:
                    items:
                      type: object
                    type: array
          description: Indicates a successful call.
        '400':
          content:
            application/json:
              examples:
                createUpdateRuntimeFieldBadRequest:
                  $ref: '#/components/examples/Data_views_error_400_response'
              schema:
                $ref: '#/components/schemas/Data_views_400_response'
          description: Bad request
      summary: Create or update a runtime field
      tags:
        - data views
      x-codeSamples:
        - lang: curl
          source: |
            curl \
              -X PUT "${KIBANA_URL}/api/data_views/data_view/${DATA_VIEW_ID}/runtime_field" \
              -H "Authorization: ApiKey ${API_KEY}" \
              -H "kbn-xsrf: true" \
              -H "Content-Type: application/json" \
              -d '{"name":"hour_of_day","runtimeField":{"type":"long","script":{"source":"emit(doc['"'"'timestamp'"'"'].value.getHour())"}}}'
        - lang: Console
          source: |
            PUT kbn://api/data_views/data_view/{viewId}/runtime_field
            {"name":"hour_of_day","runtimeField":{"type":"long","script":{"source":"emit(doc['timestamp'].value.getHour())"}}}
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/data_views/data_view/{viewId}/runtime_field/{fieldName}:
    delete:
      description: |
        **Spaces method and path for this operation:**

        <div><span class="operation-verb delete">delete</span>&nbsp;<span class="operation-path">/s/{space_id}/api/data_views/data_view/{viewId}/runtime_field/{fieldName}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Delete a runtime field from a data view.
      operationId: deleteRuntimeFieldDefault
      parameters:
        - $ref: '#/components/parameters/Data_views_field_name'
        - $ref: '#/components/parameters/Data_views_view_id'
      responses:
        '200':
          description: Indicates a successful call.
        '404':
          content:
            application/json:
              examples:
                deleteRuntimeFieldNotFound:
                  $ref: '#/components/examples/Data_views_error_404_response'
              schema:
                $ref: '#/components/schemas/Data_views_404_response'
          description: Object is not found.
      summary: Delete a runtime field
      tags:
        - data views
      x-codeSamples:
        - lang: curl
          source: |
            curl \
              -X DELETE "${KIBANA_URL}/api/data_views/data_view/${DATA_VIEW_ID}/runtime_field/${FIELD_NAME}" \
              -H "Authorization: ApiKey ${API_KEY}" \
              -H "kbn-xsrf: true"
        - lang: Console
          source: |
            DELETE kbn://api/data_views/data_view/{viewId}/runtime_field/{fieldName}
      x-metaTags:
        - content: Kibana
          name: product_name
    get:
      description: |
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/data_views/data_view/{viewId}/runtime_field/{fieldName}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Retrieve a single runtime field by name from a data view.
      operationId: getRuntimeFieldDefault
      parameters:
        - $ref: '#/components/parameters/Data_views_field_name'
        - $ref: '#/components/parameters/Data_views_view_id'
      responses:
        '200':
          content:
            application/json:
              examples:
                getRuntimeFieldResponse:
                  $ref: '#/components/examples/Data_views_get_runtime_field_response'
              schema:
                type: object
                properties:
                  data_view:
                    type: object
                  fields:
                    items:
                      type: object
                    type: array
          description: Indicates a successful call.
        '404':
          content:
            application/json:
              examples:
                getRuntimeFieldNotFound:
                  $ref: '#/components/examples/Data_views_error_404_response'
              schema:
                $ref: '#/components/schemas/Data_views_404_response'
          description: Object is not found.
      summary: Get a runtime field
      tags:
        - data views
      x-codeSamples:
        - lang: curl
          source: |
            curl \
              -X GET "${KIBANA_URL}/api/data_views/data_view/${DATA_VIEW_ID}/runtime_field/${FIELD_NAME}" \
              -H "Authorization: ApiKey ${API_KEY}"
        - lang: Console
          source: |
            GET kbn://api/data_views/data_view/{viewId}/runtime_field/{fieldName}
      x-metaTags:
        - content: Kibana
          name: product_name
    post:
      description: |
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/data_views/data_view/{viewId}/runtime_field/{fieldName}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Update an existing runtime field in a data view. Only the fields provided in the request body are updated.
      operationId: updateRuntimeFieldDefault
      parameters:
        - $ref: '#/components/parameters/Data_views_field_name'
        - $ref: '#/components/parameters/Data_views_view_id'
      requestBody:
        content:
          application/json:
            examples:
              updateRuntimeFieldRequest:
                $ref: '#/components/examples/Data_views_update_runtime_field_request'
            schema:
              type: object
              properties:
                runtimeField:
                  description: |
                    The runtime field definition object.

                    You can update following fields:

                    - `type`
                    - `script`
                  type: object
              required:
                - runtimeField
        required: true
      responses:
        '200':
          description: Indicates a successful call.
        '400':
          content:
            application/json:
              examples:
                updateRuntimeFieldBadRequest:
                  $ref: '#/components/examples/Data_views_error_400_response'
              schema:
                $ref: '#/components/schemas/Data_views_400_response'
          description: Bad request
      summary: Update a runtime field
      tags:
        - data views
      x-codeSamples:
        - lang: curl
          source: |
            curl \
              -X POST "${KIBANA_URL}/api/data_views/data_view/${DATA_VIEW_ID}/runtime_field/${FIELD_NAME}" \
              -H "Authorization: ApiKey ${API_KEY}" \
              -H "kbn-xsrf: true" \
              -H "Content-Type: application/json" \
              -d '{"runtimeField":{"type":"long","script":{"source":"emit(doc['"'"'timestamp'"'"'].value.getHour())"}}}'
        - lang: Console
          source: |
            POST kbn://api/data_views/data_view/{viewId}/runtime_field/{fieldName}
            {"runtimeField":{"type":"long","script":{"source":"emit(doc['timestamp'].value.getHour())"}}}
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/data_views/default:
    get:
      description: |
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/data_views/default</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Retrieve the identifier of the default data view for the current Kibana space.
      operationId: getDefaultDataViewDefault
      responses:
        '200':
          content:
            application/json:
              examples:
                getDefaultDataViewResponse:
                  $ref: '#/components/examples/Data_views_get_default_data_view_response'
              schema:
                type: object
                properties:
                  data_view_id:
                    type: string
          description: Indicates a successful call.
        '400':
          content:
            application/json:
              examples:
                getDefaultDataViewBadRequest:
                  $ref: '#/components/examples/Data_views_error_400_response'
              schema:
                $ref: '#/components/schemas/Data_views_400_response'
          description: Bad request
      summary: Get the default data view
      tags:
        - data views
      x-codeSamples:
        - lang: curl
          source: |
            curl \
              -X GET "${KIBANA_URL}/api/data_views/default" \
              -H "Authorization: ApiKey ${API_KEY}"
        - lang: Console
          source: |
            GET kbn://api/data_views/default
      x-metaTags:
        - content: Kibana
          name: product_name
    post:
      description: |
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/data_views/default</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Set the default data view for the current Kibana space. The default data view is used as a fallback when no specific data view is selected.
      operationId: setDefaultDatailViewDefault
      parameters:
        - $ref: '#/components/parameters/Data_views_kbn_xsrf'
      requestBody:
        content:
          application/json:
            examples:
              setDefaultDataViewRequest:
                $ref: '#/components/examples/Data_views_set_default_data_view_request'
            schema:
              type: object
              properties:
                data_view_id:
                  description: |
                    The data view identifier. NOTE: The API does not validate whether it is a valid identifier. Use `null` to unset the default data view.
                  nullable: true
                  type: string
                force:
                  default: false
                  description: Update an existing default data view identifier.
                  type: boolean
              required:
                - data_view_id
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                setDefaultDataViewResponse:
                  $ref: '#/components/examples/Data_views_set_default_data_view_response'
              schema:
                type: object
                properties:
                  acknowledged:
                    type: boolean
          description: Indicates a successful call.
        '400':
          content:
            application/json:
              examples:
                setDefaultDataViewBadRequest:
                  $ref: '#/components/examples/Data_views_error_400_response'
              schema:
                $ref: '#/components/schemas/Data_views_400_response'
          description: Bad request
      summary: Set the default data view
      tags:
        - data views
      x-codeSamples:
        - lang: curl
          source: |
            curl \
              -X POST "${KIBANA_URL}/api/data_views/default" \
              -H "Authorization: ApiKey ${API_KEY}" \
              -H "kbn-xsrf: true" \
              -H "Content-Type: application/json" \
              -d '{"data_view_id":"ff959d40-b880-11e8-a6d9-e546fe2bba5f","force":true}'
        - lang: Console
          source: |
            POST kbn://api/data_views/default
            {"data_view_id":"ff959d40-b880-11e8-a6d9-e546fe2bba5f","force":true}
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/data_views/swap_references:
    post:
      description: |
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/data_views/swap_references</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Swap saved object references from one data view to another. Use this endpoint to update dashboards, visualizations, and other saved objects that reference a data view. WARNING: Misuse can break large numbers of saved objects! Use the [`_preview`](https://www.elastic.co/docs/api/doc/kibana/operation/operation-previewswapdataviewsdefault) endpoint to see which saved objects would be affected before making changes.
      operationId: swapDataViewsDefault
      parameters:
        - $ref: '#/components/parameters/Data_views_kbn_xsrf'
      requestBody:
        content:
          application/json:
            examples:
              swapDataViewRequest:
                $ref: '#/components/examples/Data_views_swap_data_view_request'
            schema:
              $ref: '#/components/schemas/Data_views_swap_data_view_request_object'
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                swapDataViewResponse:
                  $ref: '#/components/examples/Data_views_swap_data_view_response'
              schema:
                type: object
                properties:
                  deleteStatus:
                    type: object
                    properties:
                      deletePerformed:
                        type: boolean
                      remainingRefs:
                        type: integer
                  result:
                    items:
                      type: object
                      properties:
                        id:
                          description: A saved object identifier.
                          type: string
                        type:
                          description: The saved object type.
                          type: string
                    type: array
          description: Indicates a successful call.
      summary: Swap saved object references
      tags:
        - data views
      x-codeSamples:
        - lang: curl
          source: |
            curl \
              -X POST "${KIBANA_URL}/api/data_views/swap_references" \
              -H "Authorization: ApiKey ${API_KEY}" \
              -H "kbn-xsrf: true" \
              -H "Content-Type: application/json" \
              -d '{"fromId":"abcd-efg","toId":"xyz-123","delete":true}'
        - lang: Console
          source: |
            POST kbn://api/data_views/swap_references
            {"fromId":"abcd-efg","toId":"xyz-123","delete":true}
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/data_views/swap_references/_preview:
    post:
      description: |
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/data_views/swap_references/_preview</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Preview the effect of swapping saved object references from one data view to another. Returns the list of affected saved objects without making any changes.
      operationId: previewSwapDataViewsDefault
      parameters:
        - $ref: '#/components/parameters/Data_views_kbn_xsrf'
      requestBody:
        content:
          application/json:
            examples:
              previewSwapDataViewRequest:
                $ref: '#/components/examples/Data_views_preview_swap_data_view_request'
            schema:
              $ref: '#/components/schemas/Data_views_swap_data_view_request_object'
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                previewSwapDataViewResponse:
                  $ref: '#/components/examples/Data_views_preview_swap_data_view_response'
              schema:
                type: object
                properties:
                  result:
                    items:
                      type: object
                      properties:
                        id:
                          description: A saved object identifier.
                          type: string
                        type:
                          description: The saved object type.
                          type: string
                    type: array
          description: Indicates a successful call.
      summary: Preview swap references
      tags:
        - data views
      x-codeSamples:
        - lang: curl
          source: |
            curl \
              -X POST "${KIBANA_URL}/api/data_views/swap_references/_preview" \
              -H "Authorization: ApiKey ${API_KEY}" \
              -H "kbn-xsrf: true" \
              -H "Content-Type: application/json" \
              -d '{"fromId":"abcd-efg","toId":"xyz-123"}'
        - lang: Console
          source: |
            POST kbn://api/data_views/swap_references/_preview
            {"fromId":"abcd-efg","toId":"xyz-123"}
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/detection_engine/attacks/assignees:
    post:
      description: |
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/detection_engine/attacks/assignees</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Assign users to attack discovery alerts, and unassign them from alerts.
        Optionally cascade the change to related detection alerts via `kibana.alert.attack_discovery.alert_ids`.
        > info
        > You cannot add and remove the same assignee in the same request.
      operationId: SetAttacksAssignees
      requestBody:
        content:
          application/json:
            examples:
              add:
                value:
                  assignees:
                    add:
                      - u_MxY0jbrft7EcfC6iNZSUGeI_n6iYrSwZj5mWF5EqmSU_0
                    remove: []
                  ids:
                    - 80e1383f856e67c1b7f7a1634744fa6d66b6e2ef7aa26d226e57afb5a7b2b4a1
              remove:
                value:
                  assignees:
                    add: []
                    remove:
                      - u_MxY0jbrft7EcfC6iNZSUGeI_n6iYrSwZj5mWF5EqmSU_0
                  ids:
                    - 80e1383f856e67c1b7f7a1634744fa6d66b6e2ef7aa26d226e57afb5a7b2b4a1
              withRelatedAlerts:
                value:
                  assignees:
                    add:
                      - u_MxY0jbrft7EcfC6iNZSUGeI_n6iYrSwZj5mWF5EqmSU_0
                    remove: []
                  ids:
                    - 80e1383f856e67c1b7f7a1634744fa6d66b6e2ef7aa26d226e57afb5a7b2b4a1
                  update_related_alerts: true
            schema:
              $ref: '#/components/schemas/Security_Detections_API_SetAttacksAssigneesByIds'
              description: Set attacks assignees by IDs request
        description: An object containing assignees to add or remove and attack ids the changes will be applied to
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                success:
                  value:
                    batches: 1
                    deleted: 0
                    failures: []
                    noops: 0
                    requests_per_second: -1
                    retries:
                      bulk: 0
                      search: 0
                    throttled_millis: 0
                    throttled_until_millis: 0
                    timed_out: false
                    took: 76
                    total: 1
                    updated: 1
                    version_conflicts: 0
              schema:
                additionalProperties: true
                description: Elasticsearch update by query response
                type: object
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                badRequest:
                  value:
                    error: Bad Request
                    message: '[request body].ids: at least one attack id is required to update assignees'
                    statusCode: 400
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Security_Detections_API_PlatformErrorResponse'
                  - $ref: '#/components/schemas/Security_Detections_API_SiemErrorResponse'
          description: Invalid input data response
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: |-
                      [security_exception
                      	Root causes:
                      		security_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]
                    statusCode: 401
              schema:
                $ref: '#/components/schemas/Security_Detections_API_PlatformErrorResponse'
          description: Unsuccessful authentication response
        '500':
          content:
            application/json:
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
              schema:
                $ref: '#/components/schemas/Security_Detections_API_SiemErrorResponse'
          description: Internal server error response
      summary: Assign and unassign users from attack discovery alerts
      tags:
        - Security Detections API
      x-state: added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/detection_engine/attacks/search:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/detection_engine/attacks/search</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Find and/or aggregate attack discovery alerts that match the given query. Searches scheduled and ad hoc attack discovery alert indices for the active space only.
      operationId: SearchAttacks
      requestBody:
        content:
          application/json:
            examples:
              byIds:
                value:
                  query:
                    ids:
                      values:
                        - 80e1383f856e67c1b7f7a1634744fa6d66b6e2ef7aa26d226e57afb5a7b2b4a1
            schema:
              $ref: '#/components/schemas/Security_Detections_API_QueryAlertsBodyParams'
              description: Elasticsearch query and aggregation request
        description: Search and/or aggregation query
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                success:
                  value:
                    _shards:
                      failed: 0
                      skipped: 0
                      successful: 1
                      total: 1
                    hits:
                      hits:
                        - _id: 80e1383f856e67c1b7f7a1634744fa6d66b6e2ef7aa26d226e57afb5a7b2b4a1
                          _index: .internal.adhoc.alerts-security.attack.discovery.alerts-default-000001
                          _score: 1
                          _source:
                            '@timestamp': '2025-06-23T15:16:52.984Z'
                            kibana.alert.attack_discovery.alert_ids:
                              - ee183cf525d7e9d0f47d1b2bb928d760a0f53756ffa61edcf0672f71c986ac21
                              - 46ebac989ca72439b14b57d32102543c17d5f33e0f6532d8a5c148949d8ff7b5
                            kibana.alert.attack_discovery.title_with_replacements: Widespread Malware Campaign via Compromised Account
                            kibana.alert.workflow_status: open
                      max_score: 1
                      total:
                        relation: eq
                        value: 1
                    timed_out: false
                    took: 1
              schema:
                additionalProperties: true
                description: Elasticsearch search response
                type: object
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                badRequest:
                  value:
                    error: Bad Request
                    message: 'Failed to parse search request: unknown query clause in bool filter'
                    statusCode: 400
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Security_Detections_API_PlatformErrorResponse'
                  - $ref: '#/components/schemas/Security_Detections_API_SiemErrorResponse'
          description: Invalid input data response
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: |-
                      [security_exception
                      	Root causes:
                      		security_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]
                    statusCode: 401
              schema:
                $ref: '#/components/schemas/Security_Detections_API_PlatformErrorResponse'
          description: Unsuccessful authentication response
        '500':
          content:
            application/json:
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
              schema:
                $ref: '#/components/schemas/Security_Detections_API_SiemErrorResponse'
          description: Internal server error response
      summary: Find and/or aggregate attack discovery alerts
      tags:
        - Security Detections API
      x-state: added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/detection_engine/attacks/status:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/detection_engine/attacks/status</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Set the workflow status of one or more attack discovery alerts by IDs, optionally cascading the status to their related detection alerts.
      operationId: SetAttacksStatus
      requestBody:
        content:
          application/json:
            examples:
              byId:
                value:
                  ids:
                    - 80e1383f856e67c1b7f7a1634744fa6d66b6e2ef7aa26d226e57afb5a7b2b4a1
                  status: acknowledged
              closedWithReason:
                value:
                  ids:
                    - 80e1383f856e67c1b7f7a1634744fa6d66b6e2ef7aa26d226e57afb5a7b2b4a1
                  reason: false_positive
                  status: closed
              withRelatedAlerts:
                value:
                  ids:
                    - 80e1383f856e67c1b7f7a1634744fa6d66b6e2ef7aa26d226e57afb5a7b2b4a1
                  status: closed
                  update_related_alerts: true
            schema:
              $ref: '#/components/schemas/Security_Detections_API_SetAttacksStatusByIds'
              description: Set attacks status by IDs request
        description: An object containing the desired status and explicit attack ids
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                success:
                  value:
                    batches: 1
                    deleted: 0
                    failures: []
                    noops: 0
                    requests_per_second: -1
                    retries:
                      bulk: 0
                      search: 0
                    throttled_millis: 0
                    throttled_until_millis: 0
                    timed_out: false
                    took: 81
                    total: 1
                    updated: 1
                    version_conflicts: 0
              schema:
                additionalProperties: true
                description: Elasticsearch update by query response
                type: object
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                badRequest:
                  value:
                    error: Bad Request
                    message: '[request body].ids: at least one attack id is required to update status'
                    statusCode: 400
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Security_Detections_API_PlatformErrorResponse'
                  - $ref: '#/components/schemas/Security_Detections_API_SiemErrorResponse'
          description: Invalid input data response
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: |-
                      [security_exception
                      	Root causes:
                      		security_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]
                    statusCode: 401
              schema:
                $ref: '#/components/schemas/Security_Detections_API_PlatformErrorResponse'
          description: Unsuccessful authentication response
        '500':
          content:
            application/json:
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
              schema:
                $ref: '#/components/schemas/Security_Detections_API_SiemErrorResponse'
          description: Internal server error response
      summary: Set attack discovery alerts workflow status
      tags:
        - Security Detections API
      x-state: added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/detection_engine/attacks/tags:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/detection_engine/attacks/tags</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Add tags to attack discovery alerts, and remove them from alerts, by attack IDs in a single request. Optionally cascade tag changes to related detection alerts.
      operationId: SetAttacksTags
      requestBody:
        content:
          application/json:
            examples:
              add:
                value:
                  ids:
                    - 80e1383f856e67c1b7f7a1634744fa6d66b6e2ef7aa26d226e57afb5a7b2b4a1
                  tags:
                    tags_to_add:
                      - investigation
                    tags_to_remove: []
              remove:
                value:
                  ids:
                    - 80e1383f856e67c1b7f7a1634744fa6d66b6e2ef7aa26d226e57afb5a7b2b4a1
                  tags:
                    tags_to_add: []
                    tags_to_remove:
                      - investigation
              withRelatedAlerts:
                value:
                  ids:
                    - 80e1383f856e67c1b7f7a1634744fa6d66b6e2ef7aa26d226e57afb5a7b2b4a1
                  tags:
                    tags_to_add:
                      - investigation
                    tags_to_remove: []
                  update_related_alerts: true
            schema:
              $ref: '#/components/schemas/Security_Detections_API_SetAttacksTagsByIds'
              description: Set attacks tags by IDs request
        description: An object containing tags to add or remove and attack ids the changes will be applied to
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                success:
                  value:
                    batches: 1
                    deleted: 0
                    failures: []
                    noops: 0
                    requests_per_second: -1
                    retries:
                      bulk: 0
                      search: 0
                    throttled_millis: 0
                    throttled_until_millis: 0
                    timed_out: false
                    took: 68
                    total: 1
                    updated: 1
                    version_conflicts: 0
              schema:
                additionalProperties: true
                description: Elasticsearch update by query response
                type: object
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                badRequest:
                  value:
                    message:
                      - Duplicate tags ["duplicate"] were found in the tags_to_add and tags_to_remove parameters.
                    status_code: 400
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Security_Detections_API_PlatformErrorResponse'
                  - $ref: '#/components/schemas/Security_Detections_API_SiemErrorResponse'
          description: Invalid input data response
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: |-
                      [security_exception
                      	Root causes:
                      		security_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]
                    statusCode: 401
              schema:
                $ref: '#/components/schemas/Security_Detections_API_PlatformErrorResponse'
          description: Unsuccessful authentication response
        '500':
          content:
            application/json:
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
              schema:
                $ref: '#/components/schemas/Security_Detections_API_SiemErrorResponse'
          description: Internal server error response
      summary: Add and remove attack discovery alert tags
      tags:
        - Security Detections API
      x-state: added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/detection_engine/index:
    delete:
      description: |
        **Spaces method and path for this operation:**

        <div><span class="operation-verb delete">delete</span>&nbsp;<span class="operation-path">/s/{space_id}/api/detection_engine/index</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Permanently deletes the Elastic Security alerts backing index in the current space, including the alerts
        stored in it. Use with caution; prefer lifecycle policies or the UI when available.
        Call `GET /api/detection_engine/index` first to confirm the index that will be removed.
      operationId: DeleteAlertsIndex
      responses:
        '200':
          content:
            application/json:
              examples:
                acknowledged:
                  value:
                    acknowledged: true
              schema:
                type: object
                properties:
                  acknowledged:
                    type: boolean
                required:
                  - acknowledged
          description: Successful response
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: |-
                      [security_exception
                      	Root causes:
                      		security_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]
                    statusCode: 401
              schema:
                $ref: '#/components/schemas/Security_Detections_API_PlatformErrorResponse'
          description: Unsuccessful authentication response
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  value:
                    message: API [DELETE /api/detection_engine/index] is unauthorized for the current user. The user needs alerts management permissions for the space.
                    status_code: 403
              schema:
                $ref: '#/components/schemas/Security_Detections_API_SiemErrorResponse'
          description: Not enough permissions response
        '404':
          content:
            application/json:
              examples:
                notFound:
                  value:
                    message: The Elastic Security alerts index to delete was not found.
                    status_code: 404
              schema:
                $ref: '#/components/schemas/Security_Detections_API_SiemErrorResponse'
          description: Index does not exist response
        '500':
          content:
            application/json:
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
              schema:
                $ref: '#/components/schemas/Security_Detections_API_SiemErrorResponse'
          description: Internal server error response
      summary: Delete an alerts index
      tags:
        - Security Detections API
      x-metaTags:
        - content: Kibana
          name: product_name
    get:
      description: |
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/detection_engine/index</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Returns the backing Elasticsearch index for Elastic Security detection alerts in the current space, and
        whether its mapping is outdated. Use this to verify that an alert index is provisioned before creating
        or running rules that write alerts to it.
      operationId: ReadAlertsIndex
      responses:
        '200':
          content:
            application/json:
              examples:
                success:
                  value:
                    index_mapping_outdated: false
                    name: .alerts-security.alerts-default
              schema:
                type: object
                properties:
                  index_mapping_outdated:
                    nullable: true
                    type: boolean
                  name:
                    type: string
                required:
                  - name
                  - index_mapping_outdated
          description: Successful response
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: |-
                      [security_exception
                      	Root causes:
                      		security_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]
                    statusCode: 401
              schema:
                $ref: '#/components/schemas/Security_Detections_API_PlatformErrorResponse'
          description: Unsuccessful authentication response
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  value:
                    message: API [GET /api/detection_engine/index] is unauthorized for the current user. Check Security and Kibana feature privileges (detection engine / alerts) for the space.
                    status_code: 403
              schema:
                $ref: '#/components/schemas/Security_Detections_API_SiemErrorResponse'
          description: Not enough permissions response
        '404':
          content:
            application/json:
              examples:
                notFound:
                  value:
                    message: Elastic Security alert index is not found for the current space.
                    status_code: 404
              schema:
                $ref: '#/components/schemas/Security_Detections_API_SiemErrorResponse'
          description: Not found
        '500':
          content:
            application/json:
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
              schema:
                $ref: '#/components/schemas/Security_Detections_API_SiemErrorResponse'
          description: Internal server error response
      summary: Reads the alert index name if it exists
      tags:
        - Security Detections API
      x-metaTags:
        - content: Kibana
          name: product_name
    post:
      description: |
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/detection_engine/index</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Creates an index for Elastic Security alerts. Calling this API is not
        required for the detection engine to function properly. You can create
        rules and alerts without calling this API.
      operationId: CreateAlertsIndex
      responses:
        '200':
          content:
            application/json:
              examples:
                acknowledged:
                  value:
                    acknowledged: true
              schema:
                type: object
                properties:
                  acknowledged:
                    type: boolean
                required:
                  - acknowledged
          description: Successful response
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: |-
                      [security_exception
                      	Root causes:
                      		security_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]
                    statusCode: 401
              schema:
                $ref: '#/components/schemas/Security_Detections_API_PlatformErrorResponse'
          description: Unsuccessful authentication response
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  value:
                    message: API [POST /api/detection_engine/index] is unauthorized for the current user. The user must be able to create indices for the Elastic Security solution.
                    status_code: 403
              schema:
                $ref: '#/components/schemas/Security_Detections_API_SiemErrorResponse'
          description: Not enough permissions response
        '404':
          content:
            application/json:
              examples:
                notFound:
                  value:
                    message: A prerequisite resource required to create the alerts index was not found.
                    status_code: 404
              schema:
                $ref: '#/components/schemas/Security_Detections_API_SiemErrorResponse'
          description: Not found
        '500':
          content:
            application/json:
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
              schema:
                $ref: '#/components/schemas/Security_Detections_API_SiemErrorResponse'
          description: Internal server error response
      summary: Create an alerts index
      tags:
        - Security Detections API
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/detection_engine/privileges:
    get:
      description: |
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/detection_engine/privileges</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Retrieves whether or not the user is authenticated, and the user's Kibana
        space and index privileges, which determine if the user can create an
        index for the Elastic Security alerts generated by
        detection engine rules.
      operationId: ReadPrivileges
      responses:
        '200':
          content:
            application/json:
              examples:
                success:
                  value:
                    application: {}
                    cluster:
                      all: true
                      manage: true
                      manage_api_key: true
                      manage_index_templates: true
                      manage_ml: true
                      manage_own_api_key: true
                      manage_pipeline: true
                      manage_security: true
                      manage_transform: true
                      monitor: true
                      monitor_ml: true
                      monitor_transform: true
                    has_all_requested: true
                    has_encryption_key: true
                    index:
                      .alerts-security.alerts-default:
                        all: true
                        create: true
                        create_doc: true
                        create_index: true
                        delete: true
                        delete_index: true
                        index: true
                        maintenance: true
                        manage: true
                        monitor: true
                        read: true
                        view_index_metadata: true
                        write: true
                    is_authenticated: true
                    username: elastic
              schema:
                type: object
                properties:
                  has_encryption_key:
                    type: boolean
                  is_authenticated:
                    type: boolean
                required:
                  - is_authenticated
                  - has_encryption_key
          description: Successful response
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: |-
                      [security_exception
                      	Root causes:
                      		security_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]
                    statusCode: 401
              schema:
                $ref: '#/components/schemas/Security_Detections_API_PlatformErrorResponse'
          description: Unsuccessful authentication response
        '500':
          content:
            application/json:
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
              schema:
                $ref: '#/components/schemas/Security_Detections_API_SiemErrorResponse'
          description: Internal server error response
      summary: Returns user privileges for the Kibana space
      tags:
        - Security Detections API
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/detection_engine/rules:
    delete:
      description: |
        **Spaces method and path for this operation:**

        <div><span class="operation-verb delete">delete</span>&nbsp;<span class="operation-path">/s/{space_id}/api/detection_engine/rules</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Delete a detection rule using the `rule_id` or `id` field.

        The URL query must include one of the following:

        * `id` - `DELETE /api/detection_engine/rules?id=<id>`
        * `rule_id`- `DELETE /api/detection_engine/rules?rule_id=<rule_id>`

        The difference between the `id` and `rule_id` is that the `id` is a unique rule identifier that is randomly generated when a rule is created and cannot be set, whereas `rule_id` is a stable rule identifier that can be assigned during rule creation.
      operationId: DeleteRule
      parameters:
        - description: The rule's `id` value.
          in: query
          name: id
          required: false
          schema:
            $ref: '#/components/schemas/Security_Detections_API_UUID'
        - description: The rule's `rule_id` value.
          in: query
          name: rule_id
          required: false
          schema:
            $ref: '#/components/schemas/Security_Detections_API_RuleSignatureId'
      responses:
        '200':
          content:
            application/json:
              examples:
                deletedRule:
                  summary: Response shape after a rule is deleted
                  value:
                    actions: []
                    created_at: '2020-02-03T11:19:04.259Z'
                    created_by: elastic
                    description: Process started by MS Office program in user folder
                    enabled: false
                    false_positives: []
                    from: now-4200s
                    id: c41d170b-8ba6-4de6-b8ec-76440a35ace3
                    immutable: false
                    interval: 1h
                    language: kuery
                    max_signals: 100
                    name: MS Office child process
                    query: event.action:Process*
                    references: []
                    risk_score: 50
                    rule_id: process_started_by_ms_office_user_folder
                    severity: low
                    tags:
                      - tag
                    throttle: null
                    to: now
                    type: query
                    updated_at: '2020-02-03T11:19:04.462Z'
                    updated_by: elastic
                    version: 3
              schema:
                $ref: '#/components/schemas/Security_Detections_API_RuleResponse'
          description: Indicates a successful call.
      summary: Delete a detection rule
      tags:
        - Security Detections API
      x-codeSamples:
        - lang: cURL
          source: |
            curl \
              --request DELETE https://localhost:5601/api/detection_engine/rules?rule_id=bfeaf89b-a2a7-48a3-817f-e41829dc61ee \
              --header "Content-Type: application/json; Elastic-Api-Version=2023-10-31"
      x-metaTags:
        - content: Kibana
          name: product_name
    get:
      description: |
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/detection_engine/rules</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Retrieve a detection rule using the `rule_id` or `id` field.

        The URL query must include one of the following:

        * `id` - `GET /api/detection_engine/rules?id=<id>`
        * `rule_id` - `GET /api/detection_engine/rules?rule_id=<rule_id>`

        The difference between the `id` and `rule_id` is that the `id` is a unique rule identifier that is randomly generated when a rule is created and cannot be set, whereas `rule_id` is a stable rule identifier that can be assigned during rule creation.
      operationId: ReadRule
      parameters:
        - description: The rule's `id` value.
          in: query
          name: id
          required: false
          schema:
            $ref: '#/components/schemas/Security_Detections_API_UUID'
        - description: The rule's `rule_id` value.
          in: query
          name: rule_id
          required: false
          schema:
            $ref: '#/components/schemas/Security_Detections_API_RuleSignatureId'
      responses:
        '200':
          content:
            application/json:
              examples:
                example1:
                  summary: Example response for a retrieved rule
                  value:
                    created_at: '2020-02-03T11:19:04.259Z'
                    created_by: elastic
                    description: Process started by MS Office program in user folder
                    enabled: false
                    execution_summary:
                      last_execution:
                        date: '2022-03-23T16:06:12.787Z'
                        message: This rule attempted to query data from Elasticsearch indices listed in the "Index pattern" section of the rule definition, but no matching index was found.
                        metrics:
                          execution_gap_duration_s: 0
                          total_indexing_duration_ms: 15
                          total_search_duration_ms: 135
                        status: partial failure
                        status_order: 20
                    false_positives: []
                    filters:
                      - query:
                          match:
                            event.action:
                              query: 'Process Create (rule: ProcessCreate)'
                              type: phrase
                    from: now-4200s
                    id: c41d170b-8ba6-4de6-b8ec-76440a35ace3
                    immutable: false
                    interval: 1h
                    language: kuery
                    max_signals: 100
                    name: MS Office child process
                    query: process.parent.name:EXCEL.EXE or process.parent.name:MSPUB.EXE or process.parent.name:OUTLOOK.EXE or process.parent.name:POWERPNT.EXE or process.parent.name:VISIO.EXE or process.parent.name:WINWORD.EXE
                    references: []
                    related_integrations:
                      - package: o365
                        version: ^2.3.2
                    required_fields:
                      - ecs: true
                        name: process.name
                        type: keyword
                      - ecs: true
                        name: process.parent.name
                        type: keyword
                    risk_score: 21
                    rule_id: process_started_by_ms_office_user_folder
                    setup: ''
                    severity: low
                    tags:
                      - child process
                      - ms office
                    threat:
                      - framework: MITRE ATT&CK
                        tactic:
                          id: TA0001
                          name: Initial Access
                          reference: https://attack.mitre.org/tactics/TA0001
                        technique:
                          - id: T1193
                            name: Spearphishing Attachment
                            reference: https://attack.mitre.org/techniques/T1193
                    to: now-300s
                    type: query
                    updated_at: '2020-02-03T11:19:04.462Z'
                    updated_by: elastic
                    version: 1
              schema:
                $ref: '#/components/schemas/Security_Detections_API_RuleResponse'
          description: |
            Indicates a successful call.
            > info
            > These fields are under development and their usage or schema may change: execution_summary.
      summary: Retrieve a detection rule
      tags:
        - Security Detections API
      x-codeSamples:
        - lang: cURL
          source: |
            curl \
              --request GET https://localhost:5601/api/detection_engine/rules?rule_id=bfeaf89b-a2a7-48a3-817f-e41829dc61ee \
              --header "Content-Type: application/json; Elastic-Api-Version=2023-10-31"
      x-metaTags:
        - content: Kibana
          name: product_name
    patch:
      description: |
        **Spaces method and path for this operation:**

        <div><span class="operation-verb patch">patch</span>&nbsp;<span class="operation-path">/s/{space_id}/api/detection_engine/rules</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Update specific fields of an existing detection rule using the `rule_id` or `id` field.

        The difference between the `id` and `rule_id` is that the `id` is a unique rule identifier that is randomly generated when a rule is created and cannot be set, whereas `rule_id` is a stable rule identifier that can be assigned during rule creation.
        > warn
        > When used with [API key](https://www.elastic.co/docs/deploy-manage/api-keys) authentication, the user's key gets assigned to the affected rules. If the user's key gets deleted or the user becomes inactive, the rules will stop running.

        > If the API key that is used for authorization has different privileges than the key that created or most recently updated the rule, the rule behavior might change.
      operationId: PatchRule
      requestBody:
        content:
          application/json:
            examples:
              example1:
                summary: Patch query rule
                value:
                  id: 14b7b513-3d8d-4b22-b7da-a7ae632f7e76
                  name: New name
              example2:
                summary: Patch EQL rule
                value:
                  rule_id: process_started_by_ms_office_program_possible_payload
                  threat:
                    - framework: MITRE ATT&CK
                      tactic:
                        id: TA0001
                        name: Initial Access
                        reference: https://attack.mitre.org/tactics/TA0001
                      technique:
                        - id: T1193
                          name: Spearphishing Attachment
                          reference: https://attack.mitre.org/techniques/T1193
              example3:
                summary: Patch threshold rule
                value:
                  id: 005d2c4f-51ca-493d-a2bd-20ef076339b1
                  query: 'agent.version : * and agent.id : "243d9b4f-ca01-4311-8e5c-9abbee91afd8"'
                  threshold:
                    cardinality: []
                    field: []
                    value: 600
              example4:
                summary: Patch new terms rule
                value:
                  history_window_start: now-3d
                  id: 569aac91-40dc-4807-a8ae-a2c8698089c4
                  new_terms_fields:
                    - Endpoint.policy.applied.artifacts.global.identifiers.name
              example5:
                summary: Patch esql rule
                value:
                  id: 0b15e8a2-49b6-47e0-a8e6-d63a6cc335bd
                  query: |
                    FROM logs-abc*
                    | STATS count = COUNT(*), min_timestamp = MIN(@timestamp)
                    | EVAL event_rate = count / DATE_DIFF("seconds", min_timestamp, NOW()) 
                    | KEEP event_rate
              example6:
                summary: Patch indicator match rule
                value:
                  id: 462f1986-10fe-40a3-a22c-2b1c9c4c48fd
                  threat_query: '@timestamp >= "now-30d/d" and event.module:(threatintel or ti_*) and threat.indicator.ip:* and not labels.is_ioc_transform_source:"false"'
              example7:
                summary: Patch machine learning rule
                value:
                  anomaly_threshold: 50
                  id: 60b13926-289b-41b1-a537-197ef1fa5059
                  machine_learning_job_id:
                    - auth_high_count_logon_events_ea
            schema:
              $ref: '#/components/schemas/Security_Detections_API_RulePatchProps'
        description: |
          > info
          > You cannot modify the `id` or `rule_id` values.
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                example1:
                  summary: Example response for an updated rule
                  value:
                    actions: []
                    created_at: '2020-04-07T14:51:09.755Z'
                    created_by: elastic
                    description: Updated description for the rule.
                    enabled: false
                    false_positives: []
                    filters:
                      - query: null
                    from: now-70m
                    id: 6541b99a-dee9-4f6d-a86d-dbd1869d73b1
                    immutable: false
                    interval: 1h
                    language: kuery
                    max_signals: 100
                    name: Updated Rule Name
                    query: process.parent.name:EXCEL.EXE or process.parent.name:MSPUB.EXE or process.parent.name:OUTLOOK.EXE or process.parent.name:POWERPNT.EXE or process.parent.name:VISIO.EXE or process.parent.name:WINWORD.EXE
                    references: []
                    related_integrations:
                      - package: o365
                    required_fields:
                      - name: process.parent.name
                    risk_score: 50
                    rule_id: process_started_by_ms_office_program
                    setup: ''
                    severity: low
                    tags:
                      - child process
                      - ms office
                    threat: []
                    to: now
                    type: query
                    updated_at: '2020-04-07T14:51:09.970Z'
                    updated_by: elastic
                    version: 2
              schema:
                $ref: '#/components/schemas/Security_Detections_API_RuleResponse'
          description: Indicates a successful call.
      summary: Patch a detection rule
      tags:
        - Security Detections API
      x-metaTags:
        - content: Kibana
          name: product_name
    post:
      description: |
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/detection_engine/rules</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Create a new detection rule.
        > warn
        > When used with [API key](https://www.elastic.co/docs/deploy-manage/api-keys) authentication, the user's key gets assigned to the affected rules. If the user's key gets deleted or the user becomes inactive, the rules will stop running.

        > If the API key that is used for authorization has different privileges than the key that created or most recently updated the rule, the rule behavior might change.

        You can create the following types of rules:

        * **Custom query**: Searches the defined indices and creates an alert when a document matches the rule's KQL query.
        * **Event correlation**: Searches the defined indices and creates an alert when results match an [Event Query Language (EQL)](https://www.elastic.co/guide/en/elasticsearch/reference/current/eql.html) query.
        * **Threshold**: Searches the defined indices and creates an alert when the number of times the specified field's value meets the threshold during a single execution. When there are multiple values that meet the threshold, an alert is generated for each value.
          For example, if the threshold `field` is `source.ip` and its `value` is `10`, an alert is generated for every source IP address that appears in at least 10 of the rule's search results. If you're interested, see [Terms Aggregation](https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-bucket-terms-aggregation.html) for more information.
        * **Indicator match**: Creates an alert when fields match values defined in the specified [Elasticsearch index](https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-create-index.html). For example, you can create an index for IP addresses and use this index to create an alert whenever an event's `destination.ip` equals a value in the index. The index's field mappings should be [ECS-compliant](https://www.elastic.co/guide/en/ecs/current/ecs-reference.html).
        * **New terms**: Generates an alert for each new term detected in source documents within a specified time range.
        * **ES|QL**: Uses [Elasticsearch Query Language (ES|QL)](https://www.elastic.co/guide/en/elasticsearch/reference/current/esql.html) to find events and aggregate search results.
        * **Machine learning rules**: Creates an alert when a machine learning job discovers an anomaly above the defined threshold.
        > info
        > To create machine learning rules, you must have the [appropriate license](https://www.elastic.co/subscriptions) or use a [cloud deployment](https://cloud.elastic.co/registration). Additionally, for the machine learning rule to function correctly, the associated machine learning job must be running.

        To retrieve machine learning job IDs, which are required to create machine learning jobs, call the [Elasticsearch Get jobs API](https://www.elastic.co/guide/en/elasticsearch/reference/current/ml-get-job.html). Machine learning jobs that contain `siem` in the `groups` field can be used to create rules:

        ```json
        ...
        "job_id": "linux_anomalous_network_activity_ecs",
        "job_type": "anomaly_detector",
        "job_version": "7.7.0",
        "groups": [
          "auditbeat",
          "process",
          "siem"
        ],
        ...
        ```

        Additionally, you can set up notifications for when rules create alerts. The notifications use the [Alerting and Actions framework](https://www.elastic.co/docs/explore-analyze/alerting). Each action type requires a connector. Connectors store the information required to send notifications via external systems. The following connector types are supported for rule notifications:

        * Slack
        * Email
        * PagerDuty
        * Webhook
        * Microsoft Teams
        * IBM Resilient
        * Jira
        * ServiceNow ITSM
        > info
        > For more information on PagerDuty fields, see [Send a v2 Event](https://developer.pagerduty.com/docs/events-api-v2/trigger-events/).

        To retrieve connector IDs, which are required to configure rule notifications, call the [Find objects API](https://www.elastic.co/docs/api/doc/kibana/operation/operation-findsavedobjects) with `"type": "action"` in the request payload.

        For detailed information on Kibana actions and alerting, and additional API calls, see:

        * [Alerting API](https://www.elastic.co/docs/api/doc/kibana/group/endpoint-alerting)
        * [Alerting and Actions framework](https://www.elastic.co/docs/explore-analyze/alerting)
        * [Connectors API](https://www.elastic.co/docs/api/doc/kibana/group/endpoint-connectors)
      operationId: CreateRule
      requestBody:
        content:
          application/json:
            examples:
              example1:
                description: Query rule that searches for processes started by MS Office
                summary: Query rule
                value:
                  description: Process started by MS Office program - possible payload
                  enabled: false
                  filters:
                    - query:
                        match:
                          event.action:
                            query: 'Process Create (rule: ProcessCreate)'
                            type: phrase
                  from: now-70m
                  interval: 1h
                  language: kuery
                  name: MS Office child process
                  query: process.parent.name:EXCEL.EXE or process.parent.name:MSPUB.EXE or process.parent.name:OUTLOOK.EXE or process.parent.name:POWERPNT.EXE or process.parent.name:VISIO.EXE or process.parent.name:WINWORD.EXE
                  related_integrations:
                    - package: o365
                      version: ^2.3.2
                  required_fields:
                    - name: process.parent.name
                      type: keyword
                  risk_score: 50
                  rule_id: process_started_by_ms_office_program
                  severity: low
                  tags:
                    - child process
                    - ms office
                  type: query
              example2:
                description: Threshold rule that detects multiple failed login attempts to a Windows host from the same external source IP address
                summary: Threshold rule
                value:
                  description: Detects when there are 20 or more failed login attempts from the same IP address with a 2 minute time frame.
                  enabled: true
                  exceptions_list:
                    - id: int-ips
                      namespace_type: single
                      type: detection
                  from: now-180s
                  index:
                    - winlogbeat-*
                  interval: 2m
                  name: Windows server prml-19
                  query: host.name:prml-19 and event.category:authentication and event.outcome:failure
                  required_fields:
                    - name: source.ip
                      type: ip
                  risk_score: 30
                  rule_id: liv-win-ser-logins
                  severity: low
                  severity_mapping:
                    - field: source.geo.city_name
                      operator: equals
                      severity: low
                      value: Manchester
                    - field: source.geo.city_name
                      operator: equals
                      severity: medium
                      value: London
                    - field: source.geo.city_name
                      operator: equals
                      severity: high
                      value: Birmingham
                    - field: source.geo.city_name
                      operator: equals
                      severity: critical
                      value: Wallingford
                  tags:
                    - Brute force
                  threshold:
                    field: source.ip
                    value: 20
                  type: threshold
              example3:
                description: Machine learning rule that creates alerts, and sends Slack notifications, when the linux_anomalous_network_activity_ecs machine learning job discovers anomalies with a threshold of 70 or above.
                summary: Machine learning rule
                value:
                  actions:
                    - action_type_id: .slack
                      group: default
                      id: 5ad22cd5-5e6e-4c6c-a81a-54b626a4cec5
                      params:
                        message: 'Urgent: {{context.rule.description}}'
                  anomaly_threshold: 70
                  description: Generates alerts when the job discovers anomalies over 70
                  enabled: true
                  from: now-6m
                  interval: 5m
                  machine_learning_job_id: linux_anomalous_network_activity_ecs
                  name: Anomalous Linux network activity
                  note: Shut down the internet.
                  risk_score: 70
                  rule_id: ml_linux_network_high_threshold
                  setup: This rule requires data coming in from Elastic Defend.
                  severity: high
                  tags:
                    - machine learning
                    - Linux
                  type: machine_learning
              example4:
                description: Event correlation rule that creates alerts when the Windows rundll32.exe process makes unusual network connections
                summary: EQL rule
                value:
                  description: Unusual rundll32.exe network connection
                  language: eql
                  name: rundll32.exe network connection
                  query: sequence by process.entity_id with maxspan=2h [process where event.type in ("start", "process_started") and (process.name == "rundll32.exe" or process.pe.original_file_name == "rundll32.exe") and ((process.args == "rundll32.exe" and process.args_count == 1) or (process.args != "rundll32.exe" and process.args_count == 0))] [network where event.type == "connection" and (process.name == "rundll32.exe" or process.pe.original_file_name == "rundll32.exe")]
                  required_fields:
                    - name: event.type
                      type: keyword
                    - name: process.args
                      type: keyword
                    - name: process.args_count
                      type: long
                    - name: process.entity_id
                      type: keyword
                    - name: process.name
                      type: keyword
                    - name: process.pe.original_file_name
                      type: keyword
                  risk_score: 21
                  rule_id: eql-outbound-rundll32-connections
                  severity: low
                  tags:
                    - EQL
                    - Windows
                    - rundll32.exe
                  type: eql
              example5:
                description: |
                  Indicator match rule that creates an alert when one of the following is true: The event's destination IP address and port number matches destination IP and port values in the threat_index index; The event's source IP address matches a host IP address value in the threat_index index.
                summary: Indicator match rule
                value:
                  actions: []
                  description: Checks for bad IP addresses listed in the ip-threat-list index
                  index:
                    - packetbeat-*
                  name: Bad IP threat match
                  query: destination.ip:* or host.ip:*
                  required_fields:
                    - name: destination.ip
                      type: ip
                    - name: destination.port
                      type: long
                    - name: host.ip
                      type: ip
                  risk_score: 50
                  severity: medium
                  threat_index:
                    - ip-threat-list
                  threat_mapping:
                    - entries:
                        - field: destination.ip
                          type: mapping
                          value: destination.ip
                        - field: destination.port
                          type: mapping
                          value: destination.port
                    - entries:
                        - field: source.ip
                          type: mapping
                          value: host.ip
                  threat_query: '*:*'
                  type: threat_match
              example6:
                description: New terms rule that creates alerts a new IP address is detected for a user
                summary: New terms rule
                value:
                  description: Detects a user associated with a new IP address
                  history_window_start: now-30d
                  index:
                    - auditbeat*
                  language: kuery
                  name: New User IP Detected
                  new_terms_fields:
                    - user.id
                    - source.ip
                  query: '*'
                  required_fields:
                    - name: user.id
                      type: keyword
                    - name: source.ip
                      type: ip
                  risk_score: 21
                  severity: medium
                  type: new_terms
              example7:
                description: esql rule that creates alerts from events that match an Excel parent process
                summary: Esql rule
                value:
                  description: Find Excel events
                  enabled: false
                  from: now-360s
                  interval: 5m
                  language: esql
                  name: Find Excel events
                  query: from auditbeat-8.10.2 METADATA _id, _version, _index | where process.parent.name == "EXCEL.EXE"
                  required_fields:
                    - name: process.parent.name
                      type: keyword
                  risk_score: 21
                  severity: low
                  tags: []
                  to: now
                  type: esql
              example8:
                description: Query rule that searches for processes started by MS Office and suppresses alerts by the process.parent.name field within a 5-hour time period
                summary: Query rule 2
                value:
                  alert_suppression:
                    duration:
                      unit: h
                      value: 5
                    group_by:
                      - process.parent.name
                    missing_fields_strategy: suppress
                  description: Process started by MS Office program - possible payload
                  enabled: false
                  filters:
                    - query:
                        match:
                          event.action:
                            query: 'Process Create (rule: ProcessCreate)'
                            type: phrase
                  from: now-70m
                  interval: 1h
                  language: kuery
                  name: MS Office child process
                  query: process.parent.name:EXCEL.EXE or process.parent.name:MSPUB.EXE or process.parent.name:OUTLOOK.EXE or process.parent.name:POWERPNT.EXE or process.parent.name:VISIO.EXE or process.parent.name:WINWORD.EXE
                  risk_score: 50
                  rule_id: process_started_by_ms_office_program
                  severity: low
                  tags:
                    - child process
                    - ms office
                  type: query
            schema:
              $ref: '#/components/schemas/Security_Detections_API_RuleCreateProps'
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                example1:
                  description: Example response for a query rule
                  summary: Query rule response
                  value:
                    actions: []
                    created_at: '2020-04-07T14:51:09.755Z'
                    created_by: elastic
                    description: Process started by MS Office program - possible payload
                    enabled: false
                    false_positives: []
                    filters:
                      - query:
                          match:
                            event.action:
                              query: 'Process Create (rule: ProcessCreate)'
                              type: phrase
                    from: now-70m
                    id: 6541b99a-dee9-4f6d-a86d-dbd1869d73b1
                    immutable: false
                    interval: 1h
                    language: kuery
                    max_signals: 100
                    name: MS Office child process
                    query: process.parent.name:EXCEL.EXE or process.parent.name:MSPUB.EXE or process.parent.name:OUTLOOK.EXE or process.parent.name:POWERPNT.EXE or process.parent.name:VISIO.EXE or process.parent.name:WINWORD.EXE
                    references: []
                    related_integrations:
                      - package: o365
                        version: ^2.3.2
                      - integration: graphactivitylogs
                        package: azure
                        version: ^1.11.4
                    required_fields:
                      - ecs: true
                        name: process.parent.name
                        type: keyword
                    risk_score: 50
                    rule_id: process_started_by_ms_office_program
                    setup: ''
                    severity: low
                    tags:
                      - child process
                      - ms office
                    threat: []
                    to: now
                    type: query
                    updated_at: '2020-04-07T14:51:09.970Z'
                    updated_by: elastic
                    version: 1
                example2:
                  description: Example response for a machine learning job rule
                  summary: Machine learning response
                  value:
                    actions:
                      - action_type_id: .slack
                        frequency:
                          notifyWhen: onActiveAlert
                          summary: true
                          throttle: null
                        group: default
                        id: 5ad22cd5-5e6e-4c6c-a81a-54b626a4cec5
                        params:
                          message: 'Urgent: {{context.rule.description}}'
                    anomaly_threshold: 70
                    created_at: '2020-04-07T14:45:15.679Z'
                    created_by: elastic
                    description: Generates alerts when the job discovers anomalies over 70
                    enabled: true
                    false_positives: []
                    from: now-6m
                    id: 83876f66-3a57-4a99-bf37-416494c80f3b
                    immutable: false
                    interval: 5m
                    machine_learning_job_id: linux_anomalous_network_activity_ecs
                    max_signals: 100
                    name: Anomalous Linux network activity
                    note: Shut down the internet.
                    references: []
                    related_integrations: []
                    required_fields: []
                    risk_score: 70
                    rule_id: ml_linux_network_high_threshold
                    setup: ''
                    severity: high
                    status: going to run
                    status_date: '2020-04-07T14:45:21.685Z'
                    tags:
                      - machine learning
                      - Linux
                    threat: []
                    to: now
                    type: machine_learning
                    updated_at: '2020-04-07T14:45:15.892Z'
                    updated_by: elastic
                    version: 1
                example3:
                  description: Example response for a threshold rule
                  summary: Threshold rule response
                  value:
                    actions: []
                    author: []
                    created_at: '2020-07-22T10:27:23.486Z'
                    created_by: elastic
                    description: Detects when there are 20 or more failed login attempts from the same IP address with a 2 minute time frame.
                    enabled: true
                    exceptions_list:
                      - id: int-ips
                        namespace_type: single
                        type: detection
                    false_positives: []
                    from: now-180s
                    id: 15dbde26-b627-4d74-bb1f-a5e0ed9e4993
                    immutable: false
                    index:
                      - winlogbeat-*
                    interval: 2m
                    language: kuery
                    max_signals: 100
                    name: Windows server prml-19
                    query: host.name:prml-19 and event.category:authentication and event.outcome:failure
                    references: []
                    related_integrations:
                      - package: o365
                        version: ^2.3.2
                    required_fields:
                      - ecs: true
                        name: source.ip
                        type: ip
                    risk_score: 30
                    risk_score_mapping: []
                    rule_id: liv-win-ser-logins
                    setup: ''
                    severity: low
                    severity_mapping:
                      - field: source.geo.city_name
                        operator: equals
                        severity: low
                        value: Manchester
                      - field: source.geo.city_name
                        operator: equals
                        severity: medium
                        value: London
                      - field: source.geo.city_name
                        operator: equals
                        severity: high
                        value: Birmingham
                      - field: source.geo.city_name
                        operator: equals
                        severity: critical
                        value: Wallingford
                    tags:
                      - Brute force
                    threat: []
                    threshold:
                      field: source.ip
                      value: 20
                    to: now
                    type: threshold
                    updated_at: '2020-07-22T10:27:23.673Z'
                    updated_by: elastic
                    version: 1
                example4:
                  description: Example response for an EQL rule
                  summary: EQL rule response
                  value:
                    author: []
                    created_at: '2020-10-05T09:06:16.392Z'
                    created_by: elastic
                    description: Unusual rundll32.exe network connection
                    enabled: true
                    exceptions_list: []
                    false_positives: []
                    from: now-6m
                    id: 93808cae-b05b-4dc9-8479-73574b50f8b1
                    immutable: false
                    interval: 5m
                    language: eql
                    max_signals: 100
                    name: rundll32.exe network connection
                    query: sequence by process.entity_id with maxspan=2h [process where event.type in ("start", "process_started") and (process.name == "rundll32.exe" or process.pe.original_file_name == "rundll32.exe") and ((process.args == "rundll32.exe" and process.args_count == 1) or (process.args != "rundll32.exe" and process.args_count == 0))] [network where event.type == "connection" and (process.name == "rundll32.exe" or process.pe.original_file_name == "rundll32.exe")]
                    references: []
                    related_integrations:
                      - package: o365
                        version: ^2.3.2
                    required_fields:
                      - ecs: true
                        name: event.type
                        type: keyword
                      - ecs: true
                        name: process.args
                        type: keyword
                      - ecs: true
                        name: process.args_count
                        type: long
                      - ecs: true
                        name: process.entity_id
                        type: keyword
                      - ecs: true
                        name: process.name
                        type: keyword
                      - ecs: true
                        name: process.pe.original_file_name
                        type: keyword
                    risk_score: 21
                    risk_score_mapping: []
                    rule_id: eql-outbound-rundll32-connections
                    setup: ''
                    severity: low
                    severity_mapping: []
                    tags:
                      - EQL
                      - Windows
                      - rundll32.exe
                    threat: []
                    throttle: no_actions
                    to: now
                    type: eql
                    updated_at: '2020-10-05T09:06:16.403Z'
                    updated_by: elastic
                    version: 1
                example5:
                  description: Example response for an indicator match rule
                  summary: Indicator match rule response
                  value:
                    author: []
                    created_at: '2020-10-06T07:07:58.227Z'
                    created_by: elastic
                    description: Checks for bad IP addresses listed in the ip-threat-list index
                    enabled: true
                    exceptions_list: []
                    false_positives: []
                    from: now-6m
                    id: d5daa13f-81fb-4b13-be2f-31011e1d9ae1
                    immutable: false
                    index:
                      - packetbeat-*
                    interval: 5m
                    language: kuery
                    max_signals: 100
                    name: Bad IP threat match
                    query: destination.ip:* or host.ip:*
                    references: []
                    related_integrations:
                      - package: o365
                        version: ^2.3.2
                    required_fields:
                      - ecs: true
                        name: destination.ip
                        type: ip
                      - ecs: true
                        name: destination.port
                        type: long
                      - ecs: true
                        name: host.ip
                        type: ip
                    risk_score: 50
                    risk_score_mapping: []
                    rule_id: 608501e4-c768-4f64-9326-cec55b5d439b
                    setup: ''
                    severity: medium
                    severity_mapping: []
                    tags: []
                    threat: []
                    threat_index:
                      - ip-threat-list
                    threat_mapping:
                      - entries:
                          - field: destination.ip
                            type: mapping
                            value: destination.ip
                          - field: destination.port
                            type: mapping
                            value: destination.port
                      - entries:
                          - field: source.ip
                            type: mapping
                            value: host.ip
                    threat_query: '*:*'
                    to: now
                    type: threat_match
                    updated_at: '2020-10-06T07:07:58.237Z'
                    updated_by: elastic
                    version: 1
                example6:
                  description: Example response for a new terms rule
                  summary: New terms rule response
                  value:
                    author: []
                    created_at: '2020-10-06T07:07:58.227Z'
                    created_by: elastic
                    description: Detects a user associated with a new IP address
                    enabled: true
                    exceptions_list: []
                    false_positives: []
                    from: now-6m
                    history_window_start: now-30d
                    id: eb7225c0-566b-11ee-8b4f-bbf3afdeb9f4
                    immutable: false
                    index:
                      - auditbeat*
                    interval: 5m
                    language: kuery
                    max_signals: 100
                    name: New User IP Detected
                    new_terms_fields:
                      - user.id
                      - source.ip
                    query: '*'
                    references: []
                    related_integrations:
                      - package: o365
                        version: ^2.3.2
                    required_fields:
                      - ecs: true
                        name: user.id
                        type: keyword
                      - ecs: true
                        name: source.ip
                        type: ip
                    risk_score: 21
                    risk_score_mapping: []
                    rule_id: c6f5d0bc-7be9-47d4-b2f3-073d22641e30
                    setup: ''
                    severity: medium
                    severity_mapping: []
                    tags: []
                    threat: []
                    to: now
                    type: new_terms
                    updated_at: '2020-10-06T07:07:58.237Z'
                    updated_by: elastic
                    version: 1
                example7:
                  description: Example response for an Esql rule
                  summary: Esql rule response
                  value:
                    actions: []
                    author: []
                    created_at: '2023-10-18T10:55:14.269Z'
                    created_by: elastic
                    description: Find Excel events
                    enabled: false
                    exceptions_list: []
                    false_positives: []
                    from: now-360s
                    id: d0f20490-6da4-11ee-b85e-09e9b661f2e2
                    immutable: false
                    interval: 5m
                    language: esql
                    max_signals: 100
                    name: Find Excel events
                    output_index: ''
                    query: from auditbeat-8.10.2 METADATA _id | where process.parent.name == "EXCEL.EXE"
                    references: []
                    related_integrations:
                      - package: o365
                        version: ^2.3.2
                    required_fields:
                      - ecs: true
                        name: process.parent.name
                        type: keyword
                    revision: 0
                    risk_score: 21
                    risk_score_mapping: []
                    rule_id: e4b53a89-debd-4a0d-a3e3-20606952e589
                    setup: ''
                    severity: low
                    severity_mapping: []
                    tags: []
                    threat: []
                    to: now
                    type: esql
                    updated_at: '2023-10-18T10:55:14.269Z'
                    updated_by: elastic
                    version: 1
              schema:
                $ref: '#/components/schemas/Security_Detections_API_RuleResponse'
          description: Indicates a successful call.
      summary: Create a detection rule
      tags:
        - Security Detections API
      x-metaTags:
        - content: Kibana
          name: product_name
    put:
      description: |
        **Spaces method and path for this operation:**

        <div><span class="operation-verb put">put</span>&nbsp;<span class="operation-path">/s/{space_id}/api/detection_engine/rules</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Update a detection rule using the `rule_id` or `id` field. The original rule is replaced, and all unspecified fields are deleted.

        The difference between the `id` and `rule_id` is that the `id` is a unique rule identifier that is randomly generated when a rule is created and cannot be set, whereas `rule_id` is a stable rule identifier that can be assigned during rule creation.
        > warn
        > When used with [API key](https://www.elastic.co/docs/deploy-manage/api-keys) authentication, the user's key gets assigned to the affected rules. If the user's key gets deleted or the user becomes inactive, the rules will stop running.

        > If the API key that is used for authorization has different privileges than the key that created or most recently updated the rule, the rule behavior might change.
      operationId: UpdateRule
      requestBody:
        content:
          application/json:
            examples:
              example1:
                summary: Update query rule
                value:
                  description: A new description
                  id: 14b7b513-3d8d-4b22-b7da-a7ae632f7e76
                  name: A new name for the rule
                  risk_score: 22
                  severity: medium
                  type: query
              example2:
                summary: Update EQL rule
                value:
                  description: eql rule test
                  id: 9b684efb-acf9-4323-9bff-8335b3867d14
                  index:
                    - apm-*-transaction*
                  language: eql
                  name: New name for EQL rule
                  query: process where process.name == "regsvr32.exe"
                  risk_score: 21
                  severity: low
                  type: eql
              example3:
                summary: Update threshold rule
                value:
                  description: Description of threat rule test
                  id: 005d2c4f-51ca-493d-a2bd-20ef076339b1
                  language: kuery
                  name: New name for threat rule
                  query: 'agent.version : * and agent.id : "243d9b4f-ca01-4311-8e5c-9abbee91afd8"'
                  risk_score: 21
                  severity: low
                  tags:
                    - new_tag
                  threshold:
                    cardinality: []
                    field: []
                    value: 400
                  type: threshold
              example4:
                summary: Update new terms rule
                value:
                  description: New description
                  history_window_start: now-7d
                  id: 569aac91-40dc-4807-a8ae-a2c8698089c4
                  interval: 5m
                  name: New terms rule name
                  new_terms_fields:
                    - Endpoint.policy.applied.artifacts.global.identifiers.name
                  query: 'agent.version : "9.1.0"'
                  risk_score: 21
                  severity: low
                  type: new_terms
              example5:
                summary: Update esql rule
                value:
                  description: New description for esql rule
                  id: 0b15e8a2-49b6-47e0-a8e6-d63a6cc335bd
                  language: esql
                  name: New name for esql rule
                  query: |
                    FROM logs*
                    | STATS count = COUNT(*), min_timestamp = MIN(@timestamp) /* MIN(dateField) finds the earliest timestamp in the dataset. */
                    | EVAL event_rate = count / DATE_DIFF("seconds", min_timestamp, NOW()) /* Calculates the event rate by dividing the total count of events by the time difference (in seconds) between the earliest event and the current time. */
                    | KEEP event_rate
                  risk_score: 21
                  severity: low
                  type: esql
              example6:
                summary: Update indicator match rule
                value:
                  description: New description
                  id: 462f1986-10fe-40a3-a22c-2b1c9c4c48fd
                  name: New name for Indicator Match rule
                  query: source.ip:* or destination.ip:*\n
                  risk_score: 99
                  severity: critical
                  threat_index:
                    - filebeat-*
                    - logs-ti_*
                  threat_mapping:
                    - entries:
                        - field: source.ip
                          type: mapping
                          value: threat.indicator.ip
                    - entries:
                        - field: destination.ip
                          type: mapping
                          value: threat.indicator.ip
                  threat_query: '@timestamp >= "now-30d/d" and event.module:(threatintel or ti_*) and threat.indicator.ip:* and not labels.is_ioc_transform_source:"true"'
                  type: threat_match
              example7:
                summary: Update machine learning rule
                value:
                  anomaly_threshold: 50
                  description: New description of ml rule
                  id: 60b13926-289b-41b1-a537-197ef1fa5059
                  machine_learning_job_id:
                    - auth_high_count_logon_events_ea
                  name: New name of ml rule
                  risk_score: 21
                  severity: low
                  type: machine_learning
            schema:
              $ref: '#/components/schemas/Security_Detections_API_RuleUpdateProps'
        description: |
          > info
          > All unspecified fields are deleted. You cannot modify the `id` or `rule_id` values.
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                example1:
                  summary: Example response for an updated rule
                  value:
                    actions: []
                    created_at: '2020-04-07T14:51:09.755Z'
                    created_by: elastic
                    description: Updated description for the rule.
                    enabled: false
                    false_positives: []
                    filters:
                      - query: null
                    from: now-70m
                    id: 6541b99a-dee9-4f6d-a86d-dbd1869d73b1
                    immutable: false
                    interval: 1h
                    language: kuery
                    max_signals: 100
                    name: Updated Rule Name
                    query: process.parent.name:EXCEL.EXE or process.parent.name:MSPUB.EXE or process.parent.name:OUTLOOK.EXE or process.parent.name:POWERPNT.EXE or process.parent.name:VISIO.EXE or process.parent.name:WINWORD.EXE
                    references: []
                    related_integrations:
                      - package: o365
                    required_fields:
                      - name: process.parent.name
                    risk_score: 50
                    rule_id: process_started_by_ms_office_program
                    setup: ''
                    severity: low
                    tags:
                      - child process
                      - ms office
                    threat: []
                    to: now
                    type: query
                    updated_at: '2020-04-07T14:51:09.970Z'
                    updated_by: elastic
                    version: 2
              schema:
                $ref: '#/components/schemas/Security_Detections_API_RuleResponse'
          description: Indicates a successful call.
      summary: Update a detection rule
      tags:
        - Security Detections API
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/detection_engine/rules/_bulk_action:
    post:
      description: |
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/detection_engine/rules/_bulk_action</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Apply a bulk action, such as bulk edit, duplicate, or delete, to multiple detection rules. The bulk action is applied to all rules that match the query or to the rules listed by their IDs.

        The edit action allows you to add, delete, or set tags, index patterns, investigation fields, rule actions and schedules for multiple rules at once. 
        The edit action is idempotent, meaning that if you add a tag to a rule that already has that tag, no changes are made. The same is true for other edit actions, for example removing an index pattern that is not specified in a rule will not result in any changes. The only exception is the `add_rule_actions` and `set_rule_actions` action, which is non-idempotent. This means that if you add or set a rule action to a rule that already has that action, a new action is created with a new unique ID.
        > warn
        > When used with [API key](https://www.elastic.co/docs/deploy-manage/api-keys) authentication, the user's key gets assigned to the affected rules. If the user's key gets deleted or the user becomes inactive, the rules will stop running.

        > If the API key that is used for authorization has different privileges than the key that created or most recently updated the rule, the rule behavior might change.
      operationId: PerformRulesBulkAction
      parameters:
        - description: |
            Enables dry run mode for the request call.

            Enable dry run mode to verify that bulk actions can be applied to specified rules. Certain rules, such as prebuilt Elastic rules on a Basic subscription, can’t be edited and will return errors in the request response. Error details will contain an explanation, the rule name and/or ID, and additional troubleshooting information.

            To enable dry run mode on a request, add the query parameter `dry_run=true` to the end of the request URL. Rules specified in the request will be temporarily updated. These updates won’t be written to Elasticsearch.
            > info
            > Dry run mode is not supported for the `export` bulk action. A 400 error will be returned in the request response.
          in: query
          name: dry_run
          required: false
          schema:
            type: boolean
      requestBody:
        content:
          application/json:
            examples:
              example01:
                description: The following request activates all rules with the test tag.
                summary: Enable - Enable all rules with the test tag
                value:
                  action: enable
                  query: 'alert.attributes.tags: "test"'
              example02:
                description: The following request enables the rule with the specified ID.
                summary: Enable - Enable a specific rule by ID.
                value:
                  action: enable
                  ids:
                    - 748694f0-6977-4ea5-8384-cd2e39730779
              example03:
                description: The following request disables the rule with the specified ID.
                summary: Disable - Disable a specific rule by ID
                value:
                  action: disable
                  ids:
                    - 748694f0-6977-4ea5-8384-cd2e39730779
              example04:
                description: The following request duplicates rules with the specified IDs, including exceptions but not expired exceptions.
                summary: Duplicate - Duplicate rules with specific IDs
                value:
                  action: duplicate
                  duplicate:
                    include_exceptions: true
                    include_expired_exceptions: false
                  ids:
                    - 748694f0-6977-4ea5-8384-cd2e39730779
                    - 461a4c22-416e-4009-a9a7-cf79656454bf
              example05:
                description: The following request deletes the rule with the specified ID.
                summary: Delete - Delete a specific rule by ID
                value:
                  action: delete
                  ids:
                    - cf4abfd1-7c37-4519-ab0f-5ea5c75fac60
              example06:
                description: The following request runs the rule with the specified ID within the given date range.
                summary: Run - Run a specific rule by ID
                value:
                  action: run
                  ids:
                    - 748694f0-6977-4ea5-8384-cd2e39730779
                  run:
                    end_date: '2025-03-10T23:59:59.999Z'
                    start_date: '2025-03-01T00:00:00.000Z'
              example07:
                description: The following request exports the rules with the specified IDs.
                summary: Export - Export specific rules by ID
                value:
                  action: export
                  ids:
                    - 748694f0-6977-4ea5-8384-cd2e39730779
              example08:
                description: The following request will validate that the add_index_patterns bulk action can be successfully applied to three rules. The dry_run parameter is specified in query parameters, e.g. POST api/detection_engine/rules/_bulk_action?dry_run=true
                summary: Edit - dry run - Validate add_index_patterns bulk action
                value:
                  action: edit
                  edit:
                    - type: add_index_patterns
                      value:
                        - test-*
                  ids:
                    - 81aa0480-06af-11ed-94fb-dd1a0597d8d2
                    - dc015d10-0831-11ed-ac8b-05a222bd8d4a
                    - de8f5af0-0831-11ed-ac8b-05a222bd8d4a
              example09:
                description: The following request adds the tag "tag-1" to the rules with the specified IDs. If the tag already exists for a rule, no changes are made.
                summary: Edit - Add a tag to rules (idempotent)
                value:
                  action: edit
                  edit:
                    - type: add_tags
                      value:
                        - tag-1
                  ids:
                    - 8bc7dad0-9320-11ec-9265-8b772383a08d
                    - 8e5c1a40-9320-11ec-9265-8b772383a08d
              example10:
                description: The following request adds two tags at the same time, tag-1 and tag-2, to the rules that have the IDs sent in the payload. If the tags already exist for a rule, no changes are made.
                summary: Edit - Add two tags to rules (idempotent)
                value:
                  action: edit
                  edit:
                    - type: add_tags
                      value:
                        - tag-1
                        - tag-2
                  ids:
                    - 8bc7dad0-9320-11ec-9265-8b772383a08d
                    - 8e5c1a40-9320-11ec-9265-8b772383a08d
              example11:
                description: The following request removes the tag "tag-1" from the rules with the specified IDs. If the tag does not exist for a rule, no changes are made.
                summary: Edit - Delete a tag from rules (idempotent)
                value:
                  action: edit
                  edit:
                    - type: delete_tags
                      value:
                        - tag-1
                  ids:
                    - 8bc7dad0-9320-11ec-9265-8b772383a08d
                    - 8e5c1a40-9320-11ec-9265-8b772383a08d
              example12:
                description: The following request sets the tags "tag-1" and "tag-2" for the rules with the specified IDs, overwriting any existing tags. If the set of tags is the same as the existing tags, no changes are made.
                summary: Edit - Set (overwrite existing) tags for rules (idempotent)
                value:
                  action: edit
                  edit:
                    - type: set_tags
                      value:
                        - tag-1
                        - tag-2
                  ids:
                    - 8bc7dad0-9320-11ec-9265-8b772383a08d
                    - 8e5c1a40-9320-11ec-9265-8b772383a08d
              example13:
                description: The following request adds the index pattern "test-*" to the rules with the specified IDs. If the index pattern already exists for a rule, no changes are made.
                summary: Edit - Add index patterns to rules (idempotent)
                value:
                  action: edit
                  edit:
                    - type: add_index_patterns
                      value:
                        - test-*
                  ids:
                    - 81aa0480-06af-11ed-94fb-dd1a0597d8d2
                    - dc015d10-0831-11ed-ac8b-05a222bd8d4a
              example14:
                description: The following request removes the index pattern "test-*" from the rules with the specified IDs. If the index pattern does not exist for a rule, no changes are made.
                summary: Edit - Remove index patterns from rules (idempotent)
                value:
                  action: edit
                  edit:
                    - type: delete_index_patterns
                      value:
                        - test-*
                  ids:
                    - 81aa0480-06af-11ed-94fb-dd1a0597d8d2
                    - dc015d10-0831-11ed-ac8b-05a222bd8d4a
              example15:
                description: The following request sets the index patterns "test-*" and "prod-*" for the rules with the specified IDs, overwriting any existing index patterns. If the set of index patterns is the same as the existing index patterns, no changes are made.
                summary: Edit - Set (overwrite existing) index patterns for rules patterns (idempotent)
                value:
                  action: edit
                  edit:
                    - type: set_index_patterns
                      value:
                        - test-*
                  ids:
                    - 81aa0480-06af-11ed-94fb-dd1a0597d8d2
                    - dc015d10-0831-11ed-ac8b-05a222bd8d4a
              example16:
                description: The following request adds investigation field to the rules with the specified IDs.
                summary: Edit - Add investigation field to rules
                value:
                  action: edit
                  edit:
                    - type: add_investigation_fields
                      value:
                        field_names:
                          - alert.status
                  ids:
                    - 12345678-1234-1234-1234-1234567890ab
                    - 87654321-4321-4321-4321-0987654321ba
              example17:
                description: The following request deletes investigation fields from the rules with the specified IDs. If the field does not exist for a rule, no changes are made.
                summary: Edit - Delete investigation fields from rules (idempotent)
                value:
                  action: edit
                  edit:
                    - type: delete_investigation_fields
                  ids:
                    - 12345678-1234-1234-1234-1234567890ab
                    - 87654321-4321-4321-4321-0987654321ba
                  value:
                    - field1
                    - field2
              example18:
                description: The following request sets investigation fields for the rules with the specified IDs, overwriting any existing investigation fields. If the set of investigation fields is the same as the existing investigation fields, no changes are made.
                summary: Edit - Set (overwrite existing) investigation fields for rules (idempotent)
                value:
                  action: edit
                  edit:
                    - type: set_investigation_fields
                      value:
                        - field1
                        - field2
                  ids:
                    - 12345678-1234-1234-1234-1234567890ab
                    - 87654321-4321-4321-4321-0987654321ba
              example19:
                description: The following request sets a timeline template for the rules with the specified IDs. If the same timeline template is already set for a rule, no changes are made.
                summary: Edit - Set (overwrite existing) timeline template for rules (idempotent)
                value:
                  action: edit
                  edit:
                    - type: set_timeline
                      value:
                        timeline_id: 3e827bab-838a-469f-bd1e-5e19a2bff2fd
                        timeline_title: Alerts Involving a Single User Timeline
                  ids:
                    - eacdfc95-e007-41c9-986e-4b2cbdfdc71b
              example20:
                description: The following request sets a schedule for the rules with the specified IDs. If the same schedule is already set for a rule, no changes are made.
                summary: Edit - Set (overwrite existing) schedule for rules (idempotent)
                value:
                  action: edit
                  edit:
                    - type: set_schedule
                      value:
                        interval: 1h
                        lookback: 30m
                  ids:
                    - 99887766-5544-3322-1100-aabbccddeeff
              example21:
                description: The following request adds rule actions to the rules with the specified IDs. Each new action receives its own unique ID.
                summary: Edit - Add rule actions to rules (non-idempotent)
                value:
                  action: edit
                  edit:
                    - type: add_rule_actions
                      value:
                        actions:
                          - group: default
                            id: 20fbf986-a270-460e-80f3-7b83c08b430f
                            params:
                              body: The message body
                  ids:
                    - 9e946bfc-3118-4c77-bb25-67d781191928
              example22:
                description: The following request sets rule actions for the rules with the specified IDs. Each action receives its own unique ID.
                summary: Edit - Set (overwrite existing) rule actions for rules (non-idempotent)
                value:
                  action: edit
                  edit:
                    - type: set_rule_actions
                      value:
                        actions:
                          - group: default
                            id: 20fbf986-a270-460e-80f3-7b83c08b430f
                            params:
                              body: The message body
                  ids:
                    - 9e946bfc-3118-4c77-bb25-67d781191928
              example23:
                description: The following request adds rule actions to the rules with the specified IDs. Each new action receives its own unique ID.
                summary: Edit - Add rule actions to rules for a webhook connector
                value:
                  action: edit
                  edit:
                    - type: add_rule_actions
                      value:
                        actions:
                          - group: default3
                            id: 20fbf986-a270-460e-80f3-7b83c08b430f
                            params:
                              body: The message body
                  ids:
                    - 9e946bfc-3118-4c77-bb25-67d781191921
              example24:
                description: The following request adds rule actions to the rules with the specified IDs. Each new action receives its own unique ID.
                summary: Edit - Add rule actions to rules for an email connector
                value:
                  action: edit
                  edit:
                    - type: add_rule_actions
                      value:
                        actions:
                          - group: default3
                            id: 20fbf986-a270-460e-80f3-7b83c08b430f
                            params:
                              message: The message body
                              subject: Subject
                              to: address@domain.com
                  ids:
                    - 9e946bfc-3118-4c77-bb25-67d781191921
              example25:
                description: The following request adds rule actions to the rules with the specified IDs. Each new action receives its own unique ID.
                summary: Edit - Add rule actions to rules for a slack connector
                value:
                  action: edit
                  edit:
                    - type: add_rule_actions
                      value:
                        actions:
                          - group: default3
                            id: 20fbf986-a270-460e-80f3-7b83c08b430f
                            params:
                              message: The content of the message
                  ids:
                    - 9e946bfc-3118-4c77-bb25-67d781191921
              example26:
                description: The following request adds rule actions to the rules with the specified IDs. Each new action receives its own unique ID.
                summary: Edit - Add rule actions to rules for a PagerDuty connector
                value:
                  action: edit
                  edit:
                    - type: add_rule_actions
                      value:
                        actions:
                          - group: default3
                            id: 20fbf986-a270-460e-80f3-7b83c08b430f
                            params:
                              eventAction: trigger
                              severity: critical
                              summary: The message body
                              timestamp: '2023-10-31T00:00:00Z'
                  ids:
                    - 9e946bfc-3118-4c77-bb25-67d781191921
              example27:
                description: The following request set alert suppression to the rules with the specified IDs.
                summary: Edit - Set alert suppression to rules (idempotent)
                value:
                  action: edit
                  edit:
                    - type: set_alert_suppression
                      value:
                        duration:
                          unit: h
                          value: 1
                        group_by:
                          - source.ip
                        missing_fields_strategy: suppress
                  ids:
                    - 12345678-1234-1234-1234-1234567890ab
                    - 87654321-4321-4321-4321-0987654321ba
              example28:
                description: The following request set alert suppression to threshold rules with the specified IDs.
                summary: Edit - Set alert suppression to threshold rules (idempotent)
                value:
                  action: edit
                  edit:
                    - type: set_alert_suppression_for_threshold
                      value:
                        duration:
                          unit: h
                          value: 1
                  ids:
                    - 12345678-1234-1234-1234-1234567890ab
                    - 87654321-4321-4321-4321-0987654321ba
              example29:
                description: The following request removes alert suppression from the rules with the specified IDs. If the rules do not have alert suppression, no changes are made.
                summary: Edit - Removes alert suppression from rules (idempotent)
                value:
                  action: edit
                  edit:
                    - type: delete_alert_suppression
                  ids:
                    - 12345678-1234-1234-1234-1234567890ab
                    - 87654321-4321-4321-4321-0987654321ba
              example30:
                description: The following request triggers the filling of gaps for the specified rule ids and time range
                summary: Fill Gaps - Manually trigger the filling of gaps for specified rules
                value:
                  action: fill_gaps
                  ids:
                    - 748694f0-6977-4ea5-8384-cd2e39730779
                    - 164d0918-f720-4c9f-9f5c-c5122587cf19
                  run:
                    end_date: '2025-03-10T23:59:59.999Z'
                    start_date: '2025-03-01T00:00:00.000Z'
            schema:
              oneOf:
                - $ref: '#/components/schemas/Security_Detections_API_BulkDeleteRules'
                - $ref: '#/components/schemas/Security_Detections_API_BulkDisableRules'
                - $ref: '#/components/schemas/Security_Detections_API_BulkEnableRules'
                - $ref: '#/components/schemas/Security_Detections_API_BulkExportRules'
                - $ref: '#/components/schemas/Security_Detections_API_BulkDuplicateRules'
                - $ref: '#/components/schemas/Security_Detections_API_BulkManualRuleRun'
                - $ref: '#/components/schemas/Security_Detections_API_BulkManualRuleFillGaps'
                - $ref: '#/components/schemas/Security_Detections_API_BulkEditRules'
      responses:
        '200':
          content:
            application/json:
              examples:
                example01:
                  description: In this response one rule was updated and one was skipped. Objects returned in attributes.results.skipped will only include rules' id, name, and skip_reason.
                  summary: Successful response
                  value:
                    attributes:
                      results:
                        created: []
                        deleted: []
                        skipped:
                          - id: 51658332-a15e-4c9e-912a-67214e2e2359
                            name: Skipped rule
                            skip_reason: RULE_NOT_MODIFIED
                        updated:
                          - anomaly_threshold: 50
                            author:
                              - Elastic
                            created_at: '2022-02-21T14:14:13.801Z'
                            created_by: elastic
                            description: A machine learning job detected unusually large numbers of DNS queries for a single top-level DNS domain, which is often used for DNS tunneling. DNS tunneling can be used for command-and-control, persistence, or data exfiltration activity. For example, dnscat tends to generate many DNS questions for a top-level domain as it uses the DNS protocol to tunnel data.
                            enabled: true
                            exceptions_list: []
                            execution_summary:
                              last_execution:
                                date: '2022-03-23T16:06:12.787Z'
                                message: This rule attempted to query data from Elasticsearch indices listed in the "Index pattern" section of the rule definition, but no matching index was found.
                                metrics:
                                  execution_gap_duration_s: 0
                                  total_indexing_duration_ms: 15
                                  total_search_duration_ms: 135
                                status: partial failure
                                status_order: 20
                            false_positives:
                              - DNS domains that use large numbers of child domains, such as software or content distribution networks, can trigger this alert and such parent domains can be excluded.
                            from: now-45m
                            id: 8bc7dad0-9320-11ec-9265-8b772383a08d
                            immutable: false
                            interval: 15m
                            license: Elastic License v2
                            machine_learning_job_id:
                              - dns_tunneling_ea
                            max_signals: 100
                            name: DNS Tunneling [Duplicate]
                            references:
                              - https://www.elastic.co/docs/reference/machine-learning/ootb-ml-jobs-siem
                            related_integrations: []
                            required_fields: []
                            risk_score: 21
                            risk_score_mapping: []
                            rule_id: 7289bf08-4e91-4c70-bf01-e04c4c5d7756
                            setup: ''
                            severity: low
                            severity_mapping: []
                            tags:
                              - Elastic
                              - Network
                              - Threat Detection
                              - ML
                            threat: []
                            to: now
                            type: machine_learning
                            updated_at: '2022-02-21T17:05:50.883Z'
                            updated_by: elastic
                            version: 6
                      summary:
                        failed: 0
                        skipped: 1
                        succeeded: 1
                        total: 2
                    rules_count: 1
                    success: true
                example02:
                  description: If processing of any rule fails, a partial error outputs the ID and/or name of the affected rule and the corresponding error, as well as successfully processed rules (in the same format as a successful 200 request).
                  summary: Partial failure
                  value:
                    value:
                      attributes:
                        errors:
                          - message: Index patterns can't be added. Machine learning rule doesn't have index patterns property
                            rules:
                              - id: 8bc7dad0-9320-11ec-9265-8b772383a08d
                                name: DNS Tunneling [Duplicate]
                            status_code: 500
                        results:
                          created: []
                          deleted: []
                          skipped: []
                          updated:
                            - actions: []
                              author:
                                - Elastic
                              created_at: '2022-02-21T14:14:17.883Z'
                              created_by: elastic
                              description: Generates a detection alert for each external alert written to the configured indices. Enabling this rule allows you to immediately begin investigating external alerts in the app.
                              enabled: true
                              exceptions_list: []
                              execution_summary:
                                last_execution:
                                  date: '2022-03-23T16:06:12.787Z'
                                  message: This rule attempted to query data from Elasticsearch indices listed in the "Index pattern" section of the rule definition, but no matching index was found.
                                  metrics:
                                    execution_gap_duration_s: 0
                                    total_indexing_duration_ms: 15
                                    total_search_duration_ms: 135
                                  status: partial failure
                                  status_order: 20
                              false_positives: []
                              from: now-6m
                              id: 8e5c1a40-9320-11ec-9265-8b772383a08d
                              immutable: false
                              index:
                                - apm-*-transaction*
                                - traces-apm*
                                - auditbeat-*
                                - filebeat-*
                                - logs-*
                                - packetbeat-*
                                - winlogbeat-*
                                - added-by-id-*
                              interval: 5m
                              language: kuery
                              license: Elastic License v2
                              max_signals: 10000
                              name: External Alerts [Duplicate]
                              query: |
                                event.kind:alert and not event.module:(endgame or endpoint)
                              references: []
                              related_integrations: []
                              required_fields: []
                              risk_score: 47
                              risk_score_mapping:
                                - field: event.risk_score
                                  operator: equals
                                  value: ''
                              rule_id: 941faf98-0cdc-4569-b16d-4af962914d61
                              rule_name_override: message
                              setup: ''
                              severity: medium
                              severity_mapping:
                                - field: event.severity
                                  operator: equals
                                  severity: low
                                  value: '21'
                                - field: event.severity
                                  operator: equals
                                  severity: medium
                                  value: '47'
                                - field: event.severity
                                  operator: equals
                                  severity: high
                                  value: '73'
                                - field: event.severity
                                  operator: equals
                                  severity: critical
                                  value: '99'
                              tags:
                                - Elastic
                                - Network
                                - Windows
                                - APM
                                - macOS
                                - Linux
                              threat: []
                              timestamp_override: event.ingested
                              to: now
                              type: query
                              updated_at: '2022-02-21T16:56:22.818Z'
                              updated_by: elastic
                              version: 5
                        summary:
                          failed: 1
                          skipped: 0
                          succeeded: 1
                          total: 2
                      message: Bulk edit partially failed
                      rules_count: 2
                      status_code: 500
                      success: false
                example03:
                  description: The attributes.errors section of the response shows that two rules failed to update and one succeeded. The same results would be returned if you ran the request without dry run mode enabled. Notice that there are no arrays in attributes.results. In dry run mode, rule updates are not applied and saved to Elasticsearch, so the endpoint wouldn’t return results for rules that have been updated, created, or deleted.
                  summary: Dry run
                  value:
                    attributes:
                      errors:
                        - err_code: IMMUTABLE
                          message: Elastic rule can't be edited
                          rules:
                            - id: 81aa0480-06af-11ed-94fb-dd1a0597d8d2
                              name: Unusual AWS Command for a User
                          status_code: 500
                        - err_code: MACHINE_LEARNING_INDEX_PATTERN
                          message: Machine learning rule doesn't have index patterns
                          rules:
                            - id: dc015d10-0831-11ed-ac8b-05a222bd8d4a
                              name: Suspicious Powershell Script [Duplicate]
                          status_code: 500
                      results:
                        created: []
                        deleted: []
                        skipped: []
                        updated: []
                      summary:
                        failed: 2
                        skipped: 0
                        succeeded: 1
                        total: 3
                    message: Bulk edit partially failed
                    status_code: 500
                example04:
                  description: This example presents the successful setting of tags for 2 rules. There was a difference between the set of tags that were being added and the tags that were already set in the rules, that's why the rules were updated.
                  summary: Set tags successsully for 2 rules
                  value:
                    attributes:
                      results:
                        created: []
                        deleted: []
                        skipped: []
                        updated:
                          - actions: []
                            author: []
                            created_at: '2025-03-25T11:46:41.899Z'
                            created_by: elastic
                            description: test
                            enabled: false
                            exceptions_list: []
                            false_positives: []
                            filters: []
                            from: now-6m
                            id: 738112cd-6cfa-414a-8457-2a658845d6ba
                            immutable: false
                            index:
                              - apm-*-transaction*
                              - auditbeat-*
                              - endgame-*
                              - filebeat-*
                              - logs-*
                              - packetbeat-*
                              - traces-apm*
                              - winlogbeat-*
                              - -*elastic-cloud-logs-*
                            interval: 5m
                            language: kuery
                            license: ''
                            max_signals: 100
                            meta:
                              kibana_siem_app_url: http://localhost:5601/kbn/app/security
                            name: Rule 1
                            output_index: ''
                            query: '*'
                            references: []
                            related_integrations: []
                            required_fields: []
                            revision: 1
                            risk_score: 21
                            risk_score_mapping: []
                            rule_id: 6fb746a0-dfe5-40fa-b03f-5cbb84f3e32e
                            rule_source:
                              type: internal
                            setup: ''
                            severity: low
                            severity_mapping: []
                            tags:
                              - tag-1
                              - tag-2
                            threat: []
                            to: now
                            type: query
                            updated_at: '2025-03-25T11:47:11.350Z'
                            updated_by: elastic
                            version: 2
                          - actions:
                              - action_type_id: .webhook
                                frequency:
                                  notifyWhen: onActiveAlert
                                  summary: true
                                  throttle: null
                                group: default
                                id: 20fbf986-a270-460e-80f3-7b83c08b430f
                                params:
                                  body: Hello
                                uuid: 580e2e16-5e91-411c-999b-7b75a11ed441
                            author: []
                            created_at: '2025-03-25T09:49:08.343Z'
                            created_by: elastic
                            description: test
                            enabled: false
                            exceptions_list: []
                            false_positives: []
                            filters: []
                            from: now-360s
                            id: eacdfc95-e007-41c9-986e-4b2cbdfdc71b
                            immutable: false
                            index:
                              - apm-*-transaction*
                              - auditbeat-*
                              - endgame-*
                              - filebeat-*
                              - logs-*
                              - packetbeat-*
                              - traces-apm*
                              - winlogbeat-*
                              - -*elastic-cloud-logs-*
                            interval: 3m
                            investigation_fields:
                              field_names:
                                - alert.status
                                - Endpoint.policy.applied.artifacts.global.channel
                            language: kuery
                            license: ''
                            max_signals: 100
                            meta:
                              from: 3m
                              kibana_siem_app_url: http://localhost:5601/kbn/app/security
                            name: Rule 2
                            output_index: ''
                            query: '*'
                            references: []
                            related_integrations: []
                            required_fields: []
                            revision: 33
                            risk_score: 21
                            risk_score_mapping: []
                            rule_id: 43250a55-53a3-4ddd-96cb-82a1bd720180
                            rule_source:
                              type: internal
                            setup: ''
                            severity: low
                            severity_mapping: []
                            tags:
                              - tag-1
                              - tag-2
                            threat: []
                            timeline_id: 3e827bab-838a-469f-bd1e-5e19a2bff2fd
                            timeline_title: Alerts Involving a Single User Timeline
                            to: now
                            type: query
                            updated_at: '2025-03-25T11:47:11.357Z'
                            updated_by: elastic
                            version: 24
                      summary:
                        failed: 0
                        skipped: 0
                        succeeded: 2
                        total: 2
                    rules_count: 2
                    success: true
                example05:
                  description: This example presents the idempotent behavior of the edit action with set_tags request. Both rules already had exactly the same tags that were being added, so no changes were made in any of them.
                  summary: Idempotent behavior of set_tags
                  value:
                    attributes:
                      results:
                        created: []
                        deleted: []
                        skipped:
                          - id: eacdfc95-e007-41c9-986e-4b2cbdfdc71b
                            name: Rule 1
                            skip_reason: RULE_NOT_MODIFIED
                          - id: 738112cd-6cfa-414a-8457-2a658845d6ba
                            name: Rule 2
                            skip_reason: RULE_NOT_MODIFIED
                        updated: []
                      summary:
                        failed: 0
                        skipped: 2
                        succeeded: 0
                        total: 2
                    rules_count: 2
                    success: true
                example06:
                  description: This example presents the idempotent behavior of the edit action with add_tags request. One rule was updated and one was skipped. The rule that was skipped already had all the tags that were being added.
                  summary: Idempotent behavior of add_tags
                  value:
                    attributes:
                      results:
                        created: []
                        deleted: []
                        skipped:
                          - id: 738112cd-6cfa-414a-8457-2a658845d6ba
                            name: Test Rule 2
                            skip_reason: RULE_NOT_MODIFIED
                        updated:
                          - actions:
                              - action_type_id: .webhook
                                frequency:
                                  notifyWhen: onActiveAlert
                                  summary: true
                                  throttle: null
                                group: default
                                id: 20fbf986-a270-460e-80f3-7b83c08b430f
                                params:
                                  body: Hello
                                uuid: 580e2e16-5e91-411c-999b-7b75a11ed441
                            author: []
                            created_at: '2025-03-25T09:49:08.343Z'
                            created_by: elastic
                            description: test
                            enabled: false
                            exceptions_list: []
                            false_positives: []
                            filters: []
                            from: now-360s
                            id: eacdfc95-e007-41c9-986e-4b2cbdfdc71b
                            immutable: false
                            index:
                              - apm-*-transaction*
                              - auditbeat-*
                              - endgame-*
                              - filebeat-*
                              - logs-*
                              - packetbeat-*
                              - traces-apm*
                              - winlogbeat-*
                              - -*elastic-cloud-logs-*
                            interval: 3m
                            investigation_fields:
                              field_names:
                                - alert.status
                                - Endpoint.policy.applied.artifacts.global.channel
                            language: kuery
                            license: ''
                            max_signals: 100
                            meta:
                              from: 3m
                              kibana_siem_app_url: http://localhost:5601/kbn/app/security
                            name: Test rule
                            output_index: ''
                            query: '*'
                            references: []
                            related_integrations: []
                            required_fields: []
                            revision: 34
                            risk_score: 21
                            risk_score_mapping: []
                            rule_id: 43250a55-53a3-4ddd-96cb-82a1bd720180
                            rule_source:
                              type: internal
                            setup: ''
                            severity: low
                            severity_mapping: []
                            tags:
                              - tag-1
                              - tag-2
                              - tag-4
                            threat: []
                            timeline_id: 3e827bab-838a-469f-bd1e-5e19a2bff2fd
                            timeline_title: Alerts Involving a Single User Timeline
                            to: now
                            type: query
                            updated_at: '2025-03-25T11:55:12.752Z'
                            updated_by: elastic
                            version: 25
                      summary:
                        failed: 0
                        skipped: 1
                        succeeded: 1
                        total: 2
                    rules_count: 2
                    success: true
                example07:
                  description: This example shows a non-idempotent nature of the set_rule_actions requests. Regardless if the actions are the same as the existing actions for a rule, the actions are always set in the rule and receive a new unique ID.
                  summary: Non-idempotent behavior for set_rule_actions
                  value:
                    attributes:
                      results:
                        created: []
                        deleted: []
                        skipped: []
                        updated:
                          - actions:
                              - action_type_id: .webhook
                                frequency:
                                  notifyWhen: onActiveAlert
                                  summary: true
                                  throttle: null
                                group: default
                                id: 20fbf986-a270-460e-80f3-7b83c08b430f
                                params:
                                  body: Hello
                                uuid: e48428e5-efac-4856-b8ad-b271c14eaa91
                            author: []
                            created_at: '2025-03-25T09:49:08.343Z'
                            created_by: elastic
                            description: test
                            enabled: false
                            exceptions_list: []
                            false_positives: []
                            filters: []
                            from: now-360s
                            id: eacdfc95-e007-41c9-986e-4b2cbdfdc71b
                            immutable: false
                            index:
                              - apm-*-transaction*
                              - auditbeat-*
                              - endgame-*
                              - filebeat-*
                              - logs-*
                              - packetbeat-*
                              - traces-apm*
                              - winlogbeat-*
                              - -*elastic-cloud-logs-*
                            interval: 3m
                            investigation_fields:
                              field_names:
                                - alert.status
                                - Endpoint.policy.applied.artifacts.global.channel
                            language: kuery
                            license: ''
                            max_signals: 100
                            meta:
                              from: 3m
                              kibana_siem_app_url: http://localhost:5601/kbn/app/security
                            name: Test rule
                            output_index: ''
                            query: '*'
                            references: []
                            related_integrations: []
                            required_fields: []
                            revision: 39
                            risk_score: 21
                            risk_score_mapping: []
                            rule_id: 43250a55-53a3-4ddd-96cb-82a1bd720180
                            rule_source:
                              type: internal
                            setup: ''
                            severity: low
                            severity_mapping: []
                            tags:
                              - tag-1
                              - tag-2
                              - tag-4
                            threat: []
                            timeline_id: 3e827bab-838a-469f-bd1e-5e19a2bff2fd
                            timeline_title: Alerts Involving a Single User Timeline
                            to: now
                            type: query
                            updated_at: '2025-03-25T12:17:40.528Z'
                            updated_by: elastic
                            version: 30
                      summary:
                        failed: 0
                        skipped: 0
                        succeeded: 1
                        total: 1
                    rules_count: 1
                    success: true
                example08:
                  description: This example shows a non-idempotent nature of the add_rule_actions requests. Regardless if the added action is the same as another existing action for a rule, the new action is added to the rule and receives a new unique ID.
                  summary: Non-idempotent behavior for add_rule_actions
                  value:
                    attributes:
                      results:
                        created: []
                        deleted: []
                        skipped: []
                        updated:
                          - actions:
                              - action_type_id: .webhook
                                frequency:
                                  notifyWhen: onActiveAlert
                                  summary: true
                                  throttle: null
                                group: default
                                id: 76af173d-38d8-4a9a-b2cc-a3c695b845b4
                                params:
                                  body: Message body
                                uuid: 0309347e-3954-429c-9168-5da2663389af
                              - action_type_id: .webhook
                                frequency:
                                  notifyWhen: onActiveAlert
                                  summary: true
                                  throttle: null
                                group: default
                                id: 76af173d-38d8-4a9a-b2cc-a3c695b845b4
                                params:
                                  body: Message body
                                uuid: 49ddaa94-d63d-410e-90dc-8c1bad9552bd
                            author: []
                            created_at: '2025-04-02T12:42:03.400Z'
                            created_by: elastic
                            description: test
                            enabled: false
                            exceptions_list: []
                            false_positives: []
                            filters: []
                            from: now-6m
                            id: 0d3eb0cd-88c4-4651-ac87-6d9f0cb87217
                            immutable: false
                            index:
                              - apm-*-transaction*
                              - auditbeat-*
                              - endgame-*
                              - filebeat-*
                              - logs-*
                              - packetbeat-*
                              - traces-apm*
                              - winlogbeat-*
                              - -*elastic-cloud-logs-*
                            interval: 5m
                            language: kuery
                            license: ''
                            max_signals: 100
                            meta:
                              kibana_siem_app_url: http://localhost:5601/kbn/app/security
                            name: Jacek test rule
                            output_index: ''
                            query: '*'
                            references: []
                            related_integrations: []
                            required_fields: []
                            revision: 2
                            risk_score: 21
                            risk_score_mapping: []
                            rule_id: 2684c020-1370-4719-ac27-eafe6428fe10
                            rule_source:
                              type: internal
                            setup: ''
                            severity: low
                            severity_mapping: []
                            tags: []
                            threat: []
                            to: now
                            type: query
                            updated_at: '2025-04-02T12:51:40.215Z'
                            updated_by: elastic
                            version: 2
                      summary:
                        failed: 0
                        skipped: 0
                        succeeded: 1
                        total: 1
                    rules_count: 1
                    success: true
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Security_Detections_API_BulkEditActionResponse'
                  - $ref: '#/components/schemas/Security_Detections_API_BulkExportActionResponse'
          description: OK
      summary: Apply a bulk action to detection rules
      tags:
        - Security Detections API
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/detection_engine/rules/_export:
    post:
      description: |
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/detection_engine/rules/_export</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Export detection rules to an `.ndjson` file. The following configuration items are also included in the `.ndjson` file:
        - Actions
        - Exception lists
        > info
        > Rule actions and connectors are included in the exported file, but sensitive information about the connector (such as authentication credentials) is not included. You must re-add missing connector details after importing detection rules.

        > You can use Kibana’s [Saved Objects](https://www.elastic.co/docs/explore-analyze/find-and-organize/saved-objects) UI (Stack Management → Kibana → Saved Objects) or the Saved Objects APIs (experimental) to [export](../operation/operation-post-saved-objects-export) and [import](../operation/operation-post-saved-objects-import) any necessary connectors before importing detection rules.

        > Similarly, any value lists used for rule exceptions are not included in rule exports or imports. Use the [Manage value lists](https://www.elastic.co/docs/solutions/security/detect-and-alert/create-manage-value-lists) UI (Rules → Detection rules (SIEM) → Manage value lists) to export and import value lists separately.
      operationId: ExportRules
      parameters:
        - description: Determines whether a summary of the exported rules is returned.
          in: query
          name: exclude_export_details
          required: false
          schema:
            default: false
            type: boolean
        - description: |
            File name for saving the exported rules.
            > info
            > When using cURL to export rules to a file, use the -O and -J options to save the rules to the file name specified in the URL.
          in: query
          name: file_name
          required: false
          schema:
            default: export.ndjson
            type: string
      requestBody:
        content:
          application/json:
            examples:
              exportByRuleIds:
                summary: Request body to export a subset of rules
                value:
                  objects:
                    - rule_id: 343580b5-c811-447c-8d2d-2ccf052c6900
                    - rule_id: 2938c9fa-53eb-4c04-b79c-33cbf041b18d
            schema:
              nullable: true
              type: object
              properties:
                objects:
                  description: Array of objects with a rule's `rule_id` field. Do not use rule's `id` here. Exports all rules when unspecified.
                  items:
                    type: object
                    properties:
                      rule_id:
                        $ref: '#/components/schemas/Security_Detections_API_RuleSignatureId'
                    required:
                      - rule_id
                  type: array
              required:
                - objects
        required: false
      responses:
        '200':
          content:
            application/ndjson:
              examples:
                sampleNdjson:
                  value: |
                    {"rule_id":"343580b5-c811-447c-8d2d-2ccf052c6900","name":"Example rule","type":"query","enabled":true}
                    {"exception_list":true}
                    {"export_summary":{"total_rules":1,"exceptions_count":0}}
              schema:
                description: |
                  An `.ndjson` file containing the returned rules.

                  Each line in the file represents an object (a rule, exception list parent container, or exception list item), and the last line includes a summary of what was exported.
                format: binary
                type: string
          description: Indicates a successful call.
      summary: Export detection rules
      tags:
        - Security Detections API
      x-codeSamples:
        - lang: cURL
          source: |
            curl -X POST "localhost:5601/api/detection_engine/rules/_export?exclude_export_details=true&file_name=exported_rules.ndjson" -H 'kbn-xsrf: true' -H 'Content-Type: application/json' -d'
            {
              "objects": [
                {
                  "rule_id":"343580b5-c811-447c-8d2d-2ccf052c6900"
                },
                {
                  "rule_id":"2938c9fa-53eb-4c04-b79c-33cbf041b18d"
                }
              ]
            }
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/detection_engine/rules/_find:
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/detection_engine/rules/_find</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Retrieve a paginated list of detection rules. By default, the first page is returned, with 20 results per page.
      operationId: FindRules
      parameters:
        - description: |
            List of `alert.attributes` field names to return for each rule (for example `name`, `enabled`).
            If omitted, the default field set is returned. Repeat the parameter to pass multiple field names, or
            use comma-separated values when supported by your client.
          in: query
          name: fields
          required: false
          schema:
            items:
              type: string
            type: array
        - description: |
            Search query

            Filters the returned results according to the value of the specified field, using the alert.attributes.<field name>:<field value> syntax, where <field name> can be:
            - name
            - enabled
            - tags
            - createdBy
            - interval
            - updatedBy
            > info
            > Even though the JSON rule object uses created_by and updated_by fields, you must use createdBy and updatedBy fields in the filter.
          in: query
          name: filter
          required: false
          schema:
            type: string
        - description: Field to sort by
          in: query
          name: sort_field
          required: false
          schema:
            $ref: '#/components/schemas/Security_Detections_API_FindRulesSortField'
        - description: Sort order
          in: query
          name: sort_order
          required: false
          schema:
            $ref: '#/components/schemas/Security_Detections_API_SortOrder'
        - description: Page number
          in: query
          name: page
          required: false
          schema:
            default: 1
            minimum: 1
            type: integer
        - description: Rules per page
          in: query
          name: per_page
          required: false
          schema:
            default: 20
            minimum: 0
            type: integer
        - description: Gaps range start
          in: query
          name: gaps_range_start
          required: false
          schema:
            type: string
        - description: Gaps range end
          in: query
          name: gaps_range_end
          required: false
          schema:
            type: string
        - description: Gap fill statuses
          in: query
          name: gap_fill_statuses
          required: false
          schema:
            items:
              $ref: '#/components/schemas/Security_Detections_API_GapFillStatus'
            type: array
        - description: Gap auto fill scheduler ID used to determine gap fill status for rules
          in: query
          name: gap_auto_fill_scheduler_id
          required: false
          schema:
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                example1:
                  value:
                    data:
                      - created_at: '2020-02-02T10:05:19.613Z'
                        created_by: elastic
                        description: Identifies a PowerShell process launched by either cscript.exe or wscript.exe. Observing Windows scripting processes executing a PowerShell script, may be indicative of malicious activity.
                        enabled: false
                        execution_summary:
                          last_execution:
                            date: '2022-03-23T16:06:12.787Z'
                            message: This rule attempted to query data from Elasticsearch indices listed in the "Index pattern" section of the rule definition, but no matching index was found.
                            metrics:
                              execution_gap_duration_s: 0
                              total_indexing_duration_ms: 15
                              total_search_duration_ms: 135
                            status: partial failure
                            status_order: 20
                        false_positives: []
                        from: now-6m
                        id: 89761517-fdb0-4223-b67b-7621acc48f9e
                        immutable: true
                        index:
                          - winlogbeat-*
                        interval: 5m
                        language: kuery
                        max_signals: 33
                        name: Windows Script Executing PowerShell
                        query: 'event.action:"Process Create (rule: ProcessCreate)" and process.parent.name:("wscript.exe" or "cscript.exe") and process.name:"powershell.exe"'
                        references: []
                        related_integrations:
                          - package: o365
                            version: ^2.3.2
                        required_fields:
                          - ecs: true
                            name: event.action
                            type: keyword
                          - ecs: true
                            name: process.name
                            type: keyword
                          - ecs: true
                            name: process.parent.name
                            type: keyword
                        risk_score: 21
                        rule_id: f545ff26-3c94-4fd0-bd33-3c7f95a3a0fc
                        setup: ''
                        severity: low
                        tags:
                          - Elastic
                          - Windows
                        threat:
                          - framework: MITRE ATT&CK
                            tactic:
                              id: TA0002
                              name: Execution
                              reference: https://attack.mitre.org/tactics/TA0002/
                            technique:
                              - id: T1193
                                name: Spearphishing Attachment
                                reference: https://attack.mitre.org/techniques/T1193/
                        to: now
                        type: query
                        updated_at: '2020-02-02T10:05:19.830Z'
                        updated_by: elastic
                    page: 1
                    perPage: 5
                    total: 4
              schema:
                type: object
                properties:
                  data:
                    items:
                      $ref: '#/components/schemas/Security_Detections_API_RuleResponse'
                    type: array
                  page:
                    type: integer
                  perPage:
                    type: integer
                  total:
                    type: integer
                  warnings:
                    items:
                      $ref: '#/components/schemas/Security_Detections_API_WarningSchema'
                    type: array
                required:
                  - page
                  - perPage
                  - total
                  - data
          description: |
            Successful response
            > info
            > These fields are under development and their usage or schema may change: execution_summary.
      summary: List all detection rules
      tags:
        - Security Detections API
      x-codeSamples:
        - lang: cURL
          source: |
            curl -X GET "localhost:5601/api/detection_engine/rules/_find?page=1&per_page=5&sort_field=enabled&sort_order=asc&filter=alert.attributes.name:windows" -H 'kbn-xsrf: true'
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/detection_engine/rules/_import:
    post:
      description: |
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/detection_engine/rules/_import</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Import detection rules from an `.ndjson` file, including actions and exception lists. The request must include:
        - The `Content-Type: multipart/form-data` HTTP header.
        - A link to the `.ndjson` file containing the rules.
        > warn
        > When used with [API key](https://www.elastic.co/docs/deploy-manage/api-keys) authentication, the user's key gets assigned to the affected rules. If the user's key gets deleted or the user becomes inactive, the rules will stop running.

        > If the API key that is used for authorization has different privileges than the key that created or most recently updated the rule, the rule behavior might change.
        > info
        > To import rules with actions, you need at least Read privileges for the Action and Connectors feature. To overwrite or add new connectors, you need All privileges for the Actions and Connectors feature. To import rules without actions, you don’t need Actions and Connectors privileges. Refer to [Enable and access detections](https://www.elastic.co/docs/solutions/security/detect-and-alert/detections-privileges) for more information.

        > info
        > Rule actions and connectors are included in the exported file, but sensitive information about the connector (such as authentication credentials) is not included. You must re-add missing connector details after importing detection rules.

        > You can use Kibana’s [Saved Objects](https://www.elastic.co/docs/explore-analyze/find-and-organize/saved-objects) UI (Stack Management → Kibana → Saved Objects) or the Saved Objects APIs (experimental) to [export](../operation/operation-post-saved-objects-export) and [import](../operation/operation-post-saved-objects-import) any necessary connectors before importing detection rules.

        > Similarly, any value lists used for rule exceptions are not included in rule exports or imports. Use the [Manage value lists](https://www.elastic.co/docs/solutions/security/detect-and-alert/create-manage-value-lists) UI (Rules → Detection rules (SIEM) → Manage value lists) to export and import value lists separately.
      operationId: ImportRules
      parameters:
        - description: Determines whether existing rules with the same `rule_id` are overwritten.
          in: query
          name: overwrite
          required: false
          schema:
            default: false
            type: boolean
        - description: Determines whether existing exception lists with the same `list_id` are overwritten. Both the exception list container and its items are overwritten.
          in: query
          name: overwrite_exceptions
          required: false
          schema:
            default: false
            type: boolean
        - description: Determines whether existing actions with the same `kibana.alert.rule.actions.id` are overwritten.
          in: query
          name: overwrite_action_connectors
          required: false
          schema:
            default: false
            type: boolean
        - description: Generates a new list ID for each imported exception list.
          in: query
          name: as_new_list
          required: false
          schema:
            default: false
            type: boolean
      requestBody:
        content:
          multipart/form-data:
            examples:
              rulesFile:
                summary: Multipart part containing a rule export
                value:
                  file: rules_import.ndjson
            schema:
              type: object
              properties:
                file:
                  description: The `.ndjson` file containing the rules.
                  format: binary
                  type: string
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                example1:
                  summary: Import rules with success
                  value:
                    errors: []
                    exceptions_errors: []
                    exceptions_success: true
                    exceptions_success_count: 0
                    rules_count: 1
                    success: true
                    success_count: 1
              schema:
                additionalProperties: false
                type: object
                properties:
                  action_connectors_errors:
                    items:
                      $ref: '#/components/schemas/Security_Detections_API_ErrorSchema'
                    type: array
                  action_connectors_success:
                    type: boolean
                  action_connectors_success_count:
                    minimum: 0
                    type: integer
                  action_connectors_warnings:
                    items:
                      $ref: '#/components/schemas/Security_Detections_API_WarningSchema'
                    type: array
                  errors:
                    items:
                      $ref: '#/components/schemas/Security_Detections_API_ErrorSchema'
                    type: array
                  exceptions_errors:
                    items:
                      $ref: '#/components/schemas/Security_Detections_API_ErrorSchema'
                    type: array
                  exceptions_success:
                    type: boolean
                  exceptions_success_count:
                    minimum: 0
                    type: integer
                  rules_count:
                    minimum: 0
                    type: integer
                  success:
                    type: boolean
                  success_count:
                    minimum: 0
                    type: integer
                required:
                  - exceptions_success
                  - exceptions_success_count
                  - exceptions_errors
                  - rules_count
                  - success
                  - success_count
                  - errors
                  - action_connectors_errors
                  - action_connectors_warnings
                  - action_connectors_success
                  - action_connectors_success_count
          description: Indicates a successful call.
      summary: Import detection rules
      tags:
        - Security Detections API
      x-codeSamples:
        - lang: cURL
          source: |
            curl -X POST "<KibanaURL>/api/detection_engine/rules/_import"
            -u <username>:<password> -H 'kbn-xsrf: true'
            -H 'Content-Type: multipart/form-data'
            --form "file=@<link to file>"
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/detection_engine/rules/{id}/exceptions:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/detection_engine/rules/{id}/exceptions</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Create exception items that apply to a single detection rule.
      operationId: CreateRuleExceptionListItems
      parameters:
        - description: Detection rule's identifier
          examples:
            id:
              value: 330bdd28-eedf-40e1-bed0-f10176c7f9e0
          in: path
          name: id
          required: true
          schema:
            $ref: '#/components/schemas/Security_Exceptions_API_UUID'
      requestBody:
        content:
          application/json:
            examples:
              addItems:
                value:
                  items:
                    - description: This is a sample detection type exception item.
                      entries:
                        - field: actingProcess.file.signer
                          operator: excluded
                          type: exists
                        - field: host.name
                          operator: included
                          type: match_any
                          value:
                            - saturn
                            - jupiter
                      item_id: simple_list_item
                      list_id: simple_list
                      name: Sample Exception List Item
                      namespace_type: single
                      os_types:
                        - linux
                      tags:
                        - malware
                      type: simple
            schema:
              example:
                items:
                  - description: This is a sample detection type exception item.
                    entries:
                      - field: actingProcess.file.signer
                        operator: excluded
                        type: exists
                      - field: host.name
                        operator: included
                        type: match_any
                        value:
                          - saturn
                          - jupiter
                    item_id: simple_list_item
                    list_id: simple_list
                    name: Sample Exception List Item
                    namespace_type: single
                    os_types:
                      - linux
                    tags:
                      - malware
                    type: simple
              type: object
              properties:
                items:
                  items:
                    $ref: '#/components/schemas/Security_Exceptions_API_CreateRuleExceptionListItemProps'
                  type: array
              required:
                - items
        description: Rule exception items.
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                ruleExceptionItems:
                  value:
                    - _version: WzQsMV0=
                      comments: []
                      created_at: '2025-01-07T20:07:33.119Z'
                      created_by: elastic
                      description: This is a sample detection type exception item.
                      entries:
                        - field: actingProcess.file.signer
                          operator: excluded
                          type: exists
                        - field: host.name
                          operator: included
                          type: match_any
                          value:
                            - saturn
                            - jupiter
                      id: 71a9f4b2-c85c-49b4-866f-c71eb9e67da2
                      item_id: simple_list_item
                      list_id: simple_list
                      name: Sample Exception List Item
                      namespace_type: single
                      os_types:
                        - linux
                      tags:
                        - malware
                      tie_breaker_id: 09434836-9db9-4942-a234-5a9268e0b34c
                      type: simple
                      updated_at: '2025-01-07T20:07:33.119Z'
                      updated_by: elastic
              schema:
                items:
                  $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItem'
                type: array
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                badPayload:
                  value:
                    error: Bad Request
                    message: Invalid request payload JSON format
                    statusCode: 400
                badRequest:
                  value:
                    error: Bad Request
                    message: '[request params]: id: Invalid uuid'
                    statusCode: 400
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
                  - $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
          description: Invalid input data response
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: '[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]'
                    statusCode: 401
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
          description: Unsuccessful authentication response
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  value:
                    message: Unable to create exception-list
                    status_code: 403
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
          description: Not enough privileges response
        '500':
          content:
            application/json:
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
          description: Internal server error response
      summary: Create rule exception items
      tags:
        - Security Exceptions API
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/detection_engine/rules/prepackaged:
    put:
      description: |
        **Spaces method and path for this operation:**

        <div><span class="operation-verb put">put</span>&nbsp;<span class="operation-path">/s/{space_id}/api/detection_engine/rules/prepackaged</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Install and update all Elastic prebuilt detection rules and Timelines.

        This endpoint allows you to install and update prebuilt detection rules and Timelines provided by Elastic. 
        When you call this endpoint, it will:
        - Install any new prebuilt detection rules that are not currently installed in your system.
        - Update any existing prebuilt detection rules that have been modified or improved by Elastic.
        - Install any new prebuilt Timelines that are not currently installed in your system.
        - Update any existing prebuilt Timelines that have been modified or improved by Elastic.

        This ensures that your detection engine is always up-to-date with the latest rules and Timelines, 
        providing you with the most current and effective threat detection capabilities.
      operationId: InstallPrebuiltRulesAndTimelines
      responses:
        '200':
          content:
            application/json:
              examples:
                example1:
                  value:
                    rules_installed: 112
                    rules_updated: 0
                    timelines_installed: 5
                    timelines_updated: 2
              schema:
                additionalProperties: false
                type: object
                properties:
                  rules_installed:
                    description: The number of rules installed
                    minimum: 0
                    type: integer
                  rules_updated:
                    description: The number of rules updated
                    minimum: 0
                    type: integer
                  timelines_installed:
                    description: The number of timelines installed
                    minimum: 0
                    type: integer
                  timelines_updated:
                    description: The number of timelines updated
                    minimum: 0
                    type: integer
                required:
                  - rules_installed
                  - rules_updated
                  - timelines_installed
                  - timelines_updated
          description: Indicates a successful call
      summary: Install prebuilt detection rules and Timelines
      tags:
        - Security Detections API
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/detection_engine/rules/prepackaged/_status:
    get:
      description: |
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/detection_engine/rules/prepackaged/_status</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Retrieve the status of all Elastic prebuilt detection rules and Timelines. 

        This endpoint provides detailed information about the number of custom rules, installed prebuilt rules, available prebuilt rules that are not installed, outdated prebuilt rules, installed prebuilt timelines, available prebuilt timelines that are not installed, and outdated prebuilt timelines.
      operationId: ReadPrebuiltRulesAndTimelinesStatus
      responses:
        '200':
          content:
            application/json:
              examples:
                example1:
                  value:
                    rules_custom_installed: 0
                    rules_installed: 0
                    rules_not_installed: 112
                    rules_not_updated: 0
                    timelines_installed: 0
                    timelines_not_installed: 0
                    timelines_not_updated: 0
              schema:
                additionalProperties: false
                type: object
                properties:
                  rules_custom_installed:
                    description: The total number of custom rules
                    minimum: 0
                    type: integer
                  rules_installed:
                    description: The total number of installed prebuilt rules
                    minimum: 0
                    type: integer
                  rules_not_installed:
                    description: The total number of available prebuilt rules that are not installed
                    minimum: 0
                    type: integer
                  rules_not_updated:
                    description: The total number of outdated prebuilt rules
                    minimum: 0
                    type: integer
                  timelines_installed:
                    description: The total number of installed prebuilt timelines
                    minimum: 0
                    type: integer
                  timelines_not_installed:
                    description: The total number of available prebuilt timelines that are not installed
                    minimum: 0
                    type: integer
                  timelines_not_updated:
                    description: The total number of outdated prebuilt timelines
                    minimum: 0
                    type: integer
                required:
                  - rules_custom_installed
                  - rules_installed
                  - rules_not_installed
                  - rules_not_updated
                  - timelines_installed
                  - timelines_not_installed
                  - timelines_not_updated
          description: Indicates a successful call
      summary: Retrieve the status of prebuilt detection rules and Timelines
      tags:
        - Security Detections API
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/detection_engine/rules/preview:
    post:
      description: |
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/detection_engine/rules/preview</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Simulates a detection rule using the same rule type and query logic as a persisted rule, over a short
        time window, without persisting a rule or writing alerts. Use the response to validate queries, see sample
        matching documents, and inspect execution logs. Pair `invocationCount` and `timeframeEnd` to cap run time.
      operationId: RulePreview
      parameters:
        - description: Enables logging and returning in response ES queries, performed during rule execution
          in: query
          name: enable_logged_requests
          required: false
          schema:
            type: boolean
      requestBody:
        content:
          application/json:
            examples:
              queryRule:
                value:
                  description: Find matching events
                  from: now-24h
                  index:
                    - logs-*
                  invocationCount: 1
                  language: kuery
                  max_signals: 20
                  name: Rule preview
                  query: 'process.name : *'
                  risk_score: 25
                  severity: low
                  timeframeEnd: '2025-01-20T12:00:00.000Z'
                  to: now
                  type: query
            schema:
              anyOf:
                - allOf:
                    - $ref: '#/components/schemas/Security_Detections_API_EqlRuleCreateProps'
                    - $ref: '#/components/schemas/Security_Detections_API_RulePreviewParams'
                - allOf:
                    - $ref: '#/components/schemas/Security_Detections_API_QueryRuleCreateProps'
                    - $ref: '#/components/schemas/Security_Detections_API_RulePreviewParams'
                - allOf:
                    - $ref: '#/components/schemas/Security_Detections_API_SavedQueryRuleCreateProps'
                    - $ref: '#/components/schemas/Security_Detections_API_RulePreviewParams'
                - allOf:
                    - $ref: '#/components/schemas/Security_Detections_API_ThresholdRuleCreateProps'
                    - $ref: '#/components/schemas/Security_Detections_API_RulePreviewParams'
                - allOf:
                    - $ref: '#/components/schemas/Security_Detections_API_ThreatMatchRuleCreateProps'
                    - $ref: '#/components/schemas/Security_Detections_API_RulePreviewParams'
                - allOf:
                    - $ref: '#/components/schemas/Security_Detections_API_MachineLearningRuleCreateProps'
                    - $ref: '#/components/schemas/Security_Detections_API_RulePreviewParams'
                - allOf:
                    - $ref: '#/components/schemas/Security_Detections_API_NewTermsRuleCreateProps'
                    - $ref: '#/components/schemas/Security_Detections_API_RulePreviewParams'
                - allOf:
                    - $ref: '#/components/schemas/Security_Detections_API_EsqlRuleCreateProps'
                    - $ref: '#/components/schemas/Security_Detections_API_RulePreviewParams'
              discriminator:
                propertyName: type
        description: |
          Rule create payload (same shape as `POST /api/detection_engine/rules` for a given `type`) plus
          `invocationCount` and `timeframeEnd` to control how the preview is executed. Optional
          `enable_logged_requests` surfaces Elasticsearch request logging for debugging.
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                success:
                  value:
                    isAborted: false
                    logs:
                      - duration: 45
                        errors: []
                        requests: []
                        startedAt: '2025-01-20T10:00:00.000Z'
                        warnings: []
                    previewId: 7f1c9d1e-4c8a-4a3e-9a5d-0d4f6e1b2a90
              schema:
                type: object
                properties:
                  isAborted:
                    type: boolean
                  logs:
                    items:
                      $ref: '#/components/schemas/Security_Detections_API_RulePreviewLogs'
                    type: array
                  previewId:
                    $ref: '#/components/schemas/Security_Detections_API_NonEmptyString'
                required:
                  - logs
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                badRequest:
                  value:
                    error: Bad Request
                    message: '[request body].timeframeEnd: expected string, received null'
                    statusCode: 400
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Security_Detections_API_PlatformErrorResponse'
                  - $ref: '#/components/schemas/Security_Detections_API_SiemErrorResponse'
          description: Invalid input data response
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: |-
                      [security_exception
                      	Root causes:
                      		security_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]
                    statusCode: 401
              schema:
                $ref: '#/components/schemas/Security_Detections_API_PlatformErrorResponse'
          description: Unsuccessful authentication response
        '500':
          content:
            application/json:
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
              schema:
                $ref: '#/components/schemas/Security_Detections_API_SiemErrorResponse'
          description: Internal server error response
      summary: Preview rule alerts generated on specified time range
      tags:
        - Security Detections API
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/detection_engine/signals/assignees:
    post:
      description: |
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/detection_engine/signals/assignees</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Assign users to detection alerts, and unassign them from alerts.
        > info
        > You cannot add and remove the same assignee in the same request.
      operationId: SetAlertAssignees
      requestBody:
        content:
          application/json:
            examples:
              add:
                $ref: '#/components/examples/Security_Detections_API_SetAlertAssigneesBodyAdd'
              remove:
                $ref: '#/components/examples/Security_Detections_API_SetAlertAssigneesBodyRemove'
            schema:
              $ref: '#/components/schemas/Security_Detections_API_SetAlertAssigneesBody'
        description: User profile IDs to add or remove on each listed alert document ID.
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                add:
                  value:
                    batches: 1
                    deleted: 0
                    failures: []
                    noops: 0
                    requests_per_second: -1
                    retries:
                      bulk: 0
                      search: 0
                    throttled_millis: 0
                    throttled_until_millis: 0
                    timed_out: false
                    took: 76
                    total: 1
                    updated: 1
                    version_conflicts: 0
              schema:
                additionalProperties: true
                description: Elasticsearch update by query response
                type: object
          description: |
            Indicates a successful call. The body matches an Elasticsearch update-by-query response
            (for example `took`, `updated`, `failures`).
        '400':
          content:
            application/json:
              examples:
                badRequest:
                  value:
                    error: Bad Request
                    message: '[request body].ids: at least one alert id is required to update assignees'
                    statusCode: 400
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Security_Detections_API_PlatformErrorResponse'
                  - $ref: '#/components/schemas/Security_Detections_API_SiemErrorResponse'
          description: Invalid input data response
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: |-
                      [security_exception
                      	Root causes:
                      		security_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]
                    statusCode: 401
              schema:
                $ref: '#/components/schemas/Security_Detections_API_PlatformErrorResponse'
          description: Unsuccessful authentication response
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  value:
                    error: Forbidden
                    message: API [POST /api/detection_engine/signals/assignees] is unauthorized for the current user, this action is granted by the Kibana Security Solution privileges for cases and detections
                    statusCode: 403
              schema:
                $ref: '#/components/schemas/Security_Detections_API_PlatformErrorResponse'
          description: Not enough privileges response
        '500':
          content:
            application/json:
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
              schema:
                $ref: '#/components/schemas/Security_Detections_API_SiemErrorResponse'
          description: Internal server error response
      summary: Assign and unassign users from detection alerts
      tags:
        - Security Detections API
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/detection_engine/signals/finalize_migration:
    post:
      deprecated: true
      description: |
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/detection_engine/signals/finalize_migration</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        **DEPRECATED.** Completes a legacy alert index migration. Do not automate against this in new code.
        **WARNING:** Finalizing swaps read aliases; confirm the migration has finished successfully before calling.

        Finalize successful migrations of detection alerts. This replaces the original index's alias with the
        successfully migrated index's alias. The endpoint is idempotent, so you can poll until a migration
        finishes and then call this operation once.
      operationId: FinalizeAlertsMigration
      requestBody:
        content:
          application/json:
            examples:
              oneMigration:
                value:
                  migration_ids:
                    - 924f7c50-505f-11eb-ae0a-3fa2e626a51d
            schema:
              example:
                migration_ids:
                  - 924f7c50-505f-11eb-ae0a-3fa2e626a51d
              type: object
              properties:
                migration_ids:
                  description: Array of `migration_id`s to finalize.
                  items:
                    type: string
                  minItems: 1
                  type: array
              required:
                - migration_ids
        description: Array of `migration_id`s to finalize
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                success:
                  value:
                    migrations:
                      - completed: true
                        destinationIndex: .siem-signals-default-000002-r000016
                        id: 924f7c50-505f-11eb-ae0a-3fa2e626a51d
                        sourceIndex: .siem-signals-default-000002
                        status: success
                        updated: '2021-01-06T22:05:56.859Z'
                        version: 16
              schema:
                items:
                  $ref: '#/components/schemas/Security_Detections_API_MigrationFinalizationResult'
                type: array
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                badRequest:
                  value:
                    error: Bad Request
                    message: '[request body].migration_ids: at least one migration id is required to finalize'
                    statusCode: 400
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Security_Detections_API_PlatformErrorResponse'
                  - $ref: '#/components/schemas/Security_Detections_API_SiemErrorResponse'
          description: Invalid input data response
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: |-
                      [security_exception
                      	Root causes:
                      		security_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]
                    statusCode: 401
              schema:
                $ref: '#/components/schemas/Security_Detections_API_PlatformErrorResponse'
          description: Unsuccessful authentication response
        '500':
          content:
            application/json:
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
              schema:
                $ref: '#/components/schemas/Security_Detections_API_SiemErrorResponse'
          description: Internal server error response
      summary: Finalize detection alert migrations
      tags:
        - Security Detections API
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/detection_engine/signals/migration:
    delete:
      deprecated: true
      description: |
        **Spaces method and path for this operation:**

        <div><span class="operation-verb delete">delete</span>&nbsp;<span class="operation-path">/s/{space_id}/api/detection_engine/signals/migration</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        **DEPRECATED.** Cleanup API for old migration artifacts. Do not add new call sites.
        **WARNING:** This schedules deletions; ensure no production reads still point at the source index.

        Migrations favor data integrity over shard size. Consequently, unused or orphaned indices are artifacts of
        the migration process. A successful migration can leave both the old and new indices present, so the old
        index may be deleted. While you can delete these indices manually, the endpoint applies a deletion policy
        to the relevant index, causing it to be deleted after 30 days, and removes other migration-specific artifacts.
      operationId: AlertsMigrationCleanup
      requestBody:
        content:
          application/json:
            examples:
              cleanupMigrations:
                value:
                  migration_ids:
                    - 924f7c50-505f-11eb-ae0a-3fa2e626a51d
            schema:
              example:
                migration_ids:
                  - 924f7c50-505f-11eb-ae0a-3fa2e626a51d
              type: object
              properties:
                migration_ids:
                  description: Array of `migration_id`s to cleanup.
                  items:
                    type: string
                  minItems: 1
                  type: array
              required:
                - migration_ids
        description: Array of `migration_id`s to cleanup
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                success:
                  value:
                    migrations:
                      - destinationIndex: .siem-signals-default-000002-r000016
                        id: 924f7c50-505f-11eb-ae0a-3fa2e626a51d
                        sourceIndex: .siem-signals-default-000002
                        status: success
                        updated: '2021-01-06T22:05:56.859Z'
                        version: 16
              schema:
                items:
                  $ref: '#/components/schemas/Security_Detections_API_MigrationCleanupResult'
                type: array
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                badRequest:
                  value:
                    error: Bad Request
                    message: '[request body].migration_ids: at least one migration id is required to run cleanup'
                    statusCode: 400
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Security_Detections_API_PlatformErrorResponse'
                  - $ref: '#/components/schemas/Security_Detections_API_SiemErrorResponse'
          description: Invalid input data response
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: |-
                      [security_exception
                      	Root causes:
                      		security_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]
                    statusCode: 401
              schema:
                $ref: '#/components/schemas/Security_Detections_API_PlatformErrorResponse'
          description: Unsuccessful authentication response
        '500':
          content:
            application/json:
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
              schema:
                $ref: '#/components/schemas/Security_Detections_API_SiemErrorResponse'
          description: Internal server error response
      summary: Clean up detection alert migrations
      tags:
        - Security Detections API
      x-metaTags:
        - content: Kibana
          name: product_name
    post:
      deprecated: true
      description: |
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/detection_engine/signals/migration</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        **DEPRECATED.** Legacy API for on-demand reindexing of old `.siem-signals-*` alert indices. Do not build new
        integrations; upgrade the Elastic Stack and rely on product-managed data lifecycle instead.
        **WARNING:** Migrations can be resource intensive and should be planned during a maintenance window.

        Initiate a migration of detection alerts. Migrations are initiated per index. The process is not destructive
        and should not remove existing data, but it can consume significant cluster resources. Plan capacity accordingly.
      operationId: CreateAlertsMigration
      requestBody:
        content:
          application/json:
            examples:
              singleIndex:
                value:
                  index:
                    - .siem-signals-default-000001
            schema:
              allOf:
                - type: object
                  properties:
                    index:
                      description: Array of index names to migrate.
                      items:
                        format: nonempty
                        minLength: 1
                        type: string
                      minItems: 1
                      type: array
                  required:
                    - index
                - $ref: '#/components/schemas/Security_Detections_API_AlertsReindexOptions'
        description: Alerts migration parameters
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                success:
                  value:
                    indices:
                      - index: .siem-signals-default-000001,
                        migration_id: 923f7c50-505f-11eb-ae0a-3fa2e626a51d
                        migration_index: .siem-signals-default-000001-r000016
              schema:
                type: object
                properties:
                  indices:
                    items:
                      oneOf:
                        - $ref: '#/components/schemas/Security_Detections_API_AlertsIndexMigrationSuccess'
                        - $ref: '#/components/schemas/Security_Detections_API_AlertsIndexMigrationError'
                        - $ref: '#/components/schemas/Security_Detections_API_SkippedAlertsIndexMigration'
                    type: array
                required:
                  - indices
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                badRequest:
                  value:
                    error: Bad Request
                    message: '[request body].index: at least one index name is required to start a migration'
                    statusCode: 400
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Security_Detections_API_PlatformErrorResponse'
                  - $ref: '#/components/schemas/Security_Detections_API_SiemErrorResponse'
          description: Invalid input data response
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: |-
                      [security_exception
                      	Root causes:
                      		security_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]
                    statusCode: 401
              schema:
                $ref: '#/components/schemas/Security_Detections_API_PlatformErrorResponse'
          description: Unsuccessful authentication response
        '500':
          content:
            application/json:
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
              schema:
                $ref: '#/components/schemas/Security_Detections_API_SiemErrorResponse'
          description: Internal server error response
      summary: Initiate a detection alert migration
      tags:
        - Security Detections API
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/detection_engine/signals/migration_status:
    get:
      deprecated: true
      description: |
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/detection_engine/signals/migration_status</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        **DEPRECATED.** This endpoint was used for historical `.siem-signals-*` index migration workflows. Do not use
        for new automations; there is no supported replacement in this public API.
        **WARNING:** Prefer upgrading through supported Elastic stack upgrades rather than ad-hoc index migrations.

        Retrieves indices that contain detection alerts of a particular age, along with migration information for
        each of those indices.
      operationId: ReadAlertsMigrationStatus
      parameters:
        - description: Maximum age of qualifying detection alerts
          in: query
          name: from
          required: true
          schema:
            description: |
              Time from which data is analyzed. For example, now-4200s means the rule analyzes data from 70 minutes
              before its start time. Defaults to now-6m (analyzes data from 6 minutes before the start time).
            example: now-30d
            format: date-math
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                success:
                  value:
                    indices:
                      - index: .siem-signals-default-000002
                        is_outdated: true
                        migrations:
                          - id: 924f7c50-505f-11eb-ae0a-3fa2e626a51d
                            status: pending
                            updated: '2021-01-06T20:41:37.173Z'
                            version: 16
                        signal_versions:
                          - count: 100
                            version: 15
                          - count: 87
                            version: 16
                        version: 15
                      - index: .siem-signals-default-000003
                        is_outdated: false
                        migrations: []
                        signal_versions:
                          - count: 54
                            version: 16
                        version: 16
              schema:
                type: object
                properties:
                  indices:
                    items:
                      $ref: '#/components/schemas/Security_Detections_API_IndexMigrationStatus'
                    type: array
                required:
                  - indices
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                badRequest:
                  value:
                    error: Bad Request
                    message: '[request query].from: expected date-math, received null'
                    statusCode: 400
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Security_Detections_API_PlatformErrorResponse'
                  - $ref: '#/components/schemas/Security_Detections_API_SiemErrorResponse'
          description: Invalid input data response
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: |-
                      [security_exception
                      	Root causes:
                      		security_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]
                    statusCode: 401
              schema:
                $ref: '#/components/schemas/Security_Detections_API_PlatformErrorResponse'
          description: Unsuccessful authentication response
        '500':
          content:
            application/json:
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
              schema:
                $ref: '#/components/schemas/Security_Detections_API_SiemErrorResponse'
          description: Internal server error response
      summary: Retrieve the status of detection alert migrations
      tags:
        - Security Detections API
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/detection_engine/signals/search:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/detection_engine/signals/search</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Find and/or aggregate detection alerts that match the given query.
      operationId: SearchAlerts
      requestBody:
        content:
          application/json:
            examples:
              query:
                value:
                  aggs:
                    alertsByGrouping:
                      terms:
                        field: host.name
                        size: 10
                    missingFields:
                      missing:
                        field: host.name
                  query:
                    bool:
                      filter:
                        - bool:
                            filter:
                              - match_phrase:
                                  kibana.alert.workflow_status: open
                            must: []
                            must_not:
                              - exists:
                                  field: kibana.alert.building_block_type
                            should: []
                        - range:
                            '@timestamp':
                              gte: '2025-01-17T08:00:00.000Z'
                              lte: '2025-01-18T07:59:59.999Z'
                  runtime_mappings: {}
                  size: 0
            schema:
              $ref: '#/components/schemas/Security_Detections_API_QueryAlertsBodyParams'
              description: Elasticsearch query and aggregation request
        description: Search and/or aggregation query
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                success:
                  value:
                    _shards:
                      failed: 0
                      skipped: 0
                      successful: 1
                      total: 1
                    aggregations:
                      alertsByGrouping:
                        buckets:
                          - doc_count: 5
                            key: Host-f43kkddfyc
                        doc_count_error_upper_bound: 0
                        sum_other_doc_count: 0
                      missingFields:
                        doc_count: 0
                    hits:
                      hits: []
                      max_score: null
                      total:
                        relation: eq
                        value: 5
                    timed_out: false
                    took: 0
              schema:
                additionalProperties: true
                description: Elasticsearch search response
                type: object
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                badRequest:
                  value:
                    error: Bad Request
                    message: 'Failed to parse search request: unknown query clause in bool filter'
                    statusCode: 400
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Security_Detections_API_PlatformErrorResponse'
                  - $ref: '#/components/schemas/Security_Detections_API_SiemErrorResponse'
          description: Invalid input data response
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: |-
                      [security_exception
                      	Root causes:
                      		security_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]
                    statusCode: 401
              schema:
                $ref: '#/components/schemas/Security_Detections_API_PlatformErrorResponse'
          description: Unsuccessful authentication response
        '500':
          content:
            application/json:
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
              schema:
                $ref: '#/components/schemas/Security_Detections_API_SiemErrorResponse'
          description: Internal server error response
      summary: Find and/or aggregate detection alerts
      tags:
        - Security Detections API
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/detection_engine/signals/status:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/detection_engine/signals/status</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Set the status of one or more detection alerts.
      operationId: SetAlertsStatus
      requestBody:
        content:
          application/json:
            examples:
              byId:
                value:
                  signal_ids:
                    - 80e1383f856e67c1b7f7a1634744fa6d66b6e2ef7aa26d226e57afb5a7b2b4a1
                  status: closed
              byQuery:
                value:
                  conflicts: proceed
                  query:
                    bool:
                      filter:
                        - '@timestamp':
                            format: strict_date_optional_time
                            gte: '2024-10-23T07:00:00.000Z'
                            lte: '2025-01-21T20:12:11.704Z'
                          range: null
                        - bool:
                            filter:
                              bool:
                                filter:
                                  - match_phrase:
                                      kibana.alert.workflow_status: open
                                  - '@timestamp':
                                      format: strict_date_optional_time
                                      gte: '2024-10-23T07:00:00.000Z'
                                      lte: '2025-01-21T20:12:11.704Z'
                                    range: null
                                must: []
                                must_not:
                                  - exists:
                                      field: kibana.alert.building_block_type
                                should: []
                      must: []
                      must_not: []
                      should: []
                  status: closed
            schema:
              oneOf:
                - $ref: '#/components/schemas/Security_Detections_API_SetAlertsStatusByIds'
                - $ref: '#/components/schemas/Security_Detections_API_SetAlertsStatusByQuery'
        description: An object containing desired status and explicit alert ids or a query to select alerts
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                byId:
                  value:
                    batches: 1
                    deleted: 0
                    failures: []
                    noops: 0
                    requests_per_second: -1
                    retries:
                      bulk: 0
                      search: 0
                    throttled_millis: 0
                    throttled_until_millis: 0
                    timed_out: false
                    took: 81
                    total: 1
                    updated: 1
                    version_conflicts: 0
                byQuery:
                  value:
                    batches: 1
                    deleted: 0
                    failures: []
                    noops: 0
                    requests_per_second: -1
                    retries:
                      bulk: 0
                      search: 0
                    throttled_millis: 0
                    throttled_until_millis: 0
                    timed_out: false
                    took: 100
                    total: 17
                    updated: 17
                    version_conflicts: 0
              schema:
                additionalProperties: true
                description: Elasticsearch update by query response
                type: object
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                badRequest:
                  value:
                    error: Bad Request
                    message: '[request body].signal_ids: at least one alert id is required to update status'
                    statusCode: 400
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Security_Detections_API_PlatformErrorResponse'
                  - $ref: '#/components/schemas/Security_Detections_API_SiemErrorResponse'
          description: Invalid input data response
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: |-
                      [security_exception
                      	Root causes:
                      		security_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]
                    statusCode: 401
              schema:
                $ref: '#/components/schemas/Security_Detections_API_PlatformErrorResponse'
          description: Unsuccessful authentication response
        '500':
          content:
            application/json:
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
              schema:
                $ref: '#/components/schemas/Security_Detections_API_SiemErrorResponse'
          description: Internal server error response
      summary: Set a detection alert status
      tags:
        - Security Detections API
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/detection_engine/signals/tags:
    post:
      description: |
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/detection_engine/signals/tags</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Add tags to detection alerts, and remove them from alerts, by alert IDs or a query, in a single request.
        > info
        > You cannot add and remove the same alert tag in the same request.
      operationId: SetAlertTags
      requestBody:
        content:
          application/json:
            examples:
              add:
                $ref: '#/components/examples/Security_Detections_API_SetAlertTagsBodyAdd'
              remove:
                $ref: '#/components/examples/Security_Detections_API_SetAlertTagsBodyRemove'
            schema:
              $ref: '#/components/schemas/Security_Detections_API_SetAlertTagsBody'
        description: An object containing tags to add or remove and alert ids the changes will be applied
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                success:
                  value:
                    batches: 1,
                    deleted: 0,
                    failures: []
                    noops: 0,
                    requests_per_second: -1,
                    retries:
                      bulk: 0,
                      search: 0
                    throttled_millis: 0,
                    throttled_until_millis: 0,
                    timed_out: false,
                    took: 68,
                    total: 1,
                    updated: 1,
                    version_conflicts: 0,
              schema:
                additionalProperties: true
                description: Elasticsearch update by query response
                type: object
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                badRequest:
                  value:
                    error: Bad Request
                    message: '[request body].tags: cannot add and remove the same tag in a single request'
                    statusCode: 400
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Security_Detections_API_PlatformErrorResponse'
                  - $ref: '#/components/schemas/Security_Detections_API_SiemErrorResponse'
          description: Invalid input data response
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: |-
                      [security_exception
                      	Root causes:
                      		security_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]
                    statusCode: 401
              schema:
                $ref: '#/components/schemas/Security_Detections_API_PlatformErrorResponse'
          description: Unsuccessful authentication response
        '500':
          content:
            application/json:
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
              schema:
                $ref: '#/components/schemas/Security_Detections_API_SiemErrorResponse'
          description: Internal server error response
      summary: Add and remove detection alert tags
      tags:
        - Security Detections API
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/detection_engine/tags:
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/detection_engine/tags</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        List all unique tags from all detection rules.
      operationId: ReadTags
      responses:
        '200':
          content:
            application/json:
              examples:
                example1:
                  value:
                    - zeek
                    - suricata
                    - windows
                    - linux
                    - network
                    - initial access
                    - remote access
                    - phishing
              schema:
                $ref: '#/components/schemas/Security_Detections_API_RuleTagArray'
          description: Indicates a successful call
      summary: List all detection rule tags
      tags:
        - Security Detections API
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/encrypted_saved_objects/_rotate_key:
    post:
      description: |
        Superuser role required.

        If a saved object cannot be decrypted using the primary encryption key, then Kibana will attempt to decrypt it using the specified decryption-only keys. In most of the cases this overhead is negligible, but if you're dealing with a large number of saved objects and experiencing performance issues, you may want to rotate the encryption key.

        This functionality is in technical preview and may be changed or removed in a future release. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features.
      operationId: rotateEncryptionKey
      parameters:
        - description: |
            Specifies a maximum number of saved objects that Kibana can process in a single batch. Bulk key rotation is an iterative process since Kibana may not be able to fetch and process all required saved objects in one go and splits processing into consequent batches. By default, the batch size is 10000, which is also a maximum allowed value.
          in: query
          name: batch_size
          required: false
          schema:
            default: 10000
            type: number
        - description: |
            Limits encryption key rotation only to the saved objects with the specified type. By default, Kibana tries to rotate the encryption key for all saved object types that may contain encrypted attributes.
          in: query
          name: type
          required: false
          schema:
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                rotateEncryptionKeyResponse:
                  $ref: '#/components/examples/Saved_objects_key_rotation_response'
              schema:
                type: object
                properties:
                  failed:
                    description: |
                      Indicates the number of the saved objects that were still encrypted with one of the old encryption keys that Kibana failed to re-encrypt with the primary key.
                    type: number
                  successful:
                    description: |
                      Indicates the total number of all encrypted saved objects (optionally filtered by the requested `type`), regardless of the key Kibana used for encryption.

                      NOTE: In most cases, `total` will be greater than `successful` even if `failed` is zero. The reason is that Kibana may not need or may not be able to rotate encryption keys for all encrypted saved objects.
                    type: number
                  total:
                    description: |
                      Indicates the total number of all encrypted saved objects (optionally filtered by the requested `type`), regardless of the key Kibana used for encryption.
                    type: number
          description: Indicates a successful call.
        '400':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Saved_objects_400_response'
          description: Bad request
        '429':
          content:
            application/json:
              schema:
                type: object
          description: Already in progress.
      summary: Rotate a key for encrypted saved objects
      tags:
        - saved objects
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/endpoint_list:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/endpoint_list</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Create the exception list for Elastic Endpoint rule exceptions. When you create the exception list, it will have a `list_id` of `endpoint_list`. If the Elastic Endpoint exception list already exists, your request will return an empty response.
      operationId: CreateEndpointList
      responses:
        '200':
          content:
            application/json:
              examples:
                alreadyExists:
                  summary: Endpoint exception list already exists (empty response)
                  value: {}
                newList:
                  summary: Endpoint exception list created
                  value:
                    created_at: '2025-01-01T00:00:00.000Z'
                    created_by: elastic
                    description: Endpoint Security Exception List
                    id: 2e23a8c4-ef7e-4c10-adfa-3eae4e4b4b8b
                    immutable: false
                    list_id: endpoint_list
                    name: Endpoint Security Exception List
                    namespace_type: agnostic
                    os_types: []
                    tags: []
                    tie_breaker_id: e3c5a8e0-5b6a-4b4b-8b3a-2e23a8c4ef7e
                    type: endpoint
                    updated_at: '2025-01-01T00:00:00.000Z'
                    updated_by: elastic
                    version: 1
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_EndpointList'
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                badRequest:
                  value:
                    error: Bad Request
                    message: '[request body]: expected value of type [object] but got [undefined]'
                    statusCode: 400
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_PlatformErrorResponse'
                  - $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_SiemErrorResponse'
          description: Invalid input data
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: |-
                      [security_exception
                      	Root causes:
                      		security_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]
                    statusCode: 401
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_PlatformErrorResponse'
          description: Unsuccessful authentication
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  value:
                    error: Forbidden
                    message: API [POST /api/endpoint_list] is unauthorized for user, this action is granted by the Kibana privileges [lists-all]
                    statusCode: 403
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_PlatformErrorResponse'
          description: Insufficient privileges
        '500':
          content:
            application/json:
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_SiemErrorResponse'
          description: Internal server error
      summary: Create an Elastic Endpoint rule exception list
      tags:
        - Security Endpoint Exceptions API
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/endpoint_list/items:
    delete:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb delete">delete</span>&nbsp;<span class="operation-path">/s/{space_id}/api/endpoint_list/items</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Delete an Elastic Endpoint exception list item, specified by the `id` or `item_id` field.
      operationId: DeleteEndpointListItem
      parameters:
        - description: Either `id` or `item_id` must be specified
          in: query
          name: id
          required: false
          schema:
            $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemId'
        - description: Either `id` or `item_id` must be specified
          in: query
          name: item_id
          required: false
          schema:
            $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemHumanId'
      responses:
        '200':
          content:
            application/json:
              examples:
                deleted:
                  summary: Deleted endpoint exception list item
                  value:
                    comments: []
                    created_at: '2025-01-01T12:00:00.000Z'
                    created_by: elastic
                    description: Blocks a known malicious file by its hash
                    entries:
                      - field: file.hash.sha256
                        operator: included
                        type: match
                        value: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
                    id: d4b0c1e2-3f4a-5b6c-7d8e-9f0a1b2c3d4e
                    item_id: block-malicious-file
                    list_id: endpoint_list
                    name: Block malicious file
                    namespace_type: agnostic
                    os_types:
                      - windows
                    tags: []
                    tie_breaker_id: f1e2d3c4-b5a6-7890-abcd-ef1234567890
                    type: simple
                    updated_at: '2025-01-01T12:00:00.000Z'
                    updated_by: elastic
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItem'
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                badRequest:
                  value:
                    error: Bad Request
                    message: Either "item_id" or "id" needs to be defined in the request
                    statusCode: 400
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_PlatformErrorResponse'
                  - $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_SiemErrorResponse'
          description: Invalid input data
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: |-
                      [security_exception
                      	Root causes:
                      		security_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]
                    statusCode: 401
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_PlatformErrorResponse'
          description: Unsuccessful authentication
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  value:
                    error: Forbidden
                    message: API [DELETE /api/endpoint_list/items?item_id=block-malicious-file] is unauthorized for user, this action is granted by the Kibana privileges [lists-all]
                    statusCode: 403
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_PlatformErrorResponse'
          description: Insufficient privileges
        '404':
          content:
            application/json:
              examples:
                notFound:
                  value:
                    message: 'exception list item item_id: "block-malicious-file" does not exist'
                    status_code: 404
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_SiemErrorResponse'
          description: Endpoint list item not found
        '500':
          content:
            application/json:
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_SiemErrorResponse'
          description: Internal server error
      summary: Delete an Elastic Endpoint exception list item
      tags:
        - Security Endpoint Exceptions API
      x-metaTags:
        - content: Kibana
          name: product_name
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/endpoint_list/items</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Get the details of an Elastic Endpoint exception list item, specified by the `id` or `item_id` field.
      operationId: ReadEndpointListItem
      parameters:
        - description: Either `id` or `item_id` must be specified
          in: query
          name: id
          required: false
          schema:
            $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemId'
        - description: Either `id` or `item_id` must be specified
          in: query
          name: item_id
          required: false
          schema:
            $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemHumanId'
      responses:
        '200':
          content:
            application/json:
              examples:
                item:
                  summary: Endpoint exception list item
                  value:
                    comments: []
                    created_at: '2025-01-01T12:00:00.000Z'
                    created_by: elastic
                    description: Blocks a known malicious file by its hash
                    entries:
                      - field: file.hash.sha256
                        operator: included
                        type: match
                        value: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
                    id: d4b0c1e2-3f4a-5b6c-7d8e-9f0a1b2c3d4e
                    item_id: block-malicious-file
                    list_id: endpoint_list
                    name: Block malicious file
                    namespace_type: agnostic
                    os_types:
                      - windows
                    tags:
                      - policy:all
                    tie_breaker_id: f1e2d3c4-b5a6-7890-abcd-ef1234567890
                    type: simple
                    updated_at: '2025-01-01T12:00:00.000Z'
                    updated_by: elastic
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItem'
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                badRequest:
                  value:
                    error: Bad Request
                    message: id or item_id required
                    statusCode: 400
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_PlatformErrorResponse'
                  - $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_SiemErrorResponse'
          description: Invalid input data
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: |-
                      [security_exception
                      	Root causes:
                      		security_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]
                    statusCode: 401
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_PlatformErrorResponse'
          description: Unsuccessful authentication
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  value:
                    error: Forbidden
                    message: API [GET /api/endpoint_list/items?item_id=block-malicious-file] is unauthorized for user, this action is granted by the Kibana privileges [lists-read]
                    statusCode: 403
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_PlatformErrorResponse'
          description: Insufficient privileges
        '404':
          content:
            application/json:
              examples:
                notFound:
                  value:
                    message: 'exception list item item_id: "block-malicious-file" does not exist'
                    status_code: 404
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_SiemErrorResponse'
          description: Endpoint list item not found
        '500':
          content:
            application/json:
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_SiemErrorResponse'
          description: Internal server error
      summary: Get an Elastic Endpoint rule exception list item
      tags:
        - Security Endpoint Exceptions API
      x-metaTags:
        - content: Kibana
          name: product_name
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/endpoint_list/items</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Create an Elastic Endpoint exception list item, and associate it with the Elastic Endpoint exception list.
      operationId: CreateEndpointListItem
      requestBody:
        content:
          application/json:
            examples:
              matchAny:
                summary: Exclude multiple process names
                value:
                  description: Exclude common security tools from endpoint protection
                  entries:
                    - field: process.name
                      operator: included
                      type: match_any
                      value:
                        - scanner.exe
                        - updater.exe
                  name: Trusted security tools
                  os_types:
                    - windows
                  type: simple
              simpleMatch:
                summary: Block a specific file hash
                value:
                  description: Blocks a known malicious file by its hash
                  entries:
                    - field: file.hash.sha256
                      operator: included
                      type: match
                      value: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
                  name: Block malicious file
                  os_types:
                    - windows
                  tags:
                    - policy:all
                  type: simple
            schema:
              type: object
              properties:
                comments:
                  $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemCommentArray'
                  default: []
                description:
                  $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemDescription'
                entries:
                  $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemEntryArray'
                item_id:
                  $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemHumanId'
                meta:
                  $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemMeta'
                name:
                  $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemName'
                os_types:
                  $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemOsTypeArray'
                  default: []
                tags:
                  $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemTags'
                  default: []
                type:
                  $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemType'
              required:
                - type
                - name
                - description
                - entries
        description: Exception list item's properties
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                created:
                  summary: Endpoint exception list item created
                  value:
                    comments: []
                    created_at: '2025-01-01T12:00:00.000Z'
                    created_by: elastic
                    description: Blocks a known malicious file by its hash
                    entries:
                      - field: file.hash.sha256
                        operator: included
                        type: match
                        value: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
                    id: d4b0c1e2-3f4a-5b6c-7d8e-9f0a1b2c3d4e
                    item_id: block-malicious-file
                    list_id: endpoint_list
                    name: Block malicious file
                    namespace_type: agnostic
                    os_types:
                      - windows
                    tags:
                      - policy:all
                    tie_breaker_id: f1e2d3c4-b5a6-7890-abcd-ef1234567890
                    type: simple
                    updated_at: '2025-01-01T12:00:00.000Z'
                    updated_by: elastic
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItem'
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                badRequest:
                  value:
                    error: Bad Request
                    message: '[request body]: name: Required'
                    statusCode: 400
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_PlatformErrorResponse'
                  - $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_SiemErrorResponse'
          description: Invalid input data
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: |-
                      [security_exception
                      	Root causes:
                      		security_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]
                    statusCode: 401
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_PlatformErrorResponse'
          description: Unsuccessful authentication
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  value:
                    error: Forbidden
                    message: API [POST /api/endpoint_list/items] is unauthorized for user, this action is granted by the Kibana privileges [lists-all]
                    statusCode: 403
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_PlatformErrorResponse'
          description: Insufficient privileges
        '409':
          content:
            application/json:
              examples:
                alreadyExists:
                  value:
                    message: 'exception list item id: "block-malicious-file" already exists'
                    status_code: 409
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_SiemErrorResponse'
          description: Endpoint list item already exists
        '500':
          content:
            application/json:
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_SiemErrorResponse'
          description: Internal server error
      summary: Create an Elastic Endpoint rule exception list item
      tags:
        - Security Endpoint Exceptions API
      x-metaTags:
        - content: Kibana
          name: product_name
    put:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb put">put</span>&nbsp;<span class="operation-path">/s/{space_id}/api/endpoint_list/items</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Update an Elastic Endpoint exception list item, specified by the `id` or `item_id` field.
      operationId: UpdateEndpointListItem
      requestBody:
        content:
          application/json:
            examples:
              updateName:
                summary: Update an endpoint exception list item
                value:
                  description: Updated description for the exception
                  entries:
                    - field: file.hash.sha256
                      operator: included
                      type: match
                      value: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
                  item_id: block-malicious-file
                  name: Block malicious file (updated)
                  os_types:
                    - windows
                    - linux
                  type: simple
            schema:
              type: object
              properties:
                _version:
                  description: The version id, normally returned by the API when the item is retrieved. Use it ensure updates are made against the latest version.
                  type: string
                comments:
                  $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemCommentArray'
                  default: []
                description:
                  $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemDescription'
                entries:
                  $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemEntryArray'
                id:
                  $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemId'
                  description: Either `id` or `item_id` must be specified
                item_id:
                  $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemHumanId'
                  description: Either `id` or `item_id` must be specified
                meta:
                  $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemMeta'
                name:
                  $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemName'
                os_types:
                  $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemOsTypeArray'
                  default: []
                tags:
                  $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemTags'
                type:
                  $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemType'
              required:
                - type
                - name
                - description
                - entries
        description: Exception list item's properties
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                updated:
                  summary: Endpoint exception list item updated
                  value:
                    comments: []
                    created_at: '2025-01-01T12:00:00.000Z'
                    created_by: elastic
                    description: Updated description for the exception
                    entries:
                      - field: file.hash.sha256
                        operator: included
                        type: match
                        value: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
                    id: d4b0c1e2-3f4a-5b6c-7d8e-9f0a1b2c3d4e
                    item_id: block-malicious-file
                    list_id: endpoint_list
                    name: Block malicious file (updated)
                    namespace_type: agnostic
                    os_types:
                      - windows
                      - linux
                    tags:
                      - policy:all
                    tie_breaker_id: f1e2d3c4-b5a6-7890-abcd-ef1234567890
                    type: simple
                    updated_at: '2025-01-15T09:30:00.000Z'
                    updated_by: elastic
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItem'
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                badRequest:
                  value:
                    error: Bad Request
                    message: '[request body]: name: Required'
                    statusCode: 400
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_PlatformErrorResponse'
                  - $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_SiemErrorResponse'
          description: Invalid input data
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: |-
                      [security_exception
                      	Root causes:
                      		security_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]
                    statusCode: 401
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_PlatformErrorResponse'
          description: Unsuccessful authentication
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  value:
                    error: Forbidden
                    message: API [PUT /api/endpoint_list/items] is unauthorized for user, this action is granted by the Kibana privileges [lists-all]
                    statusCode: 403
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_PlatformErrorResponse'
          description: Insufficient privileges
        '404':
          content:
            application/json:
              examples:
                notFound:
                  value:
                    message: 'list item item_id: "block-malicious-file" not found'
                    status_code: 404
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_SiemErrorResponse'
          description: Endpoint list item not found
        '500':
          content:
            application/json:
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_SiemErrorResponse'
          description: Internal server error
      summary: Update an Elastic Endpoint rule exception list item
      tags:
        - Security Endpoint Exceptions API
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/endpoint_list/items/_find:
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/endpoint_list/items/_find</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Get a list of all Elastic Endpoint exception list items.
      operationId: FindEndpointListItems
      parameters:
        - description: |
            Filters the returned results according to the value of the specified field,
            using the `<field name>:<field value>` syntax.
          in: query
          name: filter
          required: false
          schema:
            $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_NonEmptyString'
        - description: The page number to return
          in: query
          name: page
          required: false
          schema:
            minimum: 0
            type: integer
        - description: The number of exception list items to return per page
          in: query
          name: per_page
          required: false
          schema:
            minimum: 0
            type: integer
        - description: Determines which field is used to sort the results
          in: query
          name: sort_field
          required: false
          schema:
            $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_NonEmptyString'
        - description: Determines the sort order, which can be `desc` or `asc`
          in: query
          name: sort_order
          required: false
          schema:
            enum:
              - desc
              - asc
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                foundItems:
                  summary: Found endpoint exception list items
                  value:
                    data:
                      - comments: []
                        created_at: '2025-01-01T12:00:00.000Z'
                        created_by: elastic
                        description: Blocks a known malicious file by its hash
                        entries:
                          - field: file.hash.sha256
                            operator: included
                            type: match
                            value: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
                        id: d4b0c1e2-3f4a-5b6c-7d8e-9f0a1b2c3d4e
                        item_id: block-malicious-file
                        list_id: endpoint_list
                        name: Block malicious file
                        namespace_type: agnostic
                        os_types:
                          - windows
                        tags:
                          - policy:all
                        tie_breaker_id: f1e2d3c4-b5a6-7890-abcd-ef1234567890
                        type: simple
                        updated_at: '2025-01-01T12:00:00.000Z'
                        updated_by: elastic
                    page: 1
                    per_page: 20
                    total: 1
              schema:
                type: object
                properties:
                  data:
                    description: The list of endpoint exception list items.
                    items:
                      $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItem'
                    type: array
                  page:
                    description: The current page number.
                    minimum: 0
                    type: integer
                  per_page:
                    description: The number of items per page.
                    minimum: 0
                    type: integer
                  pit:
                    description: The point-in-time ID for pagination.
                    type: string
                  total:
                    description: The total number of endpoint exception list items.
                    minimum: 0
                    type: integer
                required:
                  - data
                  - page
                  - per_page
                  - total
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                badRequest:
                  value:
                    error: Bad Request
                    message: '[request query]: page: Expected number, received string'
                    statusCode: 400
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_PlatformErrorResponse'
                  - $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_SiemErrorResponse'
          description: Invalid input data
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: |-
                      [security_exception
                      	Root causes:
                      		security_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]
                    statusCode: 401
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_PlatformErrorResponse'
          description: Unsuccessful authentication
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  value:
                    error: Forbidden
                    message: API [GET /api/endpoint_list/items/_find] is unauthorized for user, this action is granted by the Kibana privileges [lists-read]
                    statusCode: 403
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_PlatformErrorResponse'
          description: Insufficient privileges
        '404':
          content:
            application/json:
              examples:
                notFound:
                  value:
                    message: 'list id: "endpoint_list" does not exist'
                    status_code: 404
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_SiemErrorResponse'
          description: Endpoint list not found
        '500':
          content:
            application/json:
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_SiemErrorResponse'
          description: Internal server error
      summary: Get Elastic Endpoint exception list items
      tags:
        - Security Endpoint Exceptions API
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/endpoint/action:
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/endpoint/action</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Get a list of all response actions.
      operationId: EndpointGetActionsList
      parameters:
        - description: The page number to return.
          in: query
          name: page
          required: false
          schema:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_Page'
        - description: The number of response actions to return per page.
          in: query
          name: pageSize
          required: false
          schema:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_PageSize'
        - description: A list of response action command names to filter by.
          in: query
          name: commands
          required: false
          schema:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_Commands'
        - description: A list of Elastic Agent IDs to filter the response actions by.
          in: query
          name: agentIds
          required: false
          schema:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_AgentIds'
        - description: A list of user IDs that submitted the response actions.
          in: query
          name: userIds
          required: false
          schema:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_UserIds'
        - description: A start date in ISO 8601 format or Date Math format (for example, `now-24h`).
          in: query
          name: startDate
          required: false
          schema:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_StartDate'
        - description: An end date in ISO 8601 format or Date Math format (for example, `now`).
          in: query
          name: endDate
          required: false
          schema:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_EndDate'
        - description: The agent type to filter response actions by. Defaults to `endpoint`.
          in: query
          name: agentTypes
          required: false
          schema:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_AgentTypes'
        - description: A list of response action IDs whose outputs should be included in the response.
          in: query
          name: withOutputs
          required: false
          schema:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_WithOutputs'
        - description: A list of response action types to filter by (`automated`, `manual`).
          in: query
          name: types
          required: false
          schema:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_Types'
      responses:
        '200':
          content:
            application/json:
              examples:
                actionsList:
                  summary: A list of response actions
                  value:
                    data:
                      - agents:
                          - afdc366c-e2e0-4cdb-ae1d-94575bd2d8e0
                        agentType: endpoint
                        command: running-processes
                        completedAt: '2022-08-08T09:50:47.672Z'
                        createdBy: elastic
                        id: b3d6de74-36b0-4fa8-be46-c375bf1771bf
                        isCompleted: true
                        isExpired: false
                        startedAt: '2022-08-08T15:24:57.402Z'
                        wasSuccessful: true
                      - agents:
                          - afdc366c-e2e0-4cdb-ae1d-94575bd2d8e0
                        agentType: endpoint
                        command: isolate
                        completedAt: '2022-08-08T10:41:57.352Z'
                        createdBy: elastic
                        id: 43b4098b-8752-4fbb-a7a7-6df7c74d0ee3
                        isCompleted: true
                        isExpired: false
                        startedAt: '2022-08-08T15:23:37.359Z'
                        wasSuccessful: true
                    elasticAgentIds:
                      - afdc366c-e2e0-4cdb-ae1d-94575bd2d8e0
                    endDate: now
                    page: 1
                    pageSize: 10
                    startDate: now-24h/h
                    total: 2
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Management_API_GetEndpointActionListResponse'
          description: Indicates a successful call.
      summary: Get response actions
      tags:
        - Security Endpoint Management API
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/endpoint/action_status:
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/endpoint/action_status</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Get the status of response actions for the specified agent IDs.
      operationId: EndpointGetActionsStatus
      parameters:
        - description: A list of agent IDs to get the action status for.
          in: query
          name: agent_ids
          required: true
          schema:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_AgentIds'
      responses:
        '200':
          content:
            application/json:
              examples:
                actionStatus:
                  summary: Pending response actions per agent
                  value:
                    data:
                      - agent_id: afdc366c-e2e0-4cdb-ae1d-94575bd2d8e0
                        pending_actions:
                          execute: 0
                          get-file: 0
                          isolate: 0
                          kill-process: 1
                          running-processes: 0
                          scan: 0
                          unisolate: 0
                          upload: 0
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Management_API_ActionStatusSuccessResponse'
          description: Indicates a successful call.
      summary: Get response actions status
      tags:
        - Security Endpoint Management API
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/endpoint/action/{action_id}:
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/endpoint/action/{action_id}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Get the details of a response action using the action ID.
      operationId: EndpointGetActionsDetails
      parameters:
        - description: The ID of the response action to retrieve.
          in: path
          name: action_id
          required: true
          schema:
            example: fr518850-681a-4y60-aa98-e22640cae2b8
            maxLength: 256
            minLength: 1
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                actionDetails:
                  summary: Details of an isolate response action
                  value:
                    data:
                      agents:
                        - ed518850-681a-4d60-bb98-e22640cae2a8
                      agentType: endpoint
                      command: isolate
                      completedAt: '2022-08-08T10:41:57.352Z'
                      createdBy: elastic
                      id: 233db9ea-6733-4849-9226-5a7039c7161d
                      isCompleted: true
                      isExpired: false
                      startedAt: '2022-08-08T15:23:37.359Z'
                      wasSuccessful: true
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Management_API_ActionDetailsResponse'
          description: OK
      summary: Get action details
      tags:
        - Security Endpoint Management API
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/endpoint/action/{action_id}/file/{file_id}:
    get:
      description: |
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/endpoint/action/{action_id}/file/{file_id}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Get information for the specified response action file download.
      operationId: EndpointFileInfo
      parameters:
        - description: The ID of the response action that generated the file.
          in: path
          name: action_id
          required: true
          schema:
            maxLength: 256
            minLength: 1
            type: string
        - description: |
            The file identifier is constructed in one of two ways:
            - For Elastic Defend agents (`agentType` of `endpoint`): combine the `action_id` and `agent_id` values using a dot (`.`) separator:
            `{file_id}` = `{action_id}.{agent_id}`
            - For all other agent types: the `file_id` is the `agent_id` for which the response action was sent to.
          in: path
          name: file_id
          required: true
          schema:
            maxLength: 256
            minLength: 1
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                fileInfo:
                  summary: File information for a response action upload
                  value:
                    data:
                      actionId: 233db9ea-6733-4849-9226-5a7039c7161d
                      agentId: ed518850-681a-4d60-bb98-e22640cae2a8
                      agentType: endpoint
                      created: '2025-02-26T13:37:30.452Z'
                      id: 233db9ea-6733-4849-9226-5a7039c7161d.ed518850-681a-4d60-bb98-e22640cae2a8
                      mimeType: application/zip
                      name: memory_dump.zip
                      size: 1048576
                      status: READY
              schema:
                properties:
                  data:
                    type: object
                    properties:
                      actionId:
                        description: The response action ID.
                        type: string
                      agentId:
                        description: The agent ID that generated the file.
                        type: string
                      agentType:
                        description: The type of agent that generated the file.
                        type: string
                      created:
                        description: The date and time the file was created.
                        format: date-time
                        type: string
                      id:
                        description: The unique file identifier.
                        type: string
                      mimeType:
                        description: The MIME type of the file.
                        type: string
                      name:
                        description: The file name.
                        type: string
                      size:
                        description: The file size in bytes.
                        type: number
                      status:
                        description: The file upload status.
                        enum:
                          - AWAITING_UPLOAD
                          - UPLOADING
                          - READY
                          - UPLOAD_ERROR
                          - DELETED
                        type: string
          description: Indicates a successful call.
      summary: Get file information
      tags:
        - Security Endpoint Management API
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/endpoint/action/{action_id}/file/{file_id}/download:
    get:
      description: |
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/endpoint/action/{action_id}/file/{file_id}/download</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Download a file associated with a response action. Files are downloaded in a password-protected `.zip` archive to prevent the file from running. Use password `elastic` to open the `.zip` in a safe environment.
        > info
        > Files retrieved from third-party-protected hosts require a different password. Refer to [Third-party response actions](https://www.elastic.co/docs/solutions/security/endpoint-response-actions/third-party-response-actions) for your system's password.
      operationId: EndpointFileDownload
      parameters:
        - description: The ID of the response action that generated the file.
          in: path
          name: action_id
          required: true
          schema:
            maxLength: 256
            minLength: 1
            type: string
        - description: |
            The file identifier is constructed in one of two ways:
            - For Elastic Defend agents (`agentType` of `endpoint`): combine the `action_id` and `agent_id` values using a dot (`.`) separator:
            `{file_id}` = `{action_id}.{agent_id}`
            - For all other agent types: the `file_id` is the `agent_id` for which the response action was sent to.
          in: path
          name: file_id
          required: true
          schema:
            maxLength: 256
            minLength: 1
            type: string
      responses:
        '200':
          content:
            application/octet-stream:
              examples:
                fileDownload:
                  summary: Password-protected ZIP archive containing the response action file
                  value: binary file content (password-protected .zip)
              schema:
                format: binary
                type: string
          description: Indicates a successful call.
      summary: Download a file
      tags:
        - Security Endpoint Management API
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/endpoint/action/cancel:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/endpoint/action/cancel</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Cancel a running or pending response action (Applies only to some agent types).
      operationId: CancelAction
      requestBody:
        content:
          application/json:
            examples:
              ElasticDefend:
                summary: Cancel a response action on an Elastic Defend host
                value:
                  agent_type: endpoint
                  comment: Cancelling action due to change in requirements
                  endpoint_ids:
                    - ed518850-681a-4d60-bb98-e22640cae2a8
                  parameters:
                    force: true
                    id: 7f8c9b2a-4d3e-4f5a-8b1c-2e3f4a5b6c7d
              MicrosoftDefenderEndpoint:
                summary: Cancel a response action on a Microsoft Defender for Endpoint host
                value:
                  agent_type: microsoft_defender_endpoint
                  comment: Cancelling action due to change in requirements
                  endpoint_ids:
                    - ed518850-681a-4d60-bb98-e22640cae2a8
                  parameters:
                    id: 7f8c9b2a-4d3e-4f5a-8b1c-2e3f4a5b6c7d
            schema:
              $ref: '#/components/schemas/Security_Endpoint_Management_API_CancelRouteRequestBody'
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                CancelSuccess:
                  summary: Cancel action successfully created
                  value:
                    data:
                      agents:
                        - ed518850-681a-4d60-bb98-e22640cae2a8
                      agentState:
                        ed518850-681a-4d60-bb98-e22640cae2a8:
                          isCompleted: false
                          wasSuccessful: false
                      agentType: microsoft_defender_endpoint
                      command: cancel
                      createdBy: elastic
                      hosts:
                        ed518850-681a-4d60-bb98-e22640cae2a8:
                          name: gke-node-1235412
                      id: 233db9ea-6733-4849-9226-5a7039c7161d
                      isCompleted: false
                      isExpired: false
                      outputs: {}
                      parameters:
                        id: 7f8c9b2a-4d3e-4f5a-8b1c-2e3f4a5b6c7d
                      startedAt: '2022-07-29T19:08:49.126Z'
                      status: pending
                      wasSuccessful: false
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Management_API_ResponseActionCreateSuccessResponse'
          description: Indicates a successful call.
      summary: Cancel a response action
      tags:
        - Security Endpoint Management API
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/endpoint/action/execute:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/endpoint/action/execute</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Run a shell command on an endpoint.
      operationId: EndpointExecuteAction
      requestBody:
        content:
          application/json:
            examples:
              executeCommand:
                summary: Execute a shell command on an endpoint
                value:
                  comment: Get list of all files
                  endpoint_ids:
                    - b3d6de74-36b0-4fa8-be46-c375bf1771bf
                  parameters:
                    command: ls -al
                    timeout: 600
            schema:
              $ref: '#/components/schemas/Security_Endpoint_Management_API_ExecuteRouteRequestBody'
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                ExecuteSuccess:
                  summary: Execute action successfully created
                  value:
                    data:
                      agents:
                        - ed518850-681a-4d60-bb98-e22640cae2a8
                      agentState:
                        ed518850-681a-4d60-bb98-e22640cae2a8:
                          isCompleted: false
                          wasSuccessful: false
                      agentType: endpoint
                      command: execute
                      createdBy: elastic
                      hosts:
                        ed518850-681a-4d60-bb98-e22640cae2a8:
                          name: gke-node-1235412
                      id: 9f934028-2300-4927-b531-b26376793dc4
                      isCompleted: false
                      isExpired: false
                      outputs: {}
                      parameters:
                        command: ls -al
                        timeout: 600
                      startedAt: '2023-07-28T18:43:27.362Z'
                      status: pending
                      wasSuccessful: false
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Management_API_ResponseActionCreateSuccessResponse'
          description: Indicates a successful call.
      summary: Run a command
      tags:
        - Security Endpoint Management API
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/endpoint/action/get_file:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/endpoint/action/get_file</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Get a file from an endpoint.
      operationId: EndpointGetFileAction
      requestBody:
        content:
          application/json:
            examples:
              getFile:
                summary: Get a specific file from an endpoint
                value:
                  comment: Get my file
                  endpoint_ids:
                    - ed518850-681a-4d60-bb98-e22640cae2a8
                  parameters:
                    path: /usr/my-file.txt
            schema:
              $ref: '#/components/schemas/Security_Endpoint_Management_API_GetFileRouteRequestBody'
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                GetFileSuccess:
                  summary: Get file action successfully created
                  value:
                    data:
                      agents:
                        - ed518850-681a-4d60-bb98-e22640cae2a8
                      agentState:
                        ed518850-681a-4d60-bb98-e22640cae2a8:
                          isCompleted: false
                          wasSuccessful: false
                      agentType: endpoint
                      command: get-file
                      createdBy: elastic
                      hosts:
                        ed518850-681a-4d60-bb98-e22640cae2a8:
                          name: gke-node-1235412
                      id: 27ba1b42-7cc6-4e53-86ce-675c876092b2
                      isCompleted: false
                      isExpired: false
                      outputs: {}
                      parameters:
                        path: /usr/my-file.txt
                      startedAt: '2023-07-28T19:00:03.911Z'
                      status: pending
                      wasSuccessful: false
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Management_API_ResponseActionCreateSuccessResponse'
          description: Indicates a successful call.
      summary: Get a file
      tags:
        - Security Endpoint Management API
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/endpoint/action/isolate:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/endpoint/action/isolate</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Isolate an endpoint from the network. The endpoint remains isolated until it's released.
      operationId: EndpointIsolateAction
      requestBody:
        content:
          application/json:
            examples:
              multiple_endpoints:
                summary: Isolates several hosts; includes a comment
                value:
                  comment: Locked down, pending further investigation
                  endpoint_ids:
                    - 9972d10e-4b9e-41aa-a534-a85e2a28ea42
                    - bc0e4f0c-3bca-4633-9fee-156c0b505d16
                    - fa89271b-b9d4-43f2-a684-307cffddeb5a
              single_endpoint:
                summary: Isolates a single host with an endpoint_id value of ed518850-681a-4d60-bb98-e22640cae2a8
                value:
                  endpoint_ids:
                    - ed518850-681a-4d60-bb98-e22640cae2a8
              with_case_id:
                summary: Isolates a single host with a case_id value of 1234
                value:
                  case_ids:
                    - 4976be38-c134-4554-bd5e-0fd89ce63667
                  comment: Isolating as initial response
                  endpoint_ids:
                    - 1aa1f8fd-0fb0-4fe4-8c30-92068272d3f0
                    - b30a11bf-1395-4707-b508-fbb45ef9793e
            schema:
              type: object
              properties:
                agent_type:
                  $ref: '#/components/schemas/Security_Endpoint_Management_API_AgentTypes'
                alert_ids:
                  description: If this action is associated with any alerts, they can be specified here. The action will be logged in any cases associated with the specified alerts. Max of 50.
                  example:
                    - alert-id-1
                    - alert-id-2
                  items:
                    maxLength: 256
                    minLength: 1
                    type: string
                  maxItems: 50
                  minItems: 1
                  type: array
                case_ids:
                  description: The IDs of cases where the action taken will be logged. Max of 50.
                  example:
                    - case-id-1
                    - case-id-2
                  items:
                    maxLength: 256
                    minLength: 1
                    type: string
                  maxItems: 50
                  minItems: 1
                  type: array
                comment:
                  $ref: '#/components/schemas/Security_Endpoint_Management_API_Comment'
                endpoint_ids:
                  $ref: '#/components/schemas/Security_Endpoint_Management_API_EndpointIds'
                parameters:
                  $ref: '#/components/schemas/Security_Endpoint_Management_API_Parameters'
              required:
                - endpoint_ids
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                IsolateSuccess:
                  summary: Isolate action successfully created
                  value:
                    action: 233db9ea-6733-4849-9226-5a7039c7161d
                    data:
                      agents:
                        - ed518850-681a-4d60-bb98-e22640cae2a8
                      agentState:
                        ed518850-681a-4d60-bb98-e22640cae2a8:
                          isCompleted: false
                          wasSuccessful: false
                      agentType: endpoint
                      command: isolate
                      createdBy: elastic
                      hosts:
                        ed518850-681a-4d60-bb98-e22640cae2a8:
                          name: gke-node-1235412
                      id: 233db9ea-6733-4849-9226-5a7039c7161d
                      isCompleted: false
                      isExpired: false
                      outputs: {}
                      startedAt: '2022-07-29T19:08:49.126Z'
                      status: pending
                      wasSuccessful: false
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Management_API_IsolateRouteResponse'
          description: Indicates a successful call.
      summary: Isolate an endpoint
      tags:
        - Security Endpoint Management API
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/endpoint/action/kill_process:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/endpoint/action/kill_process</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Terminate a running process on an endpoint.
      operationId: EndpointKillProcessAction
      requestBody:
        content:
          application/json:
            examples:
              byEntityId:
                summary: Terminate a process by entity ID
                value:
                  comment: Terminating malicious process
                  endpoint_ids:
                    - ed518850-681a-4d60-bb98-e22640cae2a8
                  parameters:
                    entity_id: abc123
              byPid:
                summary: Terminate a process by PID
                value:
                  endpoint_ids:
                    - ed518850-681a-4d60-bb98-e22640cae2a8
                  parameters:
                    pid: 1234
            schema:
              $ref: '#/components/schemas/Security_Endpoint_Management_API_KillProcessRouteRequestBody'
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                KillProcessSuccess:
                  summary: Kill process action successfully created
                  value:
                    data:
                      agents:
                        - ed518850-681a-4d60-bb98-e22640cae2a8
                      agentState:
                        ed518850-681a-4d60-bb98-e22640cae2a8:
                          isCompleted: false
                          wasSuccessful: false
                      agentType: endpoint
                      command: kill-process
                      createdBy: elastic
                      hosts:
                        ed518850-681a-4d60-bb98-e22640cae2a8:
                          name: gke-node-1235412
                      id: 233db9ea-6733-4849-9226-5a7039c7161d
                      isCompleted: false
                      isExpired: false
                      outputs: {}
                      parameters:
                        entity_id: abc123
                      startedAt: '2022-07-29T19:08:49.126Z'
                      status: pending
                      wasSuccessful: false
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Management_API_ResponseActionCreateSuccessResponse'
          description: Indicates a successful call.
      summary: Terminate a process
      tags:
        - Security Endpoint Management API
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/endpoint/action/memory_dump:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/endpoint/action/memory_dump</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Generates memory dumps on the targeted host.
      operationId: EndpointGenerateMemoryDump
      requestBody:
        content:
          application/json:
            examples:
              ProcessMemoryDump:
                summary: Generate a memory dump from the host machine
                value:
                  agent_type: endpoint
                  comment: Generating memory dump for investigation
                  endpoint_ids:
                    - ed518850-681a-4d60-bb98-e22640cae2a8
                  parameters:
                    entity_id: abc123
                    type: process
            schema:
              $ref: '#/components/schemas/Security_Endpoint_Management_API_MemoryDumpRouteRequestBody'
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                MemoryDumpSuccessResponse:
                  summary: Memory dump action successfully created
                  value:
                    data:
                      agents:
                        - ed518850-681a-4d60-bb98-e22640cae2a8
                      agentState:
                        ed518850-681a-4d60-bb98-e22640cae2a8:
                          isCompleted: false
                          wasSuccessful: false
                      agentType: endpoint
                      command: memory-dump
                      createdBy: elastic
                      hosts:
                        ed518850-681a-4d60-bb98-e22640cae2a8:
                          name: gke-node-1235412
                      id: 233db9ea-6733-4849-9226-5a7039c7161d
                      isCompleted: false
                      isExpired: false
                      outputs: {}
                      parameters:
                        entity_id: abc123
                        type: process
                      startedAt: '2022-07-29T19:08:49.126Z'
                      status: pending
                      wasSuccessful: false
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Management_API_ResponseActionCreateSuccessResponse'
          description: Indicates a successful call.
      summary: Generate a memory dump from the host machine
      tags:
        - Security Endpoint Management API
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/endpoint/action/run_script:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/endpoint/action/run_script</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Run a script on a host. Currently supported only for some agent types.
      operationId: RunScriptAction
      requestBody:
        content:
          application/json:
            examples:
              Elastic Defend:
                description: Endpoint runscript to collect logs
                summary: Run a script against an Elastic Defend agent
                value:
                  agent_type: endpoint
                  endpoint_ids:
                    - ed518850-681a-4d60-bb98-e22640cae2a8
                  parameters:
                    scriptId: 1111-2222-3333-4444-5555-6666-7777-8888
                    scriptInput: --path= /usr/log/exec.log
              MDE:
                description: Microsoft Defender Endpoint runscript
                summary: Run a script against a Microsoft Defender Endpoint agent
                value:
                  agent_type: microsoft_defender_endpoint
                  endpoint_ids:
                    - ed518850-681a-4d60-bb98-e22640cae2a8
                  parameters:
                    args: -param1 value1 -param2 value2
                    scriptName: my-script.ps1
              SentinelOne:
                description: SentinelOne runscript
                summary: Run a script against a SentinelOne agent
                value:
                  agent_type: sentinel_one
                  endpoint_ids:
                    - ed518850-681a-4d60-bb98-e22640cae2a8
                  parameters:
                    scriptId: 1111-2222-3333-4444-5555-6666-7777-8888
                    scriptInput: --delete --paths-to-delete /tmp/temp_file.txt,/tmp/random_file.txt
            schema:
              $ref: '#/components/schemas/Security_Endpoint_Management_API_RunScriptRouteRequestBody'
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                RunScriptSuccess:
                  summary: Run script action successfully created
                  value:
                    data:
                      agents:
                        - ed518850-681a-4d60-bb98-e22640cae2a8
                      agentState:
                        ed518850-681a-4d60-bb98-e22640cae2a8:
                          isCompleted: false
                          wasSuccessful: false
                      agentType: sentinel_one
                      command: runscript
                      createdBy: elastic
                      hosts:
                        ed518850-681a-4d60-bb98-e22640cae2a8:
                          name: gke-node-1235412
                      id: 233db9ea-6733-4849-9226-5a7039c7161d
                      isCompleted: false
                      isExpired: false
                      outputs: {}
                      parameters:
                        scriptId: 1111-2222-3333-4444-5555-6666-7777-8888
                      startedAt: '2022-07-29T19:08:49.126Z'
                      status: pending
                      wasSuccessful: false
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Management_API_ResponseActionCreateSuccessResponse'
          description: Indicates a successful call.
      summary: Run a script
      tags:
        - Security Endpoint Management API
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/endpoint/action/running_procs:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/endpoint/action/running_procs</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Get a list of all processes running on an endpoint.
      operationId: EndpointGetProcessesAction
      requestBody:
        content:
          application/json:
            examples:
              singleEndpoint:
                summary: Get running processes on a single endpoint
                value:
                  endpoint_ids:
                    - ed518850-681a-4d60-bb98-e22640cae2a8
            schema:
              $ref: '#/components/schemas/Security_Endpoint_Management_API_GetProcessesRouteRequestBody'
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                RunningProcsSuccess:
                  summary: Running processes action successfully created
                  value:
                    data:
                      agents:
                        - ed518850-681a-4d60-bb98-e22640cae2a8
                      agentState:
                        ed518850-681a-4d60-bb98-e22640cae2a8:
                          isCompleted: false
                          wasSuccessful: false
                      agentType: endpoint
                      command: running-processes
                      createdBy: elastic
                      hosts:
                        ed518850-681a-4d60-bb98-e22640cae2a8:
                          name: gke-node-1235412
                      id: 233db9ea-6733-4849-9226-5a7039c7161d
                      isCompleted: false
                      isExpired: false
                      outputs: {}
                      startedAt: '2022-07-29T19:08:49.126Z'
                      status: pending
                      wasSuccessful: false
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Management_API_ResponseActionCreateSuccessResponse'
          description: Indicates a successful call.
      summary: Get running processes
      tags:
        - Security Endpoint Management API
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/endpoint/action/scan:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/endpoint/action/scan</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Scan a specific file or directory on an endpoint for malware.
      operationId: EndpointScanAction
      requestBody:
        content:
          application/json:
            examples:
              scanFile:
                summary: Scan a file on an endpoint
                value:
                  comment: Scan the file for malware
                  endpoint_ids:
                    - ed518850-681a-4d60-bb98-e22640cae2a8
                  parameters:
                    path: /usr/my-file.txt
            schema:
              $ref: '#/components/schemas/Security_Endpoint_Management_API_ScanRouteRequestBody'
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                ScanSuccess:
                  summary: Scan action successfully created
                  value:
                    data:
                      agents:
                        - ed518850-681a-4d60-bb98-e22640cae2a8
                      agentState:
                        ed518850-681a-4d60-bb98-e22640cae2a8:
                          isCompleted: false
                          wasSuccessful: false
                      agentType: endpoint
                      command: scan
                      createdBy: elastic
                      hosts:
                        ed518850-681a-4d60-bb98-e22640cae2a8:
                          name: gke-node-1235412
                      id: 27ba1b42-7cc6-4e53-86ce-675c876092b2
                      isCompleted: false
                      isExpired: false
                      outputs: {}
                      parameters:
                        path: /usr/my-file.txt
                      startedAt: '2023-07-28T19:00:03.911Z'
                      status: pending
                      wasSuccessful: false
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Management_API_ResponseActionCreateSuccessResponse'
          description: Indicates a successful call.
      summary: Scan a file or directory
      tags:
        - Security Endpoint Management API
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/endpoint/action/state:
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/endpoint/action/state</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Get a response actions state, which reports whether encryption is enabled.
      operationId: EndpointGetActionsState
      responses:
        '200':
          content:
            application/json:
              examples:
                actionsState:
                  summary: Response actions state with encryption enabled
                  value:
                    data:
                      canEncrypt: true
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Management_API_ActionStateSuccessResponse'
          description: OK
      summary: Get actions state
      tags:
        - Security Endpoint Management API
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/endpoint/action/suspend_process:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/endpoint/action/suspend_process</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Suspend a running process on an endpoint.
      operationId: EndpointSuspendProcessAction
      requestBody:
        content:
          application/json:
            examples:
              byEntityId:
                summary: Suspend a process by entity ID
                value:
                  comment: Suspending suspicious process
                  endpoint_ids:
                    - ed518850-681a-4d60-bb98-e22640cae2a8
                  parameters:
                    entity_id: abc123
              byPid:
                summary: Suspend a process by PID
                value:
                  endpoint_ids:
                    - ed518850-681a-4d60-bb98-e22640cae2a8
                  parameters:
                    pid: 1234
            schema:
              $ref: '#/components/schemas/Security_Endpoint_Management_API_SuspendProcessRouteRequestBody'
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                SuspendProcessSuccess:
                  summary: Suspend process action successfully created
                  value:
                    data:
                      agents:
                        - ed518850-681a-4d60-bb98-e22640cae2a8
                      agentState:
                        ed518850-681a-4d60-bb98-e22640cae2a8:
                          isCompleted: false
                          wasSuccessful: false
                      agentType: endpoint
                      command: suspend-process
                      createdBy: elastic
                      hosts:
                        ed518850-681a-4d60-bb98-e22640cae2a8:
                          name: gke-node-1235412
                      id: 233db9ea-6733-4849-9226-5a7039c7161d
                      isCompleted: false
                      isExpired: false
                      outputs: {}
                      parameters:
                        entity_id: abc123
                      startedAt: '2022-07-29T19:08:49.126Z'
                      status: pending
                      wasSuccessful: false
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Management_API_ResponseActionCreateSuccessResponse'
          description: Indicates a successful call.
      summary: Suspend a process
      tags:
        - Security Endpoint Management API
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/endpoint/action/unisolate:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/endpoint/action/unisolate</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Release an isolated endpoint, allowing it to rejoin a network.
      operationId: EndpointUnisolateAction
      requestBody:
        content:
          application/json:
            examples:
              multipleHosts:
                summary: 'Releases several hosts; includes a comment:'
                value:
                  comment: Benign process identified, releasing group
                  endpoint_ids:
                    - 9972d10e-4b9e-41aa-a534-a85e2a28ea42
                    - bc0e4f0c-3bca-4633-9fee-156c0b505d16
                    - fa89271b-b9d4-43f2-a684-307cffddeb5a
              singleHost:
                summary: Releases a single host with an endpoint_id value of ed518850-681a-4d60-bb98-e22640cae2a8
                value:
                  endpoint_ids:
                    - ed518850-681a-4d60-bb98-e22640cae2a8
              withCaseId:
                summary: Releases hosts with an associated case; includes a comment.
                value:
                  case_ids:
                    - 4976be38-c134-4554-bd5e-0fd89ce63667
                  comment: Remediation complete, restoring network
                  endpoint_ids:
                    - 1aa1f8fd-0fb0-4fe4-8c30-92068272d3f0
                    - b30a11bf-1395-4707-b508-fbb45ef9793e
            schema:
              type: object
              properties:
                agent_type:
                  $ref: '#/components/schemas/Security_Endpoint_Management_API_AgentTypes'
                alert_ids:
                  description: If this action is associated with any alerts, they can be specified here. The action will be logged in any cases associated with the specified alerts. Max of 50.
                  example:
                    - alert-id-1
                    - alert-id-2
                  items:
                    maxLength: 256
                    minLength: 1
                    type: string
                  maxItems: 50
                  minItems: 1
                  type: array
                case_ids:
                  description: The IDs of cases where the action taken will be logged. Max of 50.
                  example:
                    - case-id-1
                    - case-id-2
                  items:
                    maxLength: 256
                    minLength: 1
                    type: string
                  maxItems: 50
                  minItems: 1
                  type: array
                comment:
                  $ref: '#/components/schemas/Security_Endpoint_Management_API_Comment'
                endpoint_ids:
                  $ref: '#/components/schemas/Security_Endpoint_Management_API_EndpointIds'
                parameters:
                  $ref: '#/components/schemas/Security_Endpoint_Management_API_Parameters'
              required:
                - endpoint_ids
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                UnisolateSuccess:
                  summary: Unisolate action successfully created
                  value:
                    action: 233db9ea-6733-4849-9226-5a7039c7161d
                    data:
                      agents:
                        - ed518850-681a-4d60-bb98-e22640cae2a8
                      agentState:
                        ed518850-681a-4d60-bb98-e22640cae2a8:
                          isCompleted: false
                          wasSuccessful: false
                      agentType: endpoint
                      command: unisolate
                      createdBy: elastic
                      hosts:
                        ed518850-681a-4d60-bb98-e22640cae2a8:
                          name: gke-node-1235412
                      id: 233db9ea-6733-4849-9226-5a7039c7161d
                      isCompleted: false
                      isExpired: false
                      outputs: {}
                      startedAt: '2022-07-29T19:08:49.126Z'
                      status: pending
                      wasSuccessful: false
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Management_API_UnisolateRouteResponse'
          description: Indicates a successful call.
      summary: Release an isolated endpoint
      tags:
        - Security Endpoint Management API
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/endpoint/action/upload:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/endpoint/action/upload</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Upload a file to an endpoint.
      operationId: EndpointUploadAction
      requestBody:
        content:
          multipart/form-data:
            examples:
              uploadFile:
                summary: Upload a script file to a specific endpoint
                value:
                  comment: Pushing remediation script to host
                  endpoint_ids:
                    - ed518850-681a-4d60-bb98-e22640cae2a8
                  file: RWxhc3RpYw==
                  parameters:
                    overwrite: false
            schema:
              $ref: '#/components/schemas/Security_Endpoint_Management_API_UploadRouteRequestBody'
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                UploadSuccess:
                  summary: Upload action successfully created
                  value:
                    data:
                      agents:
                        - ed518850-681a-4d60-bb98-e22640cae2a8
                      agentState:
                        ed518850-681a-4d60-bb98-e22640cae2a8:
                          isCompleted: false
                          wasSuccessful: false
                      agentType: endpoint
                      command: upload
                      createdBy: elastic
                      hosts:
                        ed518850-681a-4d60-bb98-e22640cae2a8:
                          name: Host-5i6cuc8kdv
                      id: 9ff6aebc-2cb6-481e-8869-9b30036c9731
                      isCompleted: false
                      isExpired: false
                      outputs: {}
                      parameters:
                        file_id: 10e4ce3d-4abb-4f93-a0cd-eaf63a489280
                        file_name: fix-malware.sh
                        file_sha256: a0bed94220193ba4895c0aa5b4e7e293381d15765cb164ddf7be5cdd010ae42a
                        file_size: 69
                      startedAt: '2023-07-03T15:07:22.837Z'
                      status: pending
                      wasSuccessful: false
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Management_API_ResponseActionCreateSuccessResponse'
          description: Indicates a successful call.
      summary: Upload a file
      tags:
        - Security Endpoint Management API
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/endpoint/metadata:
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/endpoint/metadata</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Get a list of all endpoint host metadata.
      operationId: GetEndpointMetadataList
      parameters:
        - description: The page number to return.
          in: query
          name: page
          required: false
          schema:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_Page'
        - description: The number of endpoints to return per page.
          in: query
          name: pageSize
          required: false
          schema:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_PageSize'
        - description: A KQL string to filter the endpoint metadata results.
          in: query
          name: kuery
          required: false
          schema:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_Kuery'
        - description: A set of host statuses to filter the results by (for example, `healthy`, `updating`).
          in: query
          name: hostStatuses
          required: true
          schema:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_HostStatuses'
        - description: The field used to sort the results.
          in: query
          name: sortField
          required: false
          schema:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_SortField'
        - description: The sort order, either `asc` or `desc`.
          in: query
          name: sortDirection
          required: false
          schema:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_SortDirection'
      responses:
        '200':
          content:
            application/json:
              examples:
                metadataList:
                  summary: A list of endpoint host metadata
                  value:
                    data:
                      - host_status: healthy
                        last_checkin: '2023-07-04T15:47:57.432Z'
                        metadata:
                          agent:
                            id: 285297c6-3bff-4b83-9a07-f3e749801123
                            type: endpoint
                            version: 8.10.0
                          Endpoint:
                            policy:
                              applied:
                                id: d5371dcd-93b7-4627-af88-4084f7d6aa3e
                                name: test
                                status: success
                            status: enrolled
                          host:
                            hostname: WinDev2104Eval
                            os:
                              name: Windows
                              platform: windows
                              version: 20H2
                    page: 0
                    pageSize: 10
                    sortDirection: desc
                    sortField: enrolled_at
                    total: 1
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Management_API_MetadataListResponse'
          description: Indicates a successful call.
      summary: Get a metadata list
      tags:
        - Security Endpoint Management API
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/endpoint/metadata/{id}:
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/endpoint/metadata/{id}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Get host metadata for a specific endpoint.
      operationId: GetEndpointMetadata
      parameters:
        - description: The agent ID of the endpoint.
          in: path
          name: id
          required: true
          schema:
            example: ed518850-681a-4d60-bb98-e22640cae2a8
            maxLength: 256
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                endpointMetadata:
                  summary: Host metadata for a specific endpoint
                  value:
                    host_status: healthy
                    last_checkin: '2023-07-04T15:48:57.360Z'
                    metadata:
                      agent:
                        id: abb8a826-6812-448c-a571-6d8269b51449
                        type: endpoint
                        version: 8.10.0
                      Endpoint:
                        policy:
                          applied:
                            id: d5371dcd-93b7-4627-af88-4084f7d6aa3e
                            name: test
                            status: success
                        status: enrolled
                      host:
                        hostname: WinDev2104Eval
                        os:
                          name: Windows
                          platform: windows
                          version: 20H2
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Management_API_EndpointMetadataResponse'
          description: Indicates a successful call.
      summary: Get metadata
      tags:
        - Security Endpoint Management API
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/endpoint/policy_response:
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/endpoint/policy_response</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Get the most recent policy response for an endpoint.
      operationId: GetPolicyResponse
      parameters:
        - description: The agent ID to retrieve the policy response for.
          in: query
          name: agentId
          required: true
          schema:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_AgentId'
      responses:
        '200':
          content:
            application/json:
              examples:
                policyResponse:
                  summary: The most recent policy response for an endpoint
                  value:
                    policy_response:
                      '@timestamp': '2023-07-04T15:48:57.360Z'
                      agent:
                        id: ed518850-681a-4d60-bb98-e22640cae2a8
                        version: 7.16.0
                      Endpoint:
                        policy:
                          applied:
                            endpoint_policy_version: '2'
                            id: d5371dcd-93b7-4627-af88-4084f7d6aa3e
                            name: My endpoint policy
                            status: success
                            version: '3'
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Management_API_SuccessResponse'
          description: Indicates a successful call.
      summary: Get a policy response
      tags:
        - Security Endpoint Management API
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/endpoint/protection_updates_note/{package_policy_id}:
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/endpoint/protection_updates_note/{package_policy_id}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Get the protection updates note for a package policy.
      operationId: GetProtectionUpdatesNote
      parameters:
        - description: The package policy ID to retrieve the protection updates note for.
          in: path
          name: package_policy_id
          required: true
          schema:
            maxLength: 256
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                protectionUpdatesNote:
                  summary: The protection updates note for a package policy
                  value:
                    note: Pinned protection updates to 2025-01-01 while validating new signatures.
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Management_API_ProtectionUpdatesNoteResponse'
          description: Indicates a successful call.
      summary: Get a protection updates note
      tags:
        - Security Endpoint Management API
      x-metaTags:
        - content: Kibana
          name: product_name
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/endpoint/protection_updates_note/{package_policy_id}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Create or update the protection updates note for a package policy.
      operationId: CreateUpdateProtectionUpdatesNote
      parameters:
        - description: The package policy ID to create or update the protection updates note for.
          in: path
          name: package_policy_id
          required: true
          schema:
            maxLength: 256
            type: string
      requestBody:
        content:
          application/json:
            examples:
              setNote:
                summary: Set a new protection updates note
                value:
                  note: Pinned protection updates to 2025-01-01 while validating new signatures.
            schema:
              type: object
              properties:
                note:
                  description: The note content.
                  maxLength: 10000
                  type: string
              required:
                - note
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                noteSaved:
                  summary: Protection updates note saved
                  value:
                    note: Pinned protection updates to 2025-01-01 while validating new signatures.
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Management_API_ProtectionUpdatesNoteResponse'
          description: Indicates a successful call.
      summary: Create or update a protection updates note
      tags:
        - Security Endpoint Management API
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/endpoint/scripts_library:
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/endpoint/scripts_library</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Retrieve a list of scripts
      operationId: EndpointScriptLibraryListScripts
      parameters:
        - description: Page number of the results to return. Defaults to 1.
          in: query
          name: page
          required: false
          schema:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_Page'
        - description: Number of results to return per page. Defaults to 10. Max value is 1000.
          in: query
          name: pageSize
          required: false
          schema:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_ApiPageSize'
        - description: The field to sort the results by. Defaults to name.
          in: query
          name: sortField
          required: false
          schema:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_ApiSortField'
        - description: The direction to sort the results by. Defaults to asc (ascending).
          in: query
          name: sortDirection
          required: false
          schema:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_SortDirection'
        - description: |
            A KQL query string to filter the list of scripts. Nearly all fields in the script object are searchable.
          in: query
          name: kuery
          required: false
          schema:
            allOf:
              - $ref: '#/components/schemas/Security_Endpoint_Management_API_Kuery'
              - example: platform:windows
      responses:
        '200':
          content:
            application/json:
              examples:
                response:
                  summary: List of scripts response example
                  value:
                    data: []
                    page: 1
                    pageSize: 10
                    sortDirection: asc
                    sortField: name
                    total: 100
              schema:
                type: object
                properties:
                  data:
                    items:
                      $ref: '#/components/schemas/Security_Endpoint_Management_API_EndpointScript'
                    type: array
                  page:
                    $ref: '#/components/schemas/Security_Endpoint_Management_API_Page'
                  pageSize:
                    $ref: '#/components/schemas/Security_Endpoint_Management_API_ApiPageSize'
                  sortDirection:
                    $ref: '#/components/schemas/Security_Endpoint_Management_API_SortDirection'
                  sortField:
                    $ref: '#/components/schemas/Security_Endpoint_Management_API_ApiSortField'
                  total:
                    description: The total number of scripts matching the query
                    type: integer
          description: List of scripts response
      summary: Get a list of scripts
      tags:
        - Security Endpoint Management API
      x-metaTags:
        - content: Kibana
          name: product_name
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/endpoint/scripts_library</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Create a new script entry by uploading a script file
      operationId: EndpointScriptLibraryCreateScript
      requestBody:
        content:
          multipart/form-data:
            examples:
              CreateArchiveScriptEntry:
                summary: Create an archive script entry
                value:
                  description: Collects host data for investigation
                  example: ./collect_host_data.sh --help
                  file: ./collect_host_data.zip
                  fileType: archive
                  instructions: Collects host data for investigation
                  name: Collect host data
                  pathToExecutable: ./bin/collect_host_data.sh
                  platform:
                    - linux
                    - macos
                  requiresInput: false
              CreateScriptEntry:
                summary: Create a script entry
                value:
                  description: Collects host data for investigation
                  example: ./collect_host_data.sh --help
                  file: ./collect_host_data.sh
                  fileType: script
                  instructions: Collects host data for investigation
                  name: Collect host data
                  platform:
                    - linux
                    - macos
                  requiresInput: false
            schema:
              $ref: '#/components/schemas/Security_Endpoint_Management_API_CreateScriptRouteRequestBody'
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                CreateScriptEntrySuccess:
                  summary: Create a script entry
                  value:
                    data:
                      description: Collects host data for investigation
                      file: ./collect_host_data.sh
                      fileType: script
                      id: 1234567890
                      instructions: No arguments required
                      name: Collect host data
                      platform:
                        - linux
                        - macos
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Management_API_ScriptsApiResponse'
          description: Action request was successfully created
      summary: Create script
      tags:
        - Security Endpoint Management API
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/endpoint/scripts_library/{script_id}:
    delete:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb delete">delete</span>&nbsp;<span class="operation-path">/s/{space_id}/api/endpoint/scripts_library/{script_id}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Delete a script
      operationId: EndpointScriptLibraryDeleteScript
      parameters:
        - description: The ID of the script entry to be deleted.
          example: fr518850-681a-4y60-aa98-e22640cae2b8
          in: path
          name: script_id
          required: true
          schema:
            description: The ID of the script entry to be deleted.
            example: fr518850-681a-4y60-aa98-e22640cae2b8
            maxLength: 256
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                response:
                  summary: Delete script response example.
                  value: {}
              schema:
                type: object
          description: Delete script response.
      summary: Delete a script
      tags:
        - Security Endpoint Management API
      x-metaTags:
        - content: Kibana
          name: product_name
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/endpoint/scripts_library/{script_id}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Get a script
      operationId: EndpointScriptLibraryGetOneScript
      parameters:
        - description: The ID of the script entry.
          example: fr518850-681a-4y60-aa98-e22640cae2b8
          in: path
          name: script_id
          required: true
          schema:
            description: The ID of the script entry.
            example: fr518850-681a-4y60-aa98-e22640cae2b8
            maxLength: 256
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                UpdateScriptEntrySuccess:
                  summary: Get one script entry success
                  value:
                    data:
                      description: Collects host data for investigation
                      file: ./collect_host_data.sh
                      fileType: script
                      id: 1234567890
                      instructions: No arguments required
                      name: Collect host data
                      platform:
                        - linux
                        - macos
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Management_API_ScriptsApiResponse'
          description: Get script response
      summary: Get script
      tags:
        - Security Endpoint Management API
      x-metaTags:
        - content: Kibana
          name: product_name
    patch:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb patch">patch</span>&nbsp;<span class="operation-path">/s/{space_id}/api/endpoint/scripts_library/{script_id}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Update (full or partial) a script entry
      operationId: EndpointScriptLibraryPatchUpdateScript
      parameters:
        - description: The ID of the script entry to be updated.
          example: fr518850-681a-4y60-aa98-e22640cae2b8
          in: path
          name: script_id
          required: true
          schema:
            description: The ID of the script entry to be updated.
            example: fr518850-681a-4y60-aa98-e22640cae2b8
            maxLength: 256
            type: string
      requestBody:
        content:
          multipart/form-data:
            examples:
              PatchUpdateScriptEntry:
                summary: Update script entry instructions
                value:
                  instructions: ./collect_host_data.sh --help
              PatchUpdateScriptEntryFromArchiveToScript:
                summary: Update script entry from an archive to a script
                value:
                  fileType: script
              PatchUpdateScriptEntryToArchive:
                summary: Update script entry to be an archive
                value:
                  fileType: archive
                  pathToExecutable: ./bin/collect_host_data.sh
            schema:
              $ref: '#/components/schemas/Security_Endpoint_Management_API_PatchUpdateScriptRouteRequestBody'
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                UpdateScriptEntrySuccess:
                  summary: Update script entry success
                  value:
                    data:
                      description: Collects host data for investigation
                      file: ./collect_host_data.sh
                      fileType: script
                      id: 1234567890
                      instructions: No arguments required
                      name: Collect host data
                      platform:
                        - linux
                        - macos
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Management_API_ScriptsApiResponse'
          description: Action request was successfully updated
      summary: Update script
      tags:
        - Security Endpoint Management API
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/endpoint/scripts_library/{script_id}/download:
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/endpoint/scripts_library/{script_id}/download</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Download a script file
      operationId: EndpointScriptLibraryDownloadScript
      parameters:
        - description: The ID of the script entry.
          example: fr518850-681a-4y60-aa98-e22640cae2b8
          in: path
          name: script_id
          required: true
          schema:
            description: The ID of the script entry.
            example: fr518850-681a-4y60-aa98-e22640cae2b8
            maxLength: 256
            type: string
      responses:
        '200':
          content:
            application/octet-stream:
              examples:
                response:
                  summary: Download script file response example.
                  value: null
              schema:
                description: A download stream is returned.
                format: binary
                type: string
          description: Download script file response.
      summary: Download a script file
      tags:
        - Security Endpoint Management API
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/entity_analytics/monitoring/engine/delete:
    delete:
      deprecated: true
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb delete">delete</span>&nbsp;<span class="operation-path">/s/{space_id}/api/entity_analytics/monitoring/engine/delete</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        **Deprecated in 9.4.0.** Deletes the Privilege Monitoring Engine and optionally removes all associated privileged user data.
      operationId: DeleteMonitoringEngine
      parameters:
        - description: Whether to delete all the privileged user data
          in: query
          name: data
          required: false
          schema:
            default: false
            type: boolean
      responses:
        '200':
          content:
            application/json:
              examples:
                DeleteMonitoringEngineResponse:
                  summary: Engine deleted successfully
                  value:
                    deleted: true
              schema:
                type: object
                properties:
                  deleted:
                    type: boolean
                required:
                  - deleted
          description: Successful response
      summary: Delete the Privilege Monitoring Engine
      tags:
        - Security Entity Analytics API
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/entity_analytics/monitoring/engine/disable:
    post:
      deprecated: true
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/entity_analytics/monitoring/engine/disable</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        **Deprecated in 9.4.0.** Disables the Privilege Monitoring Engine, stopping all monitoring activity without removing data.
      operationId: DisableMonitoringEngine
      responses:
        '200':
          content:
            application/json:
              examples:
                DisableMonitoringEngineResponse:
                  summary: Engine disabled successfully
                  value:
                    status: disabled
              schema:
                $ref: '#/components/schemas/Security_Entity_Analytics_API_MonitoringEngineDescriptor'
          description: Successful response
      summary: Disable the Privilege Monitoring Engine
      tags:
        - Security Entity Analytics API
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/entity_analytics/monitoring/engine/init:
    post:
      deprecated: true
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/entity_analytics/monitoring/engine/init</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        **Deprecated in 9.4.0.** Initializes the Privilege Monitoring Engine, setting up the required resources and starting the engine.
      operationId: InitMonitoringEngine
      responses:
        '200':
          content:
            application/json:
              examples:
                InitMonitoringEngineResponse:
                  summary: Engine initialized successfully
                  value:
                    status: started
              schema:
                $ref: '#/components/schemas/Security_Entity_Analytics_API_MonitoringEngineDescriptor'
          description: Successful response
        '500':
          content:
            application/json:
              examples:
                InitMonitoringEngineError:
                  summary: Internal server error during engine initialization
                  value:
                    error:
                      message: Failed to initialize monitoring engine
                    status: error
              schema:
                $ref: '#/components/schemas/Security_Entity_Analytics_API_MonitoringEngineDescriptor'
          description: Internal Server Error
      summary: Initialize the Privilege Monitoring Engine
      tags:
        - Security Entity Analytics API
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/entity_analytics/monitoring/engine/schedule_now:
    post:
      deprecated: true
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/entity_analytics/monitoring/engine/schedule_now</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        **Deprecated in 9.4.0.** Schedules the Privilege Monitoring Engine to run as soon as possible, triggering an immediate monitoring cycle.
      operationId: ScheduleMonitoringEngine
      responses:
        '200':
          content:
            application/json:
              examples:
                ScheduleMonitoringEngineResponse:
                  summary: Engine scheduled successfully
                  value:
                    success: true
              schema:
                type: object
                properties:
                  success:
                    description: Indicates the scheduling was successful
                    type: boolean
          description: Successful response
        '409':
          content:
            application/json:
              examples:
                ScheduleMonitoringEngineConflict:
                  summary: Engine is already running
                  value:
                    message: Monitoring engine is already running
              schema:
                type: object
                properties:
                  message:
                    description: Error message indicating the engine is already running
                    type: string
          description: Conflict - Monitoring engine is already running
      summary: Schedule the Privilege Monitoring Engine
      tags:
        - Security Entity Analytics API
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/entity_analytics/monitoring/privileges/health:
    get:
      deprecated: true
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/entity_analytics/monitoring/privileges/health</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        **Deprecated in 9.4.0.** Returns the current health status of the Privilege Monitoring Engine, including engine status, error details, and user count statistics.
      operationId: PrivMonHealth
      responses:
        '200':
          content:
            application/json:
              examples:
                PrivMonHealthResponse:
                  summary: Healthy privilege monitoring engine
                  value:
                    status: started
                    users:
                      current_count: 42
                      max_allowed: 1000
              schema:
                type: object
                properties:
                  error:
                    type: object
                    properties:
                      message:
                        type: string
                    required:
                      - status
                  status:
                    $ref: '#/components/schemas/Security_Entity_Analytics_API_PrivilegeMonitoringEngineStatus'
                  users:
                    description: User statistics for privilege monitoring
                    type: object
                    properties:
                      current_count:
                        description: Current number of privileged users being monitored
                        type: integer
                      max_allowed:
                        description: Maximum number of privileged users allowed to be monitored
                        type: integer
                    required:
                      - current_count
                      - max_allowed
                required:
                  - status
          description: Successful response
      summary: Health check on Privilege Monitoring
      tags:
        - Security Entity Analytics API
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/entity_analytics/monitoring/privileges/privileges:
    get:
      deprecated: true
      description: |
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/entity_analytics/monitoring/privileges/privileges</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        **Deprecated in 9.4.0.** Use the Watchlists APIs instead.

        Check if the current user has all required permissions for Privilege Monitoring.
      operationId: PrivMonPrivileges
      responses:
        '200':
          content:
            application/json:
              examples:
                PrivMonPrivilegesResponse:
                  summary: Privileges check response
                  value:
                    has_all_required: true
                    privileges:
                      elasticsearch:
                        index:
                          .entity_analytics.monitoring.user-default:
                            read: true
              schema:
                $ref: '#/components/schemas/Security_Entity_Analytics_API_EntityAnalyticsPrivileges'
          description: Successful response
      summary: Run a privileges check on Privilege Monitoring
      tags:
        - Security Entity Analytics API
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/entity_analytics/monitoring/users:
    post:
      deprecated: true
      description: |
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/entity_analytics/monitoring/users</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        **Deprecated in 9.4.0.** Use the Watchlists API instead.

        Creates a new privileged user to be monitored by the Privilege Monitoring Engine.
      operationId: CreatePrivMonUser
      requestBody:
        content:
          application/json:
            examples:
              CreatePrivMonUserRequest:
                summary: Create a monitored user
                value:
                  entity_analytics_monitoring:
                    labels:
                      - field: department
                        source: api
                        value: IT
                  user:
                    name: john.doe
            schema:
              $ref: '#/components/schemas/Security_Entity_Analytics_API_UserName'
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                CreatePrivMonUserResponse:
                  summary: Created monitored user
                  value:
                    '@timestamp': '2026-01-28T12:00:00.000Z'
                    entity_analytics_monitoring:
                      labels:
                        - field: department
                          source: api
                          value: IT
                    event:
                      ingested: '2026-01-28T12:00:00.000Z'
                    id: user-abc-123
                    user:
                      is_privileged: true
                      name: john.doe
              schema:
                $ref: '#/components/schemas/Security_Entity_Analytics_API_MonitoredUserDoc'
          description: User created successfully
      summary: Create a new monitored user
      tags:
        - Security Entity Analytics API
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/entity_analytics/monitoring/users/_csv:
    post:
      deprecated: true
      description: |
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/entity_analytics/monitoring/users/_csv</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        **Deprecated in 9.4.0.** Use the Watchlists API instead.

        Bulk upserts privileged users by uploading a CSV file. Returns per-row errors and aggregate upload statistics.
      operationId: PrivmonBulkUploadUsersCSV
      requestBody:
        content:
          multipart/form-data:
            examples:
              PrivmonBulkUploadUsersCSVRequest:
                summary: CSV file with privileged users
                value:
                  file: |
                    username,is_privileged
                    john.doe,true
                    jane.smith,true
            schema:
              type: object
              properties:
                file:
                  description: The CSV file to upload.
                  format: binary
                  type: string
              required:
                - file
      responses:
        '200':
          content:
            application/json:
              examples:
                PrivmonBulkUploadUsersCSVResponse:
                  summary: Bulk upload response with mixed results
                  value:
                    errors:
                      - index: 1
                        message: Invalid monitored field
                        username: john.doe
                    stats:
                      failedOperations: 1
                      successfulOperations: 1
                      totalOperations: 2
                      uploaded: 2
              schema:
                type: object
                properties:
                  errors:
                    items:
                      $ref: '#/components/schemas/Security_Entity_Analytics_API_PrivmonUserCsvUploadErrorItem'
                    type: array
                  stats:
                    $ref: '#/components/schemas/Security_Entity_Analytics_API_PrivmonUserCsvUploadStats'
                required:
                  - errors
                  - stats
          description: Bulk upload successful
        '413':
          description: File too large
      summary: Upsert multiple monitored users via CSV upload
      tags:
        - Security Entity Analytics API
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/entity_analytics/monitoring/users/{id}:
    delete:
      deprecated: true
      description: |
        **Spaces method and path for this operation:**

        <div><span class="operation-verb delete">delete</span>&nbsp;<span class="operation-path">/s/{space_id}/api/entity_analytics/monitoring/users/{id}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        **Deprecated in 9.4.0.** Use the Watchlists API instead.

        Removes a privileged user from monitoring by their document ID.
      operationId: DeletePrivMonUser
      parameters:
        - description: The document ID of the monitored user to delete
          in: path
          name: id
          required: true
          schema:
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                DeletePrivMonUserResponse:
                  summary: User deleted successfully
                  value:
                    acknowledged: true
                    message: User deleted successfully
              schema:
                type: object
                properties:
                  acknowledged:
                    description: Indicates if the deletion was successful
                    type: boolean
                  message:
                    description: A message providing additional information about the deletion status
                    type: string
                required:
                  - success
          description: User deleted successfully
      summary: Delete a monitored user
      tags:
        - Security Entity Analytics API
      x-metaTags:
        - content: Kibana
          name: product_name
    put:
      deprecated: true
      description: |
        **Spaces method and path for this operation:**

        <div><span class="operation-verb put">put</span>&nbsp;<span class="operation-path">/s/{space_id}/api/entity_analytics/monitoring/users/{id}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        **Deprecated in 9.4.0.** Use the Watchlists API instead.

        Updates the details of an existing monitored privileged user by their document ID.
      operationId: UpdatePrivMonUser
      parameters:
        - description: The document ID of the monitored user to update
          in: path
          name: id
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            examples:
              UpdatePrivMonUserRequest:
                summary: Update a monitored user
                value:
                  entity_analytics_monitoring:
                    labels:
                      - field: department
                        source: api
                        value: Security
                  user:
                    is_privileged: true
                    name: john.doe
            schema:
              $ref: '#/components/schemas/Security_Entity_Analytics_API_MonitoredUserUpdateDoc'
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                UpdatePrivMonUserResponse:
                  summary: Updated monitored user
                  value:
                    '@timestamp': '2026-01-28T12:00:00.000Z'
                    entity_analytics_monitoring:
                      labels:
                        - field: department
                          source: api
                          value: Security
                    event:
                      ingested: '2026-01-28T12:00:00.000Z'
                    id: user-abc-123
                    user:
                      is_privileged: true
                      name: john.doe
              schema:
                $ref: '#/components/schemas/Security_Entity_Analytics_API_MonitoredUserDoc'
          description: User updated successfully
      summary: Update a monitored user
      tags:
        - Security Entity Analytics API
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/entity_analytics/monitoring/users/list:
    get:
      deprecated: true
      description: |
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/entity_analytics/monitoring/users/list</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        **Deprecated in 9.4.0.** Use the Watchlists API instead.

        Returns a list of all privileged users currently being monitored. Supports optional KQL filtering.
      operationId: ListPrivMonUsers
      parameters:
        - description: KQL query to filter the list of monitored users
          in: query
          name: kql
          required: false
          schema:
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                ListPrivMonUsersResponse:
                  summary: List of monitored users
                  value:
                    - '@timestamp': '2026-01-28T12:00:00.000Z'
                      entity_analytics_monitoring:
                        labels:
                          - field: department
                            source: api
                            value: IT
                      event:
                        ingested: '2026-01-28T12:00:00.000Z'
                      id: user-abc-123
                      user:
                        is_privileged: true
                        name: john.doe
                    - '@timestamp': '2026-01-15T09:00:00.000Z'
                      entity_analytics_monitoring:
                        labels:
                          - field: department
                            source: csv
                            value: Security
                      event:
                        ingested: '2026-01-15T09:00:00.000Z'
                      id: user-def-456
                      user:
                        is_privileged: true
                        name: jane.smith
              schema:
                items:
                  $ref: '#/components/schemas/Security_Entity_Analytics_API_MonitoredUserDoc'
                type: array
          description: List of monitored users
      summary: List all monitored users
      tags:
        - Security Entity Analytics API
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/entity_analytics/privileged_user_monitoring/pad/install:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/entity_analytics/privileged_user_monitoring/pad/install</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Installs the privileged access detection integration package and sets up the associated ML modules required for the Entity Analytics privileged user monitoring experience.
      operationId: InstallPrivilegedAccessDetectionPackage
      responses:
        '200':
          content:
            application/json:
              examples:
                InstallPrivilegedAccessDetectionPackageResponse:
                  summary: Package installed successfully
                  value:
                    message: Privileged access detection package installed successfully
              schema:
                type: object
                properties:
                  message:
                    type: string
                required:
                  - message
          description: Successful response
      summary: Installs the privileged access detection package for the Entity Analytics privileged user monitoring experience
      tags:
        - Security Entity Analytics API
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/entity_analytics/privileged_user_monitoring/pad/status:
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/entity_analytics/privileged_user_monitoring/pad/status</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Returns the installation and ML module setup status of the privileged access detection package, along with the state of each associated ML job.
      operationId: GetPrivilegedAccessDetectionPackageStatus
      responses:
        '200':
          content:
            application/json:
              examples:
                GetPrivilegedAccessDetectionPackageStatusResponse:
                  summary: Package fully installed and running
                  value:
                    jobs:
                      - description: Detects high-risk login patterns
                        job_id: pad-high-risk-login
                        state: opened
                      - description: Detects privilege escalation events
                        job_id: pad-privilege-escalation
                        state: opened
                    ml_module_setup_status: complete
                    package_installation_status: complete
              schema:
                type: object
                properties:
                  jobs:
                    items:
                      type: object
                      properties:
                        description:
                          type: string
                        job_id:
                          type: string
                        state:
                          enum:
                            - closing
                            - closed
                            - opened
                            - failed
                            - opening
                          type: string
                      required:
                        - job_id
                        - state
                    type: array
                  ml_module_setup_status:
                    enum:
                      - complete
                      - incomplete
                    type: string
                  package_installation_status:
                    enum:
                      - complete
                      - incomplete
                    type: string
                required:
                  - package_installation_status
                  - ml_module_setup_status
                  - jobs
          description: Privileged access detection status retrieved
      summary: Gets the status of the privileged access detection package for the Entity Analytics privileged user monitoring experience
      tags:
        - Security Entity Analytics API
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/entity_analytics/watchlists:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/entity_analytics/watchlists</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Creates a new entity analytics watchlist with an optional set of entity sources. Watchlists apply a risk score modifier to matched entities.
      operationId: CreateWatchlist
      requestBody:
        content:
          application/json:
            examples:
              CreateWatchlistRequest:
                summary: Create watchlist request
                value:
                  description: High risk vendor watchlist
                  managed: false
                  name: High Risk Vendors
                  riskModifier: 1.5
              CreateWatchlistWithSourcesRequest:
                summary: Create watchlist with entity sources
                value:
                  description: High risk vendor watchlist
                  entitySources:
                    - enabled: true
                      identifierField: user.name
                      indexPattern: my-sync-index
                      name: My User Index Source
                      type: index
                  managed: false
                  name: High Risk Vendors
                  riskModifier: 1.5
            schema:
              type: object
              properties:
                description:
                  description: Description of the watchlist
                  maxLength: 1000
                  type: string
                entitySources:
                  description: Optional entity sources to create and link to the watchlist
                  items:
                    additionalProperties: false
                    type: object
                    properties:
                      enabled:
                        type: boolean
                      filter:
                        $ref: '#/components/schemas/Security_Entity_Analytics_API_Filter'
                      identifierField:
                        description: Field used to query the entity store for index-type sources
                        maxLength: 256
                        type: string
                      indexPattern:
                        maxLength: 1000
                        type: string
                      integrationName:
                        description: Required when type is entity_analytics_integration. One of entityanalytics_okta, entityanalytics_ad.
                        maxLength: 256
                        type: string
                      matchers:
                        items:
                          $ref: '#/components/schemas/Security_Entity_Analytics_API_Matcher'
                        maxItems: 100
                        type: array
                      name:
                        maxLength: 256
                        type: string
                      queryRule:
                        description: KQL query used to filter data from the provided index patterns
                        maxLength: 4096
                        type: string
                      range:
                        $ref: '#/components/schemas/Security_Entity_Analytics_API_DateRange'
                      type:
                        $ref: '#/components/schemas/Security_Entity_Analytics_API_EntitySourceType'
                    required:
                      - type
                      - name
                  maxItems: 100
                  type: array
                managed:
                  description: Indicates if the watchlist is managed by the system
                  type: boolean
                name:
                  description: Unique name for the watchlist
                  maxLength: 256
                  type: string
                riskModifier:
                  description: Risk score modifier associated with the watchlist
                  maximum: 2
                  minimum: 0
                  type: number
              required:
                - name
                - riskModifier
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                CreateWatchlistResponse:
                  summary: Created watchlist
                  value:
                    createdAt: '2026-01-28T12:00:00.000Z'
                    description: High risk vendor watchlist
                    id: watchlist-123
                    managed: false
                    name: High Risk Vendors
                    riskModifier: 1.5
                    updatedAt: '2026-01-28T12:00:00.000Z'
              schema:
                allOf:
                  - $ref: '#/components/schemas/Security_Entity_Analytics_API_WatchlistObject'
                  - type: object
                    properties:
                      entitySources:
                        items:
                          $ref: '#/components/schemas/Security_Entity_Analytics_API_MonitoringEntitySource'
                        type: array
          description: Watchlist created successfully
      summary: Create a new watchlist
      tags:
        - Security Entity Analytics API
      x-state: Technical Preview
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/entity_analytics/watchlists/{id}:
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/entity_analytics/watchlists/{id}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Retrieves the details of an entity analytics watchlist by its unique identifier.
      operationId: GetWatchlist
      parameters:
        - description: Unique ID of the watchlist
          in: path
          name: id
          required: true
          schema:
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                GetWatchlistResponse:
                  summary: Watchlist details
                  value:
                    createdAt: '2026-01-28T12:00:00.000Z'
                    description: High risk vendor watchlist
                    id: watchlist-123
                    managed: false
                    name: High Risk Vendors
                    riskModifier: 1.5
                    updatedAt: '2026-02-18T12:00:00.000Z'
              schema:
                $ref: '#/components/schemas/Security_Entity_Analytics_API_WatchlistObject'
          description: Watchlist details
      summary: Get a watchlist by ID
      tags:
        - Security Entity Analytics API
      x-state: Technical Preview
      x-metaTags:
        - content: Kibana
          name: product_name
    put:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb put">put</span>&nbsp;<span class="operation-path">/s/{space_id}/api/entity_analytics/watchlists/{id}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Updates the name, description, risk modifier, or managed status of an existing entity analytics watchlist.
      operationId: UpdateWatchlist
      parameters:
        - description: The ID of the watchlist to update
          in: path
          name: id
          required: true
          schema:
            maxLength: 256
            type: string
      requestBody:
        content:
          application/json:
            examples:
              UpdateWatchlistRequest:
                summary: Update watchlist request
                value:
                  description: High risk vendor watchlist
                  managed: false
                  name: High Risk Vendors
                  riskModifier: 1.5
            schema:
              type: object
              properties:
                description:
                  description: Description of the watchlist
                  maxLength: 1000
                  type: string
                managed:
                  description: Indicates if the watchlist is managed by the system
                  type: boolean
                name:
                  description: Unique name of the watchlist
                  maxLength: 256
                  type: string
                riskModifier:
                  description: Risk score modifier associated with the watchlist
                  maximum: 2
                  minimum: 0
                  type: number
              required:
                - name
                - riskModifier
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                UpdateWatchlistResponse:
                  summary: Updated watchlist
                  value:
                    createdAt: '2026-01-28T12:00:00.000Z'
                    description: High risk vendor watchlist
                    id: watchlist-123
                    managed: false
                    name: High Risk Vendors
                    riskModifier: 1.5
                    updatedAt: '2026-02-18T12:00:00.000Z'
              schema:
                $ref: '#/components/schemas/Security_Entity_Analytics_API_WatchlistObject'
          description: Watchlist updated successfully
      summary: Update an existing watchlist
      tags:
        - Security Entity Analytics API
      x-state: Technical Preview
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/entity_analytics/watchlists/{watchlist_id}/csv_upload:
    post:
      description: |
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/entity_analytics/watchlists/{watchlist_id}/csv_upload</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Uploads a CSV file to add entities to a watchlist. The CSV must contain a header row
        with a "type" column (user, host, service, or generic) and one or more ECS identity
        fields (e.g. "user.name", "host.hostname") used to match entities in the entity store.

        Matched entities are added to the watchlist and their `entity.attributes.watchlists`
        field is updated in the entity store.

        Each row will match up to 10,000 entities.
      operationId: UploadWatchlistCsv
      parameters:
        - description: The ID of the watchlist to add entities to
          example: high-risk-vendors
          in: path
          name: watchlist_id
          required: true
          schema:
            type: string
      requestBody:
        content:
          multipart/form-data:
            examples:
              csvUpload:
                summary: CSV file with user entities
                value:
                  file: |
                    type,user.name
                    user,john.doe
                    user,jane.smith
            schema:
              type: object
              properties:
                file:
                  description: The CSV file to upload.
                  format: binary
                  type: string
              required:
                - file
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                CsvUploadResponse:
                  summary: CSV upload response with mixed results
                  value:
                    failed: 1
                    items:
                      - matchedEntities: 1
                        status: success
                      - error: Invalid entity type
                        matchedEntities: 0
                        status: failure
                      - matchedEntities: 0
                        status: unmatched
                    successful: 1
                    total: 3
                    unmatched: 1
              schema:
                type: object
                properties:
                  failed:
                    description: Number of rows that failed to process
                    example: 1
                    type: integer
                  items:
                    items:
                      $ref: '#/components/schemas/Security_Entity_Analytics_API_WatchlistCsvUploadResponseItem'
                    type: array
                  successful:
                    description: Number of rows that matched at least one entity
                    example: 1
                    type: integer
                  total:
                    description: Total number of rows processed
                    example: 3
                    type: integer
                  unmatched:
                    description: Number of rows that matched no entities
                    example: 1
                    type: integer
                required:
                  - successful
                  - failed
                  - total
                  - unmatched
                  - items
          description: Upload successful
        '413':
          description: File too large
      summary: Upload a CSV file to add entities to a watchlist
      tags:
        - Security Entity Analytics API
      x-state: Technical Preview
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/entity_analytics/watchlists/{watchlist_id}/entities/assign:
    post:
      description: |
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/entity_analytics/watchlists/{watchlist_id}/entities/assign</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Assigns the provided entities to the specified watchlist using a "manual" source label.
        The entities must already exist in the entity store.

        If an entity is already on the watchlist, no new document is created — the "manual" label
        is added to its existing source labels instead.
      operationId: AssignWatchlistEntities
      parameters:
        - description: The ID of the watchlist to add entities to
          example: high-risk-vendors
          in: path
          name: watchlist_id
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            examples:
              assignEntities:
                summary: Assign two entities to a watchlist
                value:
                  euids:
                    - user:john.doe
                    - host:web-01
            schema:
              type: object
              properties:
                euids:
                  description: The EUIDs of the entities to assign
                  example:
                    - user:john.doe
                    - host:web-01
                  items:
                    type: string
                  type: array
              required:
                - euids
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                assignEntitiesResponse:
                  summary: Successful assignment of two entities
                  value:
                    failed: 0
                    items:
                      - euid: user:john.doe
                        status: success
                      - euid: host:web-01
                        status: not_found
                    not_found: 1
                    successful: 1
                    total: 2
              schema:
                type: object
                properties:
                  failed:
                    description: Number of entities that failed to process
                    example: 0
                    type: integer
                  items:
                    items:
                      $ref: '#/components/schemas/Security_Entity_Analytics_API_WatchlistEntityAssignResponseItem'
                    type: array
                  not_found:
                    description: Number of entities not found in the entity store
                    example: 1
                    type: integer
                  successful:
                    description: Number of entities successfully assigned
                    example: 1
                    type: integer
                  total:
                    description: Total number of entities processed
                    example: 2
                    type: integer
                required:
                  - successful
                  - failed
                  - not_found
                  - total
                  - items
          description: Assignment successful
      summary: Manually assign entities to a watchlist
      tags:
        - Security Entity Analytics API
      x-state: Technical Preview; added in 9.4.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/entity_analytics/watchlists/{watchlist_id}/entities/unassign:
    post:
      description: |
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/entity_analytics/watchlists/{watchlist_id}/entities/unassign</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Unassigns the provided entities from the specified watchlist.
        This only removes the "manual" assignment. If the entity is also
        assigned via other sources (for example, index or integration), it will
        remain on the watchlist.
      operationId: UnassignWatchlistEntities
      parameters:
        - description: The ID of the watchlist to remove entities from
          example: high-risk-vendors
          in: path
          name: watchlist_id
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            examples:
              unassignEntities:
                summary: Unassign two entities from a watchlist
                value:
                  euids:
                    - user:john.doe
                    - host:web-01
            schema:
              type: object
              properties:
                euids:
                  description: The EUIDs of the entities to unassign
                  example:
                    - user:john.doe
                    - host:web-01
                  items:
                    type: string
                  type: array
              required:
                - euids
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                unassignEntitiesResponse:
                  summary: Successful unassignment of two entities
                  value:
                    failed: 0
                    items:
                      - euid: user:john.doe
                        status: success
                      - euid: host:web-01
                        status: not_found
                    not_found: 1
                    successful: 1
                    total: 2
              schema:
                type: object
                properties:
                  failed:
                    description: Number of entities that failed to process
                    example: 0
                    type: integer
                  items:
                    items:
                      $ref: '#/components/schemas/Security_Entity_Analytics_API_WatchlistEntityUnassignResponseItem'
                    type: array
                  not_found:
                    description: Number of entities not found in the manual watchlist assignment
                    example: 1
                    type: integer
                  successful:
                    description: Number of entities successfully unassigned
                    example: 1
                    type: integer
                  total:
                    description: Total number of entities processed
                    example: 2
                    type: integer
                required:
                  - successful
                  - failed
                  - not_found
                  - total
                  - items
          description: Unassignment successful
      summary: Manually unassign entities from a watchlist
      tags:
        - Security Entity Analytics API
      x-state: Technical Preview; added in 9.4.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/entity_analytics/watchlists/list:
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/entity_analytics/watchlists/list</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Returns a list of all entity analytics watchlists.
      operationId: ListWatchlists
      responses:
        '200':
          content:
            application/json:
              examples:
                ListWatchlistsResponse:
                  summary: List of watchlists
                  value:
                    - createdAt: '2026-01-28T12:00:00.000Z'
                      description: High risk vendor watchlist
                      id: watchlist-123
                      managed: false
                      name: High Risk Vendors
                      riskModifier: 1.5
                      updatedAt: '2026-02-18T12:00:00.000Z'
                    - createdAt: '2026-01-10T09:30:00.000Z'
                      description: Privileged user monitoring watchlist
                      id: watchlist-456
                      managed: true
                      name: Privileged Accounts
                      riskModifier: 2
                      updatedAt: '2026-02-01T15:45:00.000Z'
              schema:
                items:
                  $ref: '#/components/schemas/Security_Entity_Analytics_API_WatchlistObject'
                type: array
          description: List of watchlists
      summary: List all watchlists
      tags:
        - Security Entity Analytics API
      x-state: Technical Preview
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/exception_lists:
    delete:
      description: |
        **Spaces method and path for this operation:**

        <div><span class="operation-verb delete">delete</span>&nbsp;<span class="operation-path">/s/{space_id}/api/exception_lists</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Delete an exception list using the `id` or `list_id` field.

        Before deleting an exception list that is linked to detection rules, remove or unlink the
        exception list from those rules. Deleting a linked exception list can leave rules referencing
        an exception list that no longer exists.
      operationId: DeleteExceptionList
      parameters:
        - description: Exception list's identifier. Either `id` or `list_id` must be specified.
          in: query
          name: id
          required: false
          schema:
            $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListId'
        - description: Human readable exception list string identifier, e.g. `trusted-linux-processes`. Either `id` or `list_id` must be specified.
          examples:
            autogeneratedId:
              value: 71a9f4b2-c85c-49b4-866f-c71eb9e67da2
            list_id:
              value: simple_list
          in: query
          name: list_id
          required: false
          schema:
            $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListHumanId'
        - description: |
            `single` deletes the list in the current Kibana space; `agnostic` deletes a global list. Must match the
            list you are removing when using `list_id` or `id`.
          examples:
            agnostic:
              value: agnostic
            single:
              value: single
          in: query
          name: namespace_type
          required: false
          schema:
            $ref: '#/components/schemas/Security_Exceptions_API_ExceptionNamespaceType'
            default: single
      responses:
        '200':
          content:
            application/json:
              examples:
                detectionExceptionList:
                  value:
                    _version: WzIsMV0=
                    created_at: '2025-01-07T19:34:27.942Z'
                    created_by: elastic
                    description: This is a sample detection type exception list.
                    id: 9e5fc75a-a3da-46c5-96e3-a2ec59c6bb85
                    immutable: false
                    list_id: simple_list
                    name: Sample Detection Exception List
                    namespace_type: single
                    os_types:
                      - linux
                    tags:
                      - malware
                    tie_breaker_id: 78f1aca1-f8ee-4eb5-9ceb-f5c3ee656cb3
                    type: detection
                    updated_at: '2025-01-07T19:34:27.942Z'
                    updated_by: elastic
                    version: 1
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_ExceptionList'
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                badRequest:
                  value:
                    error: Bad Request
                    message: "[request query]: namespace_type.0: Invalid enum value. Expected 'agnostic' | 'single', received 'blob'"
                    statusCode: 400
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
                  - $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
          description: Invalid input data response
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: '[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]'
                    statusCode: 401
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
          description: Unsuccessful authentication response
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  value:
                    error: Forbidden
                    message: API [DELETE /api/exception_lists?list_id=simple_list&namespace_type=single] is unauthorized for user, this action is granted by the Kibana privileges [lists-all]
                    statusCode: 403
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
          description: Not enough privileges response
        '404':
          content:
            application/json:
              examples:
                notFound:
                  value:
                    message: 'exception list list_id: "foo" does not exist'
                    status_code: 404
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
          description: Exception list not found response
        '500':
          content:
            application/json:
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
          description: Internal server error response
      summary: Delete an exception list
      tags:
        - Security Exceptions API
      x-metaTags:
        - content: Kibana
          name: product_name
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/exception_lists</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Get the details of an exception list using the `id` or `list_id` field.
      operationId: ReadExceptionList
      parameters:
        - description: Exception list's identifier. Either `id` or `list_id` must be specified.
          in: query
          name: id
          required: false
          schema:
            $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListId'
        - description: Human readable exception list string identifier, e.g. `trusted-linux-processes`. Either `id` or `list_id` must be specified.
          in: query
          name: list_id
          required: false
          schema:
            $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListHumanId'
        - description: |
            When `single`, the list is resolved in the current Kibana space. When `agnostic`, the list is a global
            (space-agnostic) container. Required for looking up the correct list when `list_id` is not unique.
          examples:
            agnostic:
              value: agnostic
            single:
              value: single
          in: query
          name: namespace_type
          required: false
          schema:
            $ref: '#/components/schemas/Security_Exceptions_API_ExceptionNamespaceType'
            default: single
      responses:
        '200':
          content:
            application/json:
              examples:
                detectionType:
                  value:
                    _version: WzIsMV0=
                    created_at: '2025-01-07T19:34:27.942Z'
                    created_by: elastic
                    description: This is a sample detection type exception list.
                    id: 9e5fc75a-a3da-46c5-96e3-a2ec59c6bb85
                    immutable: false
                    list_id: simple_list
                    name: Sample Detection Exception List
                    namespace_type: single
                    os_types:
                      - linux
                    tags:
                      - malware
                    tie_breaker_id: 78f1aca1-f8ee-4eb5-9ceb-f5c3ee656cb3
                    type: detection
                    updated_at: '2025-01-07T19:34:27.942Z'
                    updated_by: elastic
                    version: 1
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_ExceptionList'
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                badRequest:
                  value:
                    error: Bad Request
                    message: "[request query]: namespace_type.0: Invalid enum value. Expected 'agnostic' | 'single', received 'blob'"
                    statusCode: 400
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
                  - $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
          description: Invalid input data response
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: '[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]'
                    statusCode: 401
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
          description: Unsuccessful authentication response
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  value:
                    error: Forbidden
                    message: API [GET /api/exception_lists?list_id=simple_list&namespace_type=single] is unauthorized for user, this action is granted by the Kibana privileges [lists-read]
                    statusCode: 403
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
          description: Not enough privileges response
        '404':
          content:
            application/json:
              examples:
                notFound:
                  value:
                    message": 'exception list id: "foo" does not exist'
                    status_code": 404
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
          description: Exception list item not found response
        '500':
          content:
            application/json:
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
          description: Internal server error response
      summary: Get exception list details
      tags:
        - Security Exceptions API
      x-metaTags:
        - content: Kibana
          name: product_name
    post:
      description: |
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/exception_lists</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        An exception list groups exception items and can be associated with detection rules. You can assign exception lists to multiple detection rules.
        > info
        > All exception items added to the same list are evaluated using `OR` logic. That is, if any of the items in a list evaluate to `true`, the exception prevents the rule from generating an alert. Likewise, `OR` logic is used for evaluating exceptions when more than one exception list is assigned to a rule. To use the `AND` operator, you can define multiple clauses (`entries`) in a single exception item.
      operationId: CreateExceptionList
      requestBody:
        content:
          application/json:
            examples:
              createDetection:
                value:
                  description: This is a sample detection type exception list.
                  list_id: simple_list
                  name: Sample Detection Exception List
                  namespace_type: single
                  os_types:
                    - linux
                  tags:
                    - malware
                  type: detection
            schema:
              example:
                description: This is a sample detection type exception list.
                list_id: simple_list
                name: Sample Detection Exception List
                namespace_type: single
                os_types:
                  - linux
                tags:
                  - malware
                type: detection
              type: object
              properties:
                description:
                  $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListDescription'
                list_id:
                  $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListHumanId'
                meta:
                  $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListMeta'
                name:
                  $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListName'
                namespace_type:
                  $ref: '#/components/schemas/Security_Exceptions_API_ExceptionNamespaceType'
                  default: single
                os_types:
                  $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListOsTypeArray'
                tags:
                  $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListTags'
                  default: []
                type:
                  $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListType'
                version:
                  $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListVersion'
                  default: 1
              required:
                - name
                - description
                - type
        description: Exception list's properties
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                autogeneratedListId:
                  value:
                    _version: WzMsMV0=
                    created_at: '2025-01-09T01:05:23.019Z'
                    created_by: elastic
                    description: This is a sample detection type exception with an autogenerated list_id.
                    id: 28243c2f-624a-4443-823d-c0b894880931
                    immutable: false
                    list_id: 8c1aae4c-1ef5-4bce-a2e3-16584b501783
                    name: Sample Detection Exception List
                    namespace_type: single
                    os_types: []
                    tags:
                      - malware
                    tie_breaker_id: ad94de31-39f7-4ad7-b8e4-988bfa95f338
                    type: detection
                    updated_at: '2025-01-09T01:05:23.020Z'
                    updated_by: elastic
                    version: 1
                namespaceAgnostic:
                  value:
                    _version: WzUsMV0=
                    created_at: '2025-01-09T01:10:36.369Z'
                    created_by: elastic
                    description: This is a sample agnostic endpoint type exception.
                    id: 1a744e77-22ca-4b6b-9085-54f55275ebe5
                    immutable: false
                    list_id: b935eb55-7b21-4c1c-b235-faa1df23b3d6
                    name: Sample Agnostic Endpoint Exception List
                    namespace_type: agnostic
                    os_types:
                      - linux
                    tags:
                      - malware
                    tie_breaker_id: 49ea0adc-a2b8-4d83-a8f3-2fb98301dea3
                    type: endpoint
                    updated_at: '2025-01-09T01:10:36.369Z'
                    updated_by: elastic
                    version: 1
                typeDetection:
                  value:
                    _version: WzIsMV0=
                    created_at: '2025-01-07T19:34:27.942Z'
                    created_by: elastic
                    description: This is a sample detection type exception list.
                    id: 9e5fc75a-a3da-46c5-96e3-a2ec59c6bb85
                    immutable: false
                    list_id: simple_list
                    name: Sample Detection Exception List
                    namespace_type: single
                    os_types:
                      - linux
                    tags:
                      - malware
                    tie_breaker_id: 78f1aca1-f8ee-4eb5-9ceb-f5c3ee656cb3
                    type: detection
                    updated_at: '2025-01-07T19:34:27.942Z'
                    updated_by: elastic
                    version: 1
                typeEndpoint:
                  value:
                    _version: WzQsMV0=
                    created_at: '2025-01-09T01:07:49.658Z'
                    created_by: elastic
                    description: This is a sample endpoint type exception list.
                    id: a79f4730-6e32-4278-abfc-349c0add7d54
                    immutable: false
                    list_id: endpoint_list
                    name: Sample Endpoint Exception List
                    namespace_type: single
                    os_types:
                      - linux
                    tags:
                      - malware
                    tie_breaker_id: 94a028af-8f47-427a-aca5-ffaf829e64ee
                    type: endpoint
                    updated_at: '2025-01-09T01:07:49.658Z'
                    updated_by: elastic
                    version: 1
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_ExceptionList'
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                badRequest:
                  value:
                    error: Bad Request
                    message: '[request body]: list_id: Expected string, received number'
                    statusCode: 400
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
                  - $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
          description: Invalid input data response
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: |-
                      [security_exception
                      	Root causes:
                      		security_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]
                    statusCode: 401
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
          description: Unsuccessful authentication response
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  value:
                    error: Forbidden
                    message: API [POST /api/exception_lists] is unauthorized for user, this action is granted by the Kibana privileges [lists-all]
                    statusCode: 403
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
          description: Not enough privileges response
        '409':
          content:
            application/json:
              examples:
                alreadyExists:
                  value:
                    message: 'exception list id: "simple_list" already exists'
                    status_code: 409
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
          description: Exception list already exists response
        '500':
          content:
            application/json:
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
          description: Internal server error response
      summary: Create an exception list
      tags:
        - Security Exceptions API
      x-metaTags:
        - content: Kibana
          name: product_name
    put:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb put">put</span>&nbsp;<span class="operation-path">/s/{space_id}/api/exception_lists</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Update an exception list using the `id` or `list_id` field.
      operationId: UpdateExceptionList
      requestBody:
        content:
          application/json:
            examples:
              fullReplace:
                value:
                  description: Different description
                  list_id: simple_list
                  name: Updated exception list name
                  os_types:
                    - linux
                  tags:
                    - draft
                    - malware
                  type: detection
            schema:
              example:
                description: Different description
                list_id: simple_list
                name: Updated exception list name
                os_types:
                  - linux
                tags:
                  - draft malware
                type: detection
              type: object
              properties:
                _version:
                  description: The version id, normally returned by the API when the item was retrieved. Use it ensure updates are done against the latest version.
                  type: string
                description:
                  $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListDescription'
                id:
                  $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListId'
                list_id:
                  $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListHumanId'
                meta:
                  $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListMeta'
                name:
                  $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListName'
                namespace_type:
                  $ref: '#/components/schemas/Security_Exceptions_API_ExceptionNamespaceType'
                  default: single
                os_types:
                  $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListOsTypeArray'
                  default: []
                tags:
                  $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListTags'
                type:
                  $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListType'
                version:
                  $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListVersion'
              required:
                - name
                - description
                - type
        description: Exception list's properties
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                simpleList:
                  value:
                    _version: WzExLDFd
                    created_at: '2025-01-07T20:43:55.264Z'
                    created_by: elastic
                    description: Different description
                    id: fa7f545f-191b-4d32-b1f0-c7cd62a79e55
                    immutable: false
                    list_id: simple_list
                    name: Updated exception list name
                    namespace_type: single
                    os_types: []
                    tags:
                      - draft malware
                    tie_breaker_id: 319fe983-acdd-4806-b6c4-3098eae9392f
                    type: detection
                    updated_at: '2025-01-07T21:32:03.726Z'
                    updated_by: elastic
                    version: 2
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_ExceptionList'
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                badRequest:
                  value:
                    error: Bad Request
                    message: '[request body]: list_id: Expected string, received number'
                    statusCode: 400
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
                  - $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
          description: Invalid input data response
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: '[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]'
                    statusCode: 401
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
          description: Unsuccessful authentication response
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  value:
                    error: Forbidden
                    message: API [PUT /api/exception_lists] is unauthorized for user, this action is granted by the Kibana privileges [lists-all]
                    statusCode: 403
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
          description: Not enough privileges response
        '404':
          content:
            application/json:
              examples:
                notFound:
                  value:
                    message": 'exception list id: "foo" does not exist'
                    status_code": 404
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
          description: Exception list not found response
        '500':
          content:
            application/json:
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
          description: Internal server error response
      summary: Update an exception list
      tags:
        - Security Exceptions API
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/exception_lists/_duplicate:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/exception_lists/_duplicate</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Duplicate an existing exception list.
      operationId: DuplicateExceptionList
      parameters:
        - description: The `list_id` of the existing exception list to copy (source list).
          in: query
          name: list_id
          required: true
          schema:
            $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListHumanId'
        - description: Scope in which the source list is defined (`single` = current space, `agnostic` = all spaces).
          examples:
            agnostic:
              value: agnostic
            single:
              value: single
          in: query
          name: namespace_type
          required: true
          schema:
            $ref: '#/components/schemas/Security_Exceptions_API_ExceptionNamespaceType'
        - description: Determines whether to include expired exceptions in the duplicated list. Expiration date defined by `expire_time`.
          in: query
          name: include_expired_exceptions
          required: true
          schema:
            default: 'true'
            enum:
              - 'true'
              - 'false'
            example: true
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                detectionExceptionList:
                  value:
                    _version: WzExNDY1LDFd
                    created_at: '2025-01-09T16:19:50.280Z'
                    created_by: elastic
                    description: This is a sample detection type exception
                    id: b2f4a715-6ab1-444c-8b1e-3fa1b1049429
                    immutable: false
                    list_id: d6390d60-bce3-4a48-9002-52db600f329c
                    name: Sample Detection Exception List [Duplicate]
                    namespace_type: single
                    os_types: []
                    tags:
                      - malware
                    tie_breaker_id: 6fa670bd-666d-4c9c-9f1e-d1dbc516e985
                    type: detection
                    updated_at: '2025-01-09T16:19:50.280Z'
                    updated_by: elastic
                    version: 1
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_ExceptionList'
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                badRequest:
                  value:
                    error: Bad Request
                    message: "[request query]: namespace_type: Invalid enum value. Expected 'agnostic' | 'single', received 'foo'"
                    statusCode: 400
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
                  - $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
          description: Invalid input data response
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: '[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]'
                    statusCode: 401
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
          description: Unsuccessful authentication response
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  value:
                    error: Forbidden
                    message: API [POST /api/exception_lists/_duplicate] is unauthorized for user, this action is granted by the Kibana privileges [lists-all]
                    statusCode: 403
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
          description: Not enough privileges response
        '404':
          content:
            application/json:
              examples:
                notFound:
                  value:
                    message: 'exception list id: "foo" does not exist'
                    status_code: 404
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
          description: Exception list not found
        '405':
          content:
            application/json:
              examples:
                notAllowed:
                  value:
                    message: 'Cannot duplicate: list is immutable or the operation is not allowed in this state'
                    status_code: 405
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
          description: Exception list to duplicate not found response
        '500':
          content:
            application/json:
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
          description: Internal server error response
      summary: Duplicate an exception list
      tags:
        - Security Exceptions API
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/exception_lists/_export:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/exception_lists/_export</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Export an exception list and its associated items to an NDJSON file.
      operationId: ExportExceptionList
      parameters:
        - description: Exception list's internal `id` (UUID) returned on create; use with `list_id` and `namespace_type` for an unambiguous target.
          in: query
          name: id
          required: true
          schema:
            $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListId'
        - description: Human-readable `list_id` of the exception list to export, as shown in the UI and API responses.
          in: query
          name: list_id
          required: true
          schema:
            $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListHumanId'
        - description: |
            `single` exports a list in the current Kibana space; `agnostic` exports a global (space-agnostic) list.
          examples:
            agnostic:
              value: agnostic
            single:
              value: single
          in: query
          name: namespace_type
          required: true
          schema:
            $ref: '#/components/schemas/Security_Exceptions_API_ExceptionNamespaceType'
        - description: Determines whether to include expired exceptions in the exported list. Expiration date defined by `expire_time`.
          example: true
          in: query
          name: include_expired_exceptions
          required: true
          schema:
            default: 'true'
            enum:
              - 'true'
              - 'false'
            type: string
      responses:
        '200':
          content:
            application/ndjson:
              examples:
                exportSavedObjectsResponse:
                  value: |
                    {"_version":"WzExNDU5LDFd","created_at":"2025-01-09T16:18:17.757Z","created_by":"elastic","description":"This is a sample detection type exception","id":"c86c2da0-2ab6-4343-b81c-216ef27e8d75","immutable":false,"list_id":"simple_list","name":"Sample Detection Exception List","namespace_type":"single","os_types":[],"tags":["user added string for a tag","malware"],"tie_breaker_id":"cf4a7b92-732d-47f0-a0d5-49a35a1736bf","type":"detection","updated_at":"2025-01-09T16:18:17.757Z","updated_by":"elastic","version":1}
                    {"_version":"WzExNDYxLDFd","comments":[],"created_at":"2025-01-09T16:18:42.308Z","created_by":"elastic","description":"This is a sample endpoint type exception","entries":[{"type":"exists","field":"actingProcess.file.signer","operator":"excluded"},{"type":"match_any","field":"host.name","value":["some host","another host"],"operator":"included"}],"id":"f37597ce-eaa7-4b64-9100-4301118f6806","item_id":"simple_list_item","list_id":"simple_list","name":"Sample Endpoint Exception List","namespace_type":"single","os_types":["linux"],"tags":["user added string for a tag","malware"],"tie_breaker_id":"4ca3ef3e-9721-42c0-8107-cf47e094d40f","type":"simple","updated_at":"2025-01-09T16:18:42.308Z","updated_by":"elastic"}
                    {"exported_exception_list_count":1,"exported_exception_list_item_count":1,"missing_exception_list_item_count":0,"missing_exception_list_items":[],"missing_exception_lists":[],"missing_exception_lists_count":0}
              schema:
                description: A `.ndjson` file containing specified exception list and its items
                format: binary
                type: string
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                badRequest:
                  value:
                    error: Bad Request
                    message: '[request query]: list_id: Required, namespace_type: Required'
                    statusCode: 400
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
                  - $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
          description: Invalid input data response
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: '[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]'
                    statusCode: 401
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
          description: Unsuccessful authentication response
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  value:
                    error: Forbidden
                    message: API [POST /api/exception_lists/_export] is unauthorized for user, this action is granted by the Kibana privileges [lists-all]
                    statusCode: 403
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
          description: Not enough privileges response
        '404':
          content:
            application/json:
              examples:
                notFound:
                  value:
                    message": 'exception list id: "foo" does not exist'
                    status_code": 404
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
          description: Exception list not found response
        '500':
          content:
            application/json:
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
          description: Internal server error response
      summary: Export an exception list
      tags:
        - Security Exceptions API
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/exception_lists/_find:
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/exception_lists/_find</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Get a list of all exception list containers.
      operationId: FindExceptionLists
      parameters:
        - description: |
            Filters the returned results according to the value of the specified field.

            Uses the `so type.field name:field` value syntax, where `so type` can be:

            - `exception-list`: Specify a space-aware exception list.
            - `exception-list-agnostic`: Specify an exception list that is shared across spaces.
          in: query
          name: filter
          required: false
          schema:
            $ref: '#/components/schemas/Security_Exceptions_API_FindExceptionListsFilter'
        - description: |
            Determines whether the returned containers are Kibana associated with a Kibana space
            or available in all spaces (`agnostic` or `single`)
          examples:
            agnostic:
              value: agnostic
            single:
              value: single
          in: query
          name: namespace_type
          required: false
          schema:
            default:
              - single
            items:
              $ref: '#/components/schemas/Security_Exceptions_API_ExceptionNamespaceType'
            type: array
        - description: The page number to return
          in: query
          name: page
          required: false
          schema:
            example: 1
            minimum: 1
            type: integer
        - description: The number of exception lists to return per page
          in: query
          name: per_page
          required: false
          schema:
            example: 20
            minimum: 1
            type: integer
        - description: Determines which field is used to sort the results.
          in: query
          name: sort_field
          required: false
          schema:
            example: name
            type: string
        - description: Determines the sort order, which can be `desc` or `asc`.
          in: query
          name: sort_order
          required: false
          schema:
            enum:
              - desc
              - asc
            example: desc
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                simpleLists:
                  value:
                    data:
                      - _version: WzIsMV0=
                        created_at: '2025-01-07T19:34:27.942Z'
                        created_by: elastic
                        description: This is a sample detection type exception list.
                        id: 9e5fc75a-a3da-46c5-96e3-a2ec59c6bb85
                        immutable: false
                        list_id: simple_list
                        name: Detection Exception List
                        namespace_type: single
                        os_types: []
                        tags:
                          - malware
                        tie_breaker_id: 78f1aca1-f8ee-4eb5-9ceb-f5c3ee656cb3
                        type: detection
                        updated_at: '2025-01-07T19:34:27.942Z'
                        updated_by: elastic
                        version: 1
                    page: 1
                    per_page: 20
                    total: 1
              schema:
                type: object
                properties:
                  data:
                    items:
                      $ref: '#/components/schemas/Security_Exceptions_API_ExceptionList'
                    type: array
                  page:
                    minimum: 1
                    type: integer
                  per_page:
                    minimum: 1
                    type: integer
                  total:
                    minimum: 0
                    type: integer
                required:
                  - data
                  - page
                  - per_page
                  - total
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                badRequest:
                  value:
                    error: Bad Request
                    message: "[request query]: namespace_type.0: Invalid enum value. Expected 'agnostic' | 'single', received 'blob'"
                    statusCode: 400
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
                  - $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
          description: Invalid input data response
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: '[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]'
                    statusCode: 401
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
          description: Unsuccessful authentication response
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  value:
                    error: Forbidden
                    message: API [GET /api/exception_lists/_find?namespace_type=single] is unauthorized for user, this action is granted by the Kibana privileges [lists-read]
                    statusCode: 403
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
          description: Not enough privileges response
        '500':
          content:
            application/json:
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
          description: Internal server error response
      summary: Get exception lists
      tags:
        - Security Exceptions API
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/exception_lists/_import:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/exception_lists/_import</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Import an exception list and its associated items from an NDJSON file.
      operationId: ImportExceptionList
      parameters:
        - description: |
            Determines whether existing exception lists with the same `list_id` are overwritten.
            If any exception items have the same `item_id`, those are also overwritten.
          in: query
          name: overwrite
          required: false
          schema:
            default: false
            example: false
            type: boolean
        - description: |
            Determines whether the list being imported will have a new `list_id` generated.
            Additional `item_id`'s are generated for each exception item. Both the exception
            list and its items are overwritten.
          in: query
          name: as_new_list
          required: false
          schema:
            default: false
            example: false
            type: boolean
      requestBody:
        content:
          multipart/form-data:
            examples:
              ndjsonUpload:
                value:
                  file: exception_lists.ndjson
            schema:
              type: object
              properties:
                file:
                  description: A `.ndjson` file containing the exception list
                  example: |
                    {"_version":"WzExNDU5LDFd","created_at":"2025-01-09T16:18:17.757Z","created_by":"elastic","description":"This is a sample detection type exception","id":"c86c2da0-2ab6-4343-b81c-216ef27e8d75","immutable":false,"list_id":"simple_list","name":"Sample Detection Exception List","namespace_type":"single","os_types":[],"tags":["user added string for a tag","malware"],"tie_breaker_id":"cf4a7b92-732d-47f0-a0d5-49a35a1736bf","type":"detection","updated_at":"2025-01-09T16:18:17.757Z","updated_by":"elastic","version":1}
                    {"_version":"WzExNDYxLDFd","comments":[],"created_at":"2025-01-09T16:18:42.308Z","created_by":"elastic","description":"This is a sample endpoint type exception","entries":[{"type":"exists","field":"actingProcess.file.signer","operator":"excluded"},{"type":"match_any","field":"host.name","value":["some host","another host"],"operator":"included"}],"id":"f37597ce-eaa7-4b64-9100-4301118f6806","item_id":"simple_list_item","list_id":"simple_list","name":"Sample Endpoint Exception List","namespace_type":"single","os_types":["linux"],"tags":["user added string for a tag","malware"],"tie_breaker_id":"4ca3ef3e-9721-42c0-8107-cf47e094d40f","type":"simple","updated_at":"2025-01-09T16:18:42.308Z","updated_by":"elastic"}
                  format: binary
                  type: string
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                withErrors:
                  value:
                    errors:
                      - error:
                          message: 'Error found importing exception list: Invalid value \"4\" supplied to \"list_id\"'
                          status_code: 400
                        list_id: (unknown list_id)
                      - error:
                          message: 'Found that item_id: \"f7fd00bb-dba8-4c93-9d59-6cbd427b6330\" already exists. Import of item_id: \"f7fd00bb-dba8-4c93-9d59-6cbd427b6330\" skipped.'
                          status_code: 409
                        item_id: f7fd00bb-dba8-4c93-9d59-6cbd427b6330
                        list_id: 7d7cccb8-db72-4667-b1f3-648efad7c1ee
                    success: false,
                    success_count: 0,
                    success_count_exception_list_items: 0
                    success_count_exception_lists: 0,
                    success_exception_list_items: false,
                    success_exception_lists: false,
                withoutErrors:
                  value:
                    errors: []
                    success: true
                    success_count: 2
                    success_count_exception_list_items: 1
                    success_count_exception_lists: 1
                    success_exception_list_items: true
                    success_exception_lists: true,
              schema:
                type: object
                properties:
                  errors:
                    $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListsImportBulkErrorArray'
                  success:
                    type: boolean
                  success_count:
                    minimum: 0
                    type: integer
                  success_count_exception_list_items:
                    minimum: 0
                    type: integer
                  success_count_exception_lists:
                    minimum: 0
                    type: integer
                  success_exception_list_items:
                    type: boolean
                  success_exception_lists:
                    type: boolean
                required:
                  - errors
                  - success
                  - success_count
                  - success_exception_lists
                  - success_count_exception_lists
                  - success_exception_list_items
                  - success_count_exception_list_items
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                badRequest:
                  value:
                    error: Bad Request
                    message: Multipart part `file` is required and must contain a valid .ndjson exception list export
                    statusCode: 400
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
                  - $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
          description: Invalid input data response
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: '[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]'
                    statusCode: 401
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
          description: Unsuccessful authentication response
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  value:
                    error: Forbidden
                    message: API [POST /api/exception_lists/_import] is unauthorized for user, this action is granted by the Kibana privileges [lists-all]
                    statusCode: 403
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
          description: Not enough privileges response
        '500':
          content:
            application/json:
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
          description: Internal server error response
      summary: Import an exception list
      tags:
        - Security Exceptions API
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/exception_lists/items:
    delete:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb delete">delete</span>&nbsp;<span class="operation-path">/s/{space_id}/api/exception_lists/items</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Delete an exception list item using the `id` or `item_id` field.
      operationId: DeleteExceptionListItem
      parameters:
        - description: Exception item's identifier. Either `id` or `item_id` must be specified
          in: query
          name: id
          required: false
          schema:
            $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemId'
        - description: Human readable exception item string identifier, e.g. `trusted-linux-processes`. Either `id` or `item_id` must be specified
          in: query
          name: item_id
          required: false
          schema:
            $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemHumanId'
        - description: |
            `single` deletes the item in the current Kibana space; `agnostic` deletes an item in a space-agnostic list. Must match the list that owns the item.
          examples:
            agnostic:
              value: agnostic
            single:
              value: single
          in: query
          name: namespace_type
          required: false
          schema:
            $ref: '#/components/schemas/Security_Exceptions_API_ExceptionNamespaceType'
            default: single
      responses:
        '200':
          content:
            application/json:
              examples:
                simpleExceptionItem:
                  value:
                    _version: WzQsMV0=
                    comments: []
                    created_at: '2025-01-07T20:07:33.119Z'
                    created_by: elastic
                    description: This is a sample detection type exception item.
                    entries:
                      - field: actingProcess.file.signer
                        operator: excluded
                        type: exists
                      - field: host.name
                        operator: included
                        type: match_any
                        value:
                          - saturn
                          - jupiter
                    id: 71a9f4b2-c85c-49b4-866f-c71eb9e67da2
                    item_id: simple_list_item
                    list_id: simple_list
                    name: Sample Exception List Item
                    namespace_type: single
                    os_types:
                      - linux
                    tags:
                      - malware
                    tie_breaker_id: 09434836-9db9-4942-a234-5a9268e0b34c
                    type: simple
                    updated_at: '2025-01-07T20:07:33.119Z'
                    updated_by: elastic
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItem'
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                badRequest:
                  value:
                    error: Bad Request
                    message: "[request query]: namespace_type.0: Invalid enum value. Expected 'agnostic' | 'single', received 'blob'"
                    statusCode: 400
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
                  - $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
          description: Invalid input data response
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: '[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]'
                    statusCode: 401
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
          description: Unsuccessful authentication response
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  value:
                    error: Forbidden
                    message: API [DELETE /api/exception_lists/items?item_id=simple_list&namespace_type=single] is unauthorized for user, this action is granted by the Kibana privileges [lists-all]
                    statusCode: 403
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
          description: Not enough privileges response
        '404':
          content:
            application/json:
              examples:
                notFound:
                  value:
                    message: 'exception list item item_id: \"foo\" does not exist'
                    status_code: 404
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
          description: Exception list item not found response
        '500':
          content:
            application/json:
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
          description: Internal server error response
      summary: Delete an exception list item
      tags:
        - Security Exceptions API
      x-metaTags:
        - content: Kibana
          name: product_name
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/exception_lists/items</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Get the details of an exception list item using the `id` or `item_id` field.
      operationId: ReadExceptionListItem
      parameters:
        - description: Exception list item's identifier. Either `id` or `item_id` must be specified.
          in: query
          name: id
          required: false
          schema:
            $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemId'
        - description: Human readable exception item string identifier, e.g. `trusted-linux-processes`. Either `id` or `item_id` must be specified.
          in: query
          name: item_id
          required: false
          schema:
            $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemHumanId'
        - description: |
            `single` fetches the item in the current space; `agnostic` fetches a global (space-agnostic) item. Must
            match how the list was created.
          examples:
            agnostic:
              value: agnostic
            single:
              value: single
          in: query
          name: namespace_type
          required: false
          schema:
            $ref: '#/components/schemas/Security_Exceptions_API_ExceptionNamespaceType'
            default: single
      responses:
        '200':
          content:
            application/json:
              examples:
                simpleListItem:
                  value:
                    _version: WzQsMV0=
                    comments: []
                    created_at: '2025-01-07T20:07:33.119Z'
                    created_by: elastic
                    description: This is a sample detection type exception item.
                    entries:
                      - field: actingProcess.file.signer
                        operator: excluded
                        type: exists
                      - field: host.name
                        operator: included
                        type: match_any
                        value:
                          - saturn
                          - jupiter
                    id: 71a9f4b2-c85c-49b4-866f-c71eb9e67da2
                    item_id: simple_list_item
                    list_id: simple_list
                    name: Sample Exception List Item
                    namespace_type: single
                    os_types:
                      - linux
                    tags:
                      - malware
                    tie_breaker_id: 09434836-9db9-4942-a234-5a9268e0b34c
                    type: simple
                    updated_at: '2025-01-07T20:07:33.119Z'
                    updated_by: elastic
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItem'
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                badRequest:
                  value:
                    error: Bad Request
                    message: "[request query]: namespace_type.0: Invalid enum value. Expected 'agnostic' | 'single', received 'blob'"
                    statusCode: 400
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
                  - $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
          description: Invalid input data response
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: '[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]'
                    statusCode: 401
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
          description: Unsuccessful authentication response
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  value:
                    error: Forbidden
                    message: API [GET /api/exception_lists/items?item_id=&namespace_type=single] is unauthorized for user, this action is granted by the Kibana privileges [lists-read]
                    statusCode: 403
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
          description: Not enough privileges response
        '404':
          content:
            application/json:
              examples:
                notFound:
                  value:
                    message: 'exception list item item_id: \"foo\" does not exist'
                    status_code: 404
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
          description: Exception list item not found response
        '500':
          content:
            application/json:
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
          description: Internal server error response
      summary: Get an exception list item
      tags:
        - Security Exceptions API
      x-metaTags:
        - content: Kibana
          name: product_name
    post:
      description: |
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/exception_lists/items</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Create an exception item and associate it with the specified exception list.
        > info
        > Before creating exception items, you must create an exception list.
      operationId: CreateExceptionListItem
      requestBody:
        content:
          application/json:
            examples:
              simpleItem:
                value:
                  description: This is a sample detection type exception item.
                  entries:
                    - field: actingProcess.file.signer
                      operator: excluded
                      type: exists
                  item_id: simple_list_item
                  list_id: simple_list
                  name: Sample Exception List Item
                  namespace_type: single
                  os_types:
                    - linux
                  tags:
                    - malware
                  type: simple
            schema:
              oneOf:
                - $ref: '#/components/schemas/Security_Exceptions_API_CreateExceptionListItemGeneric'
                - $ref: '#/components/schemas/Security_Exceptions_API_CreateExceptionListItemEndpointList'
                - $ref: '#/components/schemas/Security_Exceptions_API_CreateExceptionListItemTrustedAppsWindows'
                - $ref: '#/components/schemas/Security_Exceptions_API_CreateExceptionListItemTrustedAppsMac'
                - $ref: '#/components/schemas/Security_Exceptions_API_CreateExceptionListItemTrustedAppsLinux'
                - $ref: '#/components/schemas/Security_Exceptions_API_CreateExceptionListItemTrustedDevicesWindows'
                - $ref: '#/components/schemas/Security_Exceptions_API_CreateExceptionListItemTrustedDevicesMac'
                - $ref: '#/components/schemas/Security_Exceptions_API_CreateExceptionListItemTrustedDevicesWindowsMac'
                - $ref: '#/components/schemas/Security_Exceptions_API_CreateExceptionListItemEventFilters'
                - $ref: '#/components/schemas/Security_Exceptions_API_CreateExceptionListItemHostIsolation'
                - $ref: '#/components/schemas/Security_Exceptions_API_CreateExceptionListItemBlocklistWindows'
                - $ref: '#/components/schemas/Security_Exceptions_API_CreateExceptionListItemBlocklistLinux'
                - $ref: '#/components/schemas/Security_Exceptions_API_CreateExceptionListItemBlocklistMac'
        description: Exception list item's properties
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                autogeneratedItemId:
                  value:
                    _version: WzYsMV0=
                    comments: []
                    created_at: '2025-01-09T01:16:23.322Z'
                    created_by: elastic
                    description: This is a sample exception that has no item_id so it is autogenerated.
                    entries:
                      - field: actingProcess.file.signer
                        operator: excluded
                        type: exists
                    id: 323faa75-c657-4fa0-9084-8827612c207b
                    item_id: 80e6edf7-4b13-4414-858f-2fa74aa52b37
                    list_id: 8c1aae4c-1ef5-4bce-a2e3-16584b501783
                    name: Sample Autogenerated Exception List Item ID
                    namespace_type: single
                    os_types: []
                    tags:
                      - malware
                    tie_breaker_id: d6799986-3a23-4213-bc6d-ed9463a32f23
                    type: simple
                    updated_at: '2025-01-09T01:16:23.322Z'
                    updated_by: elastic
                detectionExceptionListItem:
                  value:
                    _version: WzQsMV0=
                    comments: []
                    created_at: '2025-01-07T20:07:33.119Z'
                    created_by: elastic
                    description: This is a sample detection type exception item.
                    entries:
                      - field: actingProcess.file.signer
                        operator: excluded
                        type: exists
                    id: 71a9f4b2-c85c-49b4-866f-c71eb9e67da2
                    item_id: simple_list_item
                    list_id: simple_list
                    name: Sample Exception List Item
                    namespace_type: single
                    os_types:
                      - linux
                    tags:
                      - malware
                    tie_breaker_id: 09434836-9db9-4942-a234-5a9268e0b34c
                    type: simple
                    updated_at: '2025-01-07T20:07:33.119Z'
                    updated_by: elastic
                withExistEntry:
                  value:
                    _version: WzQsMV0=
                    comments: []
                    created_at: '2025-01-07T20:07:33.119Z'
                    created_by: elastic
                    description: This is a sample detection type exception item.
                    entries:
                      - field: actingProcess.file.signer
                        operator: excluded
                        type: exists
                    id: 71a9f4b2-c85c-49b4-866f-c71eb9e67da2
                    item_id: simple_list_item
                    list_id: simple_list
                    name: Sample Exception List Item
                    namespace_type: single
                    os_types:
                      - linux
                    tags:
                      - malware
                    tie_breaker_id: 09434836-9db9-4942-a234-5a9268e0b34c
                    type: simple
                    updated_at: '2025-01-07T20:07:33.119Z'
                    updated_by: elastic
                withMatchAnyEntry:
                  value:
                    _version: WzQsMV0=
                    comments: []
                    created_at: '2025-01-07T20:07:33.119Z'
                    created_by: elastic
                    description: This is a sample detection type exception item.
                    entries:
                      - field: host.name
                        operator: included
                        type: match_any
                        value:
                          - saturn
                          - jupiter
                    id: 71a9f4b2-c85c-49b4-866f-c71eb9e67da2
                    item_id: simple_list_item
                    list_id: simple_list
                    name: Sample Exception List Item
                    namespace_type: single
                    os_types:
                      - linux
                    tags:
                      - malware
                    tie_breaker_id: 09434836-9db9-4942-a234-5a9268e0b34c
                    type: simple
                    updated_at: '2025-01-07T20:07:33.119Z'
                    updated_by: elastic
                withMatchEntry:
                  value:
                    _version: WzQsMV0=
                    comments: []
                    created_at: '2025-01-07T20:07:33.119Z'
                    created_by: elastic
                    description: This is a sample detection type exception item.
                    entries:
                      - field: actingProcess.file.signer
                        operator: included
                        type: match
                        value: Elastic N.V.
                    id: 71a9f4b2-c85c-49b4-866f-c71eb9e67da2
                    item_id: simple_list_item
                    list_id: simple_list
                    name: Sample Exception List Item
                    namespace_type: single
                    os_types:
                      - linux
                    tags:
                      - malware
                    tie_breaker_id: 09434836-9db9-4942-a234-5a9268e0b34c
                    type: simple
                    updated_at: '2025-01-07T20:07:33.119Z'
                    updated_by: elastic
                withNestedEntry:
                  value:
                    _version: WzQsMV0=
                    comments: []
                    created_at: '2025-01-07T20:07:33.119Z'
                    created_by: elastic
                    description: This is a sample detection type exception item.
                    entries:
                      - entries:
                          - field: signer
                            operator: included
                            type: match
                            value: Evil
                          - field: trusted
                            operator: included
                            type: match
                            value: true
                        field: file.signature
                        type: nested
                    id: 71a9f4b2-c85c-49b4-866f-c71eb9e67da2
                    item_id: simple_list_item
                    list_id: simple_list
                    name: Sample Exception List Item
                    namespace_type: single
                    os_types:
                      - linux
                    tags:
                      - malware
                    tie_breaker_id: 09434836-9db9-4942-a234-5a9268e0b34c
                    type: simple
                    updated_at: '2025-01-07T20:07:33.119Z'
                    updated_by: elastic
                withValueListEntry:
                  value:
                    _version: WzcsMV0=
                    comments: []
                    created_at: '2025-01-09T01:31:12.614Z'
                    created_by: elastic
                    description: Don't signal when agent.name is rock01 and source.ip is in the goodguys.txt list
                    entries:
                      - field: source.ip
                        list:
                          id: goodguys.txt
                          type: ip
                        operator: excluded
                        type: list
                    id: deb26876-297d-4677-8a1f-35467d2f1c4f
                    item_id: 686b129e-9b8d-4c59-8d8d-c93a9ea82c71
                    list_id: 8c1aae4c-1ef5-4bce-a2e3-16584b501783
                    name: Filter out good guys ip and agent.name rock01
                    namespace_type: single
                    os_types: []
                    tags:
                      - malware
                    tie_breaker_id: 5e0288ce-6657-4c18-9dcc-00ec9e8cc6c8
                    type: simple
                    updated_at: '2025-01-09T01:31:12.614Z'
                    updated_by: elastic
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItem'
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                badRequest:
                  value:
                    error: Bad Request,
                    message: '[request body]: list_id: Expected string, received number'
                    statusCode: 400,
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
                  - $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
          description: Invalid input data response
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: '[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]'
                    statusCode: 401
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
          description: Unsuccessful authentication response
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  value:
                    error: Forbidden
                    message: API [POST /api/exception_lists/items] is unauthorized for user, this action is granted by the Kibana privileges [lists-all]
                    statusCode: 403
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
          description: Not enough privileges response
        '409':
          content:
            application/json:
              examples:
                alreadyExists:
                  value:
                    message: 'exception list item id: \"simple_list_item\" already exists'
                    status_code: 409
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
          description: Exception list item already exists response
        '500':
          content:
            application/json:
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
          description: Internal server error response
      summary: Create an exception list item
      tags:
        - Security Exceptions API
      x-metaTags:
        - content: Kibana
          name: product_name
    put:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb put">put</span>&nbsp;<span class="operation-path">/s/{space_id}/api/exception_lists/items</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Update an exception list item using the `id` or `item_id` field.
      operationId: UpdateExceptionListItem
      requestBody:
        content:
          application/json:
            examples:
              updateItem:
                value:
                  description: Updated description
                  id: 71a9f4b2-c85c-49b4-866f-c71eb9e67da2
                  name: Updated name
                  namespace_type: single
                  type: simple
            schema:
              oneOf:
                - $ref: '#/components/schemas/Security_Exceptions_API_UpdateExceptionListItemGeneric'
                - $ref: '#/components/schemas/Security_Exceptions_API_UpdateExceptionListItemEndpointList'
                - $ref: '#/components/schemas/Security_Exceptions_API_UpdateExceptionListItemTrustedAppsWindows'
                - $ref: '#/components/schemas/Security_Exceptions_API_UpdateExceptionListItemTrustedAppsMac'
                - $ref: '#/components/schemas/Security_Exceptions_API_UpdateExceptionListItemTrustedAppsLinux'
                - $ref: '#/components/schemas/Security_Exceptions_API_UpdateExceptionListItemTrustedDevicesWindows'
                - $ref: '#/components/schemas/Security_Exceptions_API_UpdateExceptionListItemTrustedDevicesMac'
                - $ref: '#/components/schemas/Security_Exceptions_API_UpdateExceptionListItemTrustedDevicesWindowsMac'
                - $ref: '#/components/schemas/Security_Exceptions_API_UpdateExceptionListItemEventFilters'
                - $ref: '#/components/schemas/Security_Exceptions_API_UpdateExceptionListItemHostIsolation'
                - $ref: '#/components/schemas/Security_Exceptions_API_UpdateExceptionListItemBlocklistWindows'
                - $ref: '#/components/schemas/Security_Exceptions_API_UpdateExceptionListItemBlocklistLinux'
                - $ref: '#/components/schemas/Security_Exceptions_API_UpdateExceptionListItemBlocklistMac'
        description: Exception list item's properties
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                simpleListItem:
                  value:
                    _version: WzEyLDFd
                    comments: []
                    created_at: '2025-01-07T21:12:25.512Z'
                    created_by: elastic
                    description: Updated description
                    entries:
                      - field: host.name
                        operator: included
                        type: match
                        value: rock01
                    id: 459c5e7e-f8b2-4f0b-b136-c1fc702f72da
                    item_id: simple_list_item
                    list_id: simple_list
                    name: Updated name
                    namespace_type: single
                    os_types: []
                    tags: []
                    tie_breaker_id: ad0754ff-7b19-49ca-b73e-e6aff6bfa2d0
                    type: simple
                    updated_at: '2025-01-07T21:34:50.233Z'
                    updated_by: elastic
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItem'
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                badRequest:
                  value:
                    error: Bad Request
                    message: '[request body]: item_id: Expected string, received number'
                    statusCode: 400
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
                  - $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
          description: Invalid input data response
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: '[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]'
                    statusCode: 401
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
          description: Unsuccessful authentication response
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  value:
                    error: Forbidden
                    message: API [PUT /api/exception_lists/items] is unauthorized for user, this action is granted by the Kibana privileges [lists-all]
                    statusCode: 403
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
          description: Not enough privileges response
        '404':
          content:
            application/json:
              examples:
                notFound:
                  value:
                    message: 'exception list item item_id: \"foo\" does not exist'
                    status_code: 404
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
          description: Exception list item not found response
        '500':
          content:
            application/json:
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
          description: Internal server error response
      summary: Update an exception list item
      tags:
        - Security Exceptions API
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/exception_lists/items/_find:
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/exception_lists/items/_find</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Get a list of all exception list items in the specified list.
      operationId: FindExceptionListItems
      parameters:
        - description: The `list_id`s of the items to fetch.
          in: query
          name: list_id
          required: true
          schema:
            items:
              $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListHumanId'
            type: array
        - description: |
            Filters the returned results according to the value of the specified field,
            using the `<field name>:<field value>` syntax.
          examples:
            singleFilter:
              value:
                - exception-list.attributes.name:%My%20item
          in: query
          name: filter
          required: false
          schema:
            default: []
            items:
              $ref: '#/components/schemas/Security_Exceptions_API_NonEmptyString'
            type: array
        - description: |
            Determines whether the returned containers are Kibana associated with a Kibana space
            or available in all spaces (`agnostic` or `single`)
          examples:
            single:
              value:
                - single
          in: query
          name: namespace_type
          required: false
          schema:
            default:
              - single
            items:
              $ref: '#/components/schemas/Security_Exceptions_API_ExceptionNamespaceType'
            type: array
        - description: |
            Free-text search term applied to exception list item fields (for example a hostname or file path fragment).
          in: query
          name: search
          required: false
          schema:
            example: host.name
            type: string
        - description: The page number to return
          in: query
          name: page
          required: false
          schema:
            example: 1
            minimum: 0
            type: integer
        - description: The number of exception list items to return per page
          in: query
          name: per_page
          required: false
          schema:
            example: 20
            minimum: 0
            type: integer
        - description: Determines which field is used to sort the results.
          example: name
          in: query
          name: sort_field
          required: false
          schema:
            $ref: '#/components/schemas/Security_Exceptions_API_NonEmptyString'
        - description: Determines the sort order, which can be `desc` or `asc`.
          in: query
          name: sort_order
          required: false
          schema:
            enum:
              - desc
              - asc
            example: desc
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                simpleListItems:
                  value:
                    data:
                      - _version: WzgsMV0=
                        comments: []
                        created_at: '2025-01-07T21:12:25.512Z'
                        created_by: elastic
                        description: This is a sample exception item.
                        entries:
                          - field: actingProcess.file.signer
                            operator: excluded
                            type: exists
                          - field: host.name
                            operator: included
                            type: match_any
                            value:
                              - jupiter
                              - saturn
                        id: 459c5e7e-f8b2-4f0b-b136-c1fc702f72da
                        item_id: simple_list_item
                        list_id: simple_list
                        name: Sample Exception List Item
                        namespace_type: single
                        os_types:
                          - linux
                        tags:
                          - malware
                        tie_breaker_id: ad0754ff-7b19-49ca-b73e-e6aff6bfa2d0
                        type: simple
                        updated_at: '2025-01-07T21:12:25.512Z'
                        updated_by: elastic
                    page: 1
                    per_page: 20
                    total: 1
              schema:
                type: object
                properties:
                  data:
                    items:
                      $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItem'
                    type: array
                  page:
                    minimum: 1
                    type: integer
                  per_page:
                    minimum: 1
                    type: integer
                  pit:
                    type: string
                  total:
                    minimum: 0
                    type: integer
                required:
                  - data
                  - page
                  - per_page
                  - total
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                badRequest:
                  value:
                    error: Bad Request
                    message: "[request query]: namespace_type.0: Invalid enum value. Expected 'agnostic' | 'single', received 'blob'"
                    statusCode: 400
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
                  - $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
          description: Invalid input data response
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: '[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]'
                    statusCode: 401
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
          description: Unsuccessful authentication response
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  value:
                    error: Forbidden
                    message: API [GET /api/exception_lists/items/_find?list_id=simple_list&namespace_type=single] is unauthorized for user, this action is granted by the Kibana privileges [lists-read]
                    statusCode: 403
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
          description: Not enough privileges response
        '404':
          content:
            application/json:
              examples:
                notFound:
                  value:
                    message: 'exception list list_id: "foo" does not exist'
                    status_code: 404
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
          description: Exception list not found response
        '500':
          content:
            application/json:
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
          description: Internal server error response
      summary: Get exception list items
      tags:
        - Security Exceptions API
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/exception_lists/summary:
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/exception_lists/summary</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Get a summary of the specified exception list.
      operationId: ReadExceptionListSummary
      parameters:
        - description: Exception list's identifier generated upon creation.
          in: query
          name: id
          required: false
          schema:
            $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListId'
        - description: Exception list's human readable identifier.
          in: query
          name: list_id
          required: false
          schema:
            $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListHumanId'
        - description: |
            `single` returns summary for a list in the current space; `agnostic` for a space-agnostic list. Must
            line up with `id` / `list_id` used to look up the list.
          examples:
            agnostic:
              value: agnostic
            single:
              value: single
          in: query
          name: namespace_type
          required: false
          schema:
            $ref: '#/components/schemas/Security_Exceptions_API_ExceptionNamespaceType'
            default: single
        - description: Search filter clause
          in: query
          name: filter
          required: false
          schema:
            example: exception-list-agnostic.attributes.tags:"policy:policy-1" OR exception-list-agnostic.attributes.tags:"policy:all"
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                summary:
                  value:
                    linux: 0
                    macos: 0
                    total: 0
                    windows: 0
              schema:
                type: object
                properties:
                  linux:
                    minimum: 0
                    type: integer
                  macos:
                    minimum: 0
                    type: integer
                  total:
                    minimum: 0
                    type: integer
                  windows:
                    minimum: 0
                    type: integer
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                badRequest:
                  value:
                    error: Bad Request
                    message: "[request query]: namespace_type.0: Invalid enum value. Expected 'agnostic' | 'single', received 'blob'"
                    statusCode: 400
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
                  - $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
          description: Invalid input data response
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: '[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]'
                    statusCode: 401
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
          description: Unsuccessful authentication response
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  value:
                    error: Forbidden
                    message: API [GET /api/exception_lists/summary?list_id=simple_list&namespace_type=agnostic] is unauthorized for user, this action is granted by the Kibana privileges [lists-summary]
                    statusCode: 403
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
          description: Not enough privileges response
        '404':
          content:
            application/json:
              examples:
                notFound:
                  value:
                    message": 'exception list id: "foo" does not exist'
                    status_code": 404
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
          description: Exception list not found response
        '500':
          content:
            application/json:
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
          description: Internal server error response
      summary: Get an exception list summary
      tags:
        - Security Exceptions API
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/exceptions/shared:
    post:
      description: |
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/exceptions/shared</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        An exception list groups exception items and can be associated with detection rules. A shared exception list can apply to multiple detection rules.
        > info
        > All exception items added to the same list are evaluated using `OR` logic. That is, if any of the items in a list evaluate to `true`, the exception prevents the rule from generating an alert. Likewise, `OR` logic is used for evaluating exceptions when more than one exception list is assigned to a rule. To use the `AND` operator, you can define multiple clauses (`entries`) in a single exception item.
      operationId: CreateSharedExceptionList
      requestBody:
        content:
          application/json:
            examples:
              createSharedExceptionList:
                value:
                  description: This is a sample detection type exception list.
                  list_id: simple_list
                  name: Sample Detection Exception List
                  namespace_type: single
                  os_types:
                    - linux
                  tags:
                    - malware
            schema:
              type: object
              properties:
                description:
                  $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListDescription'
                name:
                  $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListName'
              required:
                - name
                - description
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                sharedList:
                  value:
                    _version: WzIsMV0=
                    created_at: '2025-01-07T19:34:27.942Z'
                    created_by: elastic
                    description: This is a sample detection type exception list.
                    id: 9e5fc75a-a3da-46c5-96e3-a2ec59c6bb85
                    immutable: false
                    list_id: simple_list
                    name: Sample Detection Exception List
                    namespace_type: single
                    os_types:
                      - linux
                    tags:
                      - malware
                    tie_breaker_id: 78f1aca1-f8ee-4eb5-9ceb-f5c3ee656cb3
                    type: detection
                    updated_at: '2025-01-07T19:34:27.942Z'
                    updated_by: elastic
                    version: 1
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_ExceptionList'
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                badRequest:
                  value:
                    error: Bad Request
                    message: '[request body]: list_id: Expected string, received number'
                    statusCode: 400
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
                  - $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
          description: Invalid input data response
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: |-
                      [security_exception
                      	Root causes:
                      		security_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]
                    statusCode: 401
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
          description: Unsuccessful authentication response
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  value:
                    message: Unable to create exception-list
                    status_code: 403
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
          description: Not enough privileges response
        '409':
          content:
            application/json:
              examples:
                alreadyExists:
                  value:
                    message: 'exception list id: "simple_list" already exists'
                    status_code: 409
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
          description: Exception list already exists response
        '500':
          content:
            application/json:
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
          description: Internal server error response
      summary: Create a shared exception list
      tags:
        - Security Exceptions API
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/features:
    get:
      description: |
        Get information about all Kibana features. Features are used by spaces and security to refine and secure access to Kibana.
      operationId: get-features
      responses:
        '200':
          content:
            application/json:
              examples:
                getFeaturesExample:
                  value: |
                    {
                      "features": [
                        {
                          "name": "tasks",
                          "description": "Manages task results"
                        },
                        {
                          "name": "security",
                          "description": "Manages configuration for Security features, such as users and roles"
                        },
                        {
                          "name": "searchable_snapshots",
                          "description": "Manages caches and configuration for searchable snapshots"
                        },
                        {
                          "name": "logstash_management",
                          "description": "Enables Logstash Central Management pipeline storage"
                        },
                        {
                          "name": "transform",
                          "description": "Manages configuration and state for transforms"
                        },
                        {
                          "name": "kibana",
                          "description": "Manages Kibana configuration and reports"
                        },
                        {
                          "name": "synonyms",
                          "description": "Manages synonyms"
                        },
                        {
                          "name": "async_search",
                          "description": "Manages results of async searches"
                        },
                        {
                          "name": "ent_search",
                          "description": "Manages configuration for Enterprise Search features"
                        },
                        {
                          "name": "machine_learning",
                          "description": "Provides anomaly detection and forecasting functionality"
                        },
                        {
                          "name": "geoip",
                          "description": "Manages data related to GeoIP database downloader"
                        },
                        {
                          "name": "watcher",
                          "description": "Manages Watch definitions and state"
                        },
                        {
                          "name": "fleet",
                          "description": "Manages configuration for Fleet"
                        },
                        {
                          "name": "enrich",
                          "description": "Manages data related to Enrich policies"
                        },
                        {
                          "name": "inference_plugin",
                          "description": "Inference plugin for managing inference services and inference"
                        }
                      ]
                    }
              schema:
                type: object
          description: Indicates a successful call
      summary: Get features
      tags:
        - system
      x-state: Technical Preview
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/agent_download_sources:
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/agent_download_sources</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        List all agent binary download sources.<br/><br/>[Required authorization] Route required privileges: fleet-agent-policies-read OR fleet-settings-read.
      operationId: get-fleet-agent-download-sources
      parameters: []
      responses:
        '200':
          content:
            application/json:
              examples:
                getDownloadSourcesExample:
                  description: List of agent binary download sources
                  value:
                    items:
                      - host: https://artifacts.elastic.co/downloads/
                        id: download-source-id-1
                        is_default: true
                        name: Elastic Artifacts
                    page: 1
                    perPage: 20
                    total: 1
              schema:
                additionalProperties: false
                type: object
                properties:
                  items:
                    items:
                      additionalProperties: false
                      type: object
                      properties:
                        auth:
                          additionalProperties: false
                          nullable: true
                          type: object
                          properties:
                            api_key:
                              type: string
                            headers:
                              items:
                                additionalProperties: false
                                type: object
                                properties:
                                  key:
                                    type: string
                                  value:
                                    type: string
                                required:
                                  - key
                                  - value
                              maxItems: 100
                              type: array
                            password:
                              type: string
                            username:
                              type: string
                        host:
                          format: uri
                          type: string
                        id:
                          type: string
                        is_default:
                          default: false
                          type: boolean
                        is_preconfigured:
                          type: boolean
                        name:
                          type: string
                        proxy_id:
                          description: The ID of the proxy to use for this download source. See the proxies API for more information.
                          nullable: true
                          type: string
                        secrets:
                          additionalProperties: false
                          type: object
                          properties:
                            auth:
                              additionalProperties: false
                              type: object
                              properties:
                                api_key:
                                  anyOf:
                                    - additionalProperties: false
                                      type: object
                                      properties:
                                        id:
                                          type: string
                                      required:
                                        - id
                                    - type: string
                                password:
                                  anyOf:
                                    - additionalProperties: false
                                      type: object
                                      properties:
                                        id:
                                          type: string
                                      required:
                                        - id
                                    - type: string
                            ssl:
                              additionalProperties: false
                              type: object
                              properties:
                                key:
                                  anyOf:
                                    - additionalProperties: false
                                      type: object
                                      properties:
                                        id:
                                          type: string
                                      required:
                                        - id
                                    - type: string
                        ssl:
                          additionalProperties: false
                          type: object
                          properties:
                            certificate:
                              type: string
                            certificate_authorities:
                              items:
                                type: string
                              maxItems: 10
                              type: array
                            key:
                              type: string
                      required:
                        - id
                        - name
                        - host
                    maxItems: 10000
                    type: array
                  page:
                    type: number
                  perPage:
                    type: number
                  total:
                    type: number
                required:
                  - items
                  - total
                  - page
                  - perPage
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
      summary: Get agent binary download sources
      tags:
        - Elastic Agent binary download sources
      x-metaTags:
        - content: Kibana
          name: product_name
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/agent_download_sources</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Create a new agent binary download source.<br/><br/>[Required authorization] Route required privileges: fleet-settings-all.
      operationId: post-fleet-agent-download-sources
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
      requestBody:
        content:
          application/json:
            examples:
              postDownloadSourceRequestExample:
                description: Create a new agent binary download source
                value:
                  host: https://my-custom-host.example.com/downloads/
                  is_default: false
                  name: My custom download source
            schema:
              additionalProperties: false
              type: object
              properties:
                auth:
                  additionalProperties: false
                  nullable: true
                  type: object
                  properties:
                    api_key:
                      type: string
                    headers:
                      items:
                        additionalProperties: false
                        type: object
                        properties:
                          key:
                            type: string
                          value:
                            type: string
                        required:
                          - key
                          - value
                      maxItems: 100
                      type: array
                    password:
                      type: string
                    username:
                      type: string
                host:
                  format: uri
                  type: string
                id:
                  type: string
                is_default:
                  default: false
                  type: boolean
                name:
                  type: string
                proxy_id:
                  description: The ID of the proxy to use for this download source. See the proxies API for more information.
                  nullable: true
                  type: string
                secrets:
                  additionalProperties: false
                  type: object
                  properties:
                    auth:
                      additionalProperties: false
                      type: object
                      properties:
                        api_key:
                          anyOf:
                            - additionalProperties: false
                              type: object
                              properties:
                                id:
                                  type: string
                              required:
                                - id
                            - type: string
                        password:
                          anyOf:
                            - additionalProperties: false
                              type: object
                              properties:
                                id:
                                  type: string
                              required:
                                - id
                            - type: string
                    ssl:
                      additionalProperties: false
                      type: object
                      properties:
                        key:
                          anyOf:
                            - additionalProperties: false
                              type: object
                              properties:
                                id:
                                  type: string
                              required:
                                - id
                            - type: string
                ssl:
                  additionalProperties: false
                  type: object
                  properties:
                    certificate:
                      type: string
                    certificate_authorities:
                      items:
                        type: string
                      maxItems: 10
                      type: array
                    key:
                      type: string
              required:
                - name
                - host
      responses:
        '200':
          content:
            application/json:
              examples:
                postDownloadSourceExample:
                  description: The created agent binary download source
                  value:
                    item:
                      host: https://my-custom-host.example.com/downloads/
                      id: download-source-id-2
                      is_default: false
                      name: My custom download source
              schema:
                additionalProperties: false
                type: object
                properties:
                  item:
                    additionalProperties: false
                    type: object
                    properties:
                      auth:
                        additionalProperties: false
                        nullable: true
                        type: object
                        properties:
                          api_key:
                            type: string
                          headers:
                            items:
                              additionalProperties: false
                              type: object
                              properties:
                                key:
                                  type: string
                                value:
                                  type: string
                              required:
                                - key
                                - value
                            maxItems: 100
                            type: array
                          password:
                            type: string
                          username:
                            type: string
                      host:
                        format: uri
                        type: string
                      id:
                        type: string
                      is_default:
                        default: false
                        type: boolean
                      is_preconfigured:
                        type: boolean
                      name:
                        type: string
                      proxy_id:
                        description: The ID of the proxy to use for this download source. See the proxies API for more information.
                        nullable: true
                        type: string
                      secrets:
                        additionalProperties: false
                        type: object
                        properties:
                          auth:
                            additionalProperties: false
                            type: object
                            properties:
                              api_key:
                                anyOf:
                                  - additionalProperties: false
                                    type: object
                                    properties:
                                      id:
                                        type: string
                                    required:
                                      - id
                                  - type: string
                              password:
                                anyOf:
                                  - additionalProperties: false
                                    type: object
                                    properties:
                                      id:
                                        type: string
                                    required:
                                      - id
                                  - type: string
                          ssl:
                            additionalProperties: false
                            type: object
                            properties:
                              key:
                                anyOf:
                                  - additionalProperties: false
                                    type: object
                                    properties:
                                      id:
                                        type: string
                                    required:
                                      - id
                                  - type: string
                      ssl:
                        additionalProperties: false
                        type: object
                        properties:
                          certificate:
                            type: string
                          certificate_authorities:
                            items:
                              type: string
                            maxItems: 10
                            type: array
                          key:
                            type: string
                    required:
                      - id
                      - name
                      - host
                required:
                  - item
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
      summary: Create an agent binary download source
      tags:
        - Elastic Agent binary download sources
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/agent_download_sources/{sourceId}:
    delete:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb delete">delete</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/agent_download_sources/{sourceId}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Delete an agent binary download source by ID.<br/><br/>[Required authorization] Route required privileges: fleet-settings-all.
      operationId: delete-fleet-agent-download-sources-sourceid
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: The ID of the download source
          in: path
          name: sourceId
          required: true
          schema:
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                deleteDownloadSourceExample:
                  description: The download source was successfully deleted
                  value:
                    id: download-source-id-1
              schema:
                additionalProperties: false
                type: object
                properties:
                  id:
                    type: string
                required:
                  - id
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
        '404':
          content:
            application/json:
              examples:
                notFoundExample:
                  description: No download source was found with the given ID
                  value:
                    error: Not Found
                    message: Agent binary source download-source-id-1 not found
                    statusCode: 404
          description: Not Found
      summary: Delete an agent binary download source
      tags:
        - Elastic Agent binary download sources
      x-metaTags:
        - content: Kibana
          name: product_name
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/agent_download_sources/{sourceId}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Get an agent binary download source by ID.<br/><br/>[Required authorization] Route required privileges: fleet-agent-policies-read OR fleet-settings-read.
      operationId: get-fleet-agent-download-sources-sourceid
      parameters:
        - description: The ID of the download source
          in: path
          name: sourceId
          required: true
          schema:
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                getDownloadSourceExample:
                  description: An agent binary download source
                  value:
                    item:
                      host: https://artifacts.elastic.co/downloads/
                      id: download-source-id-1
                      is_default: true
                      name: Elastic Artifacts
              schema:
                additionalProperties: false
                type: object
                properties:
                  item:
                    additionalProperties: false
                    type: object
                    properties:
                      auth:
                        additionalProperties: false
                        nullable: true
                        type: object
                        properties:
                          api_key:
                            type: string
                          headers:
                            items:
                              additionalProperties: false
                              type: object
                              properties:
                                key:
                                  type: string
                                value:
                                  type: string
                              required:
                                - key
                                - value
                            maxItems: 100
                            type: array
                          password:
                            type: string
                          username:
                            type: string
                      host:
                        format: uri
                        type: string
                      id:
                        type: string
                      is_default:
                        default: false
                        type: boolean
                      is_preconfigured:
                        type: boolean
                      name:
                        type: string
                      proxy_id:
                        description: The ID of the proxy to use for this download source. See the proxies API for more information.
                        nullable: true
                        type: string
                      secrets:
                        additionalProperties: false
                        type: object
                        properties:
                          auth:
                            additionalProperties: false
                            type: object
                            properties:
                              api_key:
                                anyOf:
                                  - additionalProperties: false
                                    type: object
                                    properties:
                                      id:
                                        type: string
                                    required:
                                      - id
                                  - type: string
                              password:
                                anyOf:
                                  - additionalProperties: false
                                    type: object
                                    properties:
                                      id:
                                        type: string
                                    required:
                                      - id
                                  - type: string
                          ssl:
                            additionalProperties: false
                            type: object
                            properties:
                              key:
                                anyOf:
                                  - additionalProperties: false
                                    type: object
                                    properties:
                                      id:
                                        type: string
                                    required:
                                      - id
                                  - type: string
                      ssl:
                        additionalProperties: false
                        type: object
                        properties:
                          certificate:
                            type: string
                          certificate_authorities:
                            items:
                              type: string
                            maxItems: 10
                            type: array
                          key:
                            type: string
                    required:
                      - id
                      - name
                      - host
                required:
                  - item
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
        '404':
          content:
            application/json:
              examples:
                notFoundExample:
                  description: No download source was found with the given ID
                  value:
                    error: Not Found
                    message: Agent binary source download-source-id-1 not found
                    statusCode: 404
          description: Not Found
      summary: Get an agent binary download source
      tags:
        - Elastic Agent binary download sources
      x-metaTags:
        - content: Kibana
          name: product_name
    put:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb put">put</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/agent_download_sources/{sourceId}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Update an agent binary download source by ID.<br/><br/>[Required authorization] Route required privileges: fleet-settings-all.
      operationId: put-fleet-agent-download-sources-sourceid
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: The ID of the download source
          in: path
          name: sourceId
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            examples:
              putDownloadSourceRequestExample:
                description: Update an agent binary download source
                value:
                  host: https://updated-host.example.com/downloads/
                  is_default: false
                  name: Updated download source
            schema:
              additionalProperties: false
              type: object
              properties:
                auth:
                  additionalProperties: false
                  nullable: true
                  type: object
                  properties:
                    api_key:
                      type: string
                    headers:
                      items:
                        additionalProperties: false
                        type: object
                        properties:
                          key:
                            type: string
                          value:
                            type: string
                        required:
                          - key
                          - value
                      maxItems: 100
                      type: array
                    password:
                      type: string
                    username:
                      type: string
                host:
                  format: uri
                  type: string
                id:
                  type: string
                is_default:
                  default: false
                  type: boolean
                name:
                  type: string
                proxy_id:
                  description: The ID of the proxy to use for this download source. See the proxies API for more information.
                  nullable: true
                  type: string
                secrets:
                  additionalProperties: false
                  type: object
                  properties:
                    auth:
                      additionalProperties: false
                      type: object
                      properties:
                        api_key:
                          anyOf:
                            - additionalProperties: false
                              type: object
                              properties:
                                id:
                                  type: string
                              required:
                                - id
                            - type: string
                        password:
                          anyOf:
                            - additionalProperties: false
                              type: object
                              properties:
                                id:
                                  type: string
                              required:
                                - id
                            - type: string
                    ssl:
                      additionalProperties: false
                      type: object
                      properties:
                        key:
                          anyOf:
                            - additionalProperties: false
                              type: object
                              properties:
                                id:
                                  type: string
                              required:
                                - id
                            - type: string
                ssl:
                  additionalProperties: false
                  type: object
                  properties:
                    certificate:
                      type: string
                    certificate_authorities:
                      items:
                        type: string
                      maxItems: 10
                      type: array
                    key:
                      type: string
              required:
                - name
                - host
      responses:
        '200':
          content:
            application/json:
              examples:
                putDownloadSourceExample:
                  description: The updated agent binary download source
                  value:
                    item:
                      host: https://updated-host.example.com/downloads/
                      id: download-source-id-1
                      is_default: false
                      name: Updated download source
              schema:
                additionalProperties: false
                type: object
                properties:
                  item:
                    additionalProperties: false
                    type: object
                    properties:
                      auth:
                        additionalProperties: false
                        nullable: true
                        type: object
                        properties:
                          api_key:
                            type: string
                          headers:
                            items:
                              additionalProperties: false
                              type: object
                              properties:
                                key:
                                  type: string
                                value:
                                  type: string
                              required:
                                - key
                                - value
                            maxItems: 100
                            type: array
                          password:
                            type: string
                          username:
                            type: string
                      host:
                        format: uri
                        type: string
                      id:
                        type: string
                      is_default:
                        default: false
                        type: boolean
                      is_preconfigured:
                        type: boolean
                      name:
                        type: string
                      proxy_id:
                        description: The ID of the proxy to use for this download source. See the proxies API for more information.
                        nullable: true
                        type: string
                      secrets:
                        additionalProperties: false
                        type: object
                        properties:
                          auth:
                            additionalProperties: false
                            type: object
                            properties:
                              api_key:
                                anyOf:
                                  - additionalProperties: false
                                    type: object
                                    properties:
                                      id:
                                        type: string
                                    required:
                                      - id
                                  - type: string
                              password:
                                anyOf:
                                  - additionalProperties: false
                                    type: object
                                    properties:
                                      id:
                                        type: string
                                    required:
                                      - id
                                  - type: string
                          ssl:
                            additionalProperties: false
                            type: object
                            properties:
                              key:
                                anyOf:
                                  - additionalProperties: false
                                    type: object
                                    properties:
                                      id:
                                        type: string
                                    required:
                                      - id
                                  - type: string
                      ssl:
                        additionalProperties: false
                        type: object
                        properties:
                          certificate:
                            type: string
                          certificate_authorities:
                            items:
                              type: string
                            maxItems: 10
                            type: array
                          key:
                            type: string
                    required:
                      - id
                      - name
                      - host
                required:
                  - item
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
        '404':
          content:
            application/json:
              examples:
                notFoundExample:
                  description: No download source was found with the given ID
                  value:
                    error: Not Found
                    message: Download source download-source-id-1 not found
                    statusCode: 404
          description: Not Found
      summary: Update an agent binary download source
      tags:
        - Elastic Agent binary download sources
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/agent_policies:
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/agent_policies</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        List all agent policies.<br/><br/>[Required authorization] Route required privileges: fleet-agent-policies-read OR fleet-agents-read OR fleet-setup.
      operationId: get-fleet-agent-policies
      parameters:
        - description: Page number
          in: query
          name: page
          required: false
          schema:
            type: number
        - description: Number of results per page
          in: query
          name: perPage
          required: false
          schema:
            type: number
        - description: Field to sort results by
          in: query
          name: sortField
          required: false
          schema:
            type: string
        - description: Sort order, ascending or descending
          in: query
          name: sortOrder
          required: false
          schema:
            enum:
              - desc
              - asc
            type: string
        - description: When true, only show policies with upgradeable agents
          in: query
          name: showUpgradeable
          required: false
          schema:
            type: boolean
        - description: A KQL query string to filter results
          in: query
          name: kuery
          required: false
          schema:
            type: string
        - description: use withAgentCount instead
          in: query
          name: noAgentCount
          required: false
          schema:
            deprecated: true
            type: boolean
        - description: get policies with agent count
          in: query
          name: withAgentCount
          required: false
          schema:
            type: boolean
        - description: get full policies with package policies populated
          in: query
          name: full
          required: false
          schema:
            type: boolean
        - description: 'Format for the response: simplified or legacy'
          in: query
          name: format
          required: false
          schema:
            enum:
              - simplified
              - legacy
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                getAgentPoliciesExample:
                  description: List of agent policies
                  value:
                    items:
                      - description: A sample agent policy
                        id: agent-policy-id-1
                        is_managed: false
                        is_protected: false
                        name: My agent policy
                        namespace: default
                        revision: 1
                        status: active
                        updated_at: '2024-01-15T10:00:00.000Z'
                        updated_by: user1
                    page: 1
                    perPage: 20
                    total: 1
              schema:
                additionalProperties: false
                type: object
                properties:
                  items:
                    items:
                      $ref: '#/components/schemas/Kibana_HTTP_APIs_agent_policy_response'
                    maxItems: 10000
                    type: array
                  page:
                    type: number
                  perPage:
                    type: number
                  total:
                    type: number
                required:
                  - items
                  - total
                  - page
                  - perPage
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
      summary: Get agent policies
      tags:
        - Elastic Agent policies
      x-metaTags:
        - content: Kibana
          name: product_name
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/agent_policies</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Create a new agent policy.<br/><br/>[Required authorization] Route required privileges: fleet-agent-policies-all.
      operationId: post-fleet-agent-policies
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: Whether to add the system integration to the new agent policy
          in: query
          name: sys_monitoring
          required: false
          schema:
            type: boolean
      requestBody:
        content:
          application/json:
            examples:
              postAgentPolicyRequestExample:
                description: Create a new agent policy
                value:
                  description: A sample agent policy
                  monitoring_enabled:
                    - logs
                    - metrics
                  name: My agent policy
                  namespace: default
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_new_agent_policy'
      responses:
        '200':
          content:
            application/json:
              examples:
                postAgentPolicyExample:
                  description: The created agent policy
                  value:
                    item:
                      description: A sample agent policy
                      id: agent-policy-id-2
                      is_managed: false
                      is_protected: false
                      name: My agent policy
                      namespace: default
                      revision: 1
                      status: active
                      updated_at: '2024-01-15T10:00:00.000Z'
                      updated_by: user1
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_get_agent_policy_response'
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
      summary: Create an agent policy
      tags:
        - Elastic Agent policies
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/agent_policies/_bulk_get:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/agent_policies/_bulk_get</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Get multiple agent policies by ID.<br/><br/>[Required authorization] Route required privileges: fleet-agent-policies-read OR fleet-agents-read OR fleet-setup.
      operationId: post-fleet-agent-policies-bulk-get
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: 'Format for the response: simplified or legacy'
          in: query
          name: format
          required: false
          schema:
            enum:
              - simplified
              - legacy
            type: string
      requestBody:
        content:
          application/json:
            examples:
              postBulkGetAgentPoliciesRequestExample:
                description: Retrieve multiple agent policies by ID
                value:
                  ids:
                    - agent-policy-id-1
                    - agent-policy-id-2
            schema:
              additionalProperties: false
              type: object
              properties:
                full:
                  description: get full policies with package policies populated
                  type: boolean
                ids:
                  description: list of package policy ids
                  items:
                    type: string
                  maxItems: 1000
                  type: array
                ignoreMissing:
                  type: boolean
              required:
                - ids
      responses:
        '200':
          content:
            application/json:
              examples:
                postBulkGetAgentPoliciesExample:
                  description: The requested agent policies
                  value:
                    items:
                      - id: agent-policy-id-1
                        is_managed: false
                        is_protected: false
                        name: My agent policy
                        namespace: default
                        revision: 1
                        status: active
                        updated_at: '2024-01-15T10:00:00.000Z'
                        updated_by: user1
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_bulk_get_agent_policies_response'
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
        '404':
          content:
            application/json:
              examples:
                notFoundExample:
                  description: One or more agent policies were not found
                  value:
                    error: Not Found
                    message: An error message describing what went wrong
                    statusCode: 404
          description: Not Found
      summary: Bulk get agent policies
      tags:
        - Elastic Agent policies
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/agent_policies/{agentPolicyId}:
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/agent_policies/{agentPolicyId}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Get an agent policy by ID.<br/><br/>[Required authorization] Route required privileges: fleet-agent-policies-read OR fleet-agents-read OR fleet-setup.
      operationId: get-fleet-agent-policies-agentpolicyid
      parameters:
        - description: The ID of the agent policy
          in: path
          name: agentPolicyId
          required: true
          schema:
            type: string
        - description: 'Format for the response: simplified or legacy'
          in: query
          name: format
          required: false
          schema:
            enum:
              - simplified
              - legacy
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                getAgentPolicyExample:
                  description: An agent policy
                  value:
                    item:
                      description: A sample agent policy
                      id: agent-policy-id-1
                      is_managed: false
                      is_protected: false
                      name: My agent policy
                      namespace: default
                      revision: 1
                      status: active
                      updated_at: '2024-01-15T10:00:00.000Z'
                      updated_by: user1
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_get_agent_policy_response'
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
        '404':
          content:
            application/json:
              examples:
                notFoundExample:
                  description: No agent policy was found with the given ID
                  value:
                    error: Not Found
                    message: Agent policy not found
                    statusCode: 404
          description: Not Found
      summary: Get an agent policy
      tags:
        - Elastic Agent policies
      x-metaTags:
        - content: Kibana
          name: product_name
    put:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb put">put</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/agent_policies/{agentPolicyId}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Update an agent policy by ID.<br/><br/>[Required authorization] Route required privileges: fleet-agent-policies-all.
      operationId: put-fleet-agent-policies-agentpolicyid
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: The ID of the agent policy
          in: path
          name: agentPolicyId
          required: true
          schema:
            type: string
        - description: 'Format for the response: simplified or legacy'
          in: query
          name: format
          required: false
          schema:
            enum:
              - simplified
              - legacy
            type: string
      requestBody:
        content:
          application/json:
            examples:
              putAgentPolicyRequestExample:
                description: Update an agent policy
                value:
                  description: An updated agent policy description
                  monitoring_enabled:
                    - logs
                  name: Updated agent policy
                  namespace: default
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_update_agent_policy_request_body'
      responses:
        '200':
          content:
            application/json:
              examples:
                putAgentPolicyExample:
                  description: The updated agent policy
                  value:
                    item:
                      description: An updated agent policy description
                      id: agent-policy-id-1
                      is_managed: false
                      is_protected: false
                      name: Updated agent policy
                      namespace: default
                      revision: 2
                      status: active
                      updated_at: '2024-01-15T11:00:00.000Z'
                      updated_by: user1
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_get_agent_policy_response'
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
      summary: Update an agent policy
      tags:
        - Elastic Agent policies
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/agent_policies/{agentPolicyId}/auto_upgrade_agents_status:
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/agent_policies/{agentPolicyId}/auto_upgrade_agents_status</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Get the auto-upgrade status for agents assigned to an agent policy.<br/><br/>[Required authorization] Route required privileges: fleet-agents-read.
      operationId: get-fleet-agent-policies-agentpolicyid-auto-upgrade-agents-status
      parameters:
        - description: The ID of the agent policy
          in: path
          name: agentPolicyId
          required: true
          schema:
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                getAutoUpgradeAgentsStatusExample:
                  description: Auto-upgrade status for agents in the policy
                  value:
                    agentsCount: 5
                    currentVersion: 8.16.0
                    failedAgentsCount: 0
                    upgradedAgentsCount: 3
                    upgradingAgentsCount: 1
              schema:
                additionalProperties: false
                type: object
                properties:
                  currentVersions:
                    items:
                      additionalProperties: false
                      type: object
                      properties:
                        agents:
                          description: Number of agents that upgraded to this version
                          type: number
                        failedUpgradeActionIds:
                          description: List of action IDs related to failed upgrades
                          items:
                            type: string
                          maxItems: 1000
                          type: array
                        failedUpgradeAgents:
                          description: Number of agents that failed to upgrade to this version
                          type: number
                        inProgressUpgradeActionIds:
                          description: List of action IDs related to in-progress upgrades
                          items:
                            type: string
                          maxItems: 1000
                          type: array
                        inProgressUpgradeAgents:
                          description: Number of agents that are upgrading to this version
                          type: number
                        version:
                          description: Agent version
                          type: string
                      required:
                        - version
                        - agents
                        - failedUpgradeAgents
                        - inProgressUpgradeAgents
                    maxItems: 10000
                    type: array
                  totalAgents:
                    type: number
                required:
                  - currentVersions
                  - totalAgents
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
      summary: Get auto upgrade agent status
      tags:
        - Elastic Agent policies
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/agent_policies/{agentPolicyId}/copy:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/agent_policies/{agentPolicyId}/copy</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Copy an agent policy by ID.<br/><br/>[Required authorization] Route required privileges: fleet-agent-policies-all.
      operationId: post-fleet-agent-policies-agentpolicyid-copy
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: The ID of the agent policy
          in: path
          name: agentPolicyId
          required: true
          schema:
            type: string
        - description: 'Format for the response: simplified or legacy'
          in: query
          name: format
          required: false
          schema:
            enum:
              - simplified
              - legacy
            type: string
      requestBody:
        content:
          application/json:
            examples:
              postCopyAgentPolicyRequestExample:
                description: Copy an agent policy with a new name
                value:
                  description: A copy of the original agent policy
                  name: Copy of my agent policy
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_copy_agent_policy_request'
      responses:
        '200':
          content:
            application/json:
              examples:
                postCopyAgentPolicyExample:
                  description: The copied agent policy
                  value:
                    item:
                      description: A copy of the original agent policy
                      id: agent-policy-id-copy-1
                      is_managed: false
                      is_protected: false
                      name: Copy of my agent policy
                      namespace: default
                      revision: 1
                      status: active
                      updated_at: '2024-01-15T11:00:00.000Z'
                      updated_by: user1
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_get_agent_policy_response'
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
      summary: Copy an agent policy
      tags:
        - Elastic Agent policies
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/agent_policies/{agentPolicyId}/download:
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/agent_policies/{agentPolicyId}/download</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Download an agent policy by ID.<br/><br/>[Required authorization] Route required privileges: fleet-agent-policies-read OR fleet-setup.
      operationId: get-fleet-agent-policies-agentpolicyid-download
      parameters:
        - description: The ID of the agent policy
          in: path
          name: agentPolicyId
          required: true
          schema:
            type: string
        - description: If true, returns the policy as a downloadable file
          in: query
          name: download
          required: false
          schema:
            type: boolean
        - description: If true, returns the policy formatted for standalone agents
          in: query
          name: standalone
          required: false
          schema:
            type: boolean
        - description: If true, returns the policy formatted for Kubernetes deployment
          in: query
          name: kubernetes
          required: false
          schema:
            type: boolean
        - description: If provided, returns the policy at the specified revision. Cannot be used with standalone or kubernetes flags.
          in: query
          name: revision
          required: false
          schema:
            type: number
      responses:
        '200':
          content:
            application/json:
              examples:
                getDownloadAgentPolicyExample:
                  description: The agent policy download response
                  value:
                    item: 'id: agent-policy-id-1\nrevision: 1\noutputs:\n  default:\n    type: elasticsearch\n    hosts:\n      - https://elasticsearch.example.com:9200\n'
              schema:
                type: string
          description: Successful response — returns the agent policy as a YAML file download
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
        '404':
          content:
            application/json:
              examples:
                notFoundExample:
                  description: No agent policy was found with the given ID
                  value:
                    error: Not Found
                    message: Agent policy not found
                    statusCode: 404
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Not Found
      summary: Download an agent policy
      tags:
        - Elastic Agent policies
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/agent_policies/{agentPolicyId}/full:
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/agent_policies/{agentPolicyId}/full</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Get a full agent policy by ID.<br/><br/>[Required authorization] Route required privileges: fleet-agent-policies-read.
      operationId: get-fleet-agent-policies-agentpolicyid-full
      parameters:
        - description: The ID of the agent policy
          in: path
          name: agentPolicyId
          required: true
          schema:
            type: string
        - description: If true, returns the policy as a downloadable file
          in: query
          name: download
          required: false
          schema:
            type: boolean
        - description: If true, returns the policy formatted for standalone agents
          in: query
          name: standalone
          required: false
          schema:
            type: boolean
        - description: If true, returns the policy formatted for Kubernetes deployment
          in: query
          name: kubernetes
          required: false
          schema:
            type: boolean
        - description: If provided, returns the policy at the specified revision. Cannot be used with standalone or kubernetes flags.
          in: query
          name: revision
          required: false
          schema:
            type: number
      responses:
        '200':
          content:
            application/json:
              examples:
                getFullAgentPolicyExample:
                  description: The full agent policy configuration
                  value:
                    item:
                      agent:
                        monitoring:
                          logs: true
                          metrics: true
                      id: agent-policy-id-1
                      inputs: []
                      outputs:
                        default:
                          hosts:
                            - https://elasticsearch.example.com:9200
                          type: elasticsearch
                      revision: 1
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_get_full_agent_policy_response'
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
        '404':
          content:
            application/json:
              examples:
                notFoundExample:
                  description: No agent policy was found with the given ID
                  value:
                    error: Not Found
                    message: Agent policy not found
                    statusCode: 404
          description: Not Found
      summary: Get a full agent policy
      tags:
        - Elastic Agent policies
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/agent_policies/{agentPolicyId}/outputs:
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/agent_policies/{agentPolicyId}/outputs</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Get a list of outputs associated with agent policy by policy id.<br/><br/>[Required authorization] Route required privileges: fleet-agent-policies-read AND fleet-settings-read.
      operationId: get-fleet-agent-policies-agentpolicyid-outputs
      parameters:
        - description: The ID of the agent policy
          in: path
          name: agentPolicyId
          required: true
          schema:
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                getAgentPolicyOutputsExample:
                  description: Outputs associated with the agent policy
                  value:
                    item:
                      data_output:
                        id: output-id-1
                        name: Default output
                        type: elasticsearch
                      monitoring_output:
                        id: output-id-1
                        name: Default output
                        type: elasticsearch
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_get_agent_policy_outputs_response'
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
        '404':
          content:
            application/json:
              examples:
                notFoundExample:
                  description: No agent policy was found with the given ID
                  value:
                    error: Not Found
                    message: Agent policy not found
                    statusCode: 404
          description: Not Found
      summary: Get outputs for an agent policy
      tags:
        - Elastic Agent policies
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/agent_policies/delete:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/agent_policies/delete</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Delete an agent policy by ID.<br/><br/>[Required authorization] Route required privileges: fleet-agent-policies-all.
      operationId: post-fleet-agent-policies-delete
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
      requestBody:
        content:
          application/json:
            examples:
              postDeleteAgentPolicyRequestExample:
                description: Delete an agent policy by ID
                value:
                  agentPolicyId: agent-policy-id-1
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_delete_agent_policy_request'
      responses:
        '200':
          content:
            application/json:
              examples:
                postDeleteAgentPolicyExample:
                  description: The agent policy was successfully deleted
                  value:
                    id: agent-policy-id-1
                    name: My agent policy
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_delete_agent_policy_response'
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
      summary: Delete an agent policy
      tags:
        - Elastic Agent policies
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/agent_policies/outputs:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/agent_policies/outputs</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Get a list of outputs associated with agent policies.<br/><br/>[Required authorization] Route required privileges: fleet-agent-policies-read AND fleet-settings-read.
      operationId: post-fleet-agent-policies-outputs
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
      requestBody:
        content:
          application/json:
            examples:
              postListAgentPolicyOutputsRequestExample:
                description: Get outputs for multiple agent policies
                value:
                  ids:
                    - agent-policy-id-1
                    - agent-policy-id-2
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_get_list_agent_policy_outputs_request'
      responses:
        '200':
          content:
            application/json:
              examples:
                postListAgentPolicyOutputsExample:
                  description: Outputs associated with the requested agent policies
                  value:
                    items:
                      - agent_policy_id: agent-policy-id-1
                        data_output:
                          id: output-id-1
                          name: Default output
                          type: elasticsearch
                        monitoring_output:
                          id: output-id-1
                          name: Default output
                          type: elasticsearch
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_get_list_agent_policy_outputs_response'
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
      summary: Get outputs for agent policies
      tags:
        - Elastic Agent policies
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/agent_status:
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/agent_status</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Get a summary of agent statuses for a given agent policy.
      operationId: get-fleet-agent-status
      parameters:
        - description: Filter by agent policy ID
          in: query
          name: policyId
          required: false
          schema:
            type: string
        - description: Filter by one or more agent policy IDs
          in: query
          name: policyIds
          required: false
          schema:
            items:
              type: string
            maxItems: 1000
            type: array
        - description: A KQL query string to filter results
          in: query
          name: kuery
          required: false
          schema:
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                getAgentStatusExample:
                  description: Agent status summary for an agent policy
                  value:
                    results:
                      error: 1
                      offline: 2
                      online: 5
                      other: 0
                      updating: 0
                    totalInactive: 0
              schema:
                additionalProperties: false
                type: object
                properties:
                  results:
                    additionalProperties: false
                    type: object
                    properties:
                      active:
                        type: number
                      all:
                        type: number
                      error:
                        type: number
                      events:
                        type: number
                      inactive:
                        type: number
                      offline:
                        type: number
                      online:
                        type: number
                      orphaned:
                        type: number
                      other:
                        type: number
                      unenrolled:
                        type: number
                      uninstalled:
                        type: number
                      updating:
                        type: number
                    required:
                      - events
                      - online
                      - error
                      - offline
                      - other
                      - updating
                      - inactive
                      - unenrolled
                      - all
                      - active
                required:
                  - results
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
      summary: Get an agent status summary
      tags:
        - Elastic Agent status
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/agent_status/data:
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/agent_status/data</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Get the data streams that an agent is actively sending data to.<br/><br/>[Required authorization] Route required privileges: fleet-agents-read.
      operationId: get-fleet-agent-status-data
      parameters:
        - description: Agent IDs to check data for, as an array or comma-separated string
          in: query
          name: agentsIds
          required: true
          schema:
            items:
              type: string
            maxItems: 10000
            type: array
        - description: Filter by integration package name
          in: query
          name: pkgName
          required: false
          schema:
            type: string
        - description: Filter by integration package version
          in: query
          name: pkgVersion
          required: false
          schema:
            type: string
        - description: When true, return a preview of the ingested data
          in: query
          name: previewData
          required: false
          schema:
            default: false
            type: boolean
      responses:
        '200':
          content:
            application/json:
              examples:
                getAgentDataExample:
                  description: Data streams the agent is actively sending data to
                  value:
                    items:
                      - data:
                          logs-nginx.access-default:
                            - id: agent-id-1
                              name: my-host
                    total: 1
                    totalMonitoring: 0
              schema:
                additionalProperties: false
                type: object
                properties:
                  dataPreview:
                    items:
                      nullable: true
                    maxItems: 10000
                    type: array
                  items:
                    items:
                      additionalProperties:
                        additionalProperties: false
                        type: object
                        properties:
                          data:
                            type: boolean
                        required:
                          - data
                      type: object
                    maxItems: 10000
                    type: array
                required:
                  - items
                  - dataPreview
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
      summary: Get incoming agent data
      tags:
        - Elastic Agents
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/agentless_policies:
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/agentless_policies</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Deprecated. Use `GET /api/fleet/managed_integrations` instead. List managed integrations
      operationId: get-fleet-agentless-policies
      parameters:
        - description: Page number. Defaults to `1`.
          in: query
          name: page
          required: false
          schema:
            type: number
        - description: Number of results per page. Defaults to `20`.
          in: query
          name: perPage
          required: false
          schema:
            type: number
        - description: Field to sort results by. Defaults to `updated_at`.
          in: query
          name: sortField
          required: false
          schema:
            maxLength: 256
            type: string
        - description: Sort order, ascending or descending. Defaults to `desc`.
          in: query
          name: sortOrder
          required: false
          schema:
            enum:
              - desc
              - asc
            type: string
        - description: 'A KQL query string to filter results. Filtering is restricted to the following fields: `name`, `namespace`, `package.name`.'
          in: query
          name: kuery
          required: false
          schema:
            maxLength: 4096
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                listManagedIntegrationsResponseExample:
                  description: Example response for listing managed integrations
                  value:
                    items:
                      - created_at: '2025-11-06T18:27:43.541Z'
                        created_by: test_user
                        description: test
                        id: d52a7812-5736-4fdc-aed8-72152afa1ffa
                        inputs:
                          ESS Billing-cel:
                            enabled: true
                            streams:
                              ess_billing.billing:
                                enabled: true
                              ess_billing.credits:
                                enabled: false
                            vars:
                              api_key:
                                id: QY1sWpoBbWcMW-edr0Ee
                                isSecretRef: true
                              organization_id: '1234'
                              url: https://billing.elastic-cloud.com
                        name: ess_billing-1
                        namespace: default
                        package:
                          name: ess_billing
                          title: Elasticsearch Service Billing
                          version: 1.6.0
                        updated_at: '2025-11-06T18:27:43.541Z'
                        updated_by: test_user
                      - cloud_connector:
                          cloud_connector_id: aws-connector-67890
                          enabled: true
                        created_at: '2025-11-06T18:27:43.541Z'
                        created_by: test_user
                        description: CSPM integration for AWS with cloud connector
                        id: aws-policy-12345
                        inputs:
                          cspm-cloudbeat/cis_aws:
                            enabled: true
                        name: cspm-aws-policy
                        namespace: default
                        package:
                          name: cloud_security_posture
                          title: Cloud Security Posture Management
                          version: 3.1.1
                        updated_at: '2025-11-06T18:27:43.541Z'
                        updated_by: test_user
                        vars:
                          deployment: aws
                          posture: cspm
                    page: 1
                    perPage: 20
                    total: 2
              schema:
                additionalProperties: false
                type: object
                properties:
                  items:
                    items:
                      $ref: '#/components/schemas/Kibana_HTTP_APIs_managed_integration'
                    maxItems: 10000
                    type: array
                  page:
                    type: number
                  perPage:
                    type: number
                  total:
                    type: number
                required:
                  - items
                  - total
                  - page
                  - perPage
          description: Indicates a successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
      summary: 'Deprecated: Get managed integrations'
      tags:
        - Fleet agentless policies
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/agentless_policies</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Deprecated. Use `POST /api/fleet/managed_integrations` instead. Create a managed integration
      operationId: post-fleet-agentless-policies
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
      requestBody:
        content:
          application/json:
            examples:
              createManagedIntegrationsRequestExample:
                description: Example request to create a managed integration
                value:
                  description: test
                  inputs:
                    ESS Billing-cel:
                      enabled: true
                      streams:
                        ess_billing.billing:
                          enabled: true
                          vars:
                            hide_sensitive: true
                            http_client_timeout: 30s
                            lookbehind: 365
                            tags:
                              - forwarded
                              - billing
                        ess_billing.credits:
                          enabled: false
                      vars:
                        api_key: <REPLACE_WITH_YOUR_API_KEY>
                        organization_id: '1234'
                  name: ess_billing-1
                  namespace: default
                  package:
                    name: ess_billing
                    version: 1.6.0
              createManagedIntegrationsReuseAWSCloudConnectorExample:
                description: Example request to create a managed integration reusing an existing AWS cloud connector
                value:
                  cloud_connector:
                    cloud_connector_id: existing-aws-connector-id
                    enabled: true
                    target_csp: aws
                  description: CSPM integration for AWS reusing existing cloud connector
                  inputs:
                    cspm-cloudbeat/cis_aws:
                      enabled: true
                      streams:
                        cloud_security_posture.findings:
                          enabled: true
                          vars:
                            aws.account_type: organization-account
                            aws.credentials.type: cloud_connector
                            aws.supports_cloud_connectors: true
                            external_id:
                              id: ABCDEFGHIJKLMNOPQRST
                              isSecretRef: true
                            role_arn: arn:aws:iam::123456789012:role/TestRole
                      vars:
                        cloud_formation_template: https://console.aws.amazon.com/cloudformation/home#/stacks/quickcreate?templateURL=https://elastic-cspm-cft.s3.eu-central-1.amazonaws.com/cloudformation-cspm-ACCOUNT_TYPE-9.2.0.yml
                    cspm-cloudbeat/cis_azure:
                      enabled: false
                    cspm-cloudbeat/cis_gcp:
                      enabled: false
                  name: cspm-aws-reuse-policy
                  namespace: default
                  package:
                    name: cloud_security_posture
                    version: 3.1.1
                  vars:
                    deployment: aws
                    posture: cspm
              createManagedIntegrationsWithAWSCloudConnectorExample:
                description: Example request to create a managed integration with AWS cloud connector
                value:
                  cloud_connector:
                    enabled: true
                    target_csp: aws
                  description: CSPM integration for AWS with cloud connector
                  inputs:
                    cspm-cloudbeat/cis_aws:
                      enabled: true
                      streams:
                        cloud_security_posture.findings:
                          enabled: true
                          vars:
                            aws.account_type: organization-account
                            aws.credentials.type: cloud_connector
                            aws.supports_cloud_connectors: true
                            external_id:
                              id: ABCDEFGHIJKLMNOPQRST
                              isSecretRef: true
                            role_arn: arn:aws:iam::123456789012:role/TestRole
                      vars:
                        cloud_formation_template: https://console.aws.amazon.com/cloudformation/home#/stacks/quickcreate?templateURL=https://elastic-cspm-cft.s3.eu-central-1.amazonaws.com/cloudformation-cspm-ACCOUNT_TYPE-9.2.0.yml
                    cspm-cloudbeat/cis_azure:
                      enabled: false
                    cspm-cloudbeat/cis_gcp:
                      enabled: false
                  name: cspm-aws-policy
                  namespace: default
                  package:
                    name: cloud_security_posture
                    version: 3.1.1
                  vars:
                    deployment: aws
                    posture: cspm
              createManagedIntegrationsWithAzureCloudConnectorExample:
                description: Example request to create a managed integration with Azure cloud connector
                value:
                  cloud_connector:
                    enabled: true
                    target_csp: azure
                  description: CSPM integration for Azure with cloud connector
                  inputs:
                    cspm-cloudbeat/cis_aws:
                      enabled: false
                    cspm-cloudbeat/cis_azure:
                      enabled: true
                      streams:
                        cloud_security_posture.findings:
                          enabled: true
                          vars:
                            azure_credentials_cloud_connector_id:
                              type: text
                              value: existing-azure-credentials-connector-id
                            azure.account_type: organization-account
                            client_id:
                              id: client-secret-id
                              isSecretRef: true
                            tenant_id:
                              id: tenant-secret-id
                              isSecretRef: true
                    cspm-cloudbeat/cis_gcp:
                      enabled: false
                  name: cspm-azure-policy
                  namespace: default
                  package:
                    name: cloud_security_posture
                    version: 3.1.1
                  vars:
                    deployment: azure
                    posture: cspm
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_create_managed_integration_request'
      responses:
        '200':
          content:
            application/json:
              examples:
                createManagedIntegrationsResponseExample:
                  description: Example response for creating a managed integration
                  value:
                    item:
                      created_at: '2025-11-06T18:27:43.541Z'
                      created_by: test_user
                      description: test
                      id: d52a7812-5736-4fdc-aed8-72152afa1ffa
                      inputs:
                        ESS Billing-cel:
                          enabled: true
                          streams:
                            ess_billing.billing:
                              enabled: true
                              vars:
                                hide_sensitive: true
                                http_client_timeout: 30s
                                lookbehind: 365
                                tags:
                                  - forwarded
                                  - billing
                            ess_billing.credits:
                              enabled: false
                          vars:
                            api_key:
                              id: QY1sWpoBbWcMW-edr0Ee
                              isSecretRef: true
                            organization_id: '1234'
                            url: https://billing.elastic-cloud.com
                      name: ess_billing-1
                      namespace: default
                      package:
                        name: ess_billing
                        title: Elasticsearch Service Billing
                        version: 1.6.0
                      updated_at: '2025-11-06T18:27:43.541Z'
                      updated_by: test_user
                createManagedIntegrationsWithAWSCloudConnectorResponseExample:
                  description: Example response for AWS cloud connector integration
                  value:
                    item:
                      cloud_connector:
                        cloud_connector_id: aws-connector-67890
                        enabled: true
                      created_at: '2025-11-06T18:27:43.541Z'
                      created_by: test_user
                      description: CSPM integration for AWS with cloud connector
                      id: aws-policy-12345
                      inputs:
                        cspm-cloudbeat/cis_aws:
                          enabled: true
                          streams:
                            cloud_security_posture.findings:
                              enabled: true
                              vars:
                                aws.account_type: organization-account
                                aws.credentials.type: cloud_connector
                                external_id:
                                  id: secret-external-id-123
                                  isSecretRef: true
                                role_arn: arn:aws:iam::123456789012:role/TestRole
                          vars:
                            cloud_formation_template: https://console.aws.amazon.com/cloudformation/home#/stacks/quickcreate?templateURL=https://elastic-cspm-cft.s3.eu-central-1.amazonaws.com/cloudformation-cspm-ACCOUNT_TYPE-9.2.0.yml
                        cspm-cloudbeat/cis_azure:
                          enabled: false
                        cspm-cloudbeat/cis_gcp:
                          enabled: false
                      name: cspm-aws-policy
                      namespace: default
                      package:
                        name: cloud_security_posture
                        title: Cloud Security Posture Management
                        version: 3.1.1
                      updated_at: '2025-11-06T18:27:43.541Z'
                      updated_by: test_user
                      vars:
                        deployment: aws
                        posture: cspm
                createManagedIntegrationsWithAzureCloudConnectorResponseExample:
                  description: Example response for Azure cloud connector integration
                  value:
                    item:
                      cloud_connector:
                        cloud_connector_id: azure-connector-67890
                        enabled: true
                      created_at: '2025-11-06T18:27:43.541Z'
                      created_by: test_user
                      description: CSPM integration for Azure with cloud connector
                      id: azure-policy-12345
                      inputs:
                        cspm-cloudbeat/cis_aws:
                          enabled: false
                        cspm-cloudbeat/cis_azure:
                          enabled: true
                          streams:
                            cloud_security_posture.findings:
                              enabled: true
                              vars:
                                azure_credentials_cloud_connector_id:
                                  type: text
                                  value: existing-azure-credentials-connector-id
                                azure.account_type: organization-account
                                client_id:
                                  id: client-secret-id-456
                                  isSecretRef: true
                                tenant_id:
                                  id: tenant-secret-id-123
                                  isSecretRef: true
                        cspm-cloudbeat/cis_gcp:
                          enabled: false
                      name: cspm-azure-policy
                      namespace: default
                      package:
                        name: cloud_security_posture
                        title: Cloud Security Posture Management
                        version: 3.1.1
                      updated_at: '2025-11-06T18:27:43.541Z'
                      updated_by: test_user
                      vars:
                        deployment: azure
                        posture: cspm
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_managed_integration_response'
          description: Indicates a successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
        '409':
          content:
            application/json:
              examples:
                conflictErrorResponseExample:
                  description: Example of a conflict error response
                  value:
                    error: Conflict
                    message: An error message describing what went wrong
                    statusCode: 409
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Conflict
      summary: 'Deprecated: Create a managed integration'
      tags:
        - Fleet agentless policies
      x-state: Experimental; added in 9.3.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/agentless_policies/_upgrade:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/agentless_policies/_upgrade</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Deprecated. Use `POST /api/fleet/managed_integrations/_upgrade` instead. Upgrade multiple managed integrations to their installed package version, migrating each package policy's config onto the new schema. Always returns 200 with a per-policy result array; a missing id, or an id that is not a managed integration, is reported as a per-item failure (`success: false` + `statusCode`) without failing the batch, so valid ids are still upgraded. A successful result means the policy's saved object was upgraded, while the agentless deployment is reconciled asynchronously in the background. Policies already at the installed version are a genuine no-op: they still report `success: true` (calls stay idempotent) but nothing is re-persisted or redeployed. Note: agent-policy-level agentless settings (resources, ownership tags) are not re-derived from the new package version — use the update (PUT) endpoint for those.
      operationId: post-fleet-agentless-policies-upgrade
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
      requestBody:
        content:
          application/json:
            examples:
              upgradeManagedIntegrationsRequestExample:
                description: Bulk upgrade managed integrations to their installed package version
                value:
                  policyIds:
                    - d52a7812-5736-4fdc-aed8-72152afa1ffa
                    - aws-policy-12345
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_bulk_upgrade_managed_integrations_request'
      responses:
        '200':
          content:
            application/json:
              examples:
                upgradeManagedIntegrationsPartialFailureResponseExample:
                  description: Example response where one managed integration upgraded and another id was missing or not a managed integration (the batch still returns 200)
                  value:
                    - id: d52a7812-5736-4fdc-aed8-72152afa1ffa
                      name: ess_billing-1
                      success: true
                    - body:
                        message: Agentless policy aws-policy-12345 not found
                      id: aws-policy-12345
                      statusCode: 404
                      success: false
                upgradeManagedIntegrationsResponseExample:
                  description: Example response where every policy was upgraded
                  value:
                    - id: d52a7812-5736-4fdc-aed8-72152afa1ffa
                      name: ess_billing-1
                      success: true
                    - id: aws-policy-12345
                      name: cspm-aws-policy
                      success: true
              schema:
                items:
                  $ref: '#/components/schemas/Kibana_HTTP_APIs_bulk_upgrade_managed_integration_result'
                maxItems: 10000
                type: array
          description: "Indicates a successful response. Each item reports the per-policy upgrade outcome; inspect every item's `success` flag. A missing id, or an id that is not a managed integration, is reported as a per-item failure (`success: false` + `statusCode`) without failing the batch."
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
      summary: 'Deprecated: Bulk upgrade managed integrations'
      tags:
        - Fleet agentless policies
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/agentless_policies/_upgrade/dryrun:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/agentless_policies/_upgrade/dryrun</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Deprecated. Use `POST /api/fleet/managed_integrations/_upgrade/dryrun` instead. Preview upgrading multiple managed integrations without applying any change. Targets the installed package version by default; pass `pkgVersion` to preview a specific (for example, not-yet-installed) version. Each result returns the current/proposed version and any migration errors, plus — only on a clean dry-run (`hasErrors: false`) — the migrated `proposedPolicy`. `proposedPolicy` is for the edit-and-upgrade flow (edit it, then save via the update (PUT) endpoint); to apply an upgrade as-is, use `_upgrade`.
      operationId: post-fleet-agentless-policies-upgrade-dryrun
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
      requestBody:
        content:
          application/json:
            examples:
              upgradeManagedIntegrationsDryRunRequestExample:
                description: Preview the upgrade of managed integrations to their installed package version
                value:
                  policyIds:
                    - d52a7812-5736-4fdc-aed8-72152afa1ffa
              upgradeManagedIntegrationsDryRunTargetVersionRequestExample:
                description: Preview the upgrade against an explicit target package version (for example, before installing the new version). Defaults to the installed package version when omitted.
                value:
                  pkgVersion: 1.6.0
                  policyIds:
                    - d52a7812-5736-4fdc-aed8-72152afa1ffa
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_managed_integration_upgrade_dry_run_request'
      responses:
        '200':
          content:
            application/json:
              examples:
                upgradeManagedIntegrationsDryRunMigrationErrorsExample:
                  description: Example dry-run response where migrating the config to the new version produced errors. `hasErrors` is true and `errors` explains why; do not feed the (partial) proposed config into the update endpoint without resolving them.
                  value:
                    - currentVersion: 1.5.0
                      errors:
                        - message: Variable "organization_id" is required
                      hasErrors: true
                      id: d52a7812-5736-4fdc-aed8-72152afa1ffa
                      name: ess_billing-1
                      proposedVersion: 1.6.0
                upgradeManagedIntegrationsDryRunMixedResponseExample:
                  description: 'Example dry-run response for a mixed batch: one managed integration previews cleanly while two ids are missing or not managed integrations. Ids that are missing or not managed integrations are surfaced as per-item failures (`hasErrors: true` + `statusCode`) without failing the batch, and results stay in request order.'
                  value:
                    - currentVersion: 0.5.0
                      hasErrors: false
                      id: 2e426392-f856-4ab2-bc31-92d4dbb8d134
                      name: agentless_hello_world-16
                      proposedPolicy:
                        cloud_connector: null
                        created_at: '2026-07-01T15:59:08.299Z'
                        created_by: admin
                        description: ''
                        id: 2e426392-f856-4ab2-bc31-92d4dbb8d134
                        inputs:
                          agentless_hello_world-cel:
                            enabled: true
                            streams:
                              agentless_hello_world.generic:
                                enabled: true
                                vars:
                                  url: https://epr.elastic.co
                              agentless_hello_world.mock_counter:
                                enabled: false
                                vars:
                                  events_per_second: 10
                                  mode: constant
                                  spike_events: 100
                                  spike_every_seconds: 60
                          agentless_hello_world-httpjson:
                            enabled: false
                            streams:
                              agentless_hello_world.generic:
                                enabled: false
                                vars:
                                  url: https://epr.elastic.co
                        name: agentless_hello_world-16
                        namespace: default
                        package:
                          name: agentless_hello_world
                          title: Agentless Hello World
                          version: 0.5.0
                        updated_at: '2026-07-01T16:02:14.067Z'
                        updated_by: admin
                      proposedVersion: 0.5.0
                    - body:
                        message: Agentless policy 9300464c-6cfc-4566-850d-e9e7927457fe not found
                      hasErrors: true
                      id: 9300464c-6cfc-4566-850d-e9e7927457fe
                      statusCode: 404
                    - body:
                        message: Agentless policy 5b8763e9-791a-4038-be29-b384d578200e not found
                      hasErrors: true
                      id: 5b8763e9-791a-4038-be29-b384d578200e
                      statusCode: 404
                upgradeManagedIntegrationsDryRunResponseExample:
                  description: 'Example clean dry-run response (`hasErrors: false`) with the proposed (migrated) policy. `proposedPolicy` is intended for the edit-and-upgrade flow: edit it and submit the edited payload to the update (PUT) endpoint. To apply without edits, use the `_upgrade` endpoint instead.'
                  value:
                    - currentVersion: 1.5.0
                      hasErrors: false
                      id: d52a7812-5736-4fdc-aed8-72152afa1ffa
                      name: ess_billing-1
                      proposedPolicy:
                        created_at: '2025-11-06T18:27:43.541Z'
                        created_by: test_user
                        description: test
                        id: d52a7812-5736-4fdc-aed8-72152afa1ffa
                        inputs:
                          ESS Billing-cel:
                            enabled: true
                            vars:
                              organization_id: '1234'
                        name: ess_billing-1
                        namespace: default
                        package:
                          name: ess_billing
                          title: Elasticsearch Service Billing
                          version: 1.6.0
                        updated_at: '2025-11-06T18:27:43.541Z'
                        updated_by: test_user
                      proposedVersion: 1.6.0
              schema:
                items:
                  $ref: '#/components/schemas/Kibana_HTTP_APIs_managed_integration_upgrade_dry_run_result'
                maxItems: 10000
                type: array
          description: 'Indicates a successful response. Each clean item (`hasErrors: false`) previews the migrated policy as a consumable managed integration (`proposedPolicy`); a missing id, an id that is not a managed integration, or a migration error, is reported as a per-item failure (`hasErrors: true`, with `proposedPolicy` omitted) without failing the batch. Inspect every item.'
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
      summary: 'Deprecated: Preview a managed integrations upgrade'
      tags:
        - Fleet agentless policies
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/agentless_policies/{policyId}:
    delete:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb delete">delete</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/agentless_policies/{policyId}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Deprecated. Use `DELETE /api/fleet/managed_integrations/{policyId}` instead. Delete a managed integration
      operationId: delete-fleet-agentless-policies-policyid
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: The ID of the policy to delete.
          in: path
          name: policyId
          required: true
          schema:
            maxLength: 256
            type: string
        - description: Force delete the policy even if the policy is managed.
          in: query
          name: force
          required: false
          schema:
            type: boolean
      responses:
        '200':
          content:
            application/json:
              examples:
                deleteManagedIntegrationsResponseExample:
                  description: Example response for deleting a managed integration
                  value:
                    item:
                      id: d52a7812-5736-4fdc-aed8-72152afa1ffa
              schema:
                additionalProperties: false
                description: Response for deleting a managed integration.
                type: object
                properties:
                  id:
                    description: The ID of the deleted managed integration.
                    type: string
                required:
                  - id
          description: Indicates a successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
        '404':
          content:
            application/json:
              examples:
                notFoundErrorResponseExample:
                  description: Example of a not found error response
                  value:
                    message: Agentless policy d52a7812-5736-4fdc-aed8-72152afa1ffa not found
              schema:
                additionalProperties: false
                type: object
                properties:
                  message:
                    type: string
                required:
                  - message
          description: Not Found
        '409':
          content:
            application/json:
              examples:
                conflictErrorResponseExample:
                  description: Example of a conflict error response
                  value:
                    error: Conflict
                    message: An error message describing what went wrong
                    statusCode: 409
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Conflict
      summary: 'Deprecated: Delete a managed integration'
      tags:
        - Fleet agentless policies
      x-state: Experimental; added in 9.3.0
      x-metaTags:
        - content: Kibana
          name: product_name
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/agentless_policies/{policyId}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Deprecated. Use `GET /api/fleet/managed_integrations/{policyId}` instead. Get a managed integration by ID
      operationId: get-fleet-agentless-policies-policyid
      parameters:
        - description: The ID of the managed integration to retrieve.
          in: path
          name: policyId
          required: true
          schema:
            maxLength: 256
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                getManagedIntegrationResponseExample:
                  description: Example response for getting a managed integration by ID
                  value:
                    item:
                      created_at: '2025-11-06T18:27:43.541Z'
                      created_by: test_user
                      description: test
                      id: d52a7812-5736-4fdc-aed8-72152afa1ffa
                      inputs:
                        ESS Billing-cel:
                          enabled: true
                          streams:
                            ess_billing.billing:
                              enabled: true
                              vars:
                                hide_sensitive: true
                                http_client_timeout: 30s
                                lookbehind: 365
                                tags:
                                  - forwarded
                                  - billing
                            ess_billing.credits:
                              enabled: false
                          vars:
                            api_key:
                              id: QY1sWpoBbWcMW-edr0Ee
                              isSecretRef: true
                            organization_id: '1234'
                            url: https://billing.elastic-cloud.com
                      name: ess_billing-1
                      namespace: default
                      package:
                        name: ess_billing
                        title: Elasticsearch Service Billing
                        version: 1.6.0
                      updated_at: '2025-11-06T18:27:43.541Z'
                      updated_by: test_user
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_managed_integration_response'
          description: Indicates a successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
        '404':
          content:
            application/json:
              examples:
                notFoundErrorResponseExample:
                  description: Example of a not found error response
                  value:
                    message: Agentless policy d52a7812-5736-4fdc-aed8-72152afa1ffa not found
              schema:
                additionalProperties: false
                type: object
                properties:
                  message:
                    type: string
                required:
                  - message
          description: Not Found
      summary: 'Deprecated: Get a managed integration'
      tags:
        - Fleet agentless policies
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
    put:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb put">put</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/agentless_policies/{policyId}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Deprecated. Use `PUT /api/fleet/managed_integrations/{policyId}` instead. Update a managed integration by ID. Uses full-replace semantics: the policy is rebuilt entirely from the request body, so any omitted optional field (for example, `description`, `vars`, `global_data_tags`, `cloud_connector`) is cleared or reset to its default. The integration package name is immutable and the runtime-managed `cluster_id` is preserved from the existing policy.
      operationId: put-fleet-agentless-policies-policyid
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: The ID of the managed integration to update.
          in: path
          name: policyId
          required: true
          schema:
            maxLength: 256
            type: string
      requestBody:
        content:
          application/json:
            examples:
              updateManagedIntegrationAttachAWSCloudConnectorRequestExample:
                description: Example request to attach an AWS cloud connector to a managed integration on update. Because `PUT` is full-replace, the `cloud_connector` block must be present on every subsequent update or the connector is detached.
                value:
                  cloud_connector:
                    enabled: true
                    target_csp: aws
                  description: CSPM integration for AWS with cloud connector
                  inputs:
                    cspm-cloudbeat/cis_aws:
                      enabled: true
                      streams:
                        cloud_security_posture.findings:
                          enabled: true
                          vars:
                            aws.account_type: organization-account
                            aws.credentials.type: cloud_connector
                            aws.supports_cloud_connectors: true
                            external_id:
                              id: ABCDEFGHIJKLMNOPQRST
                              isSecretRef: true
                            role_arn: arn:aws:iam::123456789012:role/TestRole
                      vars:
                        cloud_formation_template: https://console.aws.amazon.com/cloudformation/home#/stacks/quickcreate?templateURL=https://elastic-cspm-cft.s3.eu-central-1.amazonaws.com/cloudformation-cspm-ACCOUNT_TYPE-9.2.0.yml
                    cspm-cloudbeat/cis_azure:
                      enabled: false
                    cspm-cloudbeat/cis_gcp:
                      enabled: false
                  name: cspm-aws-policy
                  namespace: default
                  package:
                    name: cloud_security_posture
                    version: 3.1.1
                  vars:
                    deployment: aws
                    posture: cspm
              updateManagedIntegrationClearFieldsRequestExample:
                description: Example showing full-replace clearing semantics. Compared to the prior state, this request omits `description` (clearing it) and provides only the minimal required fields. Any optional field not present in the body (for example, `description`, `vars`, `global_data_tags`, `cloud_connector`) is dropped from the resulting policy.
                value:
                  inputs:
                    ESS Billing-cel:
                      enabled: true
                      streams:
                        ess_billing.billing:
                          enabled: true
                        ess_billing.credits:
                          enabled: true
                      vars:
                        api_key: <REPLACE_WITH_YOUR_API_KEY>
                        organization_id: '1234'
                  name: ess_billing-1
                  namespace: default
                  package:
                    name: ess_billing
                    version: 1.6.0
              updateManagedIntegrationRequestExample:
                description: 'Example request to update a managed integration. `PUT` uses full-replace semantics: the policy is rebuilt entirely from this body, so any omitted optional field is cleared or reset to its default rather than preserved. For example, omitting `description` clears it, omitting `vars` or `global_data_tags` removes them, and omitting `cloud_connector` detaches any previously attached connector. Detaching or swapping a cloud connector only removes the reference; the connector itself is not deleted, as connectors have an independent, shareable lifecycle and are managed through the cloud connector API. Two fields are exceptions that cannot be changed using `PUT`: the integration `package.name` is immutable, and the runtime-managed `cluster_id` is preserved from the existing agent policy.'
                value:
                  description: updated description
                  inputs:
                    ESS Billing-cel:
                      enabled: true
                      streams:
                        ess_billing.billing:
                          enabled: true
                          vars:
                            hide_sensitive: true
                            http_client_timeout: 30s
                            lookbehind: 180
                            tags:
                              - forwarded
                              - billing
                        ess_billing.credits:
                          enabled: true
                      vars:
                        api_key: <REPLACE_WITH_YOUR_API_KEY>
                        organization_id: '1234'
                  name: ess_billing-1
                  namespace: default
                  package:
                    name: ess_billing
                    version: 1.6.0
              updateManagedIntegrationReuseAWSCloudConnectorRequestExample:
                description: Example request to update a managed integration reusing an existing AWS cloud connector by ID instead of creating a new one.
                value:
                  cloud_connector:
                    cloud_connector_id: existing-aws-connector-id
                    enabled: true
                    target_csp: aws
                  description: CSPM integration for AWS reusing existing cloud connector
                  inputs:
                    cspm-cloudbeat/cis_aws:
                      enabled: true
                      streams:
                        cloud_security_posture.findings:
                          enabled: true
                          vars:
                            aws.account_type: organization-account
                            aws.credentials.type: cloud_connector
                            aws.supports_cloud_connectors: true
                            external_id:
                              id: ABCDEFGHIJKLMNOPQRST
                              isSecretRef: true
                            role_arn: arn:aws:iam::123456789012:role/TestRole
                      vars:
                        cloud_formation_template: https://console.aws.amazon.com/cloudformation/home#/stacks/quickcreate?templateURL=https://elastic-cspm-cft.s3.eu-central-1.amazonaws.com/cloudformation-cspm-ACCOUNT_TYPE-9.2.0.yml
                    cspm-cloudbeat/cis_azure:
                      enabled: false
                    cspm-cloudbeat/cis_gcp:
                      enabled: false
                  name: cspm-aws-policy
                  namespace: default
                  package:
                    name: cloud_security_posture
                    version: 3.1.1
                  vars:
                    deployment: aws
                    posture: cspm
              updateManagedIntegrationVersionChangeRequestExample:
                description: Example request to update a managed integration to a different package version. The package name is immutable, but the version may change.
                value:
                  description: bumped to a newer package version
                  inputs:
                    ESS Billing-cel:
                      enabled: true
                      streams:
                        ess_billing.billing:
                          enabled: true
                        ess_billing.credits:
                          enabled: false
                      vars:
                        api_key: <REPLACE_WITH_YOUR_API_KEY>
                        organization_id: '1234'
                  name: ess_billing-1
                  namespace: default
                  package:
                    name: ess_billing
                    version: 1.7.0
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_create_managed_integration_request'
      responses:
        '200':
          content:
            application/json:
              examples:
                updateManagedIntegrationResponseExample:
                  description: Example response for updating a managed integration
                  value:
                    item:
                      created_at: '2025-11-06T18:27:43.541Z'
                      created_by: test_user
                      description: updated description
                      id: d52a7812-5736-4fdc-aed8-72152afa1ffa
                      inputs:
                        ESS Billing-cel:
                          enabled: true
                          streams:
                            ess_billing.billing:
                              enabled: true
                              vars:
                                hide_sensitive: true
                                http_client_timeout: 30s
                                lookbehind: 180
                                tags:
                                  - forwarded
                                  - billing
                            ess_billing.credits:
                              enabled: true
                          vars:
                            api_key:
                              id: QY1sWpoBbWcMW-edr0Ee
                              isSecretRef: true
                            organization_id: '1234'
                            url: https://billing.elastic-cloud.com
                      name: ess_billing-1
                      namespace: default
                      package:
                        name: ess_billing
                        title: Elasticsearch Service Billing
                        version: 1.6.0
                      updated_at: '2025-11-07T09:14:02.118Z'
                      updated_by: test_user
                updateManagedIntegrationWithAWSCloudConnectorResponseExample:
                  description: Example response after attaching an AWS cloud connector on update
                  value:
                    item:
                      cloud_connector:
                        cloud_connector_id: aws-connector-67890
                        enabled: true
                      created_at: '2025-11-06T18:27:43.541Z'
                      created_by: test_user
                      description: CSPM integration for AWS with cloud connector
                      id: aws-policy-12345
                      inputs:
                        cspm-cloudbeat/cis_aws:
                          enabled: true
                          streams:
                            cloud_security_posture.findings:
                              enabled: true
                              vars:
                                aws.account_type: organization-account
                                aws.credentials.type: cloud_connector
                                external_id:
                                  id: secret-external-id-123
                                  isSecretRef: true
                                role_arn: arn:aws:iam::123456789012:role/TestRole
                          vars:
                            cloud_formation_template: https://console.aws.amazon.com/cloudformation/home#/stacks/quickcreate?templateURL=https://elastic-cspm-cft.s3.eu-central-1.amazonaws.com/cloudformation-cspm-ACCOUNT_TYPE-9.2.0.yml
                        cspm-cloudbeat/cis_azure:
                          enabled: false
                        cspm-cloudbeat/cis_gcp:
                          enabled: false
                      name: cspm-aws-policy
                      namespace: default
                      package:
                        name: cloud_security_posture
                        title: Cloud Security Posture Management
                        version: 3.1.1
                      updated_at: '2025-11-07T09:14:02.118Z'
                      updated_by: test_user
                      vars:
                        deployment: aws
                        posture: cspm
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_managed_integration_response'
          description: Indicates a successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
                packageNameChangeErrorResponseExample:
                  description: The integration package name cannot be changed on update
                  value:
                    error: Bad Request
                    message: Cannot change the integration package of an agentless policy (from "ess_billing" to "cloud_security_posture").
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
        '404':
          content:
            application/json:
              examples:
                notFoundErrorResponseExample:
                  description: Example of a not found error response
                  value:
                    message: Agentless policy d52a7812-5736-4fdc-aed8-72152afa1ffa not found
              schema:
                additionalProperties: false
                type: object
                properties:
                  message:
                    type: string
                required:
                  - message
          description: Not Found
        '409':
          content:
            application/json:
              examples:
                conflictErrorResponseExample:
                  description: Example of a name-conflict error response
                  value:
                    error: Conflict
                    message: An integration policy with the name my-agentless-policy already exists. Please rename it or choose a different name.
                    statusCode: 409
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Conflict — for example, the requested name is already used by another integration policy.
      summary: 'Deprecated: Update a managed integration'
      tags:
        - Fleet agentless policies
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/agents:
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/agents</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        List agents, with optional filtering and pagination.<br/><br/>[Required authorization] Route required privileges: fleet-agents-read.
      operationId: get-fleet-agents
      parameters:
        - description: Page number
          in: query
          name: page
          required: false
          schema:
            type: number
        - description: Number of results per page
          in: query
          name: perPage
          required: false
          schema:
            default: 20
            type: number
        - description: A KQL query string to filter results
          in: query
          name: kuery
          required: false
          schema:
            type: string
        - description: When true, include agentless agents in the results
          in: query
          name: showAgentless
          required: false
          schema:
            default: true
            type: boolean
        - description: When true, include inactive agents in the results
          in: query
          name: showInactive
          required: false
          schema:
            default: false
            type: boolean
        - description: When true, include CPU and memory metrics in the response
          in: query
          name: withMetrics
          required: false
          schema:
            default: false
            type: boolean
        - description: When true, only return agents that are upgradeable
          in: query
          name: showUpgradeable
          required: false
          schema:
            default: false
            type: boolean
        - description: When true, return a summary of agent statuses in the response
          in: query
          name: getStatusSummary
          required: false
          schema:
            default: false
            type: boolean
        - description: Field to sort results by
          in: query
          name: sortField
          required: false
          schema:
            type: string
        - description: Sort order, ascending or descending
          in: query
          name: sortOrder
          required: false
          schema:
            enum:
              - asc
              - desc
            type: string
        - description: JSON-encoded array of sort values for `search_after` pagination
          in: query
          name: searchAfter
          required: false
          schema:
            type: string
        - description: When true, opens a new point-in-time for pagination
          in: query
          name: openPit
          required: false
          schema:
            type: boolean
        - description: Point-in-time ID for pagination
          in: query
          name: pitId
          required: false
          schema:
            type: string
        - description: Duration to keep the point-in-time alive, for example, `1m`
          in: query
          name: pitKeepAlive
          required: false
          schema:
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                getAgentsExample:
                  description: List of agents
                  value:
                    items:
                      - active: true
                        enrolled_at: '2024-01-01T00:00:00.000Z'
                        id: agent-id-1
                        policy_id: agent-policy-id-1
                        policy_revision: 1
                        status: online
                        type: PERMANENT
                        updated_at: '2024-01-01T00:00:00.000Z'
                    page: 1
                    perPage: 20
                    total: 1
              schema:
                additionalProperties: false
                type: object
                properties:
                  items:
                    items:
                      additionalProperties: false
                      type: object
                      properties:
                        access_api_key:
                          type: string
                        access_api_key_id:
                          type: string
                        active:
                          type: boolean
                        agent:
                          additionalProperties: true
                          type: object
                          properties:
                            id:
                              type: string
                            type:
                              type: string
                            version:
                              type: string
                          required:
                            - id
                            - version
                        audit_unenrolled_reason:
                          type: string
                        capabilities:
                          items:
                            type: string
                          maxItems: 100
                          type: array
                        components:
                          items:
                            additionalProperties: false
                            type: object
                            properties:
                              id:
                                type: string
                              message:
                                type: string
                              status:
                                enum:
                                  - STARTING
                                  - CONFIGURING
                                  - HEALTHY
                                  - DEGRADED
                                  - FAILED
                                  - STOPPING
                                  - STOPPED
                                type: string
                              type:
                                type: string
                              units:
                                items:
                                  additionalProperties: false
                                  type: object
                                  properties:
                                    id:
                                      type: string
                                    message:
                                      type: string
                                    payload:
                                      additionalProperties:
                                        nullable: true
                                      type: object
                                    status:
                                      enum:
                                        - STARTING
                                        - CONFIGURING
                                        - HEALTHY
                                        - DEGRADED
                                        - FAILED
                                        - STOPPING
                                        - STOPPED
                                      type: string
                                    type:
                                      enum:
                                        - input
                                        - output
                                        - ''
                                      type: string
                                  required:
                                    - id
                                    - type
                                    - status
                                    - message
                                maxItems: 10000
                                type: array
                            required:
                              - id
                              - type
                              - status
                              - message
                          maxItems: 10000
                          type: array
                        default_api_key:
                          type: string
                        default_api_key_history:
                          items:
                            additionalProperties: false
                            deprecated: true
                            type: object
                            properties:
                              id:
                                type: string
                              retired_at:
                                type: string
                            required:
                              - id
                              - retired_at
                          maxItems: 100
                          type: array
                        default_api_key_id:
                          type: string
                        effective_config:
                          nullable: true
                        enrolled_at:
                          type: string
                        health:
                          additionalProperties:
                            nullable: true
                          type: object
                        id:
                          type: string
                        identifying_attributes:
                          additionalProperties:
                            type: string
                          type: object
                        last_checkin:
                          type: string
                        last_checkin_message:
                          type: string
                        last_checkin_status:
                          enum:
                            - error
                            - online
                            - degraded
                            - updating
                            - starting
                            - disconnected
                          type: string
                        last_known_status:
                          enum:
                            - offline
                            - error
                            - online
                            - inactive
                            - enrolling
                            - unenrolling
                            - unenrolled
                            - updating
                            - degraded
                            - uninstalled
                            - orphaned
                          type: string
                        local_metadata:
                          additionalProperties:
                            nullable: true
                          type: object
                        metrics:
                          additionalProperties: false
                          type: object
                          properties:
                            cpu_avg:
                              type: number
                            memory_size_byte_avg:
                              type: number
                        namespaces:
                          items:
                            type: string
                          maxItems: 100
                          type: array
                        non_identifying_attributes:
                          additionalProperties:
                            type: string
                          type: object
                        outputs:
                          additionalProperties:
                            additionalProperties: false
                            type: object
                            properties:
                              api_key_id:
                                type: string
                              to_retire_api_key_ids:
                                items:
                                  additionalProperties: false
                                  type: object
                                  properties:
                                    id:
                                      type: string
                                    retired_at:
                                      type: string
                                  required:
                                    - id
                                    - retired_at
                                maxItems: 100
                                type: array
                              type:
                                type: string
                          type: object
                        packages:
                          items:
                            type: string
                          maxItems: 10000
                          type: array
                        pipeline_config:
                          maxLength: 10000
                          type: string
                        policy_base_id:
                          type: string
                        policy_id:
                          type: string
                        policy_revision:
                          nullable: true
                          type: number
                        sequence_num:
                          type: number
                        signals:
                          items:
                            type: string
                          maxItems: 50
                          type: array
                        sort:
                          items:
                            nullable: true
                          maxItems: 10
                          type: array
                        status:
                          enum:
                            - offline
                            - error
                            - online
                            - inactive
                            - enrolling
                            - unenrolling
                            - unenrolled
                            - updating
                            - degraded
                            - uninstalled
                            - orphaned
                          type: string
                        tags:
                          items:
                            type: string
                          maxItems: 100
                          type: array
                        type:
                          enum:
                            - PERMANENT
                            - EPHEMERAL
                            - TEMPORARY
                            - OPAMP
                          type: string
                        unenrolled_at:
                          type: string
                        unenrollment_started_at:
                          type: string
                        unhealthy_reason:
                          items:
                            enum:
                              - input
                              - output
                              - other
                            type: string
                          maxItems: 3
                          nullable: true
                          type: array
                        upgrade:
                          additionalProperties: false
                          type: object
                          properties:
                            rollbacks:
                              items:
                                additionalProperties: false
                                type: object
                                properties:
                                  valid_until:
                                    type: string
                                  version:
                                    type: string
                                required:
                                  - valid_until
                                  - version
                              maxItems: 100
                              type: array
                        upgrade_attempts:
                          items:
                            type: string
                          maxItems: 10000
                          nullable: true
                          type: array
                        upgrade_details:
                          additionalProperties: false
                          nullable: true
                          type: object
                          properties:
                            action_id:
                              type: string
                            metadata:
                              additionalProperties: false
                              type: object
                              properties:
                                download_percent:
                                  type: number
                                download_rate:
                                  type: number
                                error_msg:
                                  type: string
                                failed_state:
                                  enum:
                                    - UPG_REQUESTED
                                    - UPG_SCHEDULED
                                    - UPG_DOWNLOADING
                                    - UPG_EXTRACTING
                                    - UPG_REPLACING
                                    - UPG_RESTARTING
                                    - UPG_FAILED
                                    - UPG_WATCHING
                                    - UPG_ROLLBACK
                                  type: string
                                reason:
                                  type: string
                                retry_error_msg:
                                  type: string
                                retry_until:
                                  type: string
                                scheduled_at:
                                  type: string
                            state:
                              enum:
                                - UPG_REQUESTED
                                - UPG_SCHEDULED
                                - UPG_DOWNLOADING
                                - UPG_EXTRACTING
                                - UPG_REPLACING
                                - UPG_RESTARTING
                                - UPG_FAILED
                                - UPG_WATCHING
                                - UPG_ROLLBACK
                              type: string
                            target_version:
                              type: string
                          required:
                            - target_version
                            - action_id
                            - state
                        upgrade_started_at:
                          nullable: true
                          type: string
                        upgraded_at:
                          nullable: true
                          type: string
                        user_provided_metadata:
                          additionalProperties:
                            nullable: true
                          type: object
                      required:
                        - id
                        - packages
                        - type
                        - active
                        - enrolled_at
                        - local_metadata
                        - effective_config
                    maxItems: 10000
                    type: array
                  nextSearchAfter:
                    type: string
                  page:
                    type: number
                  perPage:
                    type: number
                  pit:
                    type: string
                  statusSummary:
                    additionalProperties:
                      type: number
                    type: object
                  total:
                    type: number
                required:
                  - items
                  - total
                  - page
                  - perPage
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
      summary: Get agents
      tags:
        - Elastic Agents
      x-metaTags:
        - content: Kibana
          name: product_name
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/agents</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Retrieve agents associated with specific action IDs.<br/><br/>[Required authorization] Route required privileges: fleet-agents-read.
      operationId: post-fleet-agents
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
      requestBody:
        content:
          application/json:
            examples:
              postGetAgentsByActionsRequestExample:
                description: Retrieve agents associated with specific action IDs
                value:
                  actionIds:
                    - action-id-1
                    - action-id-2
            schema:
              additionalProperties: false
              type: object
              properties:
                actionIds:
                  items:
                    type: string
                  maxItems: 1000
                  type: array
              required:
                - actionIds
      responses:
        '200':
          content:
            application/json:
              examples:
                postGetAgentsByActionsExample:
                  description: Agents associated with the given actions
                  value:
                    items:
                      - active: true
                        id: agent-id-1
                        policy_id: agent-policy-id-1
                        status: online
                    total: 1
              schema:
                additionalProperties: false
                type: object
                properties:
                  items:
                    items:
                      type: string
                    maxItems: 10000
                    type: array
                required:
                  - items
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
      summary: Get agents by action ids
      tags:
        - Elastic Agents
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/agents/{agentId}:
    delete:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb delete">delete</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/agents/{agentId}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Delete an agent by ID.<br/><br/>[Required authorization] Route required privileges: fleet-agents-all.
      operationId: delete-fleet-agents-agentid
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: The agent ID
          in: path
          name: agentId
          required: true
          schema:
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                deleteAgentExample:
                  description: Agent successfully deleted
                  value:
                    id: agent-id-1
                    success: true
              schema:
                additionalProperties: false
                type: object
                properties:
                  action:
                    enum:
                      - deleted
                    type: string
                required:
                  - action
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
        '404':
          content:
            application/json:
              examples:
                notFoundExample:
                  description: No agent was found with the given ID
                  value:
                    error: Not Found
                    message: Agent agent-id-1 not found
                    statusCode: 404
          description: Not Found
      summary: Delete an agent
      tags:
        - Elastic Agents
      x-metaTags:
        - content: Kibana
          name: product_name
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/agents/{agentId}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Get an agent by ID.<br/><br/>[Required authorization] Route required privileges: fleet-agents-read.
      operationId: get-fleet-agents-agentid
      parameters:
        - description: The agent ID
          in: path
          name: agentId
          required: true
          schema:
            type: string
        - description: When true, include CPU and memory metrics in the response
          in: query
          name: withMetrics
          required: false
          schema:
            default: false
            type: boolean
      responses:
        '200':
          content:
            application/json:
              examples:
                getAgentExample:
                  description: Agent details
                  value:
                    item:
                      active: true
                      agent_id: agent-id-1
                      enrolled_at: '2024-01-01T00:00:00.000Z'
                      id: agent-id-1
                      local_metadata:
                        elastic:
                          agent:
                            version: 8.17.0
                        host:
                          hostname: my-host
                        os:
                          name: linux
                      policy_id: agent-policy-id-1
                      policy_revision: 1
                      status: online
                      type: PERMANENT
                      updated_at: '2024-01-01T00:00:00.000Z'
              schema:
                additionalProperties: false
                type: object
                properties:
                  item:
                    additionalProperties: false
                    type: object
                    properties:
                      access_api_key:
                        type: string
                      access_api_key_id:
                        type: string
                      active:
                        type: boolean
                      agent:
                        additionalProperties: true
                        type: object
                        properties:
                          id:
                            type: string
                          type:
                            type: string
                          version:
                            type: string
                        required:
                          - id
                          - version
                      audit_unenrolled_reason:
                        type: string
                      capabilities:
                        items:
                          type: string
                        maxItems: 100
                        type: array
                      components:
                        items:
                          additionalProperties: false
                          type: object
                          properties:
                            id:
                              type: string
                            message:
                              type: string
                            status:
                              enum:
                                - STARTING
                                - CONFIGURING
                                - HEALTHY
                                - DEGRADED
                                - FAILED
                                - STOPPING
                                - STOPPED
                              type: string
                            type:
                              type: string
                            units:
                              items:
                                additionalProperties: false
                                type: object
                                properties:
                                  id:
                                    type: string
                                  message:
                                    type: string
                                  payload:
                                    additionalProperties:
                                      nullable: true
                                    type: object
                                  status:
                                    enum:
                                      - STARTING
                                      - CONFIGURING
                                      - HEALTHY
                                      - DEGRADED
                                      - FAILED
                                      - STOPPING
                                      - STOPPED
                                    type: string
                                  type:
                                    enum:
                                      - input
                                      - output
                                      - ''
                                    type: string
                                required:
                                  - id
                                  - type
                                  - status
                                  - message
                              maxItems: 10000
                              type: array
                          required:
                            - id
                            - type
                            - status
                            - message
                        maxItems: 10000
                        type: array
                      default_api_key:
                        type: string
                      default_api_key_history:
                        items:
                          additionalProperties: false
                          deprecated: true
                          type: object
                          properties:
                            id:
                              type: string
                            retired_at:
                              type: string
                          required:
                            - id
                            - retired_at
                        maxItems: 100
                        type: array
                      default_api_key_id:
                        type: string
                      effective_config:
                        nullable: true
                      enrolled_at:
                        type: string
                      health:
                        additionalProperties:
                          nullable: true
                        type: object
                      id:
                        type: string
                      identifying_attributes:
                        additionalProperties:
                          type: string
                        type: object
                      last_checkin:
                        type: string
                      last_checkin_message:
                        type: string
                      last_checkin_status:
                        enum:
                          - error
                          - online
                          - degraded
                          - updating
                          - starting
                          - disconnected
                        type: string
                      last_known_status:
                        enum:
                          - offline
                          - error
                          - online
                          - inactive
                          - enrolling
                          - unenrolling
                          - unenrolled
                          - updating
                          - degraded
                          - uninstalled
                          - orphaned
                        type: string
                      local_metadata:
                        additionalProperties:
                          nullable: true
                        type: object
                      metrics:
                        additionalProperties: false
                        type: object
                        properties:
                          cpu_avg:
                            type: number
                          memory_size_byte_avg:
                            type: number
                      namespaces:
                        items:
                          type: string
                        maxItems: 100
                        type: array
                      non_identifying_attributes:
                        additionalProperties:
                          type: string
                        type: object
                      outputs:
                        additionalProperties:
                          additionalProperties: false
                          type: object
                          properties:
                            api_key_id:
                              type: string
                            to_retire_api_key_ids:
                              items:
                                additionalProperties: false
                                type: object
                                properties:
                                  id:
                                    type: string
                                  retired_at:
                                    type: string
                                required:
                                  - id
                                  - retired_at
                              maxItems: 100
                              type: array
                            type:
                              type: string
                        type: object
                      packages:
                        items:
                          type: string
                        maxItems: 10000
                        type: array
                      pipeline_config:
                        maxLength: 10000
                        type: string
                      policy_base_id:
                        type: string
                      policy_id:
                        type: string
                      policy_revision:
                        nullable: true
                        type: number
                      sequence_num:
                        type: number
                      signals:
                        items:
                          type: string
                        maxItems: 50
                        type: array
                      sort:
                        items:
                          nullable: true
                        maxItems: 10
                        type: array
                      status:
                        enum:
                          - offline
                          - error
                          - online
                          - inactive
                          - enrolling
                          - unenrolling
                          - unenrolled
                          - updating
                          - degraded
                          - uninstalled
                          - orphaned
                        type: string
                      tags:
                        items:
                          type: string
                        maxItems: 100
                        type: array
                      type:
                        enum:
                          - PERMANENT
                          - EPHEMERAL
                          - TEMPORARY
                          - OPAMP
                        type: string
                      unenrolled_at:
                        type: string
                      unenrollment_started_at:
                        type: string
                      unhealthy_reason:
                        items:
                          enum:
                            - input
                            - output
                            - other
                          type: string
                        maxItems: 3
                        nullable: true
                        type: array
                      upgrade:
                        additionalProperties: false
                        type: object
                        properties:
                          rollbacks:
                            items:
                              additionalProperties: false
                              type: object
                              properties:
                                valid_until:
                                  type: string
                                version:
                                  type: string
                              required:
                                - valid_until
                                - version
                            maxItems: 100
                            type: array
                      upgrade_attempts:
                        items:
                          type: string
                        maxItems: 10000
                        nullable: true
                        type: array
                      upgrade_details:
                        additionalProperties: false
                        nullable: true
                        type: object
                        properties:
                          action_id:
                            type: string
                          metadata:
                            additionalProperties: false
                            type: object
                            properties:
                              download_percent:
                                type: number
                              download_rate:
                                type: number
                              error_msg:
                                type: string
                              failed_state:
                                enum:
                                  - UPG_REQUESTED
                                  - UPG_SCHEDULED
                                  - UPG_DOWNLOADING
                                  - UPG_EXTRACTING
                                  - UPG_REPLACING
                                  - UPG_RESTARTING
                                  - UPG_FAILED
                                  - UPG_WATCHING
                                  - UPG_ROLLBACK
                                type: string
                              reason:
                                type: string
                              retry_error_msg:
                                type: string
                              retry_until:
                                type: string
                              scheduled_at:
                                type: string
                          state:
                            enum:
                              - UPG_REQUESTED
                              - UPG_SCHEDULED
                              - UPG_DOWNLOADING
                              - UPG_EXTRACTING
                              - UPG_REPLACING
                              - UPG_RESTARTING
                              - UPG_FAILED
                              - UPG_WATCHING
                              - UPG_ROLLBACK
                            type: string
                          target_version:
                            type: string
                        required:
                          - target_version
                          - action_id
                          - state
                      upgrade_started_at:
                        nullable: true
                        type: string
                      upgraded_at:
                        nullable: true
                        type: string
                      user_provided_metadata:
                        additionalProperties:
                          nullable: true
                        type: object
                    required:
                      - id
                      - packages
                      - type
                      - active
                      - enrolled_at
                      - local_metadata
                      - effective_config
                required:
                  - item
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
        '404':
          content:
            application/json:
              examples:
                notFoundExample:
                  description: No agent was found with the given ID
                  value:
                    error: Not Found
                    message: Agent agent-id-1 not found
                    statusCode: 404
          description: Not Found
      summary: Get an agent
      tags:
        - Elastic Agents
      x-metaTags:
        - content: Kibana
          name: product_name
    put:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb put">put</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/agents/{agentId}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Update an agent by ID.<br/><br/>[Required authorization] Route required privileges: fleet-agents-all.
      operationId: put-fleet-agents-agentid
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: The agent ID
          in: path
          name: agentId
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            examples:
              putAgentRequestExample:
                description: Update agent tags
                value:
                  tags:
                    - production
                    - linux
            schema:
              additionalProperties: false
              type: object
              properties:
                tags:
                  items:
                    type: string
                  maxItems: 10
                  type: array
                user_provided_metadata:
                  additionalProperties:
                    nullable: true
                  type: object
      responses:
        '200':
          content:
            application/json:
              examples:
                putAgentExample:
                  description: Updated agent details
                  value:
                    item:
                      active: true
                      enrolled_at: '2024-01-01T00:00:00.000Z'
                      id: agent-id-1
                      policy_id: agent-policy-id-1
                      policy_revision: 1
                      status: online
                      tags:
                        - production
                        - linux
                      type: PERMANENT
                      updated_at: '2024-01-01T00:00:00.000Z'
              schema:
                additionalProperties: false
                type: object
                properties:
                  item:
                    additionalProperties: false
                    type: object
                    properties:
                      access_api_key:
                        type: string
                      access_api_key_id:
                        type: string
                      active:
                        type: boolean
                      agent:
                        additionalProperties: true
                        type: object
                        properties:
                          id:
                            type: string
                          type:
                            type: string
                          version:
                            type: string
                        required:
                          - id
                          - version
                      audit_unenrolled_reason:
                        type: string
                      capabilities:
                        items:
                          type: string
                        maxItems: 100
                        type: array
                      components:
                        items:
                          additionalProperties: false
                          type: object
                          properties:
                            id:
                              type: string
                            message:
                              type: string
                            status:
                              enum:
                                - STARTING
                                - CONFIGURING
                                - HEALTHY
                                - DEGRADED
                                - FAILED
                                - STOPPING
                                - STOPPED
                              type: string
                            type:
                              type: string
                            units:
                              items:
                                additionalProperties: false
                                type: object
                                properties:
                                  id:
                                    type: string
                                  message:
                                    type: string
                                  payload:
                                    additionalProperties:
                                      nullable: true
                                    type: object
                                  status:
                                    enum:
                                      - STARTING
                                      - CONFIGURING
                                      - HEALTHY
                                      - DEGRADED
                                      - FAILED
                                      - STOPPING
                                      - STOPPED
                                    type: string
                                  type:
                                    enum:
                                      - input
                                      - output
                                      - ''
                                    type: string
                                required:
                                  - id
                                  - type
                                  - status
                                  - message
                              maxItems: 10000
                              type: array
                          required:
                            - id
                            - type
                            - status
                            - message
                        maxItems: 10000
                        type: array
                      default_api_key:
                        type: string
                      default_api_key_history:
                        items:
                          additionalProperties: false
                          deprecated: true
                          type: object
                          properties:
                            id:
                              type: string
                            retired_at:
                              type: string
                          required:
                            - id
                            - retired_at
                        maxItems: 100
                        type: array
                      default_api_key_id:
                        type: string
                      effective_config:
                        nullable: true
                      enrolled_at:
                        type: string
                      health:
                        additionalProperties:
                          nullable: true
                        type: object
                      id:
                        type: string
                      identifying_attributes:
                        additionalProperties:
                          type: string
                        type: object
                      last_checkin:
                        type: string
                      last_checkin_message:
                        type: string
                      last_checkin_status:
                        enum:
                          - error
                          - online
                          - degraded
                          - updating
                          - starting
                          - disconnected
                        type: string
                      last_known_status:
                        enum:
                          - offline
                          - error
                          - online
                          - inactive
                          - enrolling
                          - unenrolling
                          - unenrolled
                          - updating
                          - degraded
                          - uninstalled
                          - orphaned
                        type: string
                      local_metadata:
                        additionalProperties:
                          nullable: true
                        type: object
                      metrics:
                        additionalProperties: false
                        type: object
                        properties:
                          cpu_avg:
                            type: number
                          memory_size_byte_avg:
                            type: number
                      namespaces:
                        items:
                          type: string
                        maxItems: 100
                        type: array
                      non_identifying_attributes:
                        additionalProperties:
                          type: string
                        type: object
                      outputs:
                        additionalProperties:
                          additionalProperties: false
                          type: object
                          properties:
                            api_key_id:
                              type: string
                            to_retire_api_key_ids:
                              items:
                                additionalProperties: false
                                type: object
                                properties:
                                  id:
                                    type: string
                                  retired_at:
                                    type: string
                                required:
                                  - id
                                  - retired_at
                              maxItems: 100
                              type: array
                            type:
                              type: string
                        type: object
                      packages:
                        items:
                          type: string
                        maxItems: 10000
                        type: array
                      pipeline_config:
                        maxLength: 10000
                        type: string
                      policy_base_id:
                        type: string
                      policy_id:
                        type: string
                      policy_revision:
                        nullable: true
                        type: number
                      sequence_num:
                        type: number
                      signals:
                        items:
                          type: string
                        maxItems: 50
                        type: array
                      sort:
                        items:
                          nullable: true
                        maxItems: 10
                        type: array
                      status:
                        enum:
                          - offline
                          - error
                          - online
                          - inactive
                          - enrolling
                          - unenrolling
                          - unenrolled
                          - updating
                          - degraded
                          - uninstalled
                          - orphaned
                        type: string
                      tags:
                        items:
                          type: string
                        maxItems: 100
                        type: array
                      type:
                        enum:
                          - PERMANENT
                          - EPHEMERAL
                          - TEMPORARY
                          - OPAMP
                        type: string
                      unenrolled_at:
                        type: string
                      unenrollment_started_at:
                        type: string
                      unhealthy_reason:
                        items:
                          enum:
                            - input
                            - output
                            - other
                          type: string
                        maxItems: 3
                        nullable: true
                        type: array
                      upgrade:
                        additionalProperties: false
                        type: object
                        properties:
                          rollbacks:
                            items:
                              additionalProperties: false
                              type: object
                              properties:
                                valid_until:
                                  type: string
                                version:
                                  type: string
                              required:
                                - valid_until
                                - version
                            maxItems: 100
                            type: array
                      upgrade_attempts:
                        items:
                          type: string
                        maxItems: 10000
                        nullable: true
                        type: array
                      upgrade_details:
                        additionalProperties: false
                        nullable: true
                        type: object
                        properties:
                          action_id:
                            type: string
                          metadata:
                            additionalProperties: false
                            type: object
                            properties:
                              download_percent:
                                type: number
                              download_rate:
                                type: number
                              error_msg:
                                type: string
                              failed_state:
                                enum:
                                  - UPG_REQUESTED
                                  - UPG_SCHEDULED
                                  - UPG_DOWNLOADING
                                  - UPG_EXTRACTING
                                  - UPG_REPLACING
                                  - UPG_RESTARTING
                                  - UPG_FAILED
                                  - UPG_WATCHING
                                  - UPG_ROLLBACK
                                type: string
                              reason:
                                type: string
                              retry_error_msg:
                                type: string
                              retry_until:
                                type: string
                              scheduled_at:
                                type: string
                          state:
                            enum:
                              - UPG_REQUESTED
                              - UPG_SCHEDULED
                              - UPG_DOWNLOADING
                              - UPG_EXTRACTING
                              - UPG_REPLACING
                              - UPG_RESTARTING
                              - UPG_FAILED
                              - UPG_WATCHING
                              - UPG_ROLLBACK
                            type: string
                          target_version:
                            type: string
                        required:
                          - target_version
                          - action_id
                          - state
                      upgrade_started_at:
                        nullable: true
                        type: string
                      upgraded_at:
                        nullable: true
                        type: string
                      user_provided_metadata:
                        additionalProperties:
                          nullable: true
                        type: object
                    required:
                      - id
                      - packages
                      - type
                      - active
                      - enrolled_at
                      - local_metadata
                      - effective_config
                required:
                  - item
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
        '404':
          content:
            application/json:
              examples:
                notFoundExample:
                  description: No agent was found with the given ID
                  value:
                    error: Not Found
                    message: Agent agent-id-1 not found
                    statusCode: 404
          description: Not Found
      summary: Update an agent by ID
      tags:
        - Elastic Agents
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/agents/{agentId}/actions:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/agents/{agentId}/actions</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Create a new action for a specific agent.<br/><br/>[Required authorization] Route required privileges: fleet-agents-all.
      operationId: post-fleet-agents-agentid-actions
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: The agent ID
          in: path
          name: agentId
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            examples:
              postAgentActionRequestExample:
                description: Create a UNENROLL action for an agent
                value:
                  action:
                    type: UNENROLL
            schema:
              additionalProperties: false
              type: object
              properties:
                action:
                  anyOf:
                    - additionalProperties: false
                      type: object
                      properties:
                        ack_data:
                          nullable: true
                        data:
                          nullable: true
                        type:
                          enum:
                            - UNENROLL
                            - UPGRADE
                            - POLICY_REASSIGN
                          type: string
                      required:
                        - type
                        - data
                        - ack_data
                    - additionalProperties: false
                      type: object
                      properties:
                        data:
                          additionalProperties: false
                          type: object
                          properties:
                            log_level:
                              default: null
                              enum:
                                - debug
                                - info
                                - warning
                                - error
                                - null
                              nullable: true
                              type: string
                        type:
                          enum:
                            - SETTINGS
                          type: string
                      required:
                        - type
                        - data
              required:
                - action
      responses:
        '200':
          content:
            application/json:
              examples:
                postAgentActionExample:
                  description: Created agent action
                  value:
                    item:
                      agents:
                        - agent-id-1
                      created_at: '2024-01-01T00:00:00.000Z'
                      id: action-id-1
                      type: UNENROLL
              schema:
                additionalProperties: false
                type: object
                properties:
                  item:
                    additionalProperties: false
                    type: object
                    properties:
                      ack_data:
                        nullable: true
                      agents:
                        items:
                          type: string
                        maxItems: 10000
                        type: array
                      created_at:
                        type: string
                      data:
                        nullable: true
                      expiration:
                        type: string
                      id:
                        type: string
                      minimum_execution_duration:
                        type: number
                      namespaces:
                        items:
                          type: string
                        maxItems: 100
                        type: array
                      rollout_duration_seconds:
                        type: number
                      sent_at:
                        type: string
                      source_uri:
                        type: string
                      start_time:
                        type: string
                      total:
                        type: number
                      type:
                        type: string
                    required:
                      - id
                      - type
                      - data
                      - created_at
                      - ack_data
                required:
                  - item
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
      summary: Create an agent action
      tags:
        - Elastic Agent actions
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/agents/{agentId}/effective_config:
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/agents/{agentId}/effective_config</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Get an agent's effective config by ID.<br/><br/>[Required authorization] Route required privileges: fleet-agents-read.
      operationId: get-fleet-agents-agentid-effective-config
      parameters:
        - description: The agent ID to get effective config of
          in: path
          name: agentId
          required: true
          schema:
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                successResponse:
                  value:
                    effective_config: {}
              schema:
                additionalProperties: false
                type: object
                properties:
                  effective_config:
                    nullable: true
                required:
                  - effective_config
          description: 'OK: A successful request.'
        '400':
          content:
            application/json:
              examples:
                badRequestResponse:
                  value:
                    message: Bad Request
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: A bad request.
      summary: Get an agent's effective config
      tags:
        - Elastic Agents
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/agents/{agentId}/migrate:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/agents/{agentId}/migrate</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Migrate a single agent to another cluster.<br/><br/>[Required authorization] Route required privileges: fleet-agents-all.
      operationId: post-fleet-agents-agentid-migrate
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: The agent ID
          in: path
          name: agentId
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            examples:
              postMigrateAgentRequestExample:
                description: Migrate a single agent to another cluster
                value:
                  enrollment_token: enrollment-token-value
                  settings:
                    retry_max: 5
                  uri: https://fleet-server.example.com:8220
            schema:
              additionalProperties: false
              type: object
              properties:
                enrollment_token:
                  type: string
                settings:
                  additionalProperties: false
                  type: object
                  properties:
                    ca_sha256:
                      type: string
                    certificate_authorities:
                      type: string
                    elastic_agent_cert:
                      type: string
                    elastic_agent_cert_key:
                      type: string
                    elastic_agent_cert_key_passphrase:
                      type: string
                    headers:
                      additionalProperties:
                        type: string
                      type: object
                    insecure:
                      type: boolean
                    proxy_disabled:
                      type: boolean
                    proxy_headers:
                      additionalProperties:
                        type: string
                      type: object
                    proxy_url:
                      type: string
                    replace_token:
                      type: string
                    staging:
                      type: string
                    tags:
                      items:
                        type: string
                      maxItems: 10
                      type: array
                uri:
                  format: uri
                  type: string
              required:
                - uri
                - enrollment_token
      responses:
        '200':
          content:
            application/json:
              examples:
                postMigrateAgentExample:
                  description: Agent migration initiated
                  value:
                    actionId: action-id-1
              schema:
                additionalProperties: false
                type: object
                properties:
                  actionId:
                    type: string
                required:
                  - actionId
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
      summary: Migrate a single agent
      tags:
        - Elastic Agents
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/agents/{agentId}/privilege_level_change:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/agents/{agentId}/privilege_level_change</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Change the privilege level of a single agent to unprivileged.<br/><br/>[Required authorization] Route required privileges: fleet-agents-all.
      operationId: post-fleet-agents-agentid-privilege-level-change
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: The agent ID to change privilege level for
          in: path
          name: agentId
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            examples:
              changeAgentPrivilegeLevelRequest:
                value:
                  user_info:
                    groupname: groupname
                    password: password
                    username: username
            schema:
              additionalProperties: false
              default: null
              nullable: true
              type: object
              properties:
                user_info:
                  additionalProperties: false
                  type: object
                  properties:
                    groupname:
                      type: string
                    password:
                      type: string
                    username:
                      type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                successResponse:
                  value:
                    actionId: actionId
              schema:
                anyOf:
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_action_id_response'
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_action_message_response'
          description: 'OK: A successful request.'
        '400':
          content:
            application/json:
              examples:
                badRequestResponse:
                  value:
                    message: Bad Request
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: A bad request.
      summary: Change agent privilege level
      tags:
        - Elastic Agents
      x-state: Experimental; added in 9.3.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/agents/{agentId}/reassign:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/agents/{agentId}/reassign</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Reassign an agent to a different agent policy.<br/><br/>[Required authorization] Route required privileges: fleet-agents-all.
      operationId: post-fleet-agents-agentid-reassign
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: The agent ID
          in: path
          name: agentId
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            examples:
              postReassignAgentRequestExample:
                description: Reassign an agent to a different policy
                value:
                  policy_id: agent-policy-id-2
            schema:
              additionalProperties: false
              type: object
              properties:
                policy_id:
                  type: string
              required:
                - policy_id
      responses:
        '200':
          content:
            application/json:
              examples:
                postReassignAgentExample:
                  description: Agent successfully reassigned
                  value: {}
              schema:
                additionalProperties: false
                type: object
                properties: {}
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
      summary: Reassign an agent
      tags:
        - Elastic Agent actions
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/agents/{agentId}/remove_collector:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/agents/{agentId}/remove_collector</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Remove a specific OpAMP collector from the Fleet agents list. Marks the collector as unenrolled. This action does not invalidate API keys, so the collector can reconnect on its own.<br/><br/>[Required authorization] Route required privileges: fleet-agents-all.
      operationId: post-fleet-agents-agentid-remove-collector
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: The collector agent ID
          in: path
          name: agentId
          required: true
          schema:
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                postRemoveCollectorExample:
                  description: Collector successfully removed
                  value: {}
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
          description: Bad Request
      summary: Remove an OpAMP collector
      tags:
        - Elastic Agent actions
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/agents/{agentId}/request_diagnostics:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/agents/{agentId}/request_diagnostics</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Request a diagnostics bundle from a specific agent.<br/><br/>[Required authorization] Route required privileges: fleet-agents-read.
      operationId: post-fleet-agents-agentid-request-diagnostics
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: The agent ID
          in: path
          name: agentId
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            examples:
              postRequestDiagnosticsRequestExample:
                description: Request a diagnostics bundle from an agent
                value:
                  additional_metrics:
                    - CPU
            schema:
              additionalProperties: false
              default: null
              nullable: true
              type: object
              properties:
                additional_metrics:
                  items:
                    enum:
                      - CPU
                    type: string
                  maxItems: 1
                  type: array
      responses:
        '200':
          content:
            application/json:
              examples:
                postRequestDiagnosticsExample:
                  description: Diagnostics action result
                  value:
                    actionId: action-id-1
              schema:
                anyOf:
                  - additionalProperties: false
                    type: object
                    properties:
                      actionId:
                        type: string
                    required:
                      - actionId
                  - additionalProperties: false
                    type: object
                    properties:
                      count:
                        type: number
                    required:
                      - count
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: Agent agent-id-1 does not support request diagnostics action.
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
      summary: Request agent diagnostics
      tags:
        - Elastic Agent actions
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/agents/{agentId}/restart:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/agents/{agentId}/restart</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Restart an Elastic Agent. The request fails when the agent is inactive, on a version earlier than 9.6.0, or enrolled in a hosted agent policy.<br/><br/>[Required authorization] Route required privileges: fleet-agents-all.
      operationId: post-fleet-agents-agentid-restart
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: The agent ID to restart
          in: path
          name: agentId
          required: true
          schema:
            maxLength: 512
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                successResponse:
                  value:
                    actionId: a1b2c3d4-e5f6-7890-abcd-ef1234567890
              schema:
                anyOf:
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_action_id_response'
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_action_message_response'
          description: 'OK: A successful request.'
        '400':
          content:
            application/json:
              examples:
                badRequestResponse:
                  value:
                    message: Bad Request
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: A bad request.
      summary: Restart an agent
      tags:
        - Elastic Agent actions
      x-state: Experimental; added in 9.6.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/agents/{agentId}/rollback:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/agents/{agentId}/rollback</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Rollback an agent to the previous version.<br/><br/>[Required authorization] Route required privileges: fleet-agents-all.
      operationId: post-fleet-agents-agentid-rollback
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: The agent ID to rollback
          in: path
          name: agentId
          required: true
          schema:
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                successResponse:
                  value:
                    actionId: actionId
              schema:
                anyOf:
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_action_id_response'
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_action_message_response'
          description: 'OK: A successful request.'
        '400':
          content:
            application/json:
              examples:
                badRequestResponse:
                  value:
                    message: Bad Request
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: A bad request.
      summary: Rollback an agent
      tags:
        - Elastic Agent actions
      x-state: Experimental; added in 9.4.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/agents/{agentId}/unenroll:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/agents/{agentId}/unenroll</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Unenroll a specific agent, optionally revoking its enrollment API key.<br/><br/>[Required authorization] Route required privileges: fleet-agents-all.
      operationId: post-fleet-agents-agentid-unenroll
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: The agent ID
          in: path
          name: agentId
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            examples:
              postUnenrollAgentRequestExample:
                description: Unenroll an agent, optionally revoking the enrollment API key
                value:
                  revoke: false
            schema:
              additionalProperties: false
              default: null
              nullable: true
              type: object
              properties:
                force:
                  type: boolean
                revoke:
                  type: boolean
      responses:
        '200':
          content:
            application/json:
              examples:
                postUnenrollAgentExample:
                  description: Agent successfully unenrolled
                  value: {}
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
          description: Bad Request
      summary: Unenroll an agent
      tags:
        - Elastic Agent actions
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/agents/{agentId}/upgrade:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/agents/{agentId}/upgrade</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Upgrade a specific agent to a newer version.<br/><br/>[Required authorization] Route required privileges: fleet-agents-all.
      operationId: post-fleet-agents-agentid-upgrade
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: The agent ID
          in: path
          name: agentId
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            examples:
              postUpgradeAgentRequestExample:
                description: Upgrade an agent to a specific version
                value:
                  version: 8.17.0
            schema:
              additionalProperties: false
              type: object
              properties:
                force:
                  type: boolean
                skipRateLimitCheck:
                  type: boolean
                source_uri:
                  type: string
                version:
                  type: string
              required:
                - version
      responses:
        '200':
          content:
            application/json:
              examples:
                postUpgradeAgentExample:
                  description: Agent upgrade initiated
                  value: {}
              schema:
                additionalProperties: false
                type: object
                properties: {}
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
      summary: Upgrade an agent
      tags:
        - Elastic Agent actions
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/agents/{agentId}/uploads:
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/agents/{agentId}/uploads</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Get a list of files uploaded by a specific agent.<br/><br/>[Required authorization] Route required privileges: fleet-agents-read.
      operationId: get-fleet-agents-agentid-uploads
      parameters:
        - description: The agent ID
          in: path
          name: agentId
          required: true
          schema:
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                getAgentUploadsExample:
                  description: List of files uploaded by the agent
                  value:
                    items:
                      - actionId: action-id-1
                        createTime: '2024-01-01T00:00:00.000Z'
                        filePath: /tmp/diagnostics-2024-01-01.zip
                        id: file-id-1
                        name: diagnostics-2024-01-01.zip
                        status: READY
              schema:
                additionalProperties: false
                type: object
                properties:
                  items:
                    items:
                      additionalProperties: false
                      type: object
                      properties:
                        actionId:
                          type: string
                        createTime:
                          type: string
                        error:
                          type: string
                        filePath:
                          type: string
                        id:
                          type: string
                        name:
                          type: string
                        status:
                          enum:
                            - READY
                            - AWAITING_UPLOAD
                            - DELETED
                            - EXPIRED
                            - IN_PROGRESS
                            - FAILED
                          type: string
                      required:
                        - id
                        - name
                        - filePath
                        - createTime
                        - status
                        - actionId
                    maxItems: 10000
                    type: array
                required:
                  - items
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
      summary: Get agent uploads
      tags:
        - Elastic Agents
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/agents/action_status:
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/agents/action_status</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Get the current status of recent agent actions.<br/><br/>[Required authorization] Route required privileges: fleet-agents-read.
      operationId: get-fleet-agents-action-status
      parameters:
        - description: Page number
          in: query
          name: page
          required: false
          schema:
            default: 0
            type: number
        - description: Number of results per page
          in: query
          name: perPage
          required: false
          schema:
            default: 20
            type: number
        - description: Return actions created before this date
          in: query
          name: date
          required: false
          schema:
            type: string
        - description: Return only the latest N actions
          in: query
          name: latest
          required: false
          schema:
            type: number
        - description: Return only actions whose start_time is in the future
          in: query
          name: scheduledOnly
          required: false
          schema:
            type: boolean
        - description: Number of error details to include per action
          in: query
          name: errorSize
          required: false
          schema:
            default: 5
            type: number
      responses:
        '200':
          content:
            application/json:
              examples:
                getActionStatusExample:
                  description: Status of recent agent actions
                  value:
                    items:
                      - actionId: action-id-1
                        completionTime: '2024-01-01T00:05:00.000Z'
                        creationTime: '2024-01-01T00:00:00.000Z'
                        nbAgentsAck: 2
                        nbAgentsActioned: 2
                        nbAgentsFailed: 0
                        status: COMPLETE
                        type: UPGRADE
              schema:
                additionalProperties: false
                type: object
                properties:
                  items:
                    items:
                      additionalProperties: false
                      type: object
                      properties:
                        actionId:
                          type: string
                        cancellationTime:
                          type: string
                        completionTime:
                          type: string
                        creationTime:
                          description: creation time of action
                          type: string
                        expiration:
                          type: string
                        hasRolloutPeriod:
                          type: boolean
                        is_automatic:
                          type: boolean
                        latestErrors:
                          items:
                            additionalProperties: false
                            description: latest errors that happened when the agents executed the action
                            type: object
                            properties:
                              agentId:
                                type: string
                              error:
                                type: string
                              hostname:
                                type: string
                              timestamp:
                                type: string
                            required:
                              - agentId
                              - error
                              - timestamp
                          maxItems: 10
                          type: array
                        nbAgentsAck:
                          description: number of agents that acknowledged the action
                          type: number
                        nbAgentsActionCreated:
                          description: number of agents included in action from kibana
                          type: number
                        nbAgentsActioned:
                          description: number of agents actioned
                          type: number
                        nbAgentsFailed:
                          description: number of agents that failed to execute the action
                          type: number
                        newPolicyId:
                          description: new policy id (POLICY_REASSIGN action)
                          type: string
                        policyId:
                          description: policy id (POLICY_CHANGE action)
                          type: string
                        revision:
                          description: new policy revision (POLICY_CHANGE action)
                          type: number
                        startTime:
                          description: start time of action (scheduled actions)
                          type: string
                        status:
                          enum:
                            - COMPLETE
                            - EXPIRED
                            - CANCELLED
                            - FAILED
                            - IN_PROGRESS
                            - ROLLOUT_PASSED
                          type: string
                        type:
                          enum:
                            - UPGRADE
                            - UNENROLL
                            - SETTINGS
                            - POLICY_REASSIGN
                            - CANCEL
                            - FORCE_UNENROLL
                            - REQUEST_DIAGNOSTICS
                            - UPDATE_TAGS
                            - POLICY_CHANGE
                            - INPUT_ACTION
                            - MIGRATE
                            - PRIVILEGE_LEVEL_CHANGE
                            - ROLLBACK
                            - REMOVE_COLLECTOR
                            - RESTART
                          type: string
                        version:
                          description: agent version number (UPGRADE action)
                          type: string
                      required:
                        - actionId
                        - nbAgentsActionCreated
                        - nbAgentsAck
                        - nbAgentsFailed
                        - type
                        - nbAgentsActioned
                        - status
                        - creationTime
                    maxItems: 10000
                    type: array
                required:
                  - items
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
      summary: Get an agent action status
      tags:
        - Elastic Agent actions
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/agents/actions/{actionId}/cancel:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/agents/actions/{actionId}/cancel</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Cancel a pending action for a specific agent.<br/><br/>[Required authorization] Route required privileges: fleet-agents-all.
      operationId: post-fleet-agents-actions-actionid-cancel
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: The ID of the action to cancel
          in: path
          name: actionId
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            examples:
              postCancelActionRequestExample:
                description: Cancel an agent action
                value: {}
      responses:
        '200':
          content:
            application/json:
              examples:
                postCancelActionExample:
                  description: Cancellation action created
                  value:
                    item:
                      agents:
                        - agent-id-1
                      created_at: '2024-01-01T00:00:00.000Z'
                      id: cancel-action-id-1
                      type: CANCEL
              schema:
                additionalProperties: false
                type: object
                properties:
                  item:
                    additionalProperties: false
                    type: object
                    properties:
                      ack_data:
                        nullable: true
                      agents:
                        items:
                          type: string
                        maxItems: 10000
                        type: array
                      created_at:
                        type: string
                      data:
                        nullable: true
                      expiration:
                        type: string
                      id:
                        type: string
                      minimum_execution_duration:
                        type: number
                      namespaces:
                        items:
                          type: string
                        maxItems: 100
                        type: array
                      rollout_duration_seconds:
                        type: number
                      sent_at:
                        type: string
                      source_uri:
                        type: string
                      start_time:
                        type: string
                      total:
                        type: number
                      type:
                        type: string
                    required:
                      - id
                      - type
                      - data
                      - created_at
                      - ack_data
                required:
                  - item
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
      summary: Cancel an agent action
      tags:
        - Elastic Agent actions
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/agents/available_versions:
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/agents/available_versions</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Get a list of Elastic Agent versions available for upgrade.<br/><br/>[Required authorization] Route required privileges: fleet-agents-read.
      operationId: get-fleet-agents-available-versions
      parameters: []
      responses:
        '200':
          content:
            application/json:
              examples:
                getAvailableVersionsExample:
                  description: List of available agent versions for upgrade
                  value:
                    items:
                      - 8.17.0
                      - 8.16.3
                      - 8.16.2
              schema:
                additionalProperties: false
                type: object
                properties:
                  items:
                    items:
                      type: string
                    maxItems: 10000
                    type: array
                required:
                  - items
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
      summary: Get available agent versions
      tags:
        - Elastic Agents
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/agents/bulk_migrate:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/agents/bulk_migrate</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Bulk migrate agents to another cluster.<br/><br/>[Required authorization] Route required privileges: fleet-agents-all.
      operationId: post-fleet-agents-bulk-migrate
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
      requestBody:
        content:
          application/json:
            examples:
              postBulkMigrateAgentsRequestExample:
                description: Migrate multiple agents to another cluster
                value:
                  agents:
                    - agent-id-1
                    - agent-id-2
                  enrollment_token: enrollment-token-value
                  settings:
                    retry_max: 5
                  uri: https://fleet-server.example.com:8220
            schema:
              additionalProperties: false
              type: object
              properties:
                agents:
                  anyOf:
                    - items:
                        type: string
                      maxItems: 10000
                      type: array
                    - type: string
                batchSize:
                  type: number
                dryRun:
                  type: boolean
                enrollment_token:
                  type: string
                settings:
                  additionalProperties: false
                  type: object
                  properties:
                    ca_sha256:
                      type: string
                    certificate_authorities:
                      type: string
                    elastic_agent_cert:
                      type: string
                    elastic_agent_cert_key:
                      type: string
                    elastic_agent_cert_key_passphrase:
                      type: string
                    headers:
                      additionalProperties:
                        type: string
                      type: object
                    insecure:
                      type: boolean
                    proxy_disabled:
                      type: boolean
                    proxy_headers:
                      additionalProperties:
                        type: string
                      type: object
                    proxy_url:
                      type: string
                    staging:
                      type: string
                    tags:
                      items:
                        type: string
                      maxItems: 10
                      type: array
                uri:
                  format: uri
                  type: string
              required:
                - agents
                - uri
                - enrollment_token
      responses:
        '200':
          content:
            application/json:
              examples:
                postBulkMigrateAgentsExample:
                  description: Bulk agent migration initiated
                  value:
                    actionId: action-id-1
              schema:
                anyOf:
                  - additionalProperties: false
                    type: object
                    properties:
                      actionId:
                        type: string
                    required:
                      - actionId
                  - additionalProperties: false
                    type: object
                    properties:
                      count:
                        type: number
                    required:
                      - count
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
      summary: Migrate multiple agents
      tags:
        - Elastic Agents
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/agents/bulk_privilege_level_change:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/agents/bulk_privilege_level_change</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Change multiple agents' privilege level to unprivileged.<br/><br/>[Required authorization] Route required privileges: fleet-agents-all.
      operationId: post-fleet-agents-bulk-privilege-level-change
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
      requestBody:
        content:
          application/json:
            examples:
              bulkChangeAgentPrivilegeLevelRequest:
                value:
                  agents: agent
                  user_info:
                    groupname: groupname
                    password: password
                    username: username
            schema:
              additionalProperties: false
              type: object
              properties:
                agents:
                  anyOf:
                    - items:
                        type: string
                      maxItems: 10000
                      type: array
                    - type: string
                batchSize:
                  type: number
                dryRun:
                  type: boolean
                user_info:
                  additionalProperties: false
                  type: object
                  properties:
                    groupname:
                      type: string
                    password:
                      type: string
                    username:
                      type: string
              required:
                - agents
      responses:
        '200':
          content:
            application/json:
              examples:
                successResponse:
                  value:
                    actionId: actionId
              schema:
                anyOf:
                  - additionalProperties: false
                    type: object
                    properties:
                      actionId:
                        type: string
                    required:
                      - actionId
                  - additionalProperties: false
                    type: object
                    properties:
                      count:
                        type: number
                    required:
                      - count
          description: 'OK: A successful request.'
        '400':
          content:
            application/json:
              examples:
                badRequestResponse:
                  value:
                    message: Bad Request
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: A bad request.
      summary: Bulk change agent privilege level
      tags:
        - Elastic Agents
      x-state: Experimental; added in 9.3.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/agents/bulk_reassign:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/agents/bulk_reassign</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Reassign multiple agents to a different agent policy.<br/><br/>[Required authorization] Route required privileges: fleet-agents-all.
      operationId: post-fleet-agents-bulk-reassign
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
      requestBody:
        content:
          application/json:
            examples:
              postBulkReassignAgentsRequestExample:
                description: Reassign multiple agents to a different policy
                value:
                  agents:
                    - agent-id-1
                    - agent-id-2
                  policy_id: agent-policy-id-2
            schema:
              additionalProperties: false
              type: object
              properties:
                agents:
                  anyOf:
                    - items:
                        type: string
                      maxItems: 10000
                      type: array
                    - type: string
                batchSize:
                  type: number
                dryRun:
                  type: boolean
                includeInactive:
                  default: false
                  type: boolean
                policy_id:
                  type: string
              required:
                - policy_id
                - agents
      responses:
        '200':
          content:
            application/json:
              examples:
                postBulkReassignAgentsExample:
                  description: Bulk reassign action result
                  value:
                    actionId: action-id-1
              schema:
                anyOf:
                  - additionalProperties: false
                    type: object
                    properties:
                      actionId:
                        type: string
                    required:
                      - actionId
                  - additionalProperties: false
                    type: object
                    properties:
                      count:
                        type: number
                    required:
                      - count
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
      summary: Bulk reassign agents
      tags:
        - Elastic Agent actions
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/agents/bulk_remove_collectors:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/agents/bulk_remove_collectors</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Remove multiple OpAMP collectors from the Fleet agents list. Marks the collectors as unenrolled. This action does not invalidate API keys, so collectors can reconnect on their own.<br/><br/>[Required authorization] Route required privileges: fleet-agents-all.
      operationId: post-fleet-agents-bulk-remove-collectors
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
      requestBody:
        content:
          application/json:
            examples:
              postBulkRemoveCollectorsRequestExample:
                description: Remove multiple OpAMP collectors
                value:
                  agents:
                    - collector-id-1
                    - collector-id-2
            schema:
              additionalProperties: false
              type: object
              properties:
                agents:
                  anyOf:
                    - items:
                        description: List of collector agent IDs
                        type: string
                      maxItems: 10000
                      type: array
                    - description: KQL query string. Leave empty to target all collectors
                      type: string
                dryRun:
                  type: boolean
                includeInactive:
                  description: When passing collectors by KQL query, also removes inactive collectors
                  type: boolean
              required:
                - agents
      responses:
        '200':
          content:
            application/json:
              examples:
                postBulkRemoveCollectorsExample:
                  description: Bulk remove collectors action result
                  value:
                    actionId: action-id-1
              schema:
                anyOf:
                  - additionalProperties: false
                    type: object
                    properties:
                      actionId:
                        type: string
                    required:
                      - actionId
                  - additionalProperties: false
                    type: object
                    properties:
                      count:
                        type: number
                    required:
                      - count
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
      summary: Bulk remove OpAMP collectors
      tags:
        - Elastic Agent actions
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/agents/bulk_request_diagnostics:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/agents/bulk_request_diagnostics</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Request diagnostics bundles from multiple agents.<br/><br/>[Required authorization] Route required privileges: fleet-agents-read.
      operationId: post-fleet-agents-bulk-request-diagnostics
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
      requestBody:
        content:
          application/json:
            examples:
              postBulkRequestDiagnosticsRequestExample:
                description: Request diagnostics bundles from multiple agents
                value:
                  additional_metrics:
                    - CPU
                  agents:
                    - agent-id-1
                    - agent-id-2
            schema:
              additionalProperties: false
              type: object
              properties:
                additional_metrics:
                  items:
                    enum:
                      - CPU
                    type: string
                  maxItems: 1
                  type: array
                agents:
                  anyOf:
                    - items:
                        type: string
                      maxItems: 10000
                      type: array
                    - type: string
                batchSize:
                  type: number
                dryRun:
                  type: boolean
              required:
                - agents
      responses:
        '200':
          content:
            application/json:
              examples:
                postBulkRequestDiagnosticsExample:
                  description: Bulk diagnostics action result
                  value:
                    actionId: action-id-1
              schema:
                anyOf:
                  - additionalProperties: false
                    type: object
                    properties:
                      actionId:
                        type: string
                    required:
                      - actionId
                  - additionalProperties: false
                    type: object
                    properties:
                      count:
                        type: number
                    required:
                      - count
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
      summary: Bulk request diagnostics from agents
      tags:
        - Elastic Agent actions
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/agents/bulk_restart:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/agents/bulk_restart</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Restart multiple Elastic Agents. Agents that are enrolled in a hosted policy or are on a version earlier than 9.6.0 are excluded from the action and receive individual error results.<br/><br/>[Required authorization] Route required privileges: fleet-agents-all.
      operationId: post-fleet-agents-bulk-restart
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
      requestBody:
        content:
          application/json:
            examples:
              bulkRestartAgentsRequest:
                value:
                  agents:
                    - agent-1
                    - agent-2
                  batchSize: 100
                  includeInactive: false
            schema:
              additionalProperties: false
              type: object
              properties:
                agents:
                  anyOf:
                    - items:
                        maxLength: 512
                        type: string
                      maxItems: 10000
                      type: array
                    - maxLength: 1000000
                      type: string
                batchSize:
                  minimum: 1
                  type: number
                includeInactive:
                  default: false
                  type: boolean
              required:
                - agents
      responses:
        '200':
          content:
            application/json:
              examples:
                successResponse:
                  value:
                    actionId: a1b2c3d4-e5f6-7890-abcd-ef1234567890
              schema:
                anyOf:
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_action_id_response'
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_action_message_response'
          description: 'OK: A successful request.'
        '400':
          content:
            application/json:
              examples:
                badRequestResponse:
                  value:
                    message: Bad Request
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: A bad request.
      summary: Bulk restart agents
      tags:
        - Elastic Agent actions
      x-state: Experimental; added in 9.6.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/agents/bulk_rollback:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/agents/bulk_rollback</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Rollback multiple agents to the previous version.<br/><br/>[Required authorization] Route required privileges: fleet-agents-all.
      operationId: post-fleet-agents-bulk-rollback
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
      requestBody:
        content:
          application/json:
            examples:
              bulkRollbackAgentsRequest:
                value:
                  agents:
                    - agent-1
                    - agent-2
                  batchSize: 100
                  includeInactive: false
            schema:
              additionalProperties: false
              type: object
              properties:
                agents:
                  anyOf:
                    - items:
                        type: string
                      maxItems: 10000
                      type: array
                    - type: string
                batchSize:
                  type: number
                dryRun:
                  type: boolean
                includeInactive:
                  default: false
                  type: boolean
              required:
                - agents
      responses:
        '200':
          content:
            application/json:
              examples:
                successResponse:
                  value:
                    actionIds:
                      - actionId1
                      - actionId2
              schema:
                anyOf:
                  - additionalProperties: false
                    type: object
                    properties:
                      actionIds:
                        items:
                          maxLength: 36
                          type: string
                        maxItems: 10000
                        type: array
                    required:
                      - actionIds
                  - additionalProperties: false
                    type: object
                    properties:
                      count:
                        type: number
                    required:
                      - count
          description: 'OK: A successful request.'
        '400':
          content:
            application/json:
              examples:
                badRequestResponse:
                  value:
                    message: Bad Request
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: A bad request.
      summary: Bulk rollback agents
      tags:
        - Elastic Agent actions
      x-state: Experimental; added in 9.4.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/agents/bulk_unenroll:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/agents/bulk_unenroll</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Unenroll multiple agents, optionally revoking their enrollment API keys.<br/><br/>[Required authorization] Route required privileges: fleet-agents-all.
      operationId: post-fleet-agents-bulk-unenroll
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
      requestBody:
        content:
          application/json:
            examples:
              postBulkUnenrollAgentsRequestExample:
                description: Unenroll multiple agents
                value:
                  agents:
                    - agent-id-1
                    - agent-id-2
                  revoke: false
            schema:
              additionalProperties: false
              type: object
              properties:
                agents:
                  anyOf:
                    - items:
                        description: list of agent IDs
                        type: string
                      maxItems: 10000
                      type: array
                    - description: KQL query string, leave empty to action all agents
                      type: string
                batchSize:
                  type: number
                dryRun:
                  type: boolean
                force:
                  description: Unenrolls hosted agents too
                  type: boolean
                includeInactive:
                  description: When passing agents by KQL query, unenrolls inactive agents too
                  type: boolean
                revoke:
                  description: Revokes API keys of agents
                  type: boolean
              required:
                - agents
      responses:
        '200':
          content:
            application/json:
              examples:
                postBulkUnenrollAgentsExample:
                  description: Bulk unenroll action result
                  value:
                    actionId: action-id-1
              schema:
                anyOf:
                  - additionalProperties: false
                    type: object
                    properties:
                      actionId:
                        type: string
                    required:
                      - actionId
                  - additionalProperties: false
                    type: object
                    properties:
                      count:
                        type: number
                    required:
                      - count
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
      summary: Bulk unenroll agents
      tags:
        - Elastic Agent actions
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/agents/bulk_update_agent_tags:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/agents/bulk_update_agent_tags</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Add or remove tags across multiple agents.<br/><br/>[Required authorization] Route required privileges: fleet-agents-all.
      operationId: post-fleet-agents-bulk-update-agent-tags
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
      requestBody:
        content:
          application/json:
            examples:
              postBulkUpdateAgentTagsRequestExample:
                description: Add and remove tags across multiple agents
                value:
                  agents:
                    - agent-id-1
                    - agent-id-2
                  tagsToAdd:
                    - production
                  tagsToRemove:
                    - staging
            schema:
              additionalProperties: false
              type: object
              properties:
                agents:
                  anyOf:
                    - items:
                        type: string
                      maxItems: 10000
                      type: array
                    - type: string
                batchSize:
                  type: number
                dryRun:
                  type: boolean
                includeInactive:
                  default: false
                  type: boolean
                tagsToAdd:
                  items:
                    type: string
                  maxItems: 10
                  type: array
                tagsToRemove:
                  items:
                    type: string
                  maxItems: 10
                  type: array
              required:
                - agents
      responses:
        '200':
          content:
            application/json:
              examples:
                postBulkUpdateAgentTagsExample:
                  description: Bulk action result
                  value:
                    actionId: action-id-1
              schema:
                anyOf:
                  - additionalProperties: false
                    type: object
                    properties:
                      actionId:
                        type: string
                    required:
                      - actionId
                  - additionalProperties: false
                    type: object
                    properties:
                      count:
                        type: number
                    required:
                      - count
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
      summary: Bulk update agent tags
      tags:
        - Elastic Agent actions
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/agents/bulk_upgrade:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/agents/bulk_upgrade</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Upgrade multiple agents to a newer version, with optional rollout controls.<br/><br/>[Required authorization] Route required privileges: fleet-agents-all.
      operationId: post-fleet-agents-bulk-upgrade
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
      requestBody:
        content:
          application/json:
            examples:
              postBulkUpgradeAgentsRequestExample:
                description: Upgrade multiple agents to a specific version
                value:
                  agents:
                    - agent-id-1
                    - agent-id-2
                  rollout_duration_seconds: 3600
                  version: 8.17.0
            schema:
              additionalProperties: false
              type: object
              properties:
                agents:
                  anyOf:
                    - items:
                        type: string
                      maxItems: 10000
                      type: array
                    - type: string
                batchSize:
                  type: number
                dryRun:
                  type: boolean
                force:
                  type: boolean
                includeInactive:
                  default: false
                  type: boolean
                rollout_duration_seconds:
                  minimum: 600
                  type: number
                skipRateLimitCheck:
                  type: boolean
                source_uri:
                  type: string
                start_time:
                  type: string
                version:
                  type: string
              required:
                - agents
                - version
      responses:
        '200':
          content:
            application/json:
              examples:
                postBulkUpgradeAgentsExample:
                  description: Bulk upgrade action result
                  value:
                    actionId: action-id-1
              schema:
                anyOf:
                  - additionalProperties: false
                    type: object
                    properties:
                      actionId:
                        type: string
                    required:
                      - actionId
                  - additionalProperties: false
                    type: object
                    properties:
                      count:
                        type: number
                    required:
                      - count
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
      summary: Bulk upgrade agents
      tags:
        - Elastic Agent actions
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/agents/files/{fileId}:
    delete:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb delete">delete</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/agents/files/{fileId}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Delete a file uploaded by an agent.<br/><br/>[Required authorization] Route required privileges: fleet-agents-all.
      operationId: delete-fleet-agents-files-fileid
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: The ID of the uploaded file
          in: path
          name: fileId
          required: true
          schema:
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                deleteAgentUploadFileExample:
                  description: Uploaded file successfully deleted
                  value:
                    deleted: true
                    id: file-id-1
              schema:
                additionalProperties: false
                type: object
                properties:
                  deleted:
                    type: boolean
                  id:
                    type: string
                required:
                  - id
                  - deleted
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
      summary: Delete an uploaded file
      tags:
        - Elastic Agents
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/agents/files/{fileId}/{fileName}:
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/agents/files/{fileId}/{fileName}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Get a file uploaded by an agent.<br/><br/>[Required authorization] Route required privileges: fleet-agents-read.
      operationId: get-fleet-agents-files-fileid-filename
      parameters:
        - description: The ID of the uploaded file
          in: path
          name: fileId
          required: true
          schema:
            type: string
        - description: The name of the uploaded file
          in: path
          name: fileName
          required: true
          schema:
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                getAgentUploadFileExample:
                  description: The uploaded file content as a stream
                  value: <binary file content>
              schema:
                type: object
          description: Successful response — returns the uploaded file content
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
      summary: Get an uploaded file
      tags:
        - Elastic Agents
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/agents/setup:
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/agents/setup</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Get the current Fleet setup status, including whether Fleet is ready to enroll agents and which requirements or optional features are missing.<br/><br/>[Required authorization] Route required privileges: fleet-agents-read OR fleet-agent-policies-read OR fleet-settings-read OR fleet-setup.
      operationId: get-fleet-agents-setup
      parameters: []
      responses:
        '200':
          content:
            application/json:
              examples:
                agentsSetupNotReadyExample:
                  description: Fleet is not ready — a Fleet Server and API keys are required
                  value:
                    is_action_secrets_storage_enabled: false
                    is_secrets_storage_enabled: false
                    is_space_awareness_enabled: false
                    is_ssl_secrets_storage_enabled: false
                    isReady: false
                    missing_optional_features:
                      - encrypted_saved_object_encryption_key_required
                    missing_requirements:
                      - fleet_server
                      - api_keys
                agentsSetupReadyExample:
                  description: Fleet is ready to enroll agents — all requirements are met
                  value:
                    is_action_secrets_storage_enabled: true
                    is_secrets_storage_enabled: true
                    is_space_awareness_enabled: false
                    is_ssl_secrets_storage_enabled: false
                    isReady: true
                    missing_optional_features: []
                    missing_requirements: []
                    package_verification_key_id: D88DB4CC
              schema:
                additionalProperties: false
                description: A summary of the agent setup status. `isReady` indicates whether the setup is ready. If the setup is not ready, `missing_requirements` lists which requirements are missing.
                type: object
                properties:
                  is_action_secrets_storage_enabled:
                    type: boolean
                  is_secrets_storage_enabled:
                    type: boolean
                  is_space_awareness_enabled:
                    type: boolean
                  is_ssl_secrets_storage_enabled:
                    type: boolean
                  isReady:
                    type: boolean
                  missing_optional_features:
                    items:
                      enum:
                        - encrypted_saved_object_encryption_key_required
                      type: string
                    maxItems: 1
                    type: array
                  missing_requirements:
                    items:
                      enum:
                        - security_required
                        - tls_required
                        - api_keys
                        - fleet_admin_user
                        - fleet_server
                      type: string
                    maxItems: 5
                    type: array
                  package_verification_key_id:
                    type: string
                required:
                  - isReady
                  - missing_requirements
                  - missing_optional_features
          description: Fleet setup status
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
      summary: Get agent setup info
      tags:
        - Elastic Agents
      x-metaTags:
        - content: Kibana
          name: product_name
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/agents/setup</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Initialize Fleet. This endpoint is used by Elastic Agents to trigger Fleet setup. Safe to call multiple times; subsequent calls are idempotent.<br/><br/>[Required authorization] Route required privileges: fleet-agents-read OR fleet-agent-policies-read OR fleet-settings-read OR fleet-setup.
      operationId: post-fleet-agents-setup
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                agentsSetupSuccessExample:
                  description: Fleet setup initialized successfully with no non-fatal errors
                  value:
                    isInitialized: true
                    nonFatalErrors: []
              schema:
                additionalProperties: false
                description: A summary of the result of Fleet's `setup` lifecycle. If `isInitialized` is true, Fleet is ready to accept agent enrollment. `nonFatalErrors` may include useful insight into non-blocking issues with Fleet setup.
                type: object
                properties:
                  isInitialized:
                    type: boolean
                  nonFatalErrors:
                    items:
                      additionalProperties: false
                      type: object
                      properties:
                        message:
                          type: string
                        name:
                          type: string
                      required:
                        - name
                        - message
                    maxItems: 10000
                    type: array
                required:
                  - isInitialized
                  - nonFatalErrors
          description: Fleet setup completed
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
      summary: Initiate Fleet setup
      tags:
        - Elastic Agents
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/agents/tags:
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/agents/tags</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Get a list of all tags used across enrolled agents.<br/><br/>[Required authorization] Route required privileges: fleet-agents-read.
      operationId: get-fleet-agents-tags
      parameters:
        - description: A KQL query string to filter results
          in: query
          name: kuery
          required: false
          schema:
            type: string
        - description: When true, include tags from inactive agents
          in: query
          name: showInactive
          required: false
          schema:
            default: false
            type: boolean
      responses:
        '200':
          content:
            application/json:
              examples:
                getAgentTagsExample:
                  description: List of tags used across agents
                  value:
                    items:
                      - production
                      - linux
                      - datacenter-1
              schema:
                additionalProperties: false
                type: object
                properties:
                  items:
                    items:
                      type: string
                    maxItems: 10000
                    type: array
                required:
                  - items
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
      summary: Get agent tags
      tags:
        - Elastic Agents
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/check-permissions:
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/check-permissions</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Check whether the current user has the required permissions to use Fleet. Optionally verifies Fleet Server setup privileges.
      operationId: get-fleet-check-permissions
      parameters:
        - description: When true, check Fleet Server setup privileges in addition to standard Fleet privileges
          in: query
          name: fleetServerSetup
          required: false
          schema:
            type: boolean
      responses:
        '200':
          content:
            application/json:
              examples:
                checkPermissionsMissingPrivilegesExample:
                  description: The current user is missing Fleet privileges
                  value:
                    error: MISSING_PRIVILEGES
                    success: false
                checkPermissionsSuccessExample:
                  description: The current user has all required Fleet permissions
                  value:
                    success: true
              schema:
                additionalProperties: false
                type: object
                properties:
                  error:
                    enum:
                      - MISSING_SECURITY
                      - MISSING_PRIVILEGES
                      - MISSING_FLEET_SERVER_SETUP_PRIVILEGES
                    type: string
                  success:
                    type: boolean
                required:
                  - success
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
      summary: Check permissions
      tags:
        - Fleet internals
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/cloud_connectors:
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/cloud_connectors</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        List all Fleet cloud connectors.<br/><br/>[Required authorization] Route required privileges: fleet-agent-policies-read OR integrations-read.
      operationId: get-fleet-cloud-connectors
      parameters:
        - description: The page number for pagination.
          in: query
          name: page
          required: false
          schema:
            type: string
        - description: The number of items per page.
          in: query
          name: perPage
          required: false
          schema:
            type: string
        - description: KQL query to filter cloud connectors.
          in: query
          name: kuery
          required: false
          schema:
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                getCloudConnectorsExample:
                  description: List of Fleet cloud connectors
                  value:
                    items:
                      - accountType: single-account
                        cloudProvider: aws
                        created_at: '2024-01-15T10:00:00.000Z'
                        iac_blueprint_id: federated-identity
                        iac_blueprint_version: 1.0.0
                        iac_deployment_id: arn:aws:cloudformation:us-east-1:123456789012:stack/elastic-aws-connector/abc
                        iac_key: sha256:661cb7def1c7101f
                        iac_upgrade_checked_at: '2024-01-15T10:00:00.000Z'
                        iac_upgrade_status: up_to_date
                        id: cloud-connector-id-1
                        name: My AWS connector
                        packagePolicyCount: 2
                        updated_at: '2024-01-15T10:00:00.000Z'
                        vars: {}
              schema:
                additionalProperties: false
                type: object
                properties:
                  items:
                    items:
                      additionalProperties: false
                      type: object
                      properties:
                        accountType:
                          type: string
                        cloudProvider:
                          type: string
                        created_at:
                          type: string
                        iac_blueprint_id:
                          description: Identifier of the template source last used for this connector. Set to null to remove it.
                          maxLength: 255
                          minLength: 1
                          nullable: true
                          type: string
                          x-state: Experimental; added in 9.6.0
                        iac_blueprint_version:
                          description: Version of the template source last used for this connector. Set to null to remove it.
                          maxLength: 64
                          minLength: 1
                          nullable: true
                          type: string
                          x-state: Experimental; added in 9.6.0
                        iac_deployment_id:
                          description: ARN of the last CloudFormation stack deployed for this connector (`arn:<partition>:cloudformation:<region>:<account>:stack/<name>/<id>`).
                          maxLength: 2048
                          minLength: 1
                          type: string
                          x-state: Experimental; added in 9.6.0
                        iac_key:
                          description: Checksum of the CloudFormation template last saved on this connector. Set to null to remove it.
                          maxLength: 512
                          minLength: 1
                          nullable: true
                          type: string
                          x-state: Experimental; added in 9.6.0
                        iac_upgrade_checked_at:
                          description: When this connector was last checked for a CloudFormation template upgrade.
                          type: string
                          x-state: Experimental; added in 9.6.0
                        iac_upgrade_status:
                          description: Whether a newer CloudFormation template is available for this connector.
                          enum:
                            - up_to_date
                            - upgrade_available
                          type: string
                          x-state: Experimental; added in 9.6.0
                        id:
                          type: string
                        name:
                          type: string
                        namespace:
                          type: string
                        packagePolicyCount:
                          type: number
                        updated_at:
                          type: string
                        vars:
                          additionalProperties:
                            nullable: true
                          type: object
                        verification_failed_at:
                          type: string
                        verification_started_at:
                          type: string
                        verification_status:
                          type: string
                      required:
                        - id
                        - name
                        - cloudProvider
                        - vars
                        - packagePolicyCount
                        - created_at
                        - updated_at
                    maxItems: 10000
                    type: array
                required:
                  - items
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
      summary: Get cloud connectors
      tags:
        - Fleet cloud connectors
      x-state: Experimental; added in 9.2.0
      x-metaTags:
        - content: Kibana
          name: product_name
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/cloud_connectors</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Create a new Fleet cloud connector.<br/><br/>[Required authorization] Route required privileges: fleet-agent-policies-all OR integrations-all.
      operationId: post-fleet-cloud-connectors
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
      requestBody:
        content:
          application/json:
            examples:
              postCloudConnectorRequestExample:
                description: Create a new AWS cloud connector
                value:
                  accountType: single-account
                  cloudProvider: aws
                  iac_blueprint_id: federated-identity
                  iac_blueprint_version: 1.0.0
                  iac_deployment_id: arn:aws:cloudformation:us-east-1:123456789012:stack/elastic-aws-connector/abc
                  iac_key: sha256:661cb7def1c7101f
                  name: My AWS connector
                  vars: {}
            schema:
              additionalProperties: false
              type: object
              properties:
                accountType:
                  description: 'The account type: single-account (single account/subscription) or organization-account (organization-wide).'
                  enum:
                    - single-account
                    - organization-account
                  type: string
                cloudProvider:
                  description: 'The cloud provider type: aws, azure, or gcp.'
                  enum:
                    - aws
                    - azure
                    - gcp
                  type: string
                iac_blueprint_id:
                  description: Identifier of the template source last used for this connector. Set to null to remove it.
                  maxLength: 255
                  minLength: 1
                  nullable: true
                  type: string
                  x-state: Experimental; added in 9.6.0
                iac_blueprint_version:
                  description: Version of the template source last used for this connector. Set to null to remove it.
                  maxLength: 64
                  minLength: 1
                  nullable: true
                  type: string
                  x-state: Experimental; added in 9.6.0
                iac_deployment_id:
                  description: ARN of the last CloudFormation stack deployed for this connector (`arn:<partition>:cloudformation:<region>:<account>:stack/<name>/<id>`).
                  maxLength: 2048
                  minLength: 1
                  type: string
                  x-state: Experimental; added in 9.6.0
                iac_key:
                  description: Checksum of the CloudFormation template last saved on this connector. Set to null to remove it.
                  maxLength: 512
                  minLength: 1
                  nullable: true
                  type: string
                  x-state: Experimental; added in 9.6.0
                name:
                  description: The name of the cloud connector.
                  maxLength: 255
                  minLength: 1
                  type: string
                vars:
                  additionalProperties:
                    anyOf:
                      - maxLength: 1000
                        type: string
                      - type: number
                      - type: boolean
                      - additionalProperties: false
                        type: object
                        properties:
                          frozen:
                            type: boolean
                          type:
                            maxLength: 50
                            type: string
                          value:
                            anyOf:
                              - maxLength: 1000
                                type: string
                              - additionalProperties: false
                                type: object
                                properties:
                                  id:
                                    maxLength: 255
                                    type: string
                                  isSecretRef:
                                    type: boolean
                                required:
                                  - isSecretRef
                                  - id
                        required:
                          - type
                          - value
                  type: object
              required:
                - name
                - cloudProvider
                - vars
      responses:
        '200':
          content:
            application/json:
              examples:
                postCloudConnectorExample:
                  description: The created Fleet cloud connector
                  value:
                    item:
                      accountType: single-account
                      cloudProvider: aws
                      created_at: '2024-01-15T10:00:00.000Z'
                      iac_blueprint_id: federated-identity
                      iac_blueprint_version: 1.0.0
                      iac_deployment_id: arn:aws:cloudformation:us-east-1:123456789012:stack/elastic-aws-connector/abc
                      iac_key: sha256:661cb7def1c7101f
                      iac_upgrade_checked_at: '2024-01-15T10:00:00.000Z'
                      iac_upgrade_status: up_to_date
                      id: cloud-connector-id-2
                      name: My AWS connector
                      packagePolicyCount: 0
                      updated_at: '2024-01-15T10:00:00.000Z'
                      vars: {}
              schema:
                additionalProperties: false
                type: object
                properties:
                  item:
                    additionalProperties: false
                    type: object
                    properties:
                      accountType:
                        type: string
                      cloudProvider:
                        type: string
                      created_at:
                        type: string
                      iac_blueprint_id:
                        description: Identifier of the template source last used for this connector. Set to null to remove it.
                        maxLength: 255
                        minLength: 1
                        nullable: true
                        type: string
                        x-state: Experimental; added in 9.6.0
                      iac_blueprint_version:
                        description: Version of the template source last used for this connector. Set to null to remove it.
                        maxLength: 64
                        minLength: 1
                        nullable: true
                        type: string
                        x-state: Experimental; added in 9.6.0
                      iac_deployment_id:
                        description: ARN of the last CloudFormation stack deployed for this connector (`arn:<partition>:cloudformation:<region>:<account>:stack/<name>/<id>`).
                        maxLength: 2048
                        minLength: 1
                        type: string
                        x-state: Experimental; added in 9.6.0
                      iac_key:
                        description: Checksum of the CloudFormation template last saved on this connector. Set to null to remove it.
                        maxLength: 512
                        minLength: 1
                        nullable: true
                        type: string
                        x-state: Experimental; added in 9.6.0
                      iac_upgrade_checked_at:
                        description: When this connector was last checked for a CloudFormation template upgrade.
                        type: string
                        x-state: Experimental; added in 9.6.0
                      iac_upgrade_status:
                        description: Whether a newer CloudFormation template is available for this connector.
                        enum:
                          - up_to_date
                          - upgrade_available
                        type: string
                        x-state: Experimental; added in 9.6.0
                      id:
                        type: string
                      name:
                        type: string
                      namespace:
                        type: string
                      packagePolicyCount:
                        type: number
                      updated_at:
                        type: string
                      vars:
                        additionalProperties:
                          nullable: true
                        type: object
                      verification_failed_at:
                        type: string
                      verification_started_at:
                        type: string
                      verification_status:
                        type: string
                    required:
                      - id
                      - name
                      - cloudProvider
                      - vars
                      - packagePolicyCount
                      - created_at
                      - updated_at
                required:
                  - item
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
      summary: Create cloud connector
      tags:
        - Fleet cloud connectors
      x-state: Experimental; added in 9.2.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/cloud_connectors/{cloudConnectorId}:
    delete:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb delete">delete</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/cloud_connectors/{cloudConnectorId}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Delete a cloud connector by ID. Use the `force` query parameter to delete even if package policies are still using it.<br/><br/>[Required authorization] Route required privileges: fleet-agent-policies-all OR integrations-all.
      operationId: delete-fleet-cloud-connectors-cloudconnectorid
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: The unique identifier of the cloud connector to delete.
          in: path
          name: cloudConnectorId
          required: true
          schema:
            type: string
        - description: If true, forces deletion even if the cloud connector is in use.
          in: query
          name: force
          required: false
          schema:
            type: boolean
      responses:
        '200':
          content:
            application/json:
              examples:
                deleteCloudConnectorExample:
                  description: The cloud connector was successfully deleted
                  value:
                    id: cloud-connector-id-1
              schema:
                additionalProperties: false
                type: object
                properties:
                  id:
                    type: string
                required:
                  - id
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
      summary: Delete cloud connector (supports force deletion)
      tags:
        - Fleet cloud connectors
      x-state: Experimental; added in 9.2.0
      x-metaTags:
        - content: Kibana
          name: product_name
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/cloud_connectors/{cloudConnectorId}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Get a cloud connector by ID.<br/><br/>[Required authorization] Route required privileges: fleet-agent-policies-read OR integrations-read.
      operationId: get-fleet-cloud-connectors-cloudconnectorid
      parameters:
        - description: The unique identifier of the cloud connector.
          in: path
          name: cloudConnectorId
          required: true
          schema:
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                getCloudConnectorExample:
                  description: A Fleet cloud connector
                  value:
                    item:
                      accountType: single-account
                      cloudProvider: aws
                      created_at: '2024-01-15T10:00:00.000Z'
                      iac_blueprint_id: federated-identity
                      iac_blueprint_version: 1.0.0
                      iac_deployment_id: arn:aws:cloudformation:us-east-1:123456789012:stack/elastic-aws-connector/abc
                      iac_key: sha256:661cb7def1c7101f
                      iac_upgrade_checked_at: '2024-01-15T10:00:00.000Z'
                      iac_upgrade_status: up_to_date
                      id: cloud-connector-id-1
                      name: My AWS connector
                      packagePolicyCount: 2
                      updated_at: '2024-01-15T10:00:00.000Z'
                      vars: {}
              schema:
                additionalProperties: false
                type: object
                properties:
                  item:
                    additionalProperties: false
                    type: object
                    properties:
                      accountType:
                        type: string
                      cloudProvider:
                        type: string
                      created_at:
                        type: string
                      iac_blueprint_id:
                        description: Identifier of the template source last used for this connector. Set to null to remove it.
                        maxLength: 255
                        minLength: 1
                        nullable: true
                        type: string
                        x-state: Experimental; added in 9.6.0
                      iac_blueprint_version:
                        description: Version of the template source last used for this connector. Set to null to remove it.
                        maxLength: 64
                        minLength: 1
                        nullable: true
                        type: string
                        x-state: Experimental; added in 9.6.0
                      iac_deployment_id:
                        description: ARN of the last CloudFormation stack deployed for this connector (`arn:<partition>:cloudformation:<region>:<account>:stack/<name>/<id>`).
                        maxLength: 2048
                        minLength: 1
                        type: string
                        x-state: Experimental; added in 9.6.0
                      iac_key:
                        description: Checksum of the CloudFormation template last saved on this connector. Set to null to remove it.
                        maxLength: 512
                        minLength: 1
                        nullable: true
                        type: string
                        x-state: Experimental; added in 9.6.0
                      iac_upgrade_checked_at:
                        description: When this connector was last checked for a CloudFormation template upgrade.
                        type: string
                        x-state: Experimental; added in 9.6.0
                      iac_upgrade_status:
                        description: Whether a newer CloudFormation template is available for this connector.
                        enum:
                          - up_to_date
                          - upgrade_available
                        type: string
                        x-state: Experimental; added in 9.6.0
                      id:
                        type: string
                      name:
                        type: string
                      namespace:
                        type: string
                      packagePolicyCount:
                        type: number
                      updated_at:
                        type: string
                      vars:
                        additionalProperties:
                          nullable: true
                        type: object
                      verification_failed_at:
                        type: string
                      verification_started_at:
                        type: string
                      verification_status:
                        type: string
                    required:
                      - id
                      - name
                      - cloudProvider
                      - vars
                      - packagePolicyCount
                      - created_at
                      - updated_at
                required:
                  - item
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
      summary: Get cloud connector
      tags:
        - Fleet cloud connectors
      x-state: Experimental; added in 9.2.0
      x-metaTags:
        - content: Kibana
          name: product_name
    put:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb put">put</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/cloud_connectors/{cloudConnectorId}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Update a cloud connector by ID.<br/><br/>[Required authorization] Route required privileges: fleet-agent-policies-all OR integrations-all.
      operationId: put-fleet-cloud-connectors-cloudconnectorid
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: The unique identifier of the cloud connector to update.
          in: path
          name: cloudConnectorId
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            examples:
              putCloudConnectorRequestExample:
                description: Update a Fleet cloud connector
                value:
                  iac_blueprint_id: federated-identity
                  iac_blueprint_version: 1.0.0
                  iac_deployment_id: arn:aws:cloudformation:us-east-1:123456789012:stack/elastic-aws-connector/abc
                  iac_key: sha256:661cb7def1c7101f
                  name: Updated AWS connector
                  vars: {}
            schema:
              additionalProperties: false
              type: object
              properties:
                accountType:
                  description: 'The account type: single-account (single account/subscription) or organization-account (organization-wide).'
                  enum:
                    - single-account
                    - organization-account
                  type: string
                iac_blueprint_id:
                  description: Identifier of the template source last used for this connector. Set to null to remove it.
                  maxLength: 255
                  minLength: 1
                  nullable: true
                  type: string
                  x-state: Experimental; added in 9.6.0
                iac_blueprint_version:
                  description: Version of the template source last used for this connector. Set to null to remove it.
                  maxLength: 64
                  minLength: 1
                  nullable: true
                  type: string
                  x-state: Experimental; added in 9.6.0
                iac_deployment_id:
                  description: ARN of the last CloudFormation stack deployed for this connector (`arn:<partition>:cloudformation:<region>:<account>:stack/<name>/<id>`).
                  maxLength: 2048
                  minLength: 1
                  type: string
                  x-state: Experimental; added in 9.6.0
                iac_key:
                  description: Checksum of the CloudFormation template last saved on this connector. Set to null to remove it.
                  maxLength: 512
                  minLength: 1
                  nullable: true
                  type: string
                  x-state: Experimental; added in 9.6.0
                name:
                  description: The name of the cloud connector.
                  maxLength: 255
                  minLength: 1
                  type: string
                vars:
                  additionalProperties:
                    anyOf:
                      - maxLength: 1000
                        type: string
                      - type: number
                      - type: boolean
                      - additionalProperties: false
                        type: object
                        properties:
                          frozen:
                            type: boolean
                          type:
                            maxLength: 50
                            type: string
                          value:
                            anyOf:
                              - maxLength: 1000
                                type: string
                              - additionalProperties: false
                                type: object
                                properties:
                                  id:
                                    maxLength: 255
                                    type: string
                                  isSecretRef:
                                    type: boolean
                                required:
                                  - isSecretRef
                                  - id
                        required:
                          - type
                          - value
                  type: object
      responses:
        '200':
          content:
            application/json:
              examples:
                putCloudConnectorExample:
                  description: The updated Fleet cloud connector
                  value:
                    item:
                      accountType: single-account
                      cloudProvider: aws
                      created_at: '2024-01-15T10:00:00.000Z'
                      iac_blueprint_id: federated-identity
                      iac_blueprint_version: 1.0.0
                      iac_deployment_id: arn:aws:cloudformation:us-east-1:123456789012:stack/elastic-aws-connector/abc
                      iac_key: sha256:661cb7def1c7101f
                      iac_upgrade_checked_at: '2024-01-15T11:00:00.000Z'
                      iac_upgrade_status: up_to_date
                      id: cloud-connector-id-1
                      name: Updated AWS connector
                      packagePolicyCount: 2
                      updated_at: '2024-01-15T11:00:00.000Z'
                      vars: {}
              schema:
                additionalProperties: false
                type: object
                properties:
                  item:
                    additionalProperties: false
                    type: object
                    properties:
                      accountType:
                        type: string
                      cloudProvider:
                        type: string
                      created_at:
                        type: string
                      iac_blueprint_id:
                        description: Identifier of the template source last used for this connector. Set to null to remove it.
                        maxLength: 255
                        minLength: 1
                        nullable: true
                        type: string
                        x-state: Experimental; added in 9.6.0
                      iac_blueprint_version:
                        description: Version of the template source last used for this connector. Set to null to remove it.
                        maxLength: 64
                        minLength: 1
                        nullable: true
                        type: string
                        x-state: Experimental; added in 9.6.0
                      iac_deployment_id:
                        description: ARN of the last CloudFormation stack deployed for this connector (`arn:<partition>:cloudformation:<region>:<account>:stack/<name>/<id>`).
                        maxLength: 2048
                        minLength: 1
                        type: string
                        x-state: Experimental; added in 9.6.0
                      iac_key:
                        description: Checksum of the CloudFormation template last saved on this connector. Set to null to remove it.
                        maxLength: 512
                        minLength: 1
                        nullable: true
                        type: string
                        x-state: Experimental; added in 9.6.0
                      iac_upgrade_checked_at:
                        description: When this connector was last checked for a CloudFormation template upgrade.
                        type: string
                        x-state: Experimental; added in 9.6.0
                      iac_upgrade_status:
                        description: Whether a newer CloudFormation template is available for this connector.
                        enum:
                          - up_to_date
                          - upgrade_available
                        type: string
                        x-state: Experimental; added in 9.6.0
                      id:
                        type: string
                      name:
                        type: string
                      namespace:
                        type: string
                      packagePolicyCount:
                        type: number
                      updated_at:
                        type: string
                      vars:
                        additionalProperties:
                          nullable: true
                        type: object
                      verification_failed_at:
                        type: string
                      verification_started_at:
                        type: string
                      verification_status:
                        type: string
                    required:
                      - id
                      - name
                      - cloudProvider
                      - vars
                      - packagePolicyCount
                      - created_at
                      - updated_at
                required:
                  - item
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
      summary: Update cloud connector
      tags:
        - Fleet cloud connectors
      x-state: Experimental; added in 9.2.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/cloud_connectors/{cloudConnectorId}/usage:
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/cloud_connectors/{cloudConnectorId}/usage</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Get a list of package policies that are using a given cloud connector.<br/><br/>[Required authorization] Route required privileges: fleet-agent-policies-read OR integrations-read.
      operationId: get-fleet-cloud-connectors-cloudconnectorid-usage
      parameters:
        - description: The unique identifier of the cloud connector.
          in: path
          name: cloudConnectorId
          required: true
          schema:
            type: string
        - description: The page number for pagination.
          in: query
          name: page
          required: false
          schema:
            minimum: 1
            type: number
        - description: The number of items per page.
          in: query
          name: perPage
          required: false
          schema:
            minimum: 1
            type: number
      responses:
        '200':
          content:
            application/json:
              examples:
                getCloudConnectorUsageResponseExample:
                  description: Example response showing package policies using the cloud connector
                  value:
                    items:
                      - created_at: '2025-01-16T09:00:00.000Z'
                        id: package-policy-1
                        name: CSPM AWS Policy
                        package:
                          name: cloud_security_posture
                          title: Cloud Security Posture Management
                          version: 3.1.1
                        policy_ids:
                          - policy-id-123
                          - policy-id-456
                        updated_at: '2025-01-16T09:00:00.000Z'
                    page: 1
                    perPage: 20
                    total: 2
              schema:
                additionalProperties: false
                type: object
                properties:
                  items:
                    items:
                      additionalProperties: false
                      type: object
                      properties:
                        created_at:
                          type: string
                        id:
                          type: string
                        name:
                          type: string
                        package:
                          additionalProperties: false
                          type: object
                          properties:
                            name:
                              type: string
                            title:
                              type: string
                            version:
                              type: string
                          required:
                            - name
                            - title
                            - version
                        policy_ids:
                          items:
                            type: string
                          maxItems: 10000
                          type: array
                        updated_at:
                          type: string
                      required:
                        - id
                        - name
                        - policy_ids
                        - created_at
                        - updated_at
                    maxItems: 10000
                    type: array
                  page:
                    type: number
                  perPage:
                    type: number
                  total:
                    type: number
                required:
                  - items
                  - total
                  - page
                  - perPage
          description: 'OK: A successful request.'
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: Cloud connector not found
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: A bad request.
      summary: Get cloud connector usage (package policies using the connector)
      tags:
        - Fleet cloud connectors
      x-state: Experimental; added in 9.2.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/cloud_onboarding_deployments:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/cloud_onboarding_deployments</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Create a new Fleet cloud onboarding deployment.<br/><br/>[Required authorization] Route required privileges: fleet-agent-policies-all OR integrations-all.
      operationId: post-fleet-cloud-onboarding-deployments
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
      requestBody:
        content:
          application/json:
            examples:
              postCloudOnboardingDeploymentAgentBasedRequestExample:
                description: Create a new AWS cloud onboarding deployment using an Elastic Agent (agent-based)
                value:
                  authMethod: assume_role
                  mechanisms:
                    - agent_based
                  provider: aws
                  services:
                    - cloudwatch_metrics
                  serviceVars:
                    cloudwatch_metrics:
                      namespace: AWS/EC2
                      regions:
                        - us-east-1
              postCloudOnboardingDeploymentEcfRequestExample:
                description: Create a new AWS cloud onboarding deployment using Elastic Cloud Forwarder (ECF)
                value:
                  connectorId: cloud-connector-id-1
                  mechanisms:
                    - ecf
                  provider: aws
                  services:
                    - cloudfront_logs
                  serviceVars:
                    cloudfront_logs:
                      regions:
                        - us-east-1
                      s3_bucket_arn: arn:aws:s3:::my-cloudfront-bucket
              postCloudOnboardingDeploymentRequestExample:
                description: Create a new AWS cloud onboarding deployment using identity federation (managed integration)
                value:
                  connectorId: cloud-connector-id-1
                  mechanisms:
                    - managed_integration
                  provider: aws
                  services:
                    - cloudwatch_metrics
                    - cloudtrail
                  serviceVars:
                    cloudtrail:
                      regions:
                        - us-east-1
                      s3_bucket_arn: arn:aws:s3:::my-cloudtrail-bucket
                    cloudwatch_metrics:
                      namespace: AWS/EC2
                      regions:
                        - us-east-1
                        - eu-west-1
            schema:
              additionalProperties: false
              type: object
              properties:
                agentPolicyIds:
                  description: Agent policy IDs for agent_based existing-policy deploys. Provided on create so that a mid-deploy tab-close leaves a record that hydrates back into existing mode.
                  items:
                    maxLength: 255
                    type: string
                  maxItems: 1000
                  type: array
                authMethod:
                  description: |-
                    Authentication method. Allowed values depend on the delivery mechanism:

                    - managed_integration: identity_federation | static_keys
                    - agent_based: static_keys (direct_access_keys) | temporary_keys | shared_credentials | assume_role
                  enum:
                    - identity_federation
                    - static_keys
                    - temporary_keys
                    - shared_credentials
                    - assume_role
                  type: string
                connectorId:
                  description: ID of the fleet-cloud-connector to associate with this deployment. Omit for static-keys deployments.
                  maxLength: 255
                  minLength: 1
                  type: string
                dataFormat:
                  description: 'Data format: ecs or otel.'
                  enum:
                    - ecs
                    - otel
                  type: string
                globalRegion:
                  description: Global AWS region from the Service Settings step.
                  maxLength: 64
                  type: string
                mechanisms:
                  description: Delivery mechanisms active in this deployment.
                  items:
                    description: 'Delivery mechanism: managed_integration, ecf, or agent_based.'
                    enum:
                      - managed_integration
                      - ecf
                      - agent_based
                    type: string
                  maxItems: 10
                  type: array
                provider:
                  description: Cloud provider.
                  enum:
                    - aws
                    - azure
                    - gcp
                  type: string
                services:
                  description: Service IDs to be covered by this deployment.
                  items:
                    minLength: 1
                    type: string
                  maxItems: 1000
                  minItems: 1
                  type: array
                serviceVars:
                  additionalProperties:
                    additionalProperties:
                      nullable: true
                    type: object
                  description: Per-service config keyed by instance ID.
                  type: object
              required:
                - provider
                - mechanisms
                - services
      responses:
        '200':
          content:
            application/json:
              examples:
                postCloudOnboardingDeploymentAgentBasedExample:
                  description: Agent-based deployment — agentPolicyIds set after the agent policy is selected or created
                  value:
                    item:
                      agentPolicyIds:
                        - agent-policy-id-1
                      attemptCount: 1
                      authMethod: assume_role
                      id: onboarding-deployment-id-2
                      mechanisms:
                        - agent_based
                      provider: aws
                      services:
                        - cloudwatch_metrics
                      serviceVars:
                        cloudwatch_metrics:
                          namespace: AWS/EC2
                          regions:
                            - us-east-1
                      status: pending
                postCloudOnboardingDeploymentEcfExample:
                  description: ECF deployment — apiKeyId set after the Elasticsearch API key is created for the ECF service
                  value:
                    item:
                      apiKeyId: es-api-key-id-1
                      attemptCount: 1
                      connectorId: cloud-connector-id-1
                      id: onboarding-deployment-id-3
                      mechanisms:
                        - ecf
                      provider: aws
                      services:
                        - cloudfront_logs
                      serviceVars:
                        cloudfront_logs:
                          regions:
                            - us-east-1
                          s3_bucket_arn: arn:aws:s3:::my-cloudfront-bucket
                      status: pending
                postCloudOnboardingDeploymentExample:
                  description: Managed integration deployment — packagePolicyIds set after deployment completes
                  value:
                    item:
                      attemptCount: 1
                      connectorId: cloud-connector-id-1
                      id: onboarding-deployment-id-1
                      mechanisms:
                        - managed_integration
                      packagePolicyIds:
                        - package-policy-id-1
                      provider: aws
                      services:
                        - cloudwatch_metrics
                        - cloudtrail
                      serviceVars:
                        cloudtrail:
                          regions:
                            - us-east-1
                          s3_bucket_arn: arn:aws:s3:::my-cloudtrail-bucket
                        cloudwatch_metrics:
                          namespace: AWS/EC2
                          regions:
                            - us-east-1
                            - eu-west-1
                      status: pending
              schema:
                additionalProperties: false
                type: object
                properties:
                  item:
                    additionalProperties: false
                    type: object
                    properties:
                      agentPolicyIds:
                        description: Agent policy IDs for agent_based deployments. Single-element for new-policy deploys; multiple for existing-policy deploys targeting several policies.
                        items:
                          type: string
                        maxItems: 1000
                        type: array
                      apiKeyId:
                        description: Elasticsearch API key ID for push mechanisms (ecf). Set by the backend; used for key rotation/revocation.
                        type: string
                      attemptCount:
                        description: Number of deployment attempts, including the current one.
                        minimum: 1
                        type: number
                      authMethod:
                        description: |-
                          Authentication method. Allowed values depend on the delivery mechanism:

                          - managed_integration: identity_federation | static_keys
                          - agent_based: static_keys (direct_access_keys) | temporary_keys | shared_credentials | assume_role
                        enum:
                          - identity_federation
                          - static_keys
                          - temporary_keys
                          - shared_credentials
                          - assume_role
                        type: string
                      connectorId:
                        description: ID of the fleet-cloud-connector this deployment belongs to. Absent for static-keys deployments.
                        type: string
                      dataFormat:
                        description: 'Data format: ecs or otel.'
                        enum:
                          - ecs
                          - otel
                        type: string
                      deploymentId:
                        description: Opaque deployment identifier; for AWS, the CFN stack ARN.
                        type: string
                      deploymentName:
                        description: Opaque deployment name; for AWS, the CFN stack name.
                        type: string
                      ecfStacks:
                        description: ECF CloudFormation stacks launched as part of this deployment. Written by the wizard after the user clicks Launch.
                        items:
                          additionalProperties: false
                          type: object
                          properties:
                            family:
                              description: ECF template family.
                              enum:
                                - unified
                                - otel
                                - crowdstrike
                              type: string
                            stackName:
                              description: CloudFormation stack name (128-char AWS limit).
                              maxLength: 128
                              minLength: 1
                              type: string
                            templateVersion:
                              description: ECF semantic version resolved at launch time, e.g. "1.10.0".
                              maxLength: 32
                              minLength: 1
                              type: string
                          required:
                            - family
                            - stackName
                            - templateVersion
                        maxItems: 10
                        type: array
                      globalRegion:
                        description: Global AWS region from the Service Settings step.
                        type: string
                      id:
                        type: string
                      mechanisms:
                        items:
                          description: 'Delivery mechanism: managed_integration, ecf, or agent_based.'
                          enum:
                            - managed_integration
                            - ecf
                            - agent_based
                          type: string
                        maxItems: 10
                        type: array
                      packagePolicyIds:
                        description: Package policy IDs created for this deployment (managed_integration and agent_based).
                        items:
                          type: string
                        maxItems: 1000
                        type: array
                      policyIdsByInstance:
                        additionalProperties:
                          maxLength: 255
                          type: string
                        description: instanceId → policyId mapping persisted after deploy. Hydrated into the wizard on resume to enable cleanup of stale policies when services are removed.
                        type: object
                      provider:
                        description: Cloud provider.
                        enum:
                          - aws
                          - azure
                          - gcp
                        type: string
                      services:
                        description: Service IDs covered by this deployment.
                        items:
                          type: string
                        maxItems: 1000
                        type: array
                      serviceVars:
                        additionalProperties:
                          additionalProperties:
                            nullable: true
                          type: object
                        description: Per-service config keyed by instance ID. Each value is the ServiceVars object from the Service Settings step.
                        type: object
                      status:
                        description: Deployment status.
                        enum:
                          - pending
                          - deploying
                          - succeeded
                          - failed
                        type: string
                      statusMessage:
                        description: Error context when status is failed.
                        type: string
                    required:
                      - id
                      - provider
                      - mechanisms
                      - services
                      - status
                      - attemptCount
                required:
                  - item
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
      summary: Create cloud onboarding deployment
      tags:
        - Fleet cloud onboarding deployments
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/cloud_onboarding_deployments/{id}:
    delete:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb delete">delete</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/cloud_onboarding_deployments/{id}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Delete a cloud onboarding deployment by ID.<br/><br/>[Required authorization] Route required privileges: fleet-agent-policies-all OR integrations-all.
      operationId: delete-fleet-cloud-onboarding-deployments-id
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: The saved object ID of the cloud onboarding deployment.
          in: path
          name: id
          required: true
          schema:
            maxLength: 255
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                deleteCloudOnboardingDeploymentExample:
                  description: The cloud onboarding deployment was successfully deleted
                  value:
                    id: onboarding-deployment-id-1
              schema:
                additionalProperties: false
                type: object
                properties:
                  id:
                    type: string
                required:
                  - id
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
        '404':
          content:
            application/json:
              examples:
                notFoundResponseExample:
                  description: The requested cloud onboarding deployment does not exist
                  value:
                    error: Not Found
                    message: Saved object [fleet-cloud-onboarding-deployment/unknown-id] not found
                    statusCode: 404
              schema:
                additionalProperties: false
                type: object
                properties:
                  message:
                    type: string
                required:
                  - message
          description: Not Found
      summary: Delete cloud onboarding deployment
      tags:
        - Fleet cloud onboarding deployments
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/cloud_onboarding_deployments/{id}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Get a cloud onboarding deployment by ID.<br/><br/>[Required authorization] Route required privileges: fleet-agent-policies-read OR integrations-read.
      operationId: get-fleet-cloud-onboarding-deployments-id
      parameters:
        - description: The saved object ID of the cloud onboarding deployment.
          in: path
          name: id
          required: true
          schema:
            maxLength: 255
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                getCloudOnboardingDeploymentExample:
                  description: A cloud onboarding deployment that has succeeded
                  value:
                    item:
                      agentPolicyIds:
                        - agent-policy-id-1
                      attemptCount: 1
                      connectorId: cloud-connector-id-1
                      deploymentId: arn:aws:cloudformation:us-east-1:123456789012:stack/elastic-aws-onboarding/aaa-bbb-ccc
                      deploymentName: elastic-aws-onboarding
                      id: onboarding-deployment-id-1
                      mechanisms:
                        - managed_integration
                      packagePolicyIds:
                        - package-policy-id-1
                      provider: aws
                      services:
                        - cloudwatch_metrics
                        - cloudtrail
                      serviceVars:
                        cloudtrail:
                          - regions:
                              - us-east-1
                            s3_bucket_arn: arn:aws:s3:::my-cloudtrail-bucket
                        cloudwatch_metrics:
                          - namespace: AWS/EC2
                            regions:
                              - us-east-1
                              - eu-west-1
                      status: succeeded
              schema:
                additionalProperties: false
                type: object
                properties:
                  item:
                    additionalProperties: false
                    type: object
                    properties:
                      agentPolicyIds:
                        description: Agent policy IDs for agent_based deployments. Single-element for new-policy deploys; multiple for existing-policy deploys targeting several policies.
                        items:
                          type: string
                        maxItems: 1000
                        type: array
                      apiKeyId:
                        description: Elasticsearch API key ID for push mechanisms (ecf). Set by the backend; used for key rotation/revocation.
                        type: string
                      attemptCount:
                        description: Number of deployment attempts, including the current one.
                        minimum: 1
                        type: number
                      authMethod:
                        description: |-
                          Authentication method. Allowed values depend on the delivery mechanism:

                          - managed_integration: identity_federation | static_keys
                          - agent_based: static_keys (direct_access_keys) | temporary_keys | shared_credentials | assume_role
                        enum:
                          - identity_federation
                          - static_keys
                          - temporary_keys
                          - shared_credentials
                          - assume_role
                        type: string
                      connectorId:
                        description: ID of the fleet-cloud-connector this deployment belongs to. Absent for static-keys deployments.
                        type: string
                      dataFormat:
                        description: 'Data format: ecs or otel.'
                        enum:
                          - ecs
                          - otel
                        type: string
                      deploymentId:
                        description: Opaque deployment identifier; for AWS, the CFN stack ARN.
                        type: string
                      deploymentName:
                        description: Opaque deployment name; for AWS, the CFN stack name.
                        type: string
                      ecfStacks:
                        description: ECF CloudFormation stacks launched as part of this deployment. Written by the wizard after the user clicks Launch.
                        items:
                          additionalProperties: false
                          type: object
                          properties:
                            family:
                              description: ECF template family.
                              enum:
                                - unified
                                - otel
                                - crowdstrike
                              type: string
                            stackName:
                              description: CloudFormation stack name (128-char AWS limit).
                              maxLength: 128
                              minLength: 1
                              type: string
                            templateVersion:
                              description: ECF semantic version resolved at launch time, e.g. "1.10.0".
                              maxLength: 32
                              minLength: 1
                              type: string
                          required:
                            - family
                            - stackName
                            - templateVersion
                        maxItems: 10
                        type: array
                      globalRegion:
                        description: Global AWS region from the Service Settings step.
                        type: string
                      id:
                        type: string
                      mechanisms:
                        items:
                          description: 'Delivery mechanism: managed_integration, ecf, or agent_based.'
                          enum:
                            - managed_integration
                            - ecf
                            - agent_based
                          type: string
                        maxItems: 10
                        type: array
                      packagePolicyIds:
                        description: Package policy IDs created for this deployment (managed_integration and agent_based).
                        items:
                          type: string
                        maxItems: 1000
                        type: array
                      policyIdsByInstance:
                        additionalProperties:
                          maxLength: 255
                          type: string
                        description: instanceId → policyId mapping persisted after deploy. Hydrated into the wizard on resume to enable cleanup of stale policies when services are removed.
                        type: object
                      provider:
                        description: Cloud provider.
                        enum:
                          - aws
                          - azure
                          - gcp
                        type: string
                      services:
                        description: Service IDs covered by this deployment.
                        items:
                          type: string
                        maxItems: 1000
                        type: array
                      serviceVars:
                        additionalProperties:
                          additionalProperties:
                            nullable: true
                          type: object
                        description: Per-service config keyed by instance ID. Each value is the ServiceVars object from the Service Settings step.
                        type: object
                      status:
                        description: Deployment status.
                        enum:
                          - pending
                          - deploying
                          - succeeded
                          - failed
                        type: string
                      statusMessage:
                        description: Error context when status is failed.
                        type: string
                    required:
                      - id
                      - provider
                      - mechanisms
                      - services
                      - status
                      - attemptCount
                required:
                  - item
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
        '404':
          content:
            application/json:
              examples:
                notFoundResponseExample:
                  description: The requested cloud onboarding deployment does not exist
                  value:
                    error: Not Found
                    message: Saved object [fleet-cloud-onboarding-deployment/unknown-id] not found
                    statusCode: 404
              schema:
                additionalProperties: false
                type: object
                properties:
                  message:
                    type: string
                required:
                  - message
          description: Not Found
      summary: Get cloud onboarding deployment
      tags:
        - Fleet cloud onboarding deployments
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
    put:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb put">put</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/cloud_onboarding_deployments/{id}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Update a cloud onboarding deployment by ID.<br/><br/>[Required authorization] Route required privileges: fleet-agent-policies-all OR integrations-all.
      operationId: put-fleet-cloud-onboarding-deployments-id
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: The saved object ID of the cloud onboarding deployment.
          in: path
          name: id
          required: true
          schema:
            maxLength: 255
            type: string
      requestBody:
        content:
          application/json:
            examples:
              putCloudOnboardingDeploymentRequestExample:
                description: Update a cloud onboarding deployment after the CFN stack has been submitted
                value:
                  deploymentId: arn:aws:cloudformation:us-east-1:123456789012:stack/elastic-aws-onboarding/aaa-bbb-ccc
                  deploymentName: elastic-aws-onboarding
                  status: deploying
            schema:
              additionalProperties: false
              type: object
              properties:
                agentPolicyIds:
                  description: Agent policy IDs for agent_based deployments. Single-element for new-policy deploys; multiple for existing-policy deploys targeting several policies.
                  items:
                    maxLength: 255
                    type: string
                  maxItems: 1000
                  type: array
                apiKeyId:
                  maxLength: 255
                  type: string
                attemptCount:
                  description: Incremented by callers performing a retry.
                  minimum: 1
                  type: number
                authMethod:
                  description: Authentication method. Refreshed on each successful deploy so a credential-method change between deploys is reflected on resume.
                  enum:
                    - identity_federation
                    - static_keys
                    - temporary_keys
                    - shared_credentials
                    - assume_role
                    - null
                  nullable: true
                  type: string
                connectorId:
                  maxLength: 255
                  nullable: true
                  type: string
                deploymentId:
                  description: CFN stack ARN (or equivalent); provided by the client after manual deployment.
                  maxLength: 2048
                  type: string
                deploymentName:
                  maxLength: 255
                  type: string
                ecfStacks:
                  description: ECF CloudFormation stacks to record for this deployment.
                  items:
                    additionalProperties: false
                    type: object
                    properties:
                      family:
                        description: ECF template family.
                        enum:
                          - unified
                          - otel
                          - crowdstrike
                        type: string
                      stackName:
                        description: CloudFormation stack name (128-char AWS limit).
                        maxLength: 128
                        minLength: 1
                        type: string
                      templateVersion:
                        description: ECF semantic version resolved at launch time, e.g. "1.10.0".
                        maxLength: 32
                        minLength: 1
                        type: string
                    required:
                      - family
                      - stackName
                      - templateVersion
                  maxItems: 10
                  type: array
                mechanisms:
                  description: Delivery mechanisms active in this deployment. Replaces the stored mechanisms array.
                  items:
                    description: 'Delivery mechanism: managed_integration, ecf, or agent_based.'
                    enum:
                      - managed_integration
                      - ecf
                      - agent_based
                    type: string
                  maxItems: 10
                  type: array
                packagePolicyIds:
                  description: Package policy IDs created for this deployment (managed_integration and agent_based).
                  items:
                    maxLength: 255
                    type: string
                  maxItems: 1000
                  type: array
                policyIdsByInstance:
                  additionalProperties:
                    maxLength: 255
                    type: string
                  type: object
                services:
                  description: Current service set for this deployment. Refreshed on each successful deploy so resume after an incremental service addition restores all deployed services.
                  items:
                    maxLength: 256
                    minLength: 1
                    type: string
                  maxItems: 1000
                  minItems: 1
                  type: array
                serviceVars:
                  additionalProperties:
                    additionalProperties:
                      nullable: true
                    type: object
                  description: Per-service config keyed by instance ID.
                  type: object
                status:
                  description: Deployment status.
                  enum:
                    - pending
                    - deploying
                    - succeeded
                    - failed
                  type: string
                statusMessage:
                  description: Error context; set when transitioning to failed.
                  maxLength: 1000
                  type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                putCloudOnboardingDeploymentExample:
                  description: The updated cloud onboarding deployment
                  value:
                    item:
                      agentPolicyIds:
                        - agent-policy-id-1
                      attemptCount: 1
                      connectorId: cloud-connector-id-1
                      deploymentId: arn:aws:cloudformation:us-east-1:123456789012:stack/elastic-aws-onboarding/aaa-bbb-ccc
                      deploymentName: elastic-aws-onboarding
                      id: onboarding-deployment-id-1
                      mechanisms:
                        - managed_integration
                      packagePolicyIds:
                        - package-policy-id-1
                      provider: aws
                      services:
                        - cloudwatch_metrics
                        - cloudtrail
                      status: deploying
              schema:
                additionalProperties: false
                type: object
                properties:
                  item:
                    additionalProperties: false
                    type: object
                    properties:
                      agentPolicyIds:
                        description: Agent policy IDs for agent_based deployments. Single-element for new-policy deploys; multiple for existing-policy deploys targeting several policies.
                        items:
                          type: string
                        maxItems: 1000
                        type: array
                      apiKeyId:
                        description: Elasticsearch API key ID for push mechanisms (ecf). Set by the backend; used for key rotation/revocation.
                        type: string
                      attemptCount:
                        description: Number of deployment attempts, including the current one.
                        minimum: 1
                        type: number
                      authMethod:
                        description: |-
                          Authentication method. Allowed values depend on the delivery mechanism:

                          - managed_integration: identity_federation | static_keys
                          - agent_based: static_keys (direct_access_keys) | temporary_keys | shared_credentials | assume_role
                        enum:
                          - identity_federation
                          - static_keys
                          - temporary_keys
                          - shared_credentials
                          - assume_role
                        type: string
                      connectorId:
                        description: ID of the fleet-cloud-connector this deployment belongs to. Absent for static-keys deployments.
                        type: string
                      dataFormat:
                        description: 'Data format: ecs or otel.'
                        enum:
                          - ecs
                          - otel
                        type: string
                      deploymentId:
                        description: Opaque deployment identifier; for AWS, the CFN stack ARN.
                        type: string
                      deploymentName:
                        description: Opaque deployment name; for AWS, the CFN stack name.
                        type: string
                      ecfStacks:
                        description: ECF CloudFormation stacks launched as part of this deployment. Written by the wizard after the user clicks Launch.
                        items:
                          additionalProperties: false
                          type: object
                          properties:
                            family:
                              description: ECF template family.
                              enum:
                                - unified
                                - otel
                                - crowdstrike
                              type: string
                            stackName:
                              description: CloudFormation stack name (128-char AWS limit).
                              maxLength: 128
                              minLength: 1
                              type: string
                            templateVersion:
                              description: ECF semantic version resolved at launch time, e.g. "1.10.0".
                              maxLength: 32
                              minLength: 1
                              type: string
                          required:
                            - family
                            - stackName
                            - templateVersion
                        maxItems: 10
                        type: array
                      globalRegion:
                        description: Global AWS region from the Service Settings step.
                        type: string
                      id:
                        type: string
                      mechanisms:
                        items:
                          description: 'Delivery mechanism: managed_integration, ecf, or agent_based.'
                          enum:
                            - managed_integration
                            - ecf
                            - agent_based
                          type: string
                        maxItems: 10
                        type: array
                      packagePolicyIds:
                        description: Package policy IDs created for this deployment (managed_integration and agent_based).
                        items:
                          type: string
                        maxItems: 1000
                        type: array
                      policyIdsByInstance:
                        additionalProperties:
                          maxLength: 255
                          type: string
                        description: instanceId → policyId mapping persisted after deploy. Hydrated into the wizard on resume to enable cleanup of stale policies when services are removed.
                        type: object
                      provider:
                        description: Cloud provider.
                        enum:
                          - aws
                          - azure
                          - gcp
                        type: string
                      services:
                        description: Service IDs covered by this deployment.
                        items:
                          type: string
                        maxItems: 1000
                        type: array
                      serviceVars:
                        additionalProperties:
                          additionalProperties:
                            nullable: true
                          type: object
                        description: Per-service config keyed by instance ID. Each value is the ServiceVars object from the Service Settings step.
                        type: object
                      status:
                        description: Deployment status.
                        enum:
                          - pending
                          - deploying
                          - succeeded
                          - failed
                        type: string
                      statusMessage:
                        description: Error context when status is failed.
                        type: string
                    required:
                      - id
                      - provider
                      - mechanisms
                      - services
                      - status
                      - attemptCount
                required:
                  - item
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
        '404':
          content:
            application/json:
              examples:
                notFoundResponseExample:
                  description: The requested cloud onboarding deployment does not exist
                  value:
                    error: Not Found
                    message: Saved object [fleet-cloud-onboarding-deployment/unknown-id] not found
                    statusCode: 404
              schema:
                additionalProperties: false
                type: object
                properties:
                  message:
                    type: string
                required:
                  - message
          description: Not Found
      summary: Update cloud onboarding deployment
      tags:
        - Fleet cloud onboarding deployments
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/cloud_onboarding_deployments/connector/{connectorId}:
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/cloud_onboarding_deployments/connector/{connectorId}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        List all cloud onboarding deployments for a given connector ID.<br/><br/>[Required authorization] Route required privileges: fleet-agent-policies-read OR integrations-read.
      operationId: get-fleet-cloud-onboarding-deployments-connector-connectorid
      parameters:
        - description: The fleet-cloud-connector ID to list deployments for.
          in: path
          name: connectorId
          required: true
          schema:
            maxLength: 255
            minLength: 1
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                getCloudOnboardingDeploymentsByConnectorIdExample:
                  description: List of cloud onboarding deployments for a connector
                  value:
                    items:
                      - agentPolicyIds:
                          - agent-policy-id-1
                        attemptCount: 1
                        connectorId: cloud-connector-id-1
                        deploymentId: arn:aws:cloudformation:us-east-1:123456789012:stack/elastic-aws-onboarding/aaa-bbb-ccc
                        deploymentName: elastic-aws-onboarding
                        id: onboarding-deployment-id-1
                        mechanisms:
                          - managed_integration
                        packagePolicyIds:
                          - package-policy-id-1
                        provider: aws
                        services:
                          - cloudwatch_metrics
                        status: succeeded
                      - attemptCount: 1
                        connectorId: cloud-connector-id-1
                        id: onboarding-deployment-id-2
                        mechanisms:
                          - managed_integration
                          - ecf
                        provider: aws
                        services:
                          - cloudfront_logs
                        serviceVars:
                          cloudfront_logs:
                            regions:
                              - us-east-1
                            s3_bucket_arn: arn:aws:s3:::my-cloudfront-logs-bucket
                        status: deploying
              schema:
                additionalProperties: false
                type: object
                properties:
                  items:
                    items:
                      additionalProperties: false
                      type: object
                      properties:
                        agentPolicyIds:
                          description: Agent policy IDs for agent_based deployments. Single-element for new-policy deploys; multiple for existing-policy deploys targeting several policies.
                          items:
                            type: string
                          maxItems: 1000
                          type: array
                        apiKeyId:
                          description: Elasticsearch API key ID for push mechanisms (ecf). Set by the backend; used for key rotation/revocation.
                          type: string
                        attemptCount:
                          description: Number of deployment attempts, including the current one.
                          minimum: 1
                          type: number
                        authMethod:
                          description: |-
                            Authentication method. Allowed values depend on the delivery mechanism:

                            - managed_integration: identity_federation | static_keys
                            - agent_based: static_keys (direct_access_keys) | temporary_keys | shared_credentials | assume_role
                          enum:
                            - identity_federation
                            - static_keys
                            - temporary_keys
                            - shared_credentials
                            - assume_role
                          type: string
                        connectorId:
                          description: ID of the fleet-cloud-connector this deployment belongs to. Absent for static-keys deployments.
                          type: string
                        dataFormat:
                          description: 'Data format: ecs or otel.'
                          enum:
                            - ecs
                            - otel
                          type: string
                        deploymentId:
                          description: Opaque deployment identifier; for AWS, the CFN stack ARN.
                          type: string
                        deploymentName:
                          description: Opaque deployment name; for AWS, the CFN stack name.
                          type: string
                        ecfStacks:
                          description: ECF CloudFormation stacks launched as part of this deployment. Written by the wizard after the user clicks Launch.
                          items:
                            additionalProperties: false
                            type: object
                            properties:
                              family:
                                description: ECF template family.
                                enum:
                                  - unified
                                  - otel
                                  - crowdstrike
                                type: string
                              stackName:
                                description: CloudFormation stack name (128-char AWS limit).
                                maxLength: 128
                                minLength: 1
                                type: string
                              templateVersion:
                                description: ECF semantic version resolved at launch time, e.g. "1.10.0".
                                maxLength: 32
                                minLength: 1
                                type: string
                            required:
                              - family
                              - stackName
                              - templateVersion
                          maxItems: 10
                          type: array
                        globalRegion:
                          description: Global AWS region from the Service Settings step.
                          type: string
                        id:
                          type: string
                        mechanisms:
                          items:
                            description: 'Delivery mechanism: managed_integration, ecf, or agent_based.'
                            enum:
                              - managed_integration
                              - ecf
                              - agent_based
                            type: string
                          maxItems: 10
                          type: array
                        packagePolicyIds:
                          description: Package policy IDs created for this deployment (managed_integration and agent_based).
                          items:
                            type: string
                          maxItems: 1000
                          type: array
                        policyIdsByInstance:
                          additionalProperties:
                            maxLength: 255
                            type: string
                          description: instanceId → policyId mapping persisted after deploy. Hydrated into the wizard on resume to enable cleanup of stale policies when services are removed.
                          type: object
                        provider:
                          description: Cloud provider.
                          enum:
                            - aws
                            - azure
                            - gcp
                          type: string
                        services:
                          description: Service IDs covered by this deployment.
                          items:
                            type: string
                          maxItems: 1000
                          type: array
                        serviceVars:
                          additionalProperties:
                            additionalProperties:
                              nullable: true
                            type: object
                          description: Per-service config keyed by instance ID. Each value is the ServiceVars object from the Service Settings step.
                          type: object
                        status:
                          description: Deployment status.
                          enum:
                            - pending
                            - deploying
                            - succeeded
                            - failed
                          type: string
                        statusMessage:
                          description: Error context when status is failed.
                          type: string
                      required:
                        - id
                        - provider
                        - mechanisms
                        - services
                        - status
                        - attemptCount
                    maxItems: 100
                    type: array
                required:
                  - items
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
      summary: Get cloud onboarding deployments by connector ID
      tags:
        - Fleet cloud onboarding deployments
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/data_streams:
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/data_streams</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        List all Fleet-managed data streams with metadata including package, namespace, size, and last activity.<br/><br/>[Required authorization] Route required privileges: fleet-agents-all AND fleet-agent-policies-all AND fleet-settings-all.
      operationId: get-fleet-data-streams
      parameters: []
      responses:
        '200':
          content:
            application/json:
              examples:
                getDataStreamsExample:
                  description: List of Fleet-managed data streams
                  value:
                    data_streams:
                      - dashboards:
                          - id: nginx-overview
                            title: Nginx Overview
                        dataset: nginx.access
                        index: logs-nginx.access-default
                        last_activity_ms: 1700000000000
                        namespace: default
                        package: nginx
                        package_version: 1.20.0
                        serviceDetails: null
                        size_in_bytes: 1048576
                        size_in_bytes_formatted: 1mb
                        type: logs
                      - dashboards: []
                        dataset: system.cpu
                        index: metrics-system.cpu-default
                        last_activity_ms: 1699999000000
                        namespace: default
                        package: system
                        package_version: 1.38.0
                        serviceDetails: null
                        size_in_bytes: 524288
                        size_in_bytes_formatted: 512kb
                        type: metrics
              schema:
                additionalProperties: false
                type: object
                properties:
                  data_streams:
                    items:
                      additionalProperties: false
                      type: object
                      properties:
                        dashboards:
                          items:
                            additionalProperties: false
                            type: object
                            properties:
                              id:
                                type: string
                              title:
                                type: string
                            required:
                              - id
                              - title
                          maxItems: 10000
                          type: array
                        dataset:
                          type: string
                        index:
                          type: string
                        last_activity_ms:
                          type: number
                        namespace:
                          type: string
                        package:
                          type: string
                        package_version:
                          type: string
                        serviceDetails:
                          additionalProperties: false
                          default: null
                          nullable: true
                          type: object
                          properties:
                            environment:
                              type: string
                            serviceName:
                              type: string
                          required:
                            - environment
                            - serviceName
                        size_in_bytes:
                          type: number
                        size_in_bytes_formatted:
                          anyOf:
                            - type: number
                            - type: string
                        type:
                          type: string
                      required:
                        - index
                        - dataset
                        - namespace
                        - type
                        - package
                        - package_version
                        - last_activity_ms
                        - size_in_bytes
                        - size_in_bytes_formatted
                        - dashboards
                    maxItems: 10000
                    type: array
                required:
                  - data_streams
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
      summary: Get data streams
      tags:
        - Data streams
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/data_streams/data:
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/data_streams/data</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Check whether one or more data stream index patterns contain any documents indexed at or after the given start time.<br/><br/>[Required authorization] Route required privileges: fleet-read.
      operationId: get-fleet-data-streams-data
      parameters:
        - description: A comma-separated list of data stream index patterns to check. Each pattern must be of the form `logs-<dataset>-<namespace>` or `metrics-<dataset>-<namespace>`, where `<namespace>` is `*` or a concrete namespace.
          in: query
          name: dataStreams
          required: true
          schema:
            maxLength: 4096
            type: string
        - description: An ISO 8601 timestamp. Only documents with an `@timestamp` at or after this time are considered.
          in: query
          name: start
          required: true
          schema:
            maxLength: 64
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                getDataStreamsHasDataExample:
                  description: One entry per requested index pattern
                  value:
                    results:
                      logs-aws.cloudtrail-*: true
                      metrics-aws.ec2-*: false
              schema:
                additionalProperties: false
                type: object
                properties:
                  results:
                    additionalProperties:
                      type: boolean
                    description: One entry per requested index pattern. `true` when the pattern matched at least one document, `false` when it matched none or the pattern resolved to no index.
                    type: object
                required:
                  - results
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                getDataStreamsHasDataInvalidPatternExample:
                  description: A requested pattern is not a supported data stream wildcard
                  value:
                    error: Bad Request
                    message: 'Invalid index pattern: ".security-7"'
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad request
      summary: Check if data streams have data
      tags:
        - Data streams
      x-state: Generally available; added in 9.6.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/enrollment_api_keys:
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/enrollment_api_keys</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        List all enrollment API keys.<br/><br/>[Required authorization] Route required privileges: fleet-agents-all OR fleet-setup.
      operationId: get-fleet-enrollment-api-keys
      parameters:
        - description: Page number
          in: query
          name: page
          required: false
          schema:
            default: 1
            type: number
        - description: Number of results per page
          in: query
          name: perPage
          required: false
          schema:
            default: 20
            type: number
        - description: A KQL query string to filter results
          in: query
          name: kuery
          required: false
          schema:
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                getEnrollmentApiKeysExample:
                  description: List of enrollment API keys
                  value:
                    items:
                      - active: true
                        api_key: api-key-value-1
                        api_key_id: api-key-id-1
                        created_at: '2024-01-01T00:00:00.000Z'
                        id: key-id-1
                        name: Default policy enrollment key
                        policy_id: policy-id-1
                    list:
                      - active: true
                        api_key: api-key-value-1
                        api_key_id: api-key-id-1
                        created_at: '2024-01-01T00:00:00.000Z'
                        id: key-id-1
                        name: Default policy enrollment key
                        policy_id: policy-id-1
                    page: 1
                    perPage: 20
                    total: 1
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_get_enrollment_api_keys_response'
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
      summary: Get enrollment API keys
      tags:
        - Fleet enrollment API keys
      x-metaTags:
        - content: Kibana
          name: product_name
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/enrollment_api_keys</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Create an enrollment API key for a given agent policy.<br/><br/>[Required authorization] Route required privileges: fleet-agents-all.
      operationId: post-fleet-enrollment-api-keys
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
      requestBody:
        content:
          application/json:
            examples:
              postEnrollmentApiKeyRequestExample:
                description: Create an enrollment API key for an agent policy
                value:
                  expiration: '2025-01-01T00:00:00.000Z'
                  name: My enrollment key
                  policy_id: policy-id-1
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_new_enrollment_api_key'
      responses:
        '200':
          content:
            application/json:
              examples:
                postEnrollmentApiKeyExample:
                  description: The created enrollment API key
                  value:
                    action: created
                    item:
                      active: true
                      api_key: api-key-value-1
                      api_key_id: api-key-id-1
                      created_at: '2024-01-01T00:00:00.000Z'
                      id: key-id-1
                      name: My enrollment key
                      policy_id: policy-id-1
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_create_enrollment_api_key_response'
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
      summary: Create an enrollment API key
      tags:
        - Fleet enrollment API keys
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/enrollment_api_keys/_bulk_delete:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/enrollment_api_keys/_bulk_delete</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Revoke or delete multiple enrollment API keys.<br/><br/>[Required authorization] Route required privileges: fleet-agents-all.
      operationId: post-fleet-enrollment-api-keys-bulk-delete
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
      requestBody:
        content:
          application/json:
            examples:
              bulkDeleteByIdsExample:
                description: Bulk delete enrollment API keys by IDs
                value:
                  forceDelete: true
                  tokenIds:
                    - token-id-1
                    - token-id-2
              bulkDeleteByKueryExample:
                description: Bulk delete enrollment API keys by KQL query
                value:
                  forceDelete: false
                  kuery: policy_id:"policy-id-1"
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_bulk_delete_enrollment_api_keys_request'
      responses:
        '200':
          content:
            application/json:
              examples:
                bulkDeleteEnrollmentApiKeysExample:
                  description: The enrollment API keys were successfully processed
                  value:
                    action: deleted
                    count: 2
                    errorCount: 0
                    successCount: 2
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_bulk_delete_enrollment_api_keys_response'
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: Either tokenIds or kuery must be provided
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
      summary: Bulk revoke or delete enrollment API keys
      tags:
        - Fleet enrollment API keys
      x-state: Generally available; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/enrollment_api_keys/{keyId}:
    delete:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb delete">delete</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/enrollment_api_keys/{keyId}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Revoke or delete an enrollment API key by ID. Use `forceDelete=true` to remove the document.<br/><br/>[Required authorization] Route required privileges: fleet-agents-all.
      operationId: delete-fleet-enrollment-api-keys-keyid
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: The ID of the enrollment API key
          in: path
          name: keyId
          required: true
          schema:
            type: string
        - description: When false (default), invalidate the API key and mark the token as inactive. When true, also delete the token document.
          in: query
          name: forceDelete
          required: false
          schema:
            default: false
            type: boolean
        - description: When true, allow deletion of hidden enrollment tokens (managed/agentless policies). Defaults to false.
          in: query
          name: includeHidden
          required: false
          schema:
            default: false
            type: boolean
      responses:
        '200':
          content:
            application/json:
              examples:
                deleteEnrollmentApiKeyExample:
                  description: The enrollment API key was successfully revoked
                  value:
                    action: deleted
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_delete_enrollment_api_key_response'
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
        '404':
          content:
            application/json:
              examples:
                notFoundExample:
                  description: No enrollment API key was found with the given ID
                  value:
                    error: Not Found
                    message: EnrollmentAPIKey key-id-1 not found
                    statusCode: 404
          description: Not Found
      summary: Revoke or delete an enrollment API key
      tags:
        - Fleet enrollment API keys
      x-metaTags:
        - content: Kibana
          name: product_name
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/enrollment_api_keys/{keyId}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Get an enrollment API key by ID.<br/><br/>[Required authorization] Route required privileges: fleet-agents-all OR fleet-setup.
      operationId: get-fleet-enrollment-api-keys-keyid
      parameters:
        - description: The ID of the enrollment API key
          in: path
          name: keyId
          required: true
          schema:
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                getEnrollmentApiKeyExample:
                  description: An enrollment API key
                  value:
                    item:
                      active: true
                      api_key: api-key-value-1
                      api_key_id: api-key-id-1
                      created_at: '2024-01-01T00:00:00.000Z'
                      id: key-id-1
                      name: Default policy enrollment key
                      policy_id: policy-id-1
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_enrollment_api_key_response'
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
        '404':
          content:
            application/json:
              examples:
                notFoundExample:
                  description: No enrollment API key was found with the given ID
                  value:
                    error: Not Found
                    message: EnrollmentAPIKey key-id-1 not found
                    statusCode: 404
          description: Not Found
      summary: Get an enrollment API key
      tags:
        - Fleet enrollment API keys
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/epm/bulk_assets:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/epm/bulk_assets</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Retrieve multiple Kibana saved object assets by their IDs and types.<br/><br/>[Required authorization] Route required privileges: integrations-read OR fleet-setup OR fleet-all.
      operationId: post-fleet-epm-bulk-assets
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
      requestBody:
        content:
          application/json:
            examples:
              postBulkGetAssetsRequestExample:
                description: Retrieve multiple assets by their IDs and types
                value:
                  assetIds:
                    - id: dashboard-id-1
                      type: dashboard
                    - id: index-pattern-id-1
                      type: index_pattern
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_get_bulk_assets_request'
      responses:
        '200':
          content:
            application/json:
              examples:
                postBulkGetAssetsExample:
                  description: Requested assets
                  value:
                    items:
                      - appLink: /app/dashboards#/view/dashboard-id-1
                        attributes:
                          title: My Dashboard
                        id: dashboard-id-1
                        type: dashboard
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_get_bulk_assets_response'
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
      summary: Bulk get assets
      tags:
        - Elastic Package Manager (EPM)
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/epm/categories:
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/epm/categories</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Get a list of integration categories.<br/><br/>[Required authorization] Route required privileges: integrations-read OR fleet-setup OR fleet-all.
      operationId: get-fleet-epm-categories
      parameters:
        - description: When true, include prerelease packages in the results
          in: query
          name: prerelease
          required: false
          schema:
            type: boolean
        - description: When true, include categories that only contain policy templates
          in: query
          name: include_policy_templates
          required: false
          schema:
            type: boolean
      responses:
        '200':
          content:
            application/json:
              examples:
                getCategoriesExample:
                  description: List of integration categories
                  value:
                    items:
                      - count: 42
                        id: security
                        title: Security
                      - count: 38
                        id: observability
                        title: Observability
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_get_categories_response'
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
      summary: Get package categories
      tags:
        - Elastic Package Manager (EPM)
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/epm/custom_integrations:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/epm/custom_integrations</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Create a new custom integration package with user-defined data streams.<br/><br/>[Required authorization] Route required privileges: integrations-all AND fleet-agent-policies-all.
      operationId: post-fleet-epm-custom-integrations
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
      requestBody:
        content:
          application/json:
            examples:
              postCreateCustomIntegrationRequestExample:
                description: Create a new custom integration
                value:
                  datasets:
                    - name: my_custom_logs.access
                      type: logs
                  integrationName: my_custom_logs
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_create_custom_integration_request'
      responses:
        '200':
          content:
            application/json:
              examples:
                postCreateCustomIntegrationExample:
                  description: Custom integration successfully created
                  value:
                    _meta:
                      install_source: custom
                    items:
                      - id: my_custom_logs-logs-my_custom_logs.access
                        type: index_template
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_install_package_response'
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
      summary: Create a custom integration
      tags:
        - Elastic Package Manager (EPM)
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/epm/custom_integrations/{pkgName}:
    put:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb put">put</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/epm/custom_integrations/{pkgName}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Update the datasets of an existing custom integration package.<br/><br/>[Required authorization] Route required privileges: fleet-settings-all AND integrations-all.
      operationId: put-fleet-epm-custom-integrations-pkgname
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: Package name
          in: path
          name: pkgName
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            examples:
              putUpdateCustomIntegrationRequestExample:
                description: Update a custom integration
                value:
                  datasets:
                    - name: my_custom_logs.access
                      type: logs
                  integrationName: my_custom_logs
            schema:
              additionalProperties: false
              type: object
              properties:
                categories:
                  items:
                    type: string
                  maxItems: 10
                  type: array
                readMeData:
                  type: string
              required:
                - readMeData
      responses:
        '200':
          content:
            application/json:
              examples:
                putUpdateCustomIntegrationExample:
                  description: Custom integration successfully updated
                  value: {}
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
      summary: Update a custom integration
      tags:
        - Elastic Package Manager (EPM)
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/epm/data_streams:
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/epm/data_streams</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Get a list of data streams created by installed integration packages.<br/><br/>[Required authorization] Route required privileges: integrations-read OR fleet-setup OR fleet-all.
      operationId: get-fleet-epm-data-streams
      parameters:
        - description: Filter by data stream type
          in: query
          name: type
          required: false
          schema:
            enum:
              - logs
              - metrics
              - traces
              - synthetics
              - profiles
            type: string
        - description: Filter data streams by dataset name
          in: query
          name: datasetQuery
          required: false
          schema:
            type: string
        - description: Sort order, ascending or descending
          in: query
          name: sortOrder
          required: false
          schema:
            default: asc
            enum:
              - asc
              - desc
            type: string
        - description: When true, only return data streams that are not associated with a package
          in: query
          name: uncategorisedOnly
          required: false
          schema:
            default: false
            type: boolean
      responses:
        '200':
          content:
            application/json:
              examples:
                getDataStreamsExample:
                  description: List of data streams from installed packages
                  value:
                    data_streams:
                      - ilm_policy: logs-default
                        index_template: logs-system.syslog
                        name: logs-system.syslog-default
                        package: system
                        package_version: 1.55.0
                        title: System syslog logs
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_get_data_streams_response'
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
      summary: Get data streams
      tags:
        - Data streams
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/epm/packages:
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/epm/packages</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Get a list of integration packages available in the registry.<br/><br/>[Required authorization] Route required privileges: integrations-read OR fleet-setup OR fleet-all.
      operationId: get-fleet-epm-packages
      parameters:
        - description: Filter packages by category
          in: query
          name: category
          required: false
          schema:
            type: string
        - description: When true, include prerelease packages in the results
          in: query
          name: prerelease
          required: false
          schema:
            type: boolean
        - description: When true, exclude the install status from the response
          in: query
          name: excludeInstallStatus
          required: false
          schema:
            type: boolean
        - description: When true, include the number of package policies per package
          in: query
          name: withPackagePoliciesCount
          required: false
          schema:
            type: boolean
      responses:
        '200':
          content:
            application/json:
              examples:
                getPackagesExample:
                  description: List of available integration packages
                  value:
                    items:
                      - categories:
                          - cloud
                        description: Collect logs and metrics from Amazon Web Services
                        id: aws
                        name: aws
                        status: not_installed
                        title: AWS
                        version: 2.10.0
                    searchExcluded: 0
                    total: 1
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_get_packages_response'
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
      summary: Get packages
      tags:
        - Elastic Package Manager (EPM)
      x-metaTags:
        - content: Kibana
          name: product_name
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/epm/packages</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Install a package by uploading a .zip or .tar.gz archive (max 100MB).

        Archives that contain Kibana assets requiring additional privileges are subject to a preflight authorization check before the package is installed. Privileges are checked in every space the package will be installed into.

        The following asset types require the corresponding Kibana API privilege:

        - `security_rule`: `rules-all`
        - `security_rule` with type `machine_learning`: `rules-all` and `ml:canCreateJob`
        - `security_ai_prompt`: `elasticAssistant`

        If any required privilege is missing, the request returns 403 and no assets are written. To learn more, refer to [Upload an integration to Kibana](https://www.elastic.co/docs/extend/integrations/upload-new-integration).<br/><br/>[Required authorization] Route required privileges: integrations-all AND fleet-agent-policies-all.
      operationId: post-fleet-epm-packages
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: When true, ignore mapping update errors during installation
          in: query
          name: ignoreMappingUpdateErrors
          required: false
          schema:
            default: false
            type: boolean
        - description: When true, skip data stream rollover after installation
          in: query
          name: skipDataStreamRollover
          required: false
          schema:
            default: false
            type: boolean
      requestBody:
        content:
          application/gzip:
            examples:
              postInstallByUploadRequestExample:
                description: Upload a .zip or .tar.gz package archive (max 100MB)
                value: <binary package archive>
          application/gzip; application/zip:
            examples:
              postInstallByUploadRequestExample:
                description: Upload a .zip or .tar.gz package archive (max 100MB)
                value: <binary package archive>
            schema:
              format: binary
              type: string
      responses:
        '200':
          content:
            application/gzip; application/zip:
              examples:
                postInstallByUploadExample:
                  description: Package successfully installed from upload
                  value:
                    _meta:
                      install_source: upload
                    items:
                      - id: my-custom-package-logs-default
                        type: index_template
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_install_package_response'
            application/json:
              examples:
                postInstallByUploadExample:
                  description: Package successfully installed from upload
                  value:
                    _meta:
                      install_source: upload
                    items:
                      - id: my-custom-package-logs-default
                        type: index_template
          description: Successful response
        '400':
          content:
            application/gzip; application/zip:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
          description: Bad Request
        '403':
          content:
            application/gzip; application/zip:
              examples:
                insufficientPrivilegesExample:
                  description: Caller lacks a privilege required by a gated asset type in the archive
                  summary: Missing rules-all privilege
                  value:
                    error: Forbidden
                    message: Insufficient privileges to upload this package
                    statusCode: 403
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
            application/json:
              examples:
                insufficientPrivilegesExample:
                  description: Caller lacks a privilege required by a gated asset type in the archive
                  summary: Missing rules-all privilege
                  value:
                    error: Forbidden
                    message: Insufficient privileges to upload this package
                    statusCode: 403
          description: Forbidden. The caller lacks a Kibana API privilege required by an asset in the archive. No assets are written.
      summary: Install a package by upload
      tags:
        - Elastic Package Manager (EPM)
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/epm/packages/_bulk:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/epm/packages/_bulk</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Install multiple packages from the Elastic Package Registry in a single request.<br/><br/>[Required authorization] Route required privileges: integrations-all AND fleet-agent-policies-all.
      operationId: post-fleet-epm-packages-bulk
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: When true, allow installing prerelease versions
          in: query
          name: prerelease
          required: false
          schema:
            type: boolean
      requestBody:
        content:
          application/json:
            examples:
              postBulkInstallPackagesRequestExample:
                description: Install multiple packages from the registry
                value:
                  packages:
                    - system
                    - aws
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_bulk_install_packages_from_registry_request'
      responses:
        '200':
          content:
            application/json:
              examples:
                postBulkInstallPackagesExample:
                  description: Bulk install results
                  value:
                    items:
                      - name: system
                        result:
                          assets: []
                          status: installed
                      - name: aws
                        result:
                          assets: []
                          status: installed
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_bulk_install_packages_from_registry_response'
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
      summary: Bulk install packages
      tags:
        - Elastic Package Manager (EPM)
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/epm/packages/_bulk_namespace_customization:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/epm/packages/_bulk_namespace_customization</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Enable or disable namespace-level index template customization for a list of packages in one call. Use this for IaC-style declarative flows.<br/><br/>[Required authorization] Route required privileges: integrations-all AND fleet-agent-policies-all.
      operationId: post-fleet-epm-packages-bulk-namespace-customization
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
      requestBody:
        content:
          application/json:
            examples:
              bulkNamespaceCustomizationRequest:
                value:
                  disable:
                    - dev
                  enable:
                    - production
                    - staging
                  packages:
                    - system
                    - nginx
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_bulk_namespace_customization_request'
      responses:
        '200':
          content:
            application/json:
              examples:
                successResponse:
                  value:
                    items:
                      - name: system
                        namespace_customization_enabled_for:
                          - production
                          - staging
                        success: true
                      - error: Package nginx is not installed
                        name: nginx
                        success: false
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_bulk_namespace_customization_response'
          description: 'OK: A successful request.'
        '400':
          content:
            application/json:
              examples:
                badRequestResponse:
                  value:
                    error: Bad Request
                    message: 'Namespaces must not appear in both enable and disable: production'
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: A bad request.
      summary: Bulk enable/disable namespace-level customization for packages
      tags:
        - Elastic Package Manager (EPM)
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/epm/packages/_bulk_rollback:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/epm/packages/_bulk_rollback</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Rollback multiple packages to their previous versions.<br/><br/>[Required authorization] Route required privileges: integrations-all AND fleet-agent-policies-all.
      operationId: post-fleet-epm-packages-bulk-rollback
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
      requestBody:
        content:
          application/json:
            examples:
              bulkRollbackRequest:
                value:
                  packages:
                    - name: system
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_bulk_rollback_packages_request'
      responses:
        '200':
          content:
            application/json:
              examples:
                successResponse:
                  value:
                    taskId: taskId
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_bulk_rollback_packages_response'
          description: 'OK: A successful request.'
        '400':
          content:
            application/json:
              examples:
                badRequestResponse:
                  value:
                    message: Bad Request
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: A bad request.
      summary: Bulk rollback packages
      tags:
        - Elastic Package Manager (EPM)
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/epm/packages/_bulk_rollback/{taskId}:
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/epm/packages/_bulk_rollback/{taskId}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Get the status and results of a bulk package rollback operation.<br/><br/>[Required authorization] Route required privileges: integrations-all AND fleet-agent-policies-all.
      operationId: get-fleet-epm-packages-bulk-rollback-taskid
      parameters:
        - description: Task ID of the bulk operation
          in: path
          name: taskId
          required: true
          schema:
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                successResponse:
                  value:
                    status: success
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_get_one_bulk_operation_packages_response'
          description: 'OK: A successful request.'
        '400':
          content:
            application/json:
              examples:
                badRequestResponse:
                  value:
                    message: Bad Request
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: A bad request.
      summary: Get Bulk rollback packages details
      tags:
        - Elastic Package Manager (EPM)
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/epm/packages/_bulk_uninstall:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/epm/packages/_bulk_uninstall</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Uninstall multiple packages in a single operation.<br/><br/>[Required authorization] Route required privileges: integrations-all AND fleet-agent-policies-all.
      operationId: post-fleet-epm-packages-bulk-uninstall
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
      requestBody:
        content:
          application/json:
            examples:
              postBulkUninstallPackagesRequestExample:
                description: Uninstall multiple packages
                value:
                  packages:
                    - name: aws
                    - name: gcp
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_bulk_uninstall_packages_request'
      responses:
        '200':
          content:
            application/json:
              examples:
                postBulkUninstallPackagesExample:
                  description: Bulk uninstall task initiated
                  value:
                    taskId: task-id-1
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_bulk_upgrade_packages_response'
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
      summary: Bulk uninstall packages
      tags:
        - Elastic Package Manager (EPM)
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/epm/packages/_bulk_uninstall/{taskId}:
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/epm/packages/_bulk_uninstall/{taskId}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Get the status and results of a bulk package uninstall operation.<br/><br/>[Required authorization] Route required privileges: integrations-all AND fleet-agent-policies-all.
      operationId: get-fleet-epm-packages-bulk-uninstall-taskid
      parameters:
        - description: Task ID of the bulk operation
          in: path
          name: taskId
          required: true
          schema:
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                getBulkOperationDetailsExample:
                  description: Details of the bulk operation task
                  value:
                    packages:
                      - name: system
                        result: installed
                      - name: elastic_agent
                        result: installed
                    status: success
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_get_one_bulk_operation_packages_response'
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
      summary: Get Bulk uninstall packages details
      tags:
        - Elastic Package Manager (EPM)
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/epm/packages/_bulk_upgrade:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/epm/packages/_bulk_upgrade</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Upgrade multiple packages to their latest versions.<br/><br/>[Required authorization] Route required privileges: integrations-all AND fleet-agent-policies-all.
      operationId: post-fleet-epm-packages-bulk-upgrade
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
      requestBody:
        content:
          application/json:
            examples:
              postBulkUpgradePackagesRequestExample:
                description: Upgrade multiple packages to their latest versions
                value:
                  packages:
                    - name: system
                    - name: elastic_agent
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_bulk_upgrade_packages_request'
      responses:
        '200':
          content:
            application/json:
              examples:
                postBulkUpgradePackagesExample:
                  description: Bulk upgrade task initiated
                  value:
                    taskId: task-id-1
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_bulk_upgrade_packages_response'
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
      summary: Bulk upgrade packages
      tags:
        - Elastic Package Manager (EPM)
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/epm/packages/_bulk_upgrade/{taskId}:
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/epm/packages/_bulk_upgrade/{taskId}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Get the status and results of a bulk package upgrade operation.<br/><br/>[Required authorization] Route required privileges: integrations-all AND fleet-agent-policies-all.
      operationId: get-fleet-epm-packages-bulk-upgrade-taskid
      parameters:
        - description: Task ID of the bulk operation
          in: path
          name: taskId
          required: true
          schema:
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                getBulkOperationDetailsExample:
                  description: Details of the bulk operation task
                  value:
                    packages:
                      - name: system
                        result: installed
                      - name: elastic_agent
                        result: installed
                    status: success
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_get_one_bulk_operation_packages_response'
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
      summary: Get Bulk upgrade packages details
      tags:
        - Elastic Package Manager (EPM)
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/epm/packages/{pkgName}:
    delete:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb delete">delete</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/epm/packages/{pkgName}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Uninstall a package and remove all its assets.<br/><br/>[Required authorization] Route required privileges: integrations-all AND fleet-agent-policies-all.
      operationId: delete-fleet-epm-packages-pkgname
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: Package name
          in: path
          name: pkgName
          required: true
          schema:
            maxLength: 255
            type: string
        - description: When true, delete the package even if it has active package policies
          in: query
          name: force
          required: false
          schema:
            type: boolean
      responses:
        '200':
          content:
            application/json:
              examples:
                deletePackageExample:
                  description: Package successfully deleted
                  value:
                    items:
                      - id: aws-logs-aws.cloudwatch_logs-default
                        type: index_template
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_delete_package_response'
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
      summary: Delete a package
      tags:
        - Elastic Package Manager (EPM)
      x-metaTags:
        - content: Kibana
          name: product_name
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/epm/packages/{pkgName}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Get information about a package by name, returning the latest installed or available version.
      operationId: get-fleet-epm-packages-pkgname
      parameters:
        - description: Package name
          in: path
          name: pkgName
          required: true
          schema:
            maxLength: 255
            type: string
        - description: When true, returns the package even if the signature cannot be verified
          in: query
          name: ignoreUnverified
          required: false
          schema:
            type: boolean
        - description: When true, include prerelease versions
          in: query
          name: prerelease
          required: false
          schema:
            type: boolean
        - description: When true, return the full package info including assets
          in: query
          name: full
          required: false
          schema:
            type: boolean
        - description: When true, include package metadata such as whether it has package policies
          in: query
          name: withMetadata
          required: false
          schema:
            default: false
            type: boolean
      responses:
        '200':
          content:
            application/json:
              examples:
                getPackageInfoExample:
                  description: Package details and installation status
                  value:
                    item:
                      assets:
                        kibana:
                          dashboard: []
                          index_pattern: []
                      categories:
                        - cloud
                      description: Collect logs and metrics from Amazon Web Services
                      name: aws
                      status: installed
                      title: AWS
                      version: 2.10.0
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_get_info_response'
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
      summary: Get a package
      tags:
        - Elastic Package Manager (EPM)
      x-metaTags:
        - content: Kibana
          name: product_name
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/epm/packages/{pkgName}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Install the latest version of a package from the Elastic Package Registry.<br/><br/>[Required authorization] Route required privileges: integrations-all AND fleet-agent-policies-all.
      operationId: post-fleet-epm-packages-pkgname
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: Package name
          in: path
          name: pkgName
          required: true
          schema:
            maxLength: 255
            type: string
        - description: When true, allow installing prerelease versions
          in: query
          name: prerelease
          required: false
          schema:
            type: boolean
        - description: When true, ignore mapping update errors during installation
          in: query
          name: ignoreMappingUpdateErrors
          required: false
          schema:
            default: false
            type: boolean
        - description: When true, skip data stream rollover after installation
          in: query
          name: skipDataStreamRollover
          required: false
          schema:
            default: false
            type: boolean
        - description: Skip dependency validation when installing a package with dependencies
          in: query
          name: skipDependencyCheck
          required: false
          schema:
            default: false
            type: boolean
      requestBody:
        content:
          application/json:
            examples:
              postInstallPackageRequestExample:
                description: Install a package, optionally ignoring constraints
                value:
                  ignore_constraints: false
            schema:
              allOf:
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_install_package_from_registry_request'
              default: null
              nullable: true
      responses:
        '200':
          content:
            application/json:
              examples:
                postInstallPackageExample:
                  description: Package successfully installed
                  value:
                    _meta:
                      install_source: registry
                    items:
                      - id: aws-logs-aws.cloudwatch_logs-default
                        type: index_template
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_install_package_response'
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
      summary: Install a package from the registry
      tags:
        - Elastic Package Manager (EPM)
      x-metaTags:
        - content: Kibana
          name: product_name
    put:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb put">put</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/epm/packages/{pkgName}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Update settings for a package, such as whether policies are kept up to date automatically.<br/><br/>[Required authorization] Route required privileges: integrations-all AND fleet-agent-policies-all.
      operationId: put-fleet-epm-packages-pkgname
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: Package name
          in: path
          name: pkgName
          required: true
          schema:
            maxLength: 255
            type: string
      requestBody:
        content:
          application/json:
            examples:
              putUpdatePackageNamespaceCustomizationExample:
                description: Enable namespace-level customization for the `production` and `staging` namespaces
                value:
                  namespace_customization_enabled_for:
                    - production
                    - staging
              putUpdatePackageRequestExample:
                description: Update keep_policies_up_to_date setting for a package
                value:
                  keepPoliciesUpToDate: true
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_update_package_request'
      responses:
        '200':
          content:
            application/json:
              examples:
                putUpdatePackageExample:
                  description: Updated package settings
                  value:
                    item:
                      keepPoliciesUpToDate: true
                      name: aws
                      version: 2.10.0
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_update_package_response'
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
      summary: Update package settings
      tags:
        - Elastic Package Manager (EPM)
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/epm/packages/{pkgName}/{pkgVersion}:
    delete:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb delete">delete</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/epm/packages/{pkgName}/{pkgVersion}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Uninstall a specific version of a package and remove all its assets.<br/><br/>[Required authorization] Route required privileges: integrations-all AND fleet-agent-policies-all.
      operationId: delete-fleet-epm-packages-pkgname-pkgversion
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: Package name
          in: path
          name: pkgName
          required: true
          schema:
            type: string
        - description: Package version
          in: path
          name: pkgVersion
          required: true
          schema:
            type: string
        - description: When true, delete the package even if it has active package policies
          in: query
          name: force
          required: false
          schema:
            type: boolean
      responses:
        '200':
          content:
            application/json:
              examples:
                deletePackageExample:
                  description: Package successfully deleted
                  value:
                    items:
                      - id: aws-logs-aws.cloudwatch_logs-default
                        type: index_template
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_delete_package_response'
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
      summary: Delete a package
      tags:
        - Elastic Package Manager (EPM)
      x-metaTags:
        - content: Kibana
          name: product_name
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/epm/packages/{pkgName}/{pkgVersion}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Get information about a specific version of a package.
      operationId: get-fleet-epm-packages-pkgname-pkgversion
      parameters:
        - description: Package name
          in: path
          name: pkgName
          required: true
          schema:
            type: string
        - description: Package version
          in: path
          name: pkgVersion
          required: true
          schema:
            type: string
        - description: When true, returns the package even if the signature cannot be verified
          in: query
          name: ignoreUnverified
          required: false
          schema:
            type: boolean
        - description: When true, include prerelease versions
          in: query
          name: prerelease
          required: false
          schema:
            type: boolean
        - description: When true, return the full package info including assets
          in: query
          name: full
          required: false
          schema:
            type: boolean
        - description: When true, include package metadata such as whether it has package policies
          in: query
          name: withMetadata
          required: false
          schema:
            default: false
            type: boolean
      responses:
        '200':
          content:
            application/json:
              examples:
                getPackageInfoExample:
                  description: Package details and installation status
                  value:
                    item:
                      assets:
                        kibana:
                          dashboard: []
                          index_pattern: []
                      categories:
                        - cloud
                      description: Collect logs and metrics from Amazon Web Services
                      name: aws
                      status: installed
                      title: AWS
                      version: 2.10.0
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_get_info_response'
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
      summary: Get a package
      tags:
        - Elastic Package Manager (EPM)
      x-metaTags:
        - content: Kibana
          name: product_name
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/epm/packages/{pkgName}/{pkgVersion}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Install a specific version of a package from the Elastic Package Registry.<br/><br/>[Required authorization] Route required privileges: integrations-all AND fleet-agent-policies-all.
      operationId: post-fleet-epm-packages-pkgname-pkgversion
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: Package name
          in: path
          name: pkgName
          required: true
          schema:
            type: string
        - description: Package version
          in: path
          name: pkgVersion
          required: true
          schema:
            type: string
        - description: When true, allow installing prerelease versions
          in: query
          name: prerelease
          required: false
          schema:
            type: boolean
        - description: When true, ignore mapping update errors during installation
          in: query
          name: ignoreMappingUpdateErrors
          required: false
          schema:
            default: false
            type: boolean
        - description: When true, skip data stream rollover after installation
          in: query
          name: skipDataStreamRollover
          required: false
          schema:
            default: false
            type: boolean
        - description: Skip dependency validation when installing a package with dependencies
          in: query
          name: skipDependencyCheck
          required: false
          schema:
            default: false
            type: boolean
      requestBody:
        content:
          application/json:
            examples:
              postInstallPackageRequestExample:
                description: Install a package, optionally ignoring constraints
                value:
                  ignore_constraints: false
            schema:
              allOf:
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_install_package_from_registry_request'
              default: null
              nullable: true
      responses:
        '200':
          content:
            application/json:
              examples:
                postInstallPackageExample:
                  description: Package successfully installed
                  value:
                    _meta:
                      install_source: registry
                    items:
                      - id: aws-logs-aws.cloudwatch_logs-default
                        type: index_template
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_install_package_response'
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
      summary: Install a package from the registry
      tags:
        - Elastic Package Manager (EPM)
      x-metaTags:
        - content: Kibana
          name: product_name
    put:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb put">put</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/epm/packages/{pkgName}/{pkgVersion}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Update settings for a specific version of a package.<br/><br/>[Required authorization] Route required privileges: integrations-all AND fleet-agent-policies-all.
      operationId: put-fleet-epm-packages-pkgname-pkgversion
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: Package name
          in: path
          name: pkgName
          required: true
          schema:
            type: string
        - description: Package version
          in: path
          name: pkgVersion
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            examples:
              putUpdatePackageNamespaceCustomizationExample:
                description: Enable namespace-level customization for the `production` and `staging` namespaces
                value:
                  namespace_customization_enabled_for:
                    - production
                    - staging
              putUpdatePackageRequestExample:
                description: Update keep_policies_up_to_date setting for a package
                value:
                  keepPoliciesUpToDate: true
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_update_package_request'
      responses:
        '200':
          content:
            application/json:
              examples:
                putUpdatePackageExample:
                  description: Updated package settings
                  value:
                    item:
                      keepPoliciesUpToDate: true
                      name: aws
                      version: 2.10.0
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_update_package_response'
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
      summary: Update package settings
      tags:
        - Elastic Package Manager (EPM)
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/epm/packages/{pkgName}/{pkgVersion}/{filePath}:
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/epm/packages/{pkgName}/{pkgVersion}/{filePath}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Get the contents of a specific file from a package.<br/><br/>[Required authorization] Route required privileges: integrations-read OR fleet-setup OR fleet-all.
      operationId: get-fleet-epm-packages-pkgname-pkgversion-filepath
      parameters:
        - description: Package name
          in: path
          name: pkgName
          required: true
          schema:
            type: string
        - description: Package version
          in: path
          name: pkgVersion
          required: true
          schema:
            type: string
        - description: File path within the package
          in: path
          name: filePath
          required: true
          schema:
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                getPackageFileExample:
                  description: The content of the requested package file
                  value: <file content>
              schema: {}
          description: Successful response — returns the file content
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
      summary: Get a package file
      tags:
        - Elastic Package Manager (EPM)
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/epm/packages/{pkgName}/{pkgVersion}/datastream_assets:
    delete:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb delete">delete</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/epm/packages/{pkgName}/{pkgVersion}/datastream_assets</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Delete datastream assets for a specific package, by data stream name.<br/><br/>[Required authorization] Route required privileges: integrations-all AND fleet-agent-policies-all.
      operationId: delete-fleet-epm-packages-pkgname-pkgversion-datastream-assets
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: Package name
          in: path
          name: pkgName
          required: true
          schema:
            type: string
        - description: Package version
          in: path
          name: pkgVersion
          required: true
          schema:
            type: string
        - description: The ID of the package policy
          in: query
          name: packagePolicyId
          required: true
          schema:
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                deletePackageDatastreamAssetsExample:
                  description: Package datastream assets successfully deleted
                  value:
                    items:
                      - id: logs-my_package.access-default
                        type: index_template
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_delete_package_datastream_assets_response'
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
      summary: Delete assets for a package
      tags:
        - Elastic Package Manager (EPM)
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/epm/packages/{pkgName}/{pkgVersion}/dependencies:
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/epm/packages/{pkgName}/{pkgVersion}/dependencies</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Get the list of packages that a specific package depends on.<br/><br/>[Required authorization] Route required privileges: integrations-read OR fleet-setup OR fleet-all.
      operationId: get-fleet-epm-packages-pkgname-pkgversion-dependencies
      parameters:
        - description: Package name
          in: path
          name: pkgName
          required: true
          schema:
            type: string
        - description: Package version
          in: path
          name: pkgVersion
          required: true
          schema:
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                dependenciesResponse:
                  value:
                    items:
                      - name: aws
                        title: AWS
                        version: ^2.0.0
                      - name: system
                        title: System
                        version: ^1.0.0
                noDependenciesResponse:
                  value:
                    items: []
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_get_dependencies_response'
          description: 'OK: A successful request.'
        '400':
          content:
            application/json:
              examples:
                packageNotFoundResponse:
                  value:
                    message: '[my-package-1.0.0] package not found in registry'
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: A bad request.
      summary: Get package dependencies
      tags:
        - Elastic Package Manager (EPM)
      x-state: Generally available; added in 9.4.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/epm/packages/{pkgName}/{pkgVersion}/kibana_assets:
    delete:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb delete">delete</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/epm/packages/{pkgName}/{pkgVersion}/kibana_assets</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Delete Kibana assets (dashboards, visualizations, etc.) for a specific package version.<br/><br/>[Required authorization] Route required privileges: integrations-all AND fleet-agent-policies-all.
      operationId: delete-fleet-epm-packages-pkgname-pkgversion-kibana-assets
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: Package name
          in: path
          name: pkgName
          required: true
          schema:
            type: string
        - description: Package version
          in: path
          name: pkgVersion
          required: true
          schema:
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                deleteKibanaAssetsExample:
                  description: Kibana assets successfully deleted
                  value:
                    items:
                      - id: dashboard-id-1
                        type: dashboard
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_install_kibana_assets_response'
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
      summary: Delete Kibana assets for a package
      tags:
        - Elastic Package Manager (EPM)
      x-metaTags:
        - content: Kibana
          name: product_name
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/epm/packages/{pkgName}/{pkgVersion}/kibana_assets</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Install Kibana assets (dashboards, visualizations, etc.) for a specific package version.<br/><br/>[Required authorization] Route required privileges: integrations-all AND fleet-agent-policies-all.
      operationId: post-fleet-epm-packages-pkgname-pkgversion-kibana-assets
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: Package name
          in: path
          name: pkgName
          required: true
          schema:
            type: string
        - description: Package version
          in: path
          name: pkgVersion
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            examples:
              postInstallKibanaAssetsRequestExample:
                description: Install Kibana assets for a specific package version
                value: {}
            schema:
              allOf:
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_install_kibana_assets_request'
              default: null
              nullable: true
      responses:
        '200':
          content:
            application/json:
              examples:
                postInstallKibanaAssetsExample:
                  description: Kibana assets successfully installed
                  value:
                    items:
                      - id: dashboard-id-1
                        type: dashboard
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_install_kibana_assets_response'
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
      summary: Install Kibana assets for a package
      tags:
        - Elastic Package Manager (EPM)
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/epm/packages/{pkgName}/{pkgVersion}/rule_assets:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/epm/packages/{pkgName}/{pkgVersion}/rule_assets</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Install Kibana alert rule assets for a specific package version.<br/><br/>[Required authorization] Route required privileges: integrations-all AND fleet-agent-policies-all.
      operationId: post-fleet-epm-packages-pkgname-pkgversion-rule-assets
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: Package name
          in: path
          name: pkgName
          required: true
          schema:
            type: string
        - description: Package version
          in: path
          name: pkgVersion
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            examples:
              postInstallRuleAssetsRequestExample:
                description: Install alert rule assets for a specific package version
                value: {}
            schema:
              allOf:
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_install_rule_assets_request'
              default: null
              nullable: true
      responses:
        '200':
          content:
            application/json:
              examples:
                postInstallRuleAssetsExample:
                  description: Rule assets successfully installed
                  value:
                    items:
                      - id: rule-asset-id-1
                        type: security_rule
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_install_kibana_assets_response'
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
      summary: Install Kibana alert rule for a package
      tags:
        - Elastic Package Manager (EPM)
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/epm/packages/{pkgName}/{pkgVersion}/transforms/authorize:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/epm/packages/{pkgName}/{pkgVersion}/transforms/authorize</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Reauthorize Elasticsearch transforms installed by a package with secondary authorization headers.
      operationId: post-fleet-epm-packages-pkgname-pkgversion-transforms-authorize
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: Package name
          in: path
          name: pkgName
          required: true
          schema:
            type: string
        - description: Package version
          in: path
          name: pkgVersion
          required: true
          schema:
            type: string
        - description: When true, allow prerelease versions
          in: query
          name: prerelease
          required: false
          schema:
            type: boolean
      requestBody:
        content:
          application/json:
            examples:
              postReauthorizeTransformsRequestExample:
                description: Reauthorize transforms for a package
                value:
                  transforms:
                    - destinations:
                        - index: logs-transform-dest
                      transformId: logs-transform-1
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_reauthorize_transform_request'
      responses:
        '200':
          content:
            application/json:
              examples:
                postReauthorizeTransformsExample:
                  description: Transforms successfully reauthorized
                  value:
                    - success: true
                      transformId: logs-transform-1
              schema:
                items:
                  additionalProperties: false
                  type: object
                  properties:
                    error:
                      nullable: true
                    success:
                      type: boolean
                    transformId:
                      type: string
                  required:
                    - transformId
                    - success
                    - error
                maxItems: 10000
                type: array
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
      summary: Authorize transforms
      tags:
        - Elastic Package Manager (EPM)
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/epm/packages/{pkgName}/review_upgrade:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/epm/packages/{pkgName}/review_upgrade</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Review and accept or reject a pending policy upgrade for a package that contains deprecations.<br/><br/>[Required authorization] Route required privileges: integrations-all AND fleet-agent-policies-all.
      operationId: post-fleet-epm-packages-pkgname-review-upgrade
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: Package name to review upgrade for
          in: path
          name: pkgName
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            examples:
              acceptUpgrade:
                value:
                  action: accept
                  target_version: 2.0.0
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_review_upgrade_request'
      responses:
        '200':
          content:
            application/json:
              examples:
                successResponse:
                  value:
                    success: true
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_review_upgrade_response'
          description: 'OK: A successful request.'
        '400':
          content:
            application/json:
              examples:
                badRequestResponse:
                  value:
                    message: Bad Request
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: A bad request.
      summary: Review a pending policy upgrade for a package with deprecations
      tags:
        - Elastic Package Manager (EPM)
      x-state: Generally available; added in 9.4.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/epm/packages/{pkgName}/rollback:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/epm/packages/{pkgName}/rollback</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Rollback a package to its previously installed version.<br/><br/>[Required authorization] Route required privileges: integrations-all AND fleet-agent-policies-all.
      operationId: post-fleet-epm-packages-pkgname-rollback
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: Package name to roll back
          in: path
          name: pkgName
          required: true
          schema:
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                successResponse:
                  value:
                    success: true
                    version: 1.0.0
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_rollback_package_response'
          description: 'OK: A successful request.'
        '400':
          content:
            application/json:
              examples:
                badRequestResponse:
                  value:
                    message: Bad Request
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: A bad request.
      summary: Rollback a package to previous version
      tags:
        - Elastic Package Manager (EPM)
      x-state: Experimental; added in 9.1.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/epm/packages/{pkgName}/stats:
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/epm/packages/{pkgName}/stats</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Get usage statistics for a specific package, such as the number of agent policies using it.<br/><br/>[Required authorization] Route required privileges: integrations-read OR fleet-setup OR fleet-all.
      operationId: get-fleet-epm-packages-pkgname-stats
      parameters:
        - description: Package name
          in: path
          name: pkgName
          required: true
          schema:
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                getPackageStatsExample:
                  description: Usage stats for a specific package
                  value:
                    response:
                      agent_policy_count: 3
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_get_stats_response'
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
      summary: Get package stats
      tags:
        - Elastic Package Manager (EPM)
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/epm/packages/installed:
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/epm/packages/installed</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Get a list of all currently installed integration packages.<br/><br/>[Required authorization] Route required privileges: integrations-read OR fleet-setup OR fleet-all.
      operationId: get-fleet-epm-packages-installed
      parameters:
        - description: Filter by data stream type
          in: query
          name: dataStreamType
          required: false
          schema:
            enum:
              - logs
              - metrics
              - traces
              - synthetics
              - profiles
            type: string
        - description: When true, only return packages with active data streams
          in: query
          name: showOnlyActiveDataStreams
          required: false
          schema:
            type: boolean
        - description: Filter packages by name
          in: query
          name: nameQuery
          required: false
          schema:
            type: string
        - description: Sort values from the previous page for `search_after` pagination
          in: query
          name: searchAfter
          required: false
          schema:
            items:
              anyOf:
                - type: string
                - type: number
            maxItems: 10
            type: array
        - description: Number of results per page
          in: query
          name: perPage
          required: false
          schema:
            default: 15
            type: number
        - description: Sort order, ascending or descending
          in: query
          name: sortOrder
          required: false
          schema:
            default: asc
            enum:
              - asc
              - desc
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                getInstalledPackagesExample:
                  description: List of installed integration packages
                  value:
                    items:
                      - name: system
                        status: installed
                        title: System
                        version: 1.55.0
                      - name: elastic_agent
                        status: installed
                        title: Elastic Agent
                        version: 1.15.0
                    searchExcluded: 0
                    total: 2
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_get_installed_packages_response'
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
      summary: Get installed packages
      tags:
        - Elastic Package Manager (EPM)
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/epm/packages/limited:
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/epm/packages/limited</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Get the list of packages that cannot be uninstalled (e.g. elastic_agent, fleet_server).<br/><br/>[Required authorization] Route required privileges: integrations-read OR fleet-setup OR fleet-all.
      operationId: get-fleet-epm-packages-limited
      parameters: []
      responses:
        '200':
          content:
            application/json:
              examples:
                getLimitedPackagesExample:
                  description: List of packages that cannot be uninstalled
                  value:
                    items:
                      - elastic_agent
                      - fleet_server
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_get_limited_packages_response'
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
      summary: Get a limited package list
      tags:
        - Elastic Package Manager (EPM)
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/epm/templates/{pkgName}/{pkgVersion}/inputs:
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/epm/templates/{pkgName}/{pkgVersion}/inputs</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Get an inputs template for a package, used to pre-populate package policy forms.<br/><br/>[Required authorization] Route required privileges: integrations-read OR fleet-setup OR fleet-all.
      operationId: get-fleet-epm-templates-pkgname-pkgversion-inputs
      parameters:
        - description: Package name
          in: path
          name: pkgName
          required: true
          schema:
            type: string
        - description: Package version
          in: path
          name: pkgVersion
          required: true
          schema:
            type: string
        - description: 'Output format for the inputs template: json, yml, or yaml'
          in: query
          name: format
          required: false
          schema:
            default: json
            enum:
              - json
              - yml
              - yaml
            type: string
        - description: When true, allow prerelease versions
          in: query
          name: prerelease
          required: false
          schema:
            type: boolean
        - description: When true, return inputs even if the package signature cannot be verified
          in: query
          name: ignoreUnverified
          required: false
          schema:
            type: boolean
      responses:
        '200':
          content:
            application/json:
              examples:
                getInputsTemplateExample:
                  description: Inputs template for a package
                  value:
                    inputs:
                      - description: Collect logs from log files
                        title: Collect logs from files
                        type: logfile
                        vars:
                          - name: paths
                            required: true
                            title: Paths
                            type: text
              schema:
                anyOf:
                  - type: string
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_get_inputs_response'
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
      summary: Get an inputs template
      tags:
        - Elastic Package Manager (EPM)
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/epm/verification_key_id:
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/epm/verification_key_id</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Get the GPG key ID used to verify the signatures of packages from the Elastic Package Registry.<br/><br/>[Required authorization] Route required privileges: integrations-read OR fleet-setup OR fleet-all.
      operationId: get-fleet-epm-verification-key-id
      parameters: []
      responses:
        '200':
          content:
            application/json:
              examples:
                getVerificationKeyIdExample:
                  description: The GPG key ID used to verify package signatures
                  value:
                    id: D27D666CD88E42B4
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_get_verification_key_id_response'
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
      summary: Get a package signature verification key ID
      tags:
        - Elastic Package Manager (EPM)
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/fleet_server_hosts:
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/fleet_server_hosts</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        List all Fleet Server hosts.<br/><br/>[Required authorization] Route required privileges: fleet-agents-all OR fleet-settings-read.
      operationId: get-fleet-fleet-server-hosts
      parameters: []
      responses:
        '200':
          content:
            application/json:
              examples:
                getFleetServerHostsExample:
                  description: List of Fleet Server hosts
                  value:
                    items:
                      - host_urls:
                          - https://fleet-server.example.com:8220
                        id: fleet-server-host-id-1
                        is_default: true
                        is_preconfigured: false
                        name: Default Fleet Server
                    page: 1
                    perPage: 20
                    total: 1
              schema:
                additionalProperties: false
                type: object
                properties:
                  items:
                    items:
                      additionalProperties: false
                      type: object
                      properties:
                        allow_edit:
                          items:
                            maxLength: 100
                            type: string
                          maxItems: 100
                          type: array
                        host_urls:
                          items:
                            type: string
                          maxItems: 10
                          minItems: 1
                          type: array
                        id:
                          type: string
                        is_default:
                          default: false
                          type: boolean
                        is_internal:
                          type: boolean
                        is_preconfigured:
                          default: false
                          type: boolean
                        name:
                          type: string
                        proxy_id:
                          nullable: true
                          type: string
                        secrets:
                          additionalProperties: false
                          type: object
                          properties:
                            ssl:
                              additionalProperties: false
                              type: object
                              properties:
                                agent_key:
                                  anyOf:
                                    - additionalProperties: false
                                      type: object
                                      properties:
                                        id:
                                          type: string
                                      required:
                                        - id
                                    - type: string
                                  nullable: true
                                es_key:
                                  anyOf:
                                    - additionalProperties: false
                                      type: object
                                      properties:
                                        id:
                                          type: string
                                      required:
                                        - id
                                    - type: string
                                  nullable: true
                                key:
                                  anyOf:
                                    - additionalProperties: false
                                      type: object
                                      properties:
                                        id:
                                          type: string
                                      required:
                                        - id
                                    - type: string
                                  nullable: true
                        ssl:
                          additionalProperties: false
                          nullable: true
                          type: object
                          properties:
                            agent_certificate:
                              type: string
                            agent_certificate_authorities:
                              items:
                                type: string
                              maxItems: 10
                              type: array
                            agent_key:
                              type: string
                            certificate:
                              type: string
                            certificate_authorities:
                              items:
                                type: string
                              maxItems: 10
                              type: array
                            client_auth:
                              enum:
                                - optional
                                - required
                                - none
                              type: string
                            es_certificate:
                              type: string
                            es_certificate_authorities:
                              items:
                                type: string
                              maxItems: 10
                              type: array
                            es_key:
                              type: string
                            key:
                              type: string
                      required:
                        - name
                        - host_urls
                        - id
                    maxItems: 10000
                    type: array
                  page:
                    type: number
                  perPage:
                    type: number
                  total:
                    type: number
                required:
                  - items
                  - total
                  - page
                  - perPage
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
      summary: Get Fleet Server hosts
      tags:
        - Fleet Server hosts
      x-metaTags:
        - content: Kibana
          name: product_name
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/fleet_server_hosts</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Create a new Fleet Server host.<br/><br/>[Required authorization] Route required privileges: fleet-settings-all.
      operationId: post-fleet-fleet-server-hosts
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
      requestBody:
        content:
          application/json:
            examples:
              postFleetServerHostRequestExample:
                description: Create a new Fleet Server host
                value:
                  host_urls:
                    - https://fleet-server.example.com:8220
                  is_default: false
                  name: My Fleet Server
            schema:
              additionalProperties: false
              type: object
              properties:
                allow_edit:
                  items:
                    maxLength: 100
                    type: string
                  maxItems: 100
                  type: array
                host_urls:
                  items:
                    type: string
                  maxItems: 10
                  minItems: 1
                  type: array
                id:
                  type: string
                is_default:
                  default: false
                  type: boolean
                is_internal:
                  type: boolean
                is_preconfigured:
                  default: false
                  type: boolean
                name:
                  type: string
                proxy_id:
                  nullable: true
                  type: string
                secrets:
                  additionalProperties: false
                  type: object
                  properties:
                    ssl:
                      additionalProperties: false
                      type: object
                      properties:
                        agent_key:
                          anyOf:
                            - additionalProperties: false
                              type: object
                              properties:
                                id:
                                  type: string
                              required:
                                - id
                            - type: string
                          nullable: true
                        es_key:
                          anyOf:
                            - additionalProperties: false
                              type: object
                              properties:
                                id:
                                  type: string
                              required:
                                - id
                            - type: string
                          nullable: true
                        key:
                          anyOf:
                            - additionalProperties: false
                              type: object
                              properties:
                                id:
                                  type: string
                              required:
                                - id
                            - type: string
                          nullable: true
                ssl:
                  additionalProperties: false
                  nullable: true
                  type: object
                  properties:
                    agent_certificate:
                      type: string
                    agent_certificate_authorities:
                      items:
                        type: string
                      maxItems: 10
                      type: array
                    agent_key:
                      type: string
                    certificate:
                      type: string
                    certificate_authorities:
                      items:
                        type: string
                      maxItems: 10
                      type: array
                    client_auth:
                      enum:
                        - optional
                        - required
                        - none
                      type: string
                    es_certificate:
                      type: string
                    es_certificate_authorities:
                      items:
                        type: string
                      maxItems: 10
                      type: array
                    es_key:
                      type: string
                    key:
                      type: string
              required:
                - name
                - host_urls
      responses:
        '200':
          content:
            application/json:
              examples:
                postFleetServerHostExample:
                  description: The created Fleet Server host
                  value:
                    item:
                      host_urls:
                        - https://fleet-server.example.com:8220
                      id: fleet-server-host-id-2
                      is_default: false
                      is_preconfigured: false
                      name: My Fleet Server
              schema:
                additionalProperties: false
                type: object
                properties:
                  item:
                    additionalProperties: false
                    type: object
                    properties:
                      allow_edit:
                        items:
                          maxLength: 100
                          type: string
                        maxItems: 100
                        type: array
                      host_urls:
                        items:
                          type: string
                        maxItems: 10
                        minItems: 1
                        type: array
                      id:
                        type: string
                      is_default:
                        default: false
                        type: boolean
                      is_internal:
                        type: boolean
                      is_preconfigured:
                        default: false
                        type: boolean
                      name:
                        type: string
                      proxy_id:
                        nullable: true
                        type: string
                      secrets:
                        additionalProperties: false
                        type: object
                        properties:
                          ssl:
                            additionalProperties: false
                            type: object
                            properties:
                              agent_key:
                                anyOf:
                                  - additionalProperties: false
                                    type: object
                                    properties:
                                      id:
                                        type: string
                                    required:
                                      - id
                                  - type: string
                                nullable: true
                              es_key:
                                anyOf:
                                  - additionalProperties: false
                                    type: object
                                    properties:
                                      id:
                                        type: string
                                    required:
                                      - id
                                  - type: string
                                nullable: true
                              key:
                                anyOf:
                                  - additionalProperties: false
                                    type: object
                                    properties:
                                      id:
                                        type: string
                                    required:
                                      - id
                                  - type: string
                                nullable: true
                      ssl:
                        additionalProperties: false
                        nullable: true
                        type: object
                        properties:
                          agent_certificate:
                            type: string
                          agent_certificate_authorities:
                            items:
                              type: string
                            maxItems: 10
                            type: array
                          agent_key:
                            type: string
                          certificate:
                            type: string
                          certificate_authorities:
                            items:
                              type: string
                            maxItems: 10
                            type: array
                          client_auth:
                            enum:
                              - optional
                              - required
                              - none
                            type: string
                          es_certificate:
                            type: string
                          es_certificate_authorities:
                            items:
                              type: string
                            maxItems: 10
                            type: array
                          es_key:
                            type: string
                          key:
                            type: string
                    required:
                      - name
                      - host_urls
                      - id
                required:
                  - item
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
      summary: Create a Fleet Server host
      tags:
        - Fleet Server hosts
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/fleet_server_hosts/{itemId}:
    delete:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb delete">delete</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/fleet_server_hosts/{itemId}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Delete a Fleet Server host by ID.<br/><br/>[Required authorization] Route required privileges: fleet-settings-all.
      operationId: delete-fleet-fleet-server-hosts-itemid
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: The ID of the Fleet Server host
          in: path
          name: itemId
          required: true
          schema:
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                deleteFleetServerHostExample:
                  description: The Fleet Server host was successfully deleted
                  value:
                    id: fleet-server-host-id-1
              schema:
                additionalProperties: false
                type: object
                properties:
                  id:
                    type: string
                required:
                  - id
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
        '404':
          content:
            application/json:
              examples:
                notFoundExample:
                  description: No Fleet Server host was found with the given ID
                  value:
                    error: Not Found
                    message: Fleet server fleet-server-host-id-1 not found
                    statusCode: 404
          description: Not Found
      summary: Delete a Fleet Server host
      tags:
        - Fleet Server hosts
      x-metaTags:
        - content: Kibana
          name: product_name
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/fleet_server_hosts/{itemId}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Get a Fleet Server host by ID.<br/><br/>[Required authorization] Route required privileges: fleet-settings-read.
      operationId: get-fleet-fleet-server-hosts-itemid
      parameters:
        - description: The ID of the Fleet Server host
          in: path
          name: itemId
          required: true
          schema:
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                getFleetServerHostExample:
                  description: A Fleet Server host
                  value:
                    item:
                      host_urls:
                        - https://fleet-server.example.com:8220
                      id: fleet-server-host-id-1
                      is_default: true
                      is_preconfigured: false
                      name: Default Fleet Server
              schema:
                additionalProperties: false
                type: object
                properties:
                  item:
                    additionalProperties: false
                    type: object
                    properties:
                      allow_edit:
                        items:
                          maxLength: 100
                          type: string
                        maxItems: 100
                        type: array
                      host_urls:
                        items:
                          type: string
                        maxItems: 10
                        minItems: 1
                        type: array
                      id:
                        type: string
                      is_default:
                        default: false
                        type: boolean
                      is_internal:
                        type: boolean
                      is_preconfigured:
                        default: false
                        type: boolean
                      name:
                        type: string
                      proxy_id:
                        nullable: true
                        type: string
                      secrets:
                        additionalProperties: false
                        type: object
                        properties:
                          ssl:
                            additionalProperties: false
                            type: object
                            properties:
                              agent_key:
                                anyOf:
                                  - additionalProperties: false
                                    type: object
                                    properties:
                                      id:
                                        type: string
                                    required:
                                      - id
                                  - type: string
                                nullable: true
                              es_key:
                                anyOf:
                                  - additionalProperties: false
                                    type: object
                                    properties:
                                      id:
                                        type: string
                                    required:
                                      - id
                                  - type: string
                                nullable: true
                              key:
                                anyOf:
                                  - additionalProperties: false
                                    type: object
                                    properties:
                                      id:
                                        type: string
                                    required:
                                      - id
                                  - type: string
                                nullable: true
                      ssl:
                        additionalProperties: false
                        nullable: true
                        type: object
                        properties:
                          agent_certificate:
                            type: string
                          agent_certificate_authorities:
                            items:
                              type: string
                            maxItems: 10
                            type: array
                          agent_key:
                            type: string
                          certificate:
                            type: string
                          certificate_authorities:
                            items:
                              type: string
                            maxItems: 10
                            type: array
                          client_auth:
                            enum:
                              - optional
                              - required
                              - none
                            type: string
                          es_certificate:
                            type: string
                          es_certificate_authorities:
                            items:
                              type: string
                            maxItems: 10
                            type: array
                          es_key:
                            type: string
                          key:
                            type: string
                    required:
                      - name
                      - host_urls
                      - id
                required:
                  - item
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
        '404':
          content:
            application/json:
              examples:
                notFoundExample:
                  description: No Fleet Server host was found with the given ID
                  value:
                    error: Not Found
                    message: Fleet server fleet-server-host-id-1 not found
                    statusCode: 404
          description: Not Found
      summary: Get a Fleet Server host
      tags:
        - Fleet Server hosts
      x-metaTags:
        - content: Kibana
          name: product_name
    put:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb put">put</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/fleet_server_hosts/{itemId}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Update a Fleet Server host by ID.<br/><br/>[Required authorization] Route required privileges: fleet-settings-all.
      operationId: put-fleet-fleet-server-hosts-itemid
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: The ID of the Fleet Server host
          in: path
          name: itemId
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            examples:
              putFleetServerHostRequestExample:
                description: Update a Fleet Server host
                value:
                  host_urls:
                    - https://updated-fleet-server.example.com:8220
                  is_default: false
                  name: Updated Fleet Server
            schema:
              additionalProperties: false
              type: object
              properties:
                allow_edit:
                  items:
                    maxLength: 100
                    type: string
                  maxItems: 100
                  type: array
                host_urls:
                  items:
                    type: string
                  maxItems: 10
                  minItems: 1
                  type: array
                is_default:
                  type: boolean
                is_internal:
                  type: boolean
                name:
                  type: string
                proxy_id:
                  default: null
                  nullable: true
                  type: string
                secrets:
                  additionalProperties: false
                  type: object
                  properties:
                    ssl:
                      additionalProperties: false
                      type: object
                      properties:
                        agent_key:
                          anyOf:
                            - additionalProperties: false
                              type: object
                              properties:
                                id:
                                  type: string
                              required:
                                - id
                            - type: string
                          nullable: true
                        es_key:
                          anyOf:
                            - additionalProperties: false
                              type: object
                              properties:
                                id:
                                  type: string
                              required:
                                - id
                            - type: string
                          nullable: true
                        key:
                          anyOf:
                            - additionalProperties: false
                              type: object
                              properties:
                                id:
                                  type: string
                              required:
                                - id
                            - type: string
                          nullable: true
                ssl:
                  additionalProperties: false
                  nullable: true
                  type: object
                  properties:
                    agent_certificate:
                      type: string
                    agent_certificate_authorities:
                      items:
                        type: string
                      maxItems: 10
                      type: array
                    agent_key:
                      type: string
                    certificate:
                      type: string
                    certificate_authorities:
                      items:
                        type: string
                      maxItems: 10
                      type: array
                    client_auth:
                      enum:
                        - optional
                        - required
                        - none
                      type: string
                    es_certificate:
                      type: string
                    es_certificate_authorities:
                      items:
                        type: string
                      maxItems: 10
                      type: array
                    es_key:
                      type: string
                    key:
                      type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                putFleetServerHostExample:
                  description: The updated Fleet Server host
                  value:
                    item:
                      host_urls:
                        - https://updated-fleet-server.example.com:8220
                      id: fleet-server-host-id-1
                      is_default: false
                      is_preconfigured: false
                      name: Updated Fleet Server
              schema:
                additionalProperties: false
                type: object
                properties:
                  item:
                    additionalProperties: false
                    type: object
                    properties:
                      allow_edit:
                        items:
                          maxLength: 100
                          type: string
                        maxItems: 100
                        type: array
                      host_urls:
                        items:
                          type: string
                        maxItems: 10
                        minItems: 1
                        type: array
                      id:
                        type: string
                      is_default:
                        default: false
                        type: boolean
                      is_internal:
                        type: boolean
                      is_preconfigured:
                        default: false
                        type: boolean
                      name:
                        type: string
                      proxy_id:
                        nullable: true
                        type: string
                      secrets:
                        additionalProperties: false
                        type: object
                        properties:
                          ssl:
                            additionalProperties: false
                            type: object
                            properties:
                              agent_key:
                                anyOf:
                                  - additionalProperties: false
                                    type: object
                                    properties:
                                      id:
                                        type: string
                                    required:
                                      - id
                                  - type: string
                                nullable: true
                              es_key:
                                anyOf:
                                  - additionalProperties: false
                                    type: object
                                    properties:
                                      id:
                                        type: string
                                    required:
                                      - id
                                  - type: string
                                nullable: true
                              key:
                                anyOf:
                                  - additionalProperties: false
                                    type: object
                                    properties:
                                      id:
                                        type: string
                                    required:
                                      - id
                                  - type: string
                                nullable: true
                      ssl:
                        additionalProperties: false
                        nullable: true
                        type: object
                        properties:
                          agent_certificate:
                            type: string
                          agent_certificate_authorities:
                            items:
                              type: string
                            maxItems: 10
                            type: array
                          agent_key:
                            type: string
                          certificate:
                            type: string
                          certificate_authorities:
                            items:
                              type: string
                            maxItems: 10
                            type: array
                          client_auth:
                            enum:
                              - optional
                              - required
                              - none
                            type: string
                          es_certificate:
                            type: string
                          es_certificate_authorities:
                            items:
                              type: string
                            maxItems: 10
                            type: array
                          es_key:
                            type: string
                          key:
                            type: string
                    required:
                      - name
                      - host_urls
                      - id
                required:
                  - item
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
        '404':
          content:
            application/json:
              examples:
                notFoundExample:
                  description: No Fleet Server host was found with the given ID
                  value:
                    error: Not Found
                    message: Fleet server fleet-server-host-id-1 not found
                    statusCode: 404
          description: Not Found
      summary: Update a Fleet Server host
      tags:
        - Fleet Server hosts
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/health_check:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/health_check</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Check the health status of a Fleet Server instance by its host ID. Returns the server status and name if available.<br/><br/>[Required authorization] Route required privileges: fleet-settings-all.
      operationId: post-fleet-health-check
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
      requestBody:
        content:
          application/json:
            examples:
              postHealthCheckRequestExample:
                description: Check the health of a Fleet Server instance by its host ID
                value:
                  id: fleet-server-host-id-1
            schema:
              additionalProperties: false
              type: object
              properties:
                id:
                  type: string
              required:
                - id
      responses:
        '200':
          content:
            application/json:
              examples:
                postHealthCheckHealthyExample:
                  description: Fleet Server is online and healthy
                  value:
                    name: fleet-server-1
                    status: ONLINE
                postHealthCheckUnreachableExample:
                  description: Fleet Server host is not reachable (request timed out or aborted)
                  value:
                    host_id: fleet-server-host-id-1
                    status: OFFLINE
              schema:
                additionalProperties: false
                type: object
                properties:
                  host_id:
                    type: string
                  name:
                    type: string
                  status:
                    type: string
                required:
                  - status
          description: Successful health check response
        '400':
          content:
            application/json:
              examples:
                badRequestExample:
                  description: The host ID exists but has no associated host URLs configured
                  value:
                    error: Bad Request
                    message: The requested host id fleet-server-host-id-1 does not have associated host urls.
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
        '404':
          content:
            application/json:
              examples:
                notFoundExample:
                  description: No Fleet Server host was found with the given ID
                  value:
                    error: Not Found
                    message: The requested host id fleet-server-host-id-1 does not exist.
                    statusCode: 404
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Not Found
      summary: Check Fleet Server health
      tags:
        - Fleet internals
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/kubernetes:
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/kubernetes</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Get the Kubernetes manifest for deploying Elastic Agent.<br/><br/>[Required authorization] Route required privileges: fleet-agent-policies-read OR fleet-setup.
      operationId: get-fleet-kubernetes
      parameters:
        - description: If true, returns the manifest as a downloadable file
          in: query
          name: download
          required: false
          schema:
            type: boolean
        - description: Fleet Server host URL to include in the manifest
          in: query
          name: fleetServer
          required: false
          schema:
            type: string
        - description: Enrollment token to include in the manifest
          in: query
          name: enrolToken
          required: false
          schema:
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                getK8sManifestExample:
                  description: The Kubernetes manifest for deploying Elastic Agent
                  value:
                    item: 'apiVersion: v1\nkind: ConfigMap\nmetadata:\n  name: agent-node-datastreams\n  namespace: kube-system\n'
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_get_k8s_manifest_response'
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
      summary: Get a full K8s agent manifest
      tags:
        - Elastic Agent policies
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/kubernetes/download:
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/kubernetes/download</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Download the Kubernetes manifest for deploying Elastic Agent.<br/><br/>[Required authorization] Route required privileges: fleet-agent-policies-read OR fleet-setup.
      operationId: get-fleet-kubernetes-download
      parameters:
        - description: If true, returns the manifest as a downloadable file
          in: query
          name: download
          required: false
          schema:
            type: boolean
        - description: Fleet Server host URL to include in the manifest
          in: query
          name: fleetServer
          required: false
          schema:
            type: string
        - description: Enrollment token to include in the manifest
          in: query
          name: enrolToken
          required: false
          schema:
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                getDownloadK8sManifestExample:
                  description: The Kubernetes manifest download
                  value: 'apiVersion: v1\nkind: ConfigMap\nmetadata:\n  name: agent-node-datastreams\n  namespace: kube-system\n'
              schema:
                type: string
          description: Successful response — returns the Kubernetes manifest as a YAML file download
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
        '404':
          content:
            application/json:
              examples:
                notFoundExample:
                  description: No manifest was found
                  value:
                    error: Not Found
                    message: Agent manifest not found
                    statusCode: 404
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Not Found
      summary: Download an agent manifest
      tags:
        - Elastic Agent policies
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/logstash_api_keys:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/logstash_api_keys</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Generate an API key for Logstash to use with a Fleet output.<br/><br/>[Required authorization] Route required privileges: fleet-settings-all.
      operationId: post-fleet-logstash-api-keys
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                postLogstashApiKeyExample:
                  description: The generated Logstash API key
                  value:
                    api_key: TiNAGG4BaaMdaH1tRfuU:KnR6yE41RrSowb0kQ0HWoA
              schema:
                additionalProperties: false
                type: object
                properties:
                  api_key:
                    type: string
                required:
                  - api_key
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
      summary: Generate a Logstash API key
      tags:
        - Fleet outputs
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/managed_integrations:
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/managed_integrations</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        List managed integrations
      operationId: get-fleet-managed-integrations
      parameters:
        - description: Page number. Defaults to `1`.
          in: query
          name: page
          required: false
          schema:
            type: number
        - description: Number of results per page. Defaults to `20`.
          in: query
          name: perPage
          required: false
          schema:
            type: number
        - description: Field to sort results by. Defaults to `updated_at`.
          in: query
          name: sortField
          required: false
          schema:
            maxLength: 256
            type: string
        - description: Sort order, ascending or descending. Defaults to `desc`.
          in: query
          name: sortOrder
          required: false
          schema:
            enum:
              - desc
              - asc
            type: string
        - description: 'A KQL query string to filter results. Filtering is restricted to the following fields: `name`, `namespace`, `package.name`.'
          in: query
          name: kuery
          required: false
          schema:
            maxLength: 4096
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                listManagedIntegrationsResponseExample:
                  description: Example response for listing managed integrations
                  value:
                    items:
                      - created_at: '2025-11-06T18:27:43.541Z'
                        created_by: test_user
                        description: test
                        id: d52a7812-5736-4fdc-aed8-72152afa1ffa
                        inputs:
                          ESS Billing-cel:
                            enabled: true
                            streams:
                              ess_billing.billing:
                                enabled: true
                              ess_billing.credits:
                                enabled: false
                            vars:
                              api_key:
                                id: QY1sWpoBbWcMW-edr0Ee
                                isSecretRef: true
                              organization_id: '1234'
                              url: https://billing.elastic-cloud.com
                        name: ess_billing-1
                        namespace: default
                        package:
                          name: ess_billing
                          title: Elasticsearch Service Billing
                          version: 1.6.0
                        updated_at: '2025-11-06T18:27:43.541Z'
                        updated_by: test_user
                      - cloud_connector:
                          cloud_connector_id: aws-connector-67890
                          enabled: true
                        created_at: '2025-11-06T18:27:43.541Z'
                        created_by: test_user
                        description: CSPM integration for AWS with cloud connector
                        id: aws-policy-12345
                        inputs:
                          cspm-cloudbeat/cis_aws:
                            enabled: true
                        name: cspm-aws-policy
                        namespace: default
                        package:
                          name: cloud_security_posture
                          title: Cloud Security Posture Management
                          version: 3.1.1
                        updated_at: '2025-11-06T18:27:43.541Z'
                        updated_by: test_user
                        vars:
                          deployment: aws
                          posture: cspm
                    page: 1
                    perPage: 20
                    total: 2
              schema:
                additionalProperties: false
                type: object
                properties:
                  items:
                    items:
                      $ref: '#/components/schemas/Kibana_HTTP_APIs_managed_integration'
                    maxItems: 10000
                    type: array
                  page:
                    type: number
                  perPage:
                    type: number
                  total:
                    type: number
                required:
                  - items
                  - total
                  - page
                  - perPage
          description: Indicates a successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
      summary: Get managed integrations
      tags:
        - Fleet managed integrations
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/managed_integrations</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Create a managed integration
      operationId: post-fleet-managed-integrations
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
      requestBody:
        content:
          application/json:
            examples:
              createManagedIntegrationsRequestExample:
                description: Example request to create a managed integration
                value:
                  description: test
                  inputs:
                    ESS Billing-cel:
                      enabled: true
                      streams:
                        ess_billing.billing:
                          enabled: true
                          vars:
                            hide_sensitive: true
                            http_client_timeout: 30s
                            lookbehind: 365
                            tags:
                              - forwarded
                              - billing
                        ess_billing.credits:
                          enabled: false
                      vars:
                        api_key: <REPLACE_WITH_YOUR_API_KEY>
                        organization_id: '1234'
                  name: ess_billing-1
                  namespace: default
                  package:
                    name: ess_billing
                    version: 1.6.0
              createManagedIntegrationsReuseAWSCloudConnectorExample:
                description: Example request to create a managed integration reusing an existing AWS cloud connector
                value:
                  cloud_connector:
                    cloud_connector_id: existing-aws-connector-id
                    enabled: true
                    target_csp: aws
                  description: CSPM integration for AWS reusing existing cloud connector
                  inputs:
                    cspm-cloudbeat/cis_aws:
                      enabled: true
                      streams:
                        cloud_security_posture.findings:
                          enabled: true
                          vars:
                            aws.account_type: organization-account
                            aws.credentials.type: cloud_connector
                            aws.supports_cloud_connectors: true
                            external_id:
                              id: ABCDEFGHIJKLMNOPQRST
                              isSecretRef: true
                            role_arn: arn:aws:iam::123456789012:role/TestRole
                      vars:
                        cloud_formation_template: https://console.aws.amazon.com/cloudformation/home#/stacks/quickcreate?templateURL=https://elastic-cspm-cft.s3.eu-central-1.amazonaws.com/cloudformation-cspm-ACCOUNT_TYPE-9.2.0.yml
                    cspm-cloudbeat/cis_azure:
                      enabled: false
                    cspm-cloudbeat/cis_gcp:
                      enabled: false
                  name: cspm-aws-reuse-policy
                  namespace: default
                  package:
                    name: cloud_security_posture
                    version: 3.1.1
                  vars:
                    deployment: aws
                    posture: cspm
              createManagedIntegrationsWithAWSCloudConnectorExample:
                description: Example request to create a managed integration with AWS cloud connector
                value:
                  cloud_connector:
                    enabled: true
                    target_csp: aws
                  description: CSPM integration for AWS with cloud connector
                  inputs:
                    cspm-cloudbeat/cis_aws:
                      enabled: true
                      streams:
                        cloud_security_posture.findings:
                          enabled: true
                          vars:
                            aws.account_type: organization-account
                            aws.credentials.type: cloud_connector
                            aws.supports_cloud_connectors: true
                            external_id:
                              id: ABCDEFGHIJKLMNOPQRST
                              isSecretRef: true
                            role_arn: arn:aws:iam::123456789012:role/TestRole
                      vars:
                        cloud_formation_template: https://console.aws.amazon.com/cloudformation/home#/stacks/quickcreate?templateURL=https://elastic-cspm-cft.s3.eu-central-1.amazonaws.com/cloudformation-cspm-ACCOUNT_TYPE-9.2.0.yml
                    cspm-cloudbeat/cis_azure:
                      enabled: false
                    cspm-cloudbeat/cis_gcp:
                      enabled: false
                  name: cspm-aws-policy
                  namespace: default
                  package:
                    name: cloud_security_posture
                    version: 3.1.1
                  vars:
                    deployment: aws
                    posture: cspm
              createManagedIntegrationsWithAzureCloudConnectorExample:
                description: Example request to create a managed integration with Azure cloud connector
                value:
                  cloud_connector:
                    enabled: true
                    target_csp: azure
                  description: CSPM integration for Azure with cloud connector
                  inputs:
                    cspm-cloudbeat/cis_aws:
                      enabled: false
                    cspm-cloudbeat/cis_azure:
                      enabled: true
                      streams:
                        cloud_security_posture.findings:
                          enabled: true
                          vars:
                            azure_credentials_cloud_connector_id:
                              type: text
                              value: existing-azure-credentials-connector-id
                            azure.account_type: organization-account
                            client_id:
                              id: client-secret-id
                              isSecretRef: true
                            tenant_id:
                              id: tenant-secret-id
                              isSecretRef: true
                    cspm-cloudbeat/cis_gcp:
                      enabled: false
                  name: cspm-azure-policy
                  namespace: default
                  package:
                    name: cloud_security_posture
                    version: 3.1.1
                  vars:
                    deployment: azure
                    posture: cspm
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_create_managed_integration_request'
      responses:
        '200':
          content:
            application/json:
              examples:
                createManagedIntegrationsResponseExample:
                  description: Example response for creating a managed integration
                  value:
                    item:
                      created_at: '2025-11-06T18:27:43.541Z'
                      created_by: test_user
                      description: test
                      id: d52a7812-5736-4fdc-aed8-72152afa1ffa
                      inputs:
                        ESS Billing-cel:
                          enabled: true
                          streams:
                            ess_billing.billing:
                              enabled: true
                              vars:
                                hide_sensitive: true
                                http_client_timeout: 30s
                                lookbehind: 365
                                tags:
                                  - forwarded
                                  - billing
                            ess_billing.credits:
                              enabled: false
                          vars:
                            api_key:
                              id: QY1sWpoBbWcMW-edr0Ee
                              isSecretRef: true
                            organization_id: '1234'
                            url: https://billing.elastic-cloud.com
                      name: ess_billing-1
                      namespace: default
                      package:
                        name: ess_billing
                        title: Elasticsearch Service Billing
                        version: 1.6.0
                      updated_at: '2025-11-06T18:27:43.541Z'
                      updated_by: test_user
                createManagedIntegrationsWithAWSCloudConnectorResponseExample:
                  description: Example response for AWS cloud connector integration
                  value:
                    item:
                      cloud_connector:
                        cloud_connector_id: aws-connector-67890
                        enabled: true
                      created_at: '2025-11-06T18:27:43.541Z'
                      created_by: test_user
                      description: CSPM integration for AWS with cloud connector
                      id: aws-policy-12345
                      inputs:
                        cspm-cloudbeat/cis_aws:
                          enabled: true
                          streams:
                            cloud_security_posture.findings:
                              enabled: true
                              vars:
                                aws.account_type: organization-account
                                aws.credentials.type: cloud_connector
                                external_id:
                                  id: secret-external-id-123
                                  isSecretRef: true
                                role_arn: arn:aws:iam::123456789012:role/TestRole
                          vars:
                            cloud_formation_template: https://console.aws.amazon.com/cloudformation/home#/stacks/quickcreate?templateURL=https://elastic-cspm-cft.s3.eu-central-1.amazonaws.com/cloudformation-cspm-ACCOUNT_TYPE-9.2.0.yml
                        cspm-cloudbeat/cis_azure:
                          enabled: false
                        cspm-cloudbeat/cis_gcp:
                          enabled: false
                      name: cspm-aws-policy
                      namespace: default
                      package:
                        name: cloud_security_posture
                        title: Cloud Security Posture Management
                        version: 3.1.1
                      updated_at: '2025-11-06T18:27:43.541Z'
                      updated_by: test_user
                      vars:
                        deployment: aws
                        posture: cspm
                createManagedIntegrationsWithAzureCloudConnectorResponseExample:
                  description: Example response for Azure cloud connector integration
                  value:
                    item:
                      cloud_connector:
                        cloud_connector_id: azure-connector-67890
                        enabled: true
                      created_at: '2025-11-06T18:27:43.541Z'
                      created_by: test_user
                      description: CSPM integration for Azure with cloud connector
                      id: azure-policy-12345
                      inputs:
                        cspm-cloudbeat/cis_aws:
                          enabled: false
                        cspm-cloudbeat/cis_azure:
                          enabled: true
                          streams:
                            cloud_security_posture.findings:
                              enabled: true
                              vars:
                                azure_credentials_cloud_connector_id:
                                  type: text
                                  value: existing-azure-credentials-connector-id
                                azure.account_type: organization-account
                                client_id:
                                  id: client-secret-id-456
                                  isSecretRef: true
                                tenant_id:
                                  id: tenant-secret-id-123
                                  isSecretRef: true
                        cspm-cloudbeat/cis_gcp:
                          enabled: false
                      name: cspm-azure-policy
                      namespace: default
                      package:
                        name: cloud_security_posture
                        title: Cloud Security Posture Management
                        version: 3.1.1
                      updated_at: '2025-11-06T18:27:43.541Z'
                      updated_by: test_user
                      vars:
                        deployment: azure
                        posture: cspm
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_managed_integration_response'
          description: Indicates a successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
        '409':
          content:
            application/json:
              examples:
                conflictErrorResponseExample:
                  description: Example of a conflict error response
                  value:
                    error: Conflict
                    message: An error message describing what went wrong
                    statusCode: 409
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Conflict
      summary: Create a managed integration
      tags:
        - Fleet managed integrations
      x-state: Experimental; added in 9.3.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/managed_integrations/_upgrade:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/managed_integrations/_upgrade</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Upgrade multiple managed integrations to their installed package version, migrating each package policy's config onto the new schema. Always returns 200 with a per-policy result array; a missing id, or an id that is not a managed integration, is reported as a per-item failure (`success: false` + `statusCode`) without failing the batch, so valid ids are still upgraded. A successful result means the policy's saved object was upgraded, while the agentless deployment is reconciled asynchronously in the background. Policies already at the installed version are a genuine no-op: they still report `success: true` (calls stay idempotent) but nothing is re-persisted or redeployed. Note: agent-policy-level agentless settings (resources, ownership tags) are not re-derived from the new package version — use the update (PUT) endpoint for those.
      operationId: post-fleet-managed-integrations-upgrade
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
      requestBody:
        content:
          application/json:
            examples:
              upgradeManagedIntegrationsRequestExample:
                description: Bulk upgrade managed integrations to their installed package version
                value:
                  policyIds:
                    - d52a7812-5736-4fdc-aed8-72152afa1ffa
                    - aws-policy-12345
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_bulk_upgrade_managed_integrations_request'
      responses:
        '200':
          content:
            application/json:
              examples:
                upgradeManagedIntegrationsPartialFailureResponseExample:
                  description: Example response where one managed integration upgraded and another id was missing or not a managed integration (the batch still returns 200)
                  value:
                    - id: d52a7812-5736-4fdc-aed8-72152afa1ffa
                      name: ess_billing-1
                      success: true
                    - body:
                        message: Agentless policy aws-policy-12345 not found
                      id: aws-policy-12345
                      statusCode: 404
                      success: false
                upgradeManagedIntegrationsResponseExample:
                  description: Example response where every policy was upgraded
                  value:
                    - id: d52a7812-5736-4fdc-aed8-72152afa1ffa
                      name: ess_billing-1
                      success: true
                    - id: aws-policy-12345
                      name: cspm-aws-policy
                      success: true
              schema:
                items:
                  $ref: '#/components/schemas/Kibana_HTTP_APIs_bulk_upgrade_managed_integration_result'
                maxItems: 10000
                type: array
          description: "Indicates a successful response. Each item reports the per-policy upgrade outcome; inspect every item's `success` flag. A missing id, or an id that is not a managed integration, is reported as a per-item failure (`success: false` + `statusCode`) without failing the batch."
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
      summary: Bulk upgrade managed integrations
      tags:
        - Fleet managed integrations
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/managed_integrations/_upgrade/dryrun:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/managed_integrations/_upgrade/dryrun</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Preview upgrading multiple managed integrations without applying any change. Targets the installed package version by default; pass `pkgVersion` to preview a specific (for example, not-yet-installed) version. Each result returns the current/proposed version and any migration errors, plus — only on a clean dry-run (`hasErrors: false`) — the migrated `proposedPolicy`. `proposedPolicy` is for the edit-and-upgrade flow (edit it, then save via the update (PUT) endpoint); to apply an upgrade as-is, use `_upgrade`.
      operationId: post-fleet-managed-integrations-upgrade-dryrun
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
      requestBody:
        content:
          application/json:
            examples:
              upgradeManagedIntegrationsDryRunRequestExample:
                description: Preview the upgrade of managed integrations to their installed package version
                value:
                  policyIds:
                    - d52a7812-5736-4fdc-aed8-72152afa1ffa
              upgradeManagedIntegrationsDryRunTargetVersionRequestExample:
                description: Preview the upgrade against an explicit target package version (for example, before installing the new version). Defaults to the installed package version when omitted.
                value:
                  pkgVersion: 1.6.0
                  policyIds:
                    - d52a7812-5736-4fdc-aed8-72152afa1ffa
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_managed_integration_upgrade_dry_run_request'
      responses:
        '200':
          content:
            application/json:
              examples:
                upgradeManagedIntegrationsDryRunMigrationErrorsExample:
                  description: Example dry-run response where migrating the config to the new version produced errors. `hasErrors` is true and `errors` explains why; do not feed the (partial) proposed config into the update endpoint without resolving them.
                  value:
                    - currentVersion: 1.5.0
                      errors:
                        - message: Variable "organization_id" is required
                      hasErrors: true
                      id: d52a7812-5736-4fdc-aed8-72152afa1ffa
                      name: ess_billing-1
                      proposedVersion: 1.6.0
                upgradeManagedIntegrationsDryRunMixedResponseExample:
                  description: 'Example dry-run response for a mixed batch: one managed integration previews cleanly while two ids are missing or not managed integrations. Ids that are missing or not managed integrations are surfaced as per-item failures (`hasErrors: true` + `statusCode`) without failing the batch, and results stay in request order.'
                  value:
                    - currentVersion: 0.5.0
                      hasErrors: false
                      id: 2e426392-f856-4ab2-bc31-92d4dbb8d134
                      name: agentless_hello_world-16
                      proposedPolicy:
                        cloud_connector: null
                        created_at: '2026-07-01T15:59:08.299Z'
                        created_by: admin
                        description: ''
                        id: 2e426392-f856-4ab2-bc31-92d4dbb8d134
                        inputs:
                          agentless_hello_world-cel:
                            enabled: true
                            streams:
                              agentless_hello_world.generic:
                                enabled: true
                                vars:
                                  url: https://epr.elastic.co
                              agentless_hello_world.mock_counter:
                                enabled: false
                                vars:
                                  events_per_second: 10
                                  mode: constant
                                  spike_events: 100
                                  spike_every_seconds: 60
                          agentless_hello_world-httpjson:
                            enabled: false
                            streams:
                              agentless_hello_world.generic:
                                enabled: false
                                vars:
                                  url: https://epr.elastic.co
                        name: agentless_hello_world-16
                        namespace: default
                        package:
                          name: agentless_hello_world
                          title: Agentless Hello World
                          version: 0.5.0
                        updated_at: '2026-07-01T16:02:14.067Z'
                        updated_by: admin
                      proposedVersion: 0.5.0
                    - body:
                        message: Agentless policy 9300464c-6cfc-4566-850d-e9e7927457fe not found
                      hasErrors: true
                      id: 9300464c-6cfc-4566-850d-e9e7927457fe
                      statusCode: 404
                    - body:
                        message: Agentless policy 5b8763e9-791a-4038-be29-b384d578200e not found
                      hasErrors: true
                      id: 5b8763e9-791a-4038-be29-b384d578200e
                      statusCode: 404
                upgradeManagedIntegrationsDryRunResponseExample:
                  description: 'Example clean dry-run response (`hasErrors: false`) with the proposed (migrated) policy. `proposedPolicy` is intended for the edit-and-upgrade flow: edit it and submit the edited payload to the update (PUT) endpoint. To apply without edits, use the `_upgrade` endpoint instead.'
                  value:
                    - currentVersion: 1.5.0
                      hasErrors: false
                      id: d52a7812-5736-4fdc-aed8-72152afa1ffa
                      name: ess_billing-1
                      proposedPolicy:
                        created_at: '2025-11-06T18:27:43.541Z'
                        created_by: test_user
                        description: test
                        id: d52a7812-5736-4fdc-aed8-72152afa1ffa
                        inputs:
                          ESS Billing-cel:
                            enabled: true
                            vars:
                              organization_id: '1234'
                        name: ess_billing-1
                        namespace: default
                        package:
                          name: ess_billing
                          title: Elasticsearch Service Billing
                          version: 1.6.0
                        updated_at: '2025-11-06T18:27:43.541Z'
                        updated_by: test_user
                      proposedVersion: 1.6.0
              schema:
                items:
                  $ref: '#/components/schemas/Kibana_HTTP_APIs_managed_integration_upgrade_dry_run_result'
                maxItems: 10000
                type: array
          description: 'Indicates a successful response. Each clean item (`hasErrors: false`) previews the migrated policy as a consumable managed integration (`proposedPolicy`); a missing id, an id that is not a managed integration, or a migration error, is reported as a per-item failure (`hasErrors: true`, with `proposedPolicy` omitted) without failing the batch. Inspect every item.'
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
      summary: Preview a managed integrations upgrade
      tags:
        - Fleet managed integrations
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/managed_integrations/{policyId}:
    delete:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb delete">delete</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/managed_integrations/{policyId}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Delete a managed integration
      operationId: delete-fleet-managed-integrations-policyid
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: The ID of the policy to delete.
          in: path
          name: policyId
          required: true
          schema:
            maxLength: 256
            type: string
        - description: Force delete the policy even if the policy is managed.
          in: query
          name: force
          required: false
          schema:
            type: boolean
      responses:
        '200':
          content:
            application/json:
              examples:
                deleteManagedIntegrationsResponseExample:
                  description: Example response for deleting a managed integration
                  value:
                    item:
                      id: d52a7812-5736-4fdc-aed8-72152afa1ffa
              schema:
                additionalProperties: false
                description: Response for deleting a managed integration.
                type: object
                properties:
                  id:
                    description: The ID of the deleted managed integration.
                    type: string
                required:
                  - id
          description: Indicates a successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
        '404':
          content:
            application/json:
              examples:
                notFoundErrorResponseExample:
                  description: Example of a not found error response
                  value:
                    message: Agentless policy d52a7812-5736-4fdc-aed8-72152afa1ffa not found
              schema:
                additionalProperties: false
                type: object
                properties:
                  message:
                    type: string
                required:
                  - message
          description: Not Found
        '409':
          content:
            application/json:
              examples:
                conflictErrorResponseExample:
                  description: Example of a conflict error response
                  value:
                    error: Conflict
                    message: An error message describing what went wrong
                    statusCode: 409
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Conflict
      summary: Delete a managed integration
      tags:
        - Fleet managed integrations
      x-state: Experimental; added in 9.3.0
      x-metaTags:
        - content: Kibana
          name: product_name
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/managed_integrations/{policyId}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Get a managed integration by ID
      operationId: get-fleet-managed-integrations-policyid
      parameters:
        - description: The ID of the managed integration to retrieve.
          in: path
          name: policyId
          required: true
          schema:
            maxLength: 256
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                getManagedIntegrationResponseExample:
                  description: Example response for getting a managed integration by ID
                  value:
                    item:
                      created_at: '2025-11-06T18:27:43.541Z'
                      created_by: test_user
                      description: test
                      id: d52a7812-5736-4fdc-aed8-72152afa1ffa
                      inputs:
                        ESS Billing-cel:
                          enabled: true
                          streams:
                            ess_billing.billing:
                              enabled: true
                              vars:
                                hide_sensitive: true
                                http_client_timeout: 30s
                                lookbehind: 365
                                tags:
                                  - forwarded
                                  - billing
                            ess_billing.credits:
                              enabled: false
                          vars:
                            api_key:
                              id: QY1sWpoBbWcMW-edr0Ee
                              isSecretRef: true
                            organization_id: '1234'
                            url: https://billing.elastic-cloud.com
                      name: ess_billing-1
                      namespace: default
                      package:
                        name: ess_billing
                        title: Elasticsearch Service Billing
                        version: 1.6.0
                      updated_at: '2025-11-06T18:27:43.541Z'
                      updated_by: test_user
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_managed_integration_response'
          description: Indicates a successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
        '404':
          content:
            application/json:
              examples:
                notFoundErrorResponseExample:
                  description: Example of a not found error response
                  value:
                    message: Agentless policy d52a7812-5736-4fdc-aed8-72152afa1ffa not found
              schema:
                additionalProperties: false
                type: object
                properties:
                  message:
                    type: string
                required:
                  - message
          description: Not Found
      summary: Get a managed integration
      tags:
        - Fleet managed integrations
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
    put:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb put">put</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/managed_integrations/{policyId}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Update a managed integration by ID. Uses full-replace semantics: the policy is rebuilt entirely from the request body, so any omitted optional field (for example, `description`, `vars`, `global_data_tags`, `cloud_connector`) is cleared or reset to its default. The integration package name is immutable and the runtime-managed `cluster_id` is preserved from the existing policy.
      operationId: put-fleet-managed-integrations-policyid
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: The ID of the managed integration to update.
          in: path
          name: policyId
          required: true
          schema:
            maxLength: 256
            type: string
      requestBody:
        content:
          application/json:
            examples:
              updateManagedIntegrationAttachAWSCloudConnectorRequestExample:
                description: Example request to attach an AWS cloud connector to a managed integration on update. Because `PUT` is full-replace, the `cloud_connector` block must be present on every subsequent update or the connector is detached.
                value:
                  cloud_connector:
                    enabled: true
                    target_csp: aws
                  description: CSPM integration for AWS with cloud connector
                  inputs:
                    cspm-cloudbeat/cis_aws:
                      enabled: true
                      streams:
                        cloud_security_posture.findings:
                          enabled: true
                          vars:
                            aws.account_type: organization-account
                            aws.credentials.type: cloud_connector
                            aws.supports_cloud_connectors: true
                            external_id:
                              id: ABCDEFGHIJKLMNOPQRST
                              isSecretRef: true
                            role_arn: arn:aws:iam::123456789012:role/TestRole
                      vars:
                        cloud_formation_template: https://console.aws.amazon.com/cloudformation/home#/stacks/quickcreate?templateURL=https://elastic-cspm-cft.s3.eu-central-1.amazonaws.com/cloudformation-cspm-ACCOUNT_TYPE-9.2.0.yml
                    cspm-cloudbeat/cis_azure:
                      enabled: false
                    cspm-cloudbeat/cis_gcp:
                      enabled: false
                  name: cspm-aws-policy
                  namespace: default
                  package:
                    name: cloud_security_posture
                    version: 3.1.1
                  vars:
                    deployment: aws
                    posture: cspm
              updateManagedIntegrationClearFieldsRequestExample:
                description: Example showing full-replace clearing semantics. Compared to the prior state, this request omits `description` (clearing it) and provides only the minimal required fields. Any optional field not present in the body (for example, `description`, `vars`, `global_data_tags`, `cloud_connector`) is dropped from the resulting policy.
                value:
                  inputs:
                    ESS Billing-cel:
                      enabled: true
                      streams:
                        ess_billing.billing:
                          enabled: true
                        ess_billing.credits:
                          enabled: true
                      vars:
                        api_key: <REPLACE_WITH_YOUR_API_KEY>
                        organization_id: '1234'
                  name: ess_billing-1
                  namespace: default
                  package:
                    name: ess_billing
                    version: 1.6.0
              updateManagedIntegrationRequestExample:
                description: 'Example request to update a managed integration. `PUT` uses full-replace semantics: the policy is rebuilt entirely from this body, so any omitted optional field is cleared or reset to its default rather than preserved. For example, omitting `description` clears it, omitting `vars` or `global_data_tags` removes them, and omitting `cloud_connector` detaches any previously attached connector. Detaching or swapping a cloud connector only removes the reference; the connector itself is not deleted, as connectors have an independent, shareable lifecycle and are managed through the cloud connector API. Two fields are exceptions that cannot be changed using `PUT`: the integration `package.name` is immutable, and the runtime-managed `cluster_id` is preserved from the existing agent policy.'
                value:
                  description: updated description
                  inputs:
                    ESS Billing-cel:
                      enabled: true
                      streams:
                        ess_billing.billing:
                          enabled: true
                          vars:
                            hide_sensitive: true
                            http_client_timeout: 30s
                            lookbehind: 180
                            tags:
                              - forwarded
                              - billing
                        ess_billing.credits:
                          enabled: true
                      vars:
                        api_key: <REPLACE_WITH_YOUR_API_KEY>
                        organization_id: '1234'
                  name: ess_billing-1
                  namespace: default
                  package:
                    name: ess_billing
                    version: 1.6.0
              updateManagedIntegrationReuseAWSCloudConnectorRequestExample:
                description: Example request to update a managed integration reusing an existing AWS cloud connector by ID instead of creating a new one.
                value:
                  cloud_connector:
                    cloud_connector_id: existing-aws-connector-id
                    enabled: true
                    target_csp: aws
                  description: CSPM integration for AWS reusing existing cloud connector
                  inputs:
                    cspm-cloudbeat/cis_aws:
                      enabled: true
                      streams:
                        cloud_security_posture.findings:
                          enabled: true
                          vars:
                            aws.account_type: organization-account
                            aws.credentials.type: cloud_connector
                            aws.supports_cloud_connectors: true
                            external_id:
                              id: ABCDEFGHIJKLMNOPQRST
                              isSecretRef: true
                            role_arn: arn:aws:iam::123456789012:role/TestRole
                      vars:
                        cloud_formation_template: https://console.aws.amazon.com/cloudformation/home#/stacks/quickcreate?templateURL=https://elastic-cspm-cft.s3.eu-central-1.amazonaws.com/cloudformation-cspm-ACCOUNT_TYPE-9.2.0.yml
                    cspm-cloudbeat/cis_azure:
                      enabled: false
                    cspm-cloudbeat/cis_gcp:
                      enabled: false
                  name: cspm-aws-policy
                  namespace: default
                  package:
                    name: cloud_security_posture
                    version: 3.1.1
                  vars:
                    deployment: aws
                    posture: cspm
              updateManagedIntegrationVersionChangeRequestExample:
                description: Example request to update a managed integration to a different package version. The package name is immutable, but the version may change.
                value:
                  description: bumped to a newer package version
                  inputs:
                    ESS Billing-cel:
                      enabled: true
                      streams:
                        ess_billing.billing:
                          enabled: true
                        ess_billing.credits:
                          enabled: false
                      vars:
                        api_key: <REPLACE_WITH_YOUR_API_KEY>
                        organization_id: '1234'
                  name: ess_billing-1
                  namespace: default
                  package:
                    name: ess_billing
                    version: 1.7.0
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_create_managed_integration_request'
      responses:
        '200':
          content:
            application/json:
              examples:
                updateManagedIntegrationResponseExample:
                  description: Example response for updating a managed integration
                  value:
                    item:
                      created_at: '2025-11-06T18:27:43.541Z'
                      created_by: test_user
                      description: updated description
                      id: d52a7812-5736-4fdc-aed8-72152afa1ffa
                      inputs:
                        ESS Billing-cel:
                          enabled: true
                          streams:
                            ess_billing.billing:
                              enabled: true
                              vars:
                                hide_sensitive: true
                                http_client_timeout: 30s
                                lookbehind: 180
                                tags:
                                  - forwarded
                                  - billing
                            ess_billing.credits:
                              enabled: true
                          vars:
                            api_key:
                              id: QY1sWpoBbWcMW-edr0Ee
                              isSecretRef: true
                            organization_id: '1234'
                            url: https://billing.elastic-cloud.com
                      name: ess_billing-1
                      namespace: default
                      package:
                        name: ess_billing
                        title: Elasticsearch Service Billing
                        version: 1.6.0
                      updated_at: '2025-11-07T09:14:02.118Z'
                      updated_by: test_user
                updateManagedIntegrationWithAWSCloudConnectorResponseExample:
                  description: Example response after attaching an AWS cloud connector on update
                  value:
                    item:
                      cloud_connector:
                        cloud_connector_id: aws-connector-67890
                        enabled: true
                      created_at: '2025-11-06T18:27:43.541Z'
                      created_by: test_user
                      description: CSPM integration for AWS with cloud connector
                      id: aws-policy-12345
                      inputs:
                        cspm-cloudbeat/cis_aws:
                          enabled: true
                          streams:
                            cloud_security_posture.findings:
                              enabled: true
                              vars:
                                aws.account_type: organization-account
                                aws.credentials.type: cloud_connector
                                external_id:
                                  id: secret-external-id-123
                                  isSecretRef: true
                                role_arn: arn:aws:iam::123456789012:role/TestRole
                          vars:
                            cloud_formation_template: https://console.aws.amazon.com/cloudformation/home#/stacks/quickcreate?templateURL=https://elastic-cspm-cft.s3.eu-central-1.amazonaws.com/cloudformation-cspm-ACCOUNT_TYPE-9.2.0.yml
                        cspm-cloudbeat/cis_azure:
                          enabled: false
                        cspm-cloudbeat/cis_gcp:
                          enabled: false
                      name: cspm-aws-policy
                      namespace: default
                      package:
                        name: cloud_security_posture
                        title: Cloud Security Posture Management
                        version: 3.1.1
                      updated_at: '2025-11-07T09:14:02.118Z'
                      updated_by: test_user
                      vars:
                        deployment: aws
                        posture: cspm
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_managed_integration_response'
          description: Indicates a successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
                packageNameChangeErrorResponseExample:
                  description: The integration package name cannot be changed on update
                  value:
                    error: Bad Request
                    message: Cannot change the integration package of an agentless policy (from "ess_billing" to "cloud_security_posture").
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
        '404':
          content:
            application/json:
              examples:
                notFoundErrorResponseExample:
                  description: Example of a not found error response
                  value:
                    message: Agentless policy d52a7812-5736-4fdc-aed8-72152afa1ffa not found
              schema:
                additionalProperties: false
                type: object
                properties:
                  message:
                    type: string
                required:
                  - message
          description: Not Found
        '409':
          content:
            application/json:
              examples:
                conflictErrorResponseExample:
                  description: Example of a name-conflict error response
                  value:
                    error: Conflict
                    message: An integration policy with the name my-agentless-policy already exists. Please rename it or choose a different name.
                    statusCode: 409
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Conflict — for example, the requested name is already used by another integration policy.
      summary: Update a managed integration
      tags:
        - Fleet managed integrations
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/message_signing_service/rotate_key_pair:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/message_signing_service/rotate_key_pair</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Rotate the key pair used by Fleet to sign messages sent to Elastic Agents. This operation is irreversible and requires all agents in the Fleet to be re-enrolled after rotation. You must explicitly acknowledge the risk by passing `acknowledge=true` as a query parameter.<br/><br/>[Required authorization] Route required privileges: fleet-agents-all AND fleet-agent-policies-all AND fleet-settings-all.
      operationId: post-fleet-message-signing-service-rotate-key-pair
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: Set to true to confirm you understand the risks of rotating the key pair
          in: query
          name: acknowledge
          required: false
          schema:
            default: false
            type: boolean
      responses:
        '200':
          content:
            application/json:
              examples:
                rotateKeyPairSuccessExample:
                  description: The key pair was rotated. All agents must be re-enrolled to receive the new signing key.
                  value:
                    message: Key pair rotated successfully.
              schema:
                additionalProperties: false
                type: object
                properties:
                  message:
                    type: string
                required:
                  - message
          description: Key pair rotated successfully
        '400':
          content:
            application/json:
              examples:
                acknowledgeRequiredExample:
                  description: Request was rejected because the acknowledge query parameter was not set to true
                  value:
                    error: Bad Request
                    message: 'Warning: this API will cause a key pair to rotate and should not be necessary in normal operation.  If you proceed, you may need to reinstall Agents in your network. You must acknowledge the risks of rotating the key pair with acknowledge=true in the request parameters.  For more information, reach out to your administrator.'
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
        '500':
          content:
            application/json:
              examples:
                serviceUnavailableExample:
                  description: The message signing service is not available
                  value:
                    error: Internal Server Error
                    message: Failed to rotate key pair. Message signing service is unavailable!
                    statusCode: 500
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Internal Server Error
      summary: Rotate a Fleet message signing key pair
      tags:
        - Message Signing Service
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/outputs:
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/outputs</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        List all Fleet outputs.<br/><br/>[Required authorization] Route required privileges: fleet-settings-read OR fleet-agent-policies-read.
      operationId: get-fleet-outputs
      parameters: []
      responses:
        '200':
          content:
            application/json:
              examples:
                getOutputsExample:
                  description: List of Fleet outputs
                  value:
                    items:
                      - hosts:
                          - https://elasticsearch.example.com:9200
                        id: output-id-1
                        is_default: true
                        is_default_monitoring: true
                        name: Default output
                        type: elasticsearch
                    page: 1
                    perPage: 20
                    total: 1
              schema:
                additionalProperties: false
                type: object
                properties:
                  items:
                    items:
                      discriminator:
                        mapping:
                          elasticsearch: '#/components/schemas/Kibana_HTTP_APIs_output_response_elasticsearch'
                          kafka: '#/components/schemas/Kibana_HTTP_APIs_output_response_kafka'
                          logstash: '#/components/schemas/Kibana_HTTP_APIs_output_response_logstash'
                          otlp: '#/components/schemas/Kibana_HTTP_APIs_output_response_otlp'
                          remote_elasticsearch: '#/components/schemas/Kibana_HTTP_APIs_output_response_remote_elasticsearch'
                        propertyName: type
                      oneOf:
                        - $ref: '#/components/schemas/Kibana_HTTP_APIs_output_response_elasticsearch'
                        - $ref: '#/components/schemas/Kibana_HTTP_APIs_output_response_remote_elasticsearch'
                        - $ref: '#/components/schemas/Kibana_HTTP_APIs_output_response_logstash'
                        - $ref: '#/components/schemas/Kibana_HTTP_APIs_output_response_kafka'
                        - $ref: '#/components/schemas/Kibana_HTTP_APIs_output_response_otlp'
                    maxItems: 10000
                    type: array
                  page:
                    type: number
                  perPage:
                    type: number
                  total:
                    type: number
                required:
                  - items
                  - total
                  - page
                  - perPage
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
      summary: Get outputs
      tags:
        - Fleet outputs
      x-metaTags:
        - content: Kibana
          name: product_name
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/outputs</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Create a new Fleet output.<br/><br/>[Required authorization] Route required privileges: fleet-settings-all.
      operationId: post-fleet-outputs
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
      requestBody:
        content:
          application/json:
            examples:
              postOutputRequestExample:
                description: Create a new Elasticsearch output
                value:
                  hosts:
                    - https://elasticsearch.example.com:9200
                  is_default: false
                  is_default_monitoring: false
                  name: My output
                  type: elasticsearch
            schema:
              discriminator:
                mapping:
                  elasticsearch: '#/components/schemas/Kibana_HTTP_APIs_new_output_elasticsearch'
                  kafka: '#/components/schemas/Kibana_HTTP_APIs_new_output_kafka'
                  logstash: '#/components/schemas/Kibana_HTTP_APIs_new_output_logstash'
                  otlp: '#/components/schemas/Kibana_HTTP_APIs_new_output_otlp'
                  remote_elasticsearch: '#/components/schemas/Kibana_HTTP_APIs_new_output_remote_elasticsearch'
                propertyName: type
              oneOf:
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_new_output_elasticsearch'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_new_output_remote_elasticsearch'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_new_output_logstash'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_new_output_kafka'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_new_output_otlp'
      responses:
        '200':
          content:
            application/json:
              examples:
                postOutputExample:
                  description: The created Fleet output
                  value:
                    item:
                      hosts:
                        - https://elasticsearch.example.com:9200
                      id: output-id-2
                      is_default: false
                      is_default_monitoring: false
                      name: My output
                      type: elasticsearch
              schema:
                additionalProperties: false
                type: object
                properties:
                  item:
                    discriminator:
                      mapping:
                        elasticsearch: '#/components/schemas/Kibana_HTTP_APIs_output_response_elasticsearch'
                        kafka: '#/components/schemas/Kibana_HTTP_APIs_output_response_kafka'
                        logstash: '#/components/schemas/Kibana_HTTP_APIs_output_response_logstash'
                        otlp: '#/components/schemas/Kibana_HTTP_APIs_output_response_otlp'
                        remote_elasticsearch: '#/components/schemas/Kibana_HTTP_APIs_output_response_remote_elasticsearch'
                      propertyName: type
                    oneOf:
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_output_response_elasticsearch'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_output_response_remote_elasticsearch'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_output_response_logstash'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_output_response_kafka'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_output_response_otlp'
                required:
                  - item
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
      summary: Create output
      tags:
        - Fleet outputs
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/outputs/{outputId}:
    delete:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb delete">delete</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/outputs/{outputId}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Delete output by ID.<br/><br/>[Required authorization] Route required privileges: fleet-settings-all.
      operationId: delete-fleet-outputs-outputid
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: The ID of the output
          in: path
          name: outputId
          required: true
          schema:
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                deleteOutputExample:
                  description: The output was successfully deleted
                  value:
                    id: output-id-1
              schema:
                additionalProperties: false
                type: object
                properties:
                  id:
                    type: string
                required:
                  - id
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
        '404':
          content:
            application/json:
              examples:
                notFoundExample:
                  description: No output was found with the given ID
                  value:
                    error: Not Found
                    message: Output output-id-1 not found
                    statusCode: 404
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Not Found
      summary: Delete output
      tags:
        - Fleet outputs
      x-metaTags:
        - content: Kibana
          name: product_name
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/outputs/{outputId}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Get output by ID.<br/><br/>[Required authorization] Route required privileges: fleet-settings-read OR fleet-agent-policies-read.
      operationId: get-fleet-outputs-outputid
      parameters:
        - description: The ID of the output
          in: path
          name: outputId
          required: true
          schema:
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                getOutputExample:
                  description: A Fleet output
                  value:
                    item:
                      hosts:
                        - https://elasticsearch.example.com:9200
                      id: output-id-1
                      is_default: true
                      is_default_monitoring: true
                      name: Default output
                      type: elasticsearch
              schema:
                additionalProperties: false
                type: object
                properties:
                  item:
                    discriminator:
                      mapping:
                        elasticsearch: '#/components/schemas/Kibana_HTTP_APIs_output_response_elasticsearch'
                        kafka: '#/components/schemas/Kibana_HTTP_APIs_output_response_kafka'
                        logstash: '#/components/schemas/Kibana_HTTP_APIs_output_response_logstash'
                        otlp: '#/components/schemas/Kibana_HTTP_APIs_output_response_otlp'
                        remote_elasticsearch: '#/components/schemas/Kibana_HTTP_APIs_output_response_remote_elasticsearch'
                      propertyName: type
                    oneOf:
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_output_response_elasticsearch'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_output_response_remote_elasticsearch'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_output_response_logstash'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_output_response_kafka'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_output_response_otlp'
                required:
                  - item
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
        '404':
          content:
            application/json:
              examples:
                notFoundExample:
                  description: No output was found with the given ID
                  value:
                    error: Not Found
                    message: Output output-id-1 not found
                    statusCode: 404
          description: Not Found
      summary: Get output
      tags:
        - Fleet outputs
      x-metaTags:
        - content: Kibana
          name: product_name
    put:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb put">put</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/outputs/{outputId}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Update output by ID.<br/><br/>[Required authorization] Route required privileges: fleet-settings-all.
      operationId: put-fleet-outputs-outputid
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: The ID of the output
          in: path
          name: outputId
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            examples:
              putOutputRequestExample:
                description: Update a Fleet output
                value:
                  hosts:
                    - https://updated-elasticsearch.example.com:9200
                  name: Updated output
            schema:
              anyOf:
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_update_output_elasticsearch'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_update_output_remote_elasticsearch'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_update_output_logstash'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_update_output_kafka'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_update_output_otlp'
      responses:
        '200':
          content:
            application/json:
              examples:
                putOutputExample:
                  description: The updated Fleet output
                  value:
                    item:
                      hosts:
                        - https://updated-elasticsearch.example.com:9200
                      id: output-id-1
                      is_default: true
                      is_default_monitoring: true
                      name: Updated output
                      type: elasticsearch
              schema:
                additionalProperties: false
                type: object
                properties:
                  item:
                    discriminator:
                      mapping:
                        elasticsearch: '#/components/schemas/Kibana_HTTP_APIs_output_response_elasticsearch'
                        kafka: '#/components/schemas/Kibana_HTTP_APIs_output_response_kafka'
                        logstash: '#/components/schemas/Kibana_HTTP_APIs_output_response_logstash'
                        otlp: '#/components/schemas/Kibana_HTTP_APIs_output_response_otlp'
                        remote_elasticsearch: '#/components/schemas/Kibana_HTTP_APIs_output_response_remote_elasticsearch'
                      propertyName: type
                    oneOf:
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_output_response_elasticsearch'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_output_response_remote_elasticsearch'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_output_response_logstash'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_output_response_kafka'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_output_response_otlp'
                required:
                  - item
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
        '404':
          content:
            application/json:
              examples:
                notFoundExample:
                  description: No output was found with the given ID
                  value:
                    error: Not Found
                    message: Output output-id-1 not found
                    statusCode: 404
          description: Not Found
      summary: Update output
      tags:
        - Fleet outputs
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/outputs/{outputId}/health:
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/outputs/{outputId}/health</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Get the latest health status of an output by ID.<br/><br/>[Required authorization] Route required privileges: fleet-settings-read.
      operationId: get-fleet-outputs-outputid-health
      parameters:
        - description: The ID of the output
          in: path
          name: outputId
          required: true
          schema:
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                getOutputHealthExample:
                  description: The latest health status of a Fleet output
                  value:
                    message: ''
                    state: HEALTHY
                    timestamp: '2024-01-15T10:00:00.000Z'
              schema:
                additionalProperties: false
                type: object
                properties:
                  message:
                    description: long message if unhealthy
                    type: string
                  state:
                    description: state of output, HEALTHY or DEGRADED
                    type: string
                  timestamp:
                    description: timestamp of reported state
                    type: string
                required:
                  - state
                  - message
                  - timestamp
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
      summary: Get the latest output health
      tags:
        - Fleet outputs
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/package_policies:
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/package_policies</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        List all package policies.
      operationId: get-fleet-package-policies
      parameters:
        - description: Page number
          in: query
          name: page
          required: false
          schema:
            type: number
        - description: Number of results per page
          in: query
          name: perPage
          required: false
          schema:
            type: number
        - description: Field to sort results by
          in: query
          name: sortField
          required: false
          schema:
            type: string
        - description: Sort order, ascending or descending
          in: query
          name: sortOrder
          required: false
          schema:
            enum:
              - desc
              - asc
            type: string
        - description: When true, only show policies with available upgrades
          in: query
          name: showUpgradeable
          required: false
          schema:
            type: boolean
        - description: A KQL query string to filter results
          in: query
          name: kuery
          required: false
          schema:
            type: string
        - description: 'Format for the response: simplified or legacy'
          in: query
          name: format
          required: false
          schema:
            enum:
              - simplified
              - legacy
            type: string
        - description: When true, include the agent count per package policy
          in: query
          name: withAgentCount
          required: false
          schema:
            type: boolean
      responses:
        '200':
          content:
            application/json:
              examples:
                getPackagePoliciesExample:
                  description: List of package policies
                  value:
                    items:
                      - created_at: '2024-01-15T10:00:00.000Z'
                        enabled: true
                        id: package-policy-id-1
                        inputs: []
                        name: nginx-1
                        namespace: default
                        package:
                          name: nginx
                          title: Nginx
                          version: 1.20.0
                        policy_ids:
                          - agent-policy-id-1
                        updated_at: '2024-01-15T10:00:00.000Z'
                    page: 1
                    perPage: 20
                    total: 1
              schema:
                additionalProperties: false
                type: object
                properties:
                  items:
                    items:
                      $ref: '#/components/schemas/Kibana_HTTP_APIs_package_policy_response'
                    maxItems: 10000
                    type: array
                  page:
                    type: number
                  perPage:
                    type: number
                  total:
                    type: number
                required:
                  - items
                  - total
                  - page
                  - perPage
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
      summary: Get package policies
      tags:
        - Fleet package policies
      x-metaTags:
        - content: Kibana
          name: product_name
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/package_policies</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Create a new package policy and assign it to an agent policy.
      operationId: post-fleet-package-policies
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: 'Format for the response: simplified or legacy'
          in: query
          name: format
          required: false
          schema:
            enum:
              - simplified
              - legacy
            type: string
      requestBody:
        content:
          application/json:
            examples:
              postPackagePolicyRequestExample:
                description: Create a new nginx package policy
                value:
                  inputs: {}
                  name: nginx-1
                  namespace: default
                  package:
                    name: nginx
                    version: 1.20.0
                  policy_ids:
                    - agent-policy-id-1
            schema:
              anyOf:
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_create_package_policy_request'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_simplified_create_package_policy_request'
              description: You should use inputs as an object and not use the deprecated inputs array.
      responses:
        '200':
          content:
            application/json:
              examples:
                postPackagePolicyExample:
                  description: The created package policy
                  value:
                    item:
                      created_at: '2024-01-15T10:00:00.000Z'
                      enabled: true
                      id: package-policy-id-2
                      inputs: []
                      name: nginx-1
                      namespace: default
                      package:
                        name: nginx
                        title: Nginx
                        version: 1.20.0
                      policy_ids:
                        - agent-policy-id-1
                      updated_at: '2024-01-15T10:00:00.000Z'
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_create_package_policy_response'
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
        '409':
          content:
            application/json:
              examples:
                conflictExample:
                  description: A package policy with the same name already exists
                  value:
                    error: Conflict
                    message: An error message describing what went wrong
                    statusCode: 409
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Conflict
      summary: Create a package policy
      tags:
        - Fleet package policies
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/package_policies/_bulk_get:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/package_policies/_bulk_get</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Get multiple package policies by ID.
      operationId: post-fleet-package-policies-bulk-get
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: 'Format for the response: simplified or legacy'
          in: query
          name: format
          required: false
          schema:
            enum:
              - simplified
              - legacy
            type: string
      requestBody:
        content:
          application/json:
            examples:
              postBulkGetPackagePoliciesRequestExample:
                description: Retrieve multiple package policies by ID
                value:
                  ids:
                    - package-policy-id-1
                    - package-policy-id-2
            schema:
              additionalProperties: false
              type: object
              properties:
                ids:
                  description: list of package policy ids
                  items:
                    type: string
                  maxItems: 1000
                  type: array
                ignoreMissing:
                  type: boolean
              required:
                - ids
      responses:
        '200':
          content:
            application/json:
              examples:
                postBulkGetPackagePoliciesExample:
                  description: The requested package policies
                  value:
                    items:
                      - created_at: '2024-01-15T10:00:00.000Z'
                        enabled: true
                        id: package-policy-id-1
                        inputs: []
                        name: nginx-1
                        namespace: default
                        package:
                          name: nginx
                          title: Nginx
                          version: 1.20.0
                        policy_ids:
                          - agent-policy-id-1
                        updated_at: '2024-01-15T10:00:00.000Z'
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_bulk_get_package_policies_response'
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
        '404':
          content:
            application/json:
              examples:
                notFoundExample:
                  description: One or more package policies were not found
                  value:
                    error: Not Found
                    message: Package policy package-policy-id-2 not found
                    statusCode: 404
              schema:
                additionalProperties: false
                type: object
                properties:
                  message:
                    type: string
                required:
                  - message
          description: Not Found
      summary: Bulk get package policies
      tags:
        - Fleet package policies
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/package_policies/{packagePolicyId}:
    delete:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb delete">delete</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/package_policies/{packagePolicyId}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Delete a package policy by ID.<br/><br/>[Required authorization] Route required privileges: fleet-agent-policies-all AND integrations-all.
      operationId: delete-fleet-package-policies-packagepolicyid
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: The ID of the package policy
          in: path
          name: packagePolicyId
          required: true
          schema:
            type: string
        - description: When true, delete the package policy even if it is managed
          in: query
          name: force
          required: false
          schema:
            type: boolean
      responses:
        '200':
          content:
            application/json:
              examples:
                deletePackagePolicyExample:
                  description: The package policy was successfully deleted
                  value:
                    id: package-policy-id-1
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_delete_one_package_policy_response'
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
      summary: Delete a package policy
      tags:
        - Fleet package policies
      x-metaTags:
        - content: Kibana
          name: product_name
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/package_policies/{packagePolicyId}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Get a package policy by ID.
      operationId: get-fleet-package-policies-packagepolicyid
      parameters:
        - description: The ID of the package policy
          in: path
          name: packagePolicyId
          required: true
          schema:
            type: string
        - description: 'Format for the response: simplified or legacy'
          in: query
          name: format
          required: false
          schema:
            enum:
              - simplified
              - legacy
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                getPackagePolicyExample:
                  description: A package policy
                  value:
                    item:
                      created_at: '2024-01-15T10:00:00.000Z'
                      enabled: true
                      id: package-policy-id-1
                      inputs: []
                      name: nginx-1
                      namespace: default
                      package:
                        name: nginx
                        title: Nginx
                        version: 1.20.0
                      policy_ids:
                        - agent-policy-id-1
                      updated_at: '2024-01-15T10:00:00.000Z'
              schema:
                additionalProperties: false
                type: object
                properties:
                  item:
                    $ref: '#/components/schemas/Kibana_HTTP_APIs_package_policy_response'
                required:
                  - item
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
        '404':
          content:
            application/json:
              examples:
                notFoundExample:
                  description: No package policy was found with the given ID
                  value:
                    error: Not Found
                    message: Package policy package-policy-id-1 not found
                    statusCode: 404
              schema:
                additionalProperties: false
                type: object
                properties:
                  message:
                    type: string
                required:
                  - message
          description: Not Found
      summary: Get a package policy
      tags:
        - Fleet package policies
      x-metaTags:
        - content: Kibana
          name: product_name
    put:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb put">put</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/package_policies/{packagePolicyId}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Update a package policy by ID.
      operationId: put-fleet-package-policies-packagepolicyid
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: The ID of the package policy
          in: path
          name: packagePolicyId
          required: true
          schema:
            type: string
        - description: 'Format for the response: simplified or legacy'
          in: query
          name: format
          required: false
          schema:
            enum:
              - simplified
              - legacy
            type: string
      requestBody:
        content:
          application/json:
            examples:
              putPackagePolicyRequestExample:
                description: Update a package policy
                value:
                  enabled: true
                  inputs: {}
                  name: nginx-1-updated
                  namespace: default
                  package:
                    name: nginx
                    version: 1.20.0
                  policy_ids:
                    - agent-policy-id-1
            schema:
              anyOf:
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_update_package_policy_request'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_simplified_create_package_policy_request'
      responses:
        '200':
          content:
            application/json:
              examples:
                putPackagePolicyExample:
                  description: The updated package policy
                  value:
                    item:
                      created_at: '2024-01-15T10:00:00.000Z'
                      enabled: true
                      id: package-policy-id-1
                      inputs: []
                      name: nginx-1-updated
                      namespace: default
                      package:
                        name: nginx
                        title: Nginx
                        version: 1.20.0
                      policy_ids:
                        - agent-policy-id-1
                      updated_at: '2024-01-15T11:00:00.000Z'
              schema:
                additionalProperties: false
                type: object
                properties:
                  item:
                    $ref: '#/components/schemas/Kibana_HTTP_APIs_package_policy_response'
                required:
                  - item
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
        '403':
          content:
            application/json:
              examples:
                forbiddenExample:
                  description: The update is not authorized for this package
                  value:
                    error: Forbidden
                    message: An error message describing what went wrong
                    statusCode: 403
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Forbidden
      summary: Update a package policy
      tags:
        - Fleet package policies
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/package_policies/delete:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/package_policies/delete</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Delete multiple package policies by ID.<br/><br/>[Required authorization] Route required privileges: fleet-agent-policies-all AND integrations-all.
      operationId: post-fleet-package-policies-delete
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
      requestBody:
        content:
          application/json:
            examples:
              postDeletePackagePoliciesRequestExample:
                description: Delete multiple package policies by ID
                value:
                  packagePolicyIds:
                    - package-policy-id-1
                    - package-policy-id-2
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_delete_package_policies_request'
      responses:
        '200':
          content:
            application/json:
              examples:
                postDeletePackagePoliciesExample:
                  description: Results of the bulk delete operation
                  value:
                    - id: package-policy-id-1
                      success: true
                    - id: package-policy-id-2
                      success: true
              schema:
                items:
                  $ref: '#/components/schemas/Kibana_HTTP_APIs_delete_package_policies_response_item'
                maxItems: 10000
                type: array
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
      summary: Bulk delete package policies
      tags:
        - Fleet package policies
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/package_policies/upgrade:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/package_policies/upgrade</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Upgrade a package policy to a newer package version.<br/><br/>[Required authorization] Route required privileges: fleet-agent-policies-all AND integrations-all.
      operationId: post-fleet-package-policies-upgrade
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
      requestBody:
        content:
          application/json:
            examples:
              postUpgradePackagePoliciesRequestExample:
                description: Upgrade package policies to the latest version
                value:
                  packagePolicyIds:
                    - package-policy-id-1
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_upgrade_package_policies_request'
      responses:
        '200':
          content:
            application/json:
              examples:
                postUpgradePackagePoliciesExample:
                  description: Results of the upgrade operation
                  value:
                    - id: package-policy-id-1
                      name: nginx-1
                      success: true
              schema:
                items:
                  $ref: '#/components/schemas/Kibana_HTTP_APIs_package_policy_status_response'
                maxItems: 10000
                type: array
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
      summary: Upgrade a package policy
      tags:
        - Fleet package policies
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/package_policies/upgrade/dryrun:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/package_policies/upgrade/dryrun</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Preview the changes that would be applied by upgrading a package policy to a newer package version.<br/><br/>[Required authorization] Route required privileges: fleet-agent-policies-read AND integrations-read.
      operationId: post-fleet-package-policies-upgrade-dryrun
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
      requestBody:
        content:
          application/json:
            examples:
              postDryRunPackagePoliciesRequestExample:
                description: Dry run an upgrade of a package policy
                value:
                  packagePolicyIds:
                    - package-policy-id-1
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_dry_run_package_policies_request'
      responses:
        '200':
          content:
            application/json:
              examples:
                postDryRunPackagePoliciesExample:
                  description: Preview of the package policy upgrade diff
                  value:
                    - diff:
                        - id: package-policy-id-1
                          name: nginx-1
                          package:
                            name: nginx
                            version: 1.20.0
                        - name: nginx-1
                          package:
                            name: nginx
                            version: 1.21.0
                      hasErrors: false
                      name: nginx-1
              schema:
                items:
                  additionalProperties: false
                  type: object
                  properties:
                    agent_diff:
                      items:
                        items:
                          additionalProperties: true
                          type: object
                          properties:
                            data_stream:
                              additionalProperties: true
                              type: object
                              properties:
                                namespace:
                                  type: string
                              required:
                                - namespace
                            id:
                              type: string
                            meta:
                              additionalProperties: true
                              type: object
                              properties:
                                package:
                                  additionalProperties: true
                                  type: object
                                  properties:
                                    name:
                                      type: string
                                    version:
                                      type: string
                                  required:
                                    - name
                                    - version
                              required:
                                - package
                            name:
                              type: string
                            package_policy_id:
                              type: string
                            processors:
                              items:
                                additionalProperties: true
                                type: object
                                properties:
                                  add_fields:
                                    additionalProperties: true
                                    type: object
                                    properties:
                                      fields:
                                        additionalProperties:
                                          anyOf:
                                            - type: string
                                            - type: number
                                        type: object
                                      target:
                                        type: string
                                    required:
                                      - target
                                      - fields
                                required:
                                  - add_fields
                              maxItems: 10000
                              type: array
                            revision:
                              type: number
                            streams:
                              items:
                                additionalProperties: true
                                type: object
                                properties:
                                  data_stream:
                                    additionalProperties: true
                                    type: object
                                    properties:
                                      dataset:
                                        type: string
                                      type:
                                        type: string
                                    required:
                                      - dataset
                                  id:
                                    type: string
                                required:
                                  - data_stream
                              maxItems: 10000
                              type: array
                            type:
                              type: string
                            use_output:
                              type: string
                          required:
                            - id
                            - name
                            - revision
                            - type
                            - data_stream
                            - use_output
                            - package_policy_id
                        maxItems: 10000
                        type: array
                      maxItems: 1
                      type: array
                    body:
                      additionalProperties: false
                      type: object
                      properties:
                        message:
                          type: string
                      required:
                        - message
                    diff:
                      items:
                        anyOf:
                          - $ref: '#/components/schemas/Kibana_HTTP_APIs_dry_run_package_policy_response'
                          - $ref: '#/components/schemas/Kibana_HTTP_APIs_dry_run_package_policy'
                      maxItems: 2
                      type: array
                    hasErrors:
                      type: boolean
                    name:
                      type: string
                    statusCode:
                      type: number
                  required:
                    - hasErrors
                maxItems: 10000
                type: array
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
      summary: Dry run a package policy upgrade
      tags:
        - Fleet package policies
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/proxies:
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/proxies</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        List all Fleet proxies.<br/><br/>[Required authorization] Route required privileges: fleet-settings-read.
      operationId: get-fleet-proxies
      parameters: []
      responses:
        '200':
          content:
            application/json:
              examples:
                getFleetProxiesExample:
                  description: List of Fleet proxies
                  value:
                    items:
                      - id: proxy-id-1
                        is_preconfigured: false
                        name: My proxy
                        url: http://proxy.example.com:3128
                    page: 1
                    perPage: 20
                    total: 1
              schema:
                additionalProperties: false
                type: object
                properties:
                  items:
                    items:
                      additionalProperties: false
                      type: object
                      properties:
                        certificate:
                          nullable: true
                          type: string
                        certificate_authorities:
                          nullable: true
                          type: string
                        certificate_key:
                          nullable: true
                          type: string
                        id:
                          type: string
                        is_preconfigured:
                          default: false
                          type: boolean
                        name:
                          type: string
                        proxy_headers:
                          additionalProperties:
                            anyOf:
                              - type: string
                              - type: boolean
                              - type: number
                          nullable: true
                          type: object
                        url:
                          type: string
                      required:
                        - id
                        - url
                        - name
                    maxItems: 10000
                    type: array
                  page:
                    type: number
                  perPage:
                    type: number
                  total:
                    type: number
                required:
                  - items
                  - total
                  - page
                  - perPage
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
      summary: Get proxies
      tags:
        - Fleet proxies
      x-metaTags:
        - content: Kibana
          name: product_name
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/proxies</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Create a new Fleet proxy.<br/><br/>[Required authorization] Route required privileges: fleet-settings-all.
      operationId: post-fleet-proxies
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
      requestBody:
        content:
          application/json:
            examples:
              postFleetProxyRequestExample:
                description: Create a new Fleet proxy
                value:
                  name: My proxy
                  url: http://proxy.example.com:3128
            schema:
              additionalProperties: false
              type: object
              properties:
                certificate:
                  nullable: true
                  type: string
                certificate_authorities:
                  nullable: true
                  type: string
                certificate_key:
                  nullable: true
                  type: string
                id:
                  type: string
                is_preconfigured:
                  default: false
                  type: boolean
                name:
                  type: string
                proxy_headers:
                  additionalProperties:
                    anyOf:
                      - type: string
                      - type: boolean
                      - type: number
                  nullable: true
                  type: object
                url:
                  type: string
              required:
                - url
                - name
      responses:
        '200':
          content:
            application/json:
              examples:
                postFleetProxyExample:
                  description: The created Fleet proxy
                  value:
                    item:
                      id: proxy-id-2
                      is_preconfigured: false
                      name: My proxy
                      url: http://proxy.example.com:3128
              schema:
                additionalProperties: false
                type: object
                properties:
                  item:
                    additionalProperties: false
                    type: object
                    properties:
                      certificate:
                        nullable: true
                        type: string
                      certificate_authorities:
                        nullable: true
                        type: string
                      certificate_key:
                        nullable: true
                        type: string
                      id:
                        type: string
                      is_preconfigured:
                        default: false
                        type: boolean
                      name:
                        type: string
                      proxy_headers:
                        additionalProperties:
                          anyOf:
                            - type: string
                            - type: boolean
                            - type: number
                        nullable: true
                        type: object
                      url:
                        type: string
                    required:
                      - id
                      - url
                      - name
                required:
                  - item
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
      summary: Create a proxy
      tags:
        - Fleet proxies
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/proxies/{itemId}:
    delete:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb delete">delete</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/proxies/{itemId}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Delete a proxy by ID<br/><br/>[Required authorization] Route required privileges: fleet-settings-all.
      operationId: delete-fleet-proxies-itemid
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: The ID of the proxy
          in: path
          name: itemId
          required: true
          schema:
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                deleteFleetProxyExample:
                  description: The Fleet proxy was successfully deleted
                  value:
                    id: proxy-id-1
              schema:
                additionalProperties: false
                type: object
                properties:
                  id:
                    type: string
                required:
                  - id
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
        '404':
          content:
            application/json:
              examples:
                notFoundExample:
                  description: No proxy was found with the given ID
                  value:
                    error: Not Found
                    message: Fleet proxy proxy-id-1 not found
                    statusCode: 404
          description: Not Found
      summary: Delete a proxy
      tags:
        - Fleet proxies
      x-metaTags:
        - content: Kibana
          name: product_name
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/proxies/{itemId}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Get a proxy by ID.<br/><br/>[Required authorization] Route required privileges: fleet-settings-read.
      operationId: get-fleet-proxies-itemid
      parameters:
        - description: The ID of the proxy
          in: path
          name: itemId
          required: true
          schema:
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                getFleetProxyExample:
                  description: A Fleet proxy
                  value:
                    item:
                      id: proxy-id-1
                      is_preconfigured: false
                      name: My proxy
                      url: http://proxy.example.com:3128
              schema:
                additionalProperties: false
                type: object
                properties:
                  item:
                    additionalProperties: false
                    type: object
                    properties:
                      certificate:
                        nullable: true
                        type: string
                      certificate_authorities:
                        nullable: true
                        type: string
                      certificate_key:
                        nullable: true
                        type: string
                      id:
                        type: string
                      is_preconfigured:
                        default: false
                        type: boolean
                      name:
                        type: string
                      proxy_headers:
                        additionalProperties:
                          anyOf:
                            - type: string
                            - type: boolean
                            - type: number
                        nullable: true
                        type: object
                      url:
                        type: string
                    required:
                      - id
                      - url
                      - name
                required:
                  - item
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
        '404':
          content:
            application/json:
              examples:
                notFoundExample:
                  description: No proxy was found with the given ID
                  value:
                    error: Not Found
                    message: Fleet proxy proxy-id-1 not found
                    statusCode: 404
          description: Not Found
      summary: Get a proxy
      tags:
        - Fleet proxies
      x-metaTags:
        - content: Kibana
          name: product_name
    put:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb put">put</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/proxies/{itemId}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Update a proxy by ID.<br/><br/>[Required authorization] Route required privileges: fleet-settings-all.
      operationId: put-fleet-proxies-itemid
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: The ID of the proxy
          in: path
          name: itemId
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            examples:
              putFleetProxyRequestExample:
                description: Update a Fleet proxy
                value:
                  name: Updated proxy
                  url: http://updated-proxy.example.com:3128
            schema:
              additionalProperties: false
              type: object
              properties:
                certificate:
                  default: null
                  nullable: true
                  type: string
                certificate_authorities:
                  default: null
                  nullable: true
                  type: string
                certificate_key:
                  default: null
                  nullable: true
                  type: string
                name:
                  type: string
                proxy_headers:
                  additionalProperties:
                    anyOf:
                      - type: string
                      - type: boolean
                      - type: number
                  nullable: true
                  type: object
                url:
                  type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                putFleetProxyExample:
                  description: The updated Fleet proxy
                  value:
                    item:
                      id: proxy-id-1
                      is_preconfigured: false
                      name: Updated proxy
                      url: http://updated-proxy.example.com:3128
              schema:
                additionalProperties: false
                type: object
                properties:
                  item:
                    additionalProperties: false
                    type: object
                    properties:
                      certificate:
                        nullable: true
                        type: string
                      certificate_authorities:
                        nullable: true
                        type: string
                      certificate_key:
                        nullable: true
                        type: string
                      id:
                        type: string
                      is_preconfigured:
                        default: false
                        type: boolean
                      name:
                        type: string
                      proxy_headers:
                        additionalProperties:
                          anyOf:
                            - type: string
                            - type: boolean
                            - type: number
                        nullable: true
                        type: object
                      url:
                        type: string
                    required:
                      - id
                      - url
                      - name
                required:
                  - item
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
        '404':
          content:
            application/json:
              examples:
                notFoundExample:
                  description: No proxy was found with the given ID
                  value:
                    error: Not Found
                    message: Proxy proxy-id-1 not found
                    statusCode: 404
          description: Not Found
      summary: Update a proxy
      tags:
        - Fleet proxies
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/remote_synced_integrations/{outputId}/remote_status:
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/remote_synced_integrations/{outputId}/remote_status</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Get the synchronization status of remote integrations for a specific output by its ID.<br/><br/>[Required authorization] Route required privileges: fleet-settings-read AND integrations-read.
      operationId: get-fleet-remote-synced-integrations-outputid-remote-status
      parameters:
        - description: The ID of the output
          in: path
          name: outputId
          required: true
          schema:
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                getRemoteSyncedIntegrationsInfoExample:
                  description: Synchronization status of remote integrations for a specific output
                  value:
                    integrations:
                      - id: nginx-remote
                        install_status:
                          main: installed
                          remote: installed
                        package_name: nginx
                        package_version: 1.20.0
                        sync_status: COMPLETED
                        updated_at: '2024-01-01T00:00:00.000Z'
              schema:
                additionalProperties: false
                type: object
                properties:
                  custom_assets:
                    additionalProperties:
                      additionalProperties: false
                      type: object
                      properties:
                        error:
                          type: string
                        is_deleted:
                          type: boolean
                        name:
                          type: string
                        package_name:
                          type: string
                        package_version:
                          type: string
                        sync_status:
                          enum:
                            - completed
                            - synchronizing
                            - failed
                            - warning
                          type: string
                        type:
                          type: string
                        warning:
                          additionalProperties: false
                          type: object
                          properties:
                            message:
                              type: string
                            title:
                              type: string
                          required:
                            - title
                      required:
                        - type
                        - name
                        - package_name
                        - package_version
                        - sync_status
                    type: object
                  error:
                    type: string
                  integrations:
                    items:
                      additionalProperties: false
                      type: object
                      properties:
                        error:
                          type: string
                        id:
                          type: string
                        install_status:
                          additionalProperties: false
                          type: object
                          properties:
                            main:
                              type: string
                            remote:
                              type: string
                          required:
                            - main
                        package_name:
                          type: string
                        package_version:
                          type: string
                        sync_status:
                          enum:
                            - completed
                            - synchronizing
                            - failed
                            - warning
                          type: string
                        updated_at:
                          type: string
                        warning:
                          additionalProperties: false
                          type: object
                          properties:
                            message:
                              type: string
                            title:
                              type: string
                          required:
                            - title
                      required:
                        - sync_status
                        - install_status
                    maxItems: 10000
                    type: array
                  warning:
                    additionalProperties: false
                    type: object
                    properties:
                      message:
                        type: string
                      title:
                        type: string
                    required:
                      - title
                required:
                  - integrations
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
      summary: Get remote synced integrations status by outputId
      tags:
        - Fleet remote synced integrations
      x-state: Generally available; added in 9.1.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/remote_synced_integrations/status:
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/remote_synced_integrations/status</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Get the synchronization status of all remote integrations across connected remote clusters.<br/><br/>[Required authorization] Route required privileges: fleet-settings-read AND integrations-read.
      operationId: get-fleet-remote-synced-integrations-status
      parameters: []
      responses:
        '200':
          content:
            application/json:
              examples:
                getRemoteSyncedIntegrationsStatusExample:
                  description: Synchronization status of remote integrations across connected remote clusters
                  value:
                    integrations:
                      - id: nginx-remote
                        install_status:
                          main: installed
                          remote: installed
                        package_name: nginx
                        package_version: 1.20.0
                        sync_status: COMPLETED
                        updated_at: '2024-01-01T00:00:00.000Z'
                      - error: Failed to sync package to remote cluster
                        id: system-remote
                        install_status:
                          main: installed
                          remote: not_installed
                        package_name: system
                        package_version: 1.38.0
                        sync_status: FAILED
                        updated_at: '2024-01-01T00:00:00.000Z'
              schema:
                additionalProperties: false
                type: object
                properties:
                  custom_assets:
                    additionalProperties:
                      additionalProperties: false
                      type: object
                      properties:
                        error:
                          type: string
                        is_deleted:
                          type: boolean
                        name:
                          type: string
                        package_name:
                          type: string
                        package_version:
                          type: string
                        sync_status:
                          enum:
                            - completed
                            - synchronizing
                            - failed
                            - warning
                          type: string
                        type:
                          type: string
                        warning:
                          additionalProperties: false
                          type: object
                          properties:
                            message:
                              type: string
                            title:
                              type: string
                          required:
                            - title
                      required:
                        - type
                        - name
                        - package_name
                        - package_version
                        - sync_status
                    type: object
                  error:
                    type: string
                  integrations:
                    items:
                      additionalProperties: false
                      type: object
                      properties:
                        error:
                          type: string
                        id:
                          type: string
                        install_status:
                          additionalProperties: false
                          type: object
                          properties:
                            main:
                              type: string
                            remote:
                              type: string
                          required:
                            - main
                        package_name:
                          type: string
                        package_version:
                          type: string
                        sync_status:
                          enum:
                            - completed
                            - synchronizing
                            - failed
                            - warning
                          type: string
                        updated_at:
                          type: string
                        warning:
                          additionalProperties: false
                          type: object
                          properties:
                            message:
                              type: string
                            title:
                              type: string
                          required:
                            - title
                      required:
                        - sync_status
                        - install_status
                    maxItems: 10000
                    type: array
                  warning:
                    additionalProperties: false
                    type: object
                    properties:
                      message:
                        type: string
                      title:
                        type: string
                    required:
                      - title
                required:
                  - integrations
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
      summary: Get remote synced integrations status
      tags:
        - Fleet remote synced integrations
      x-state: Generally available; added in 9.1.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/service_tokens:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/service_tokens</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Create a Fleet Server service token. The token is used to enroll Fleet Server instances with Kibana.<br/><br/>[Required authorization] Route required privileges: fleet-agents-all.
      operationId: post-fleet-service-tokens
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
      requestBody:
        content:
          application/json:
            examples:
              postGenerateServiceTokenRequestExample:
                description: Generate a service token for a remote Fleet Server
                value:
                  remote: true
            schema:
              additionalProperties: false
              default: null
              nullable: true
              type: object
              properties:
                remote:
                  default: false
                  type: boolean
      responses:
        '200':
          content:
            application/json:
              examples:
                postGenerateServiceTokenExample:
                  description: The generated Fleet Server service token
                  value:
                    name: elastic/fleet-server/token-1234567890
                    value: AAEAAWVsYXN0aWMvZmxlZXQtc2VydmVyL3Rva2VuLTEyMzQ1Njc4OTA6QUJDREVGR0hJSktMTU5P
              schema:
                additionalProperties: false
                type: object
                properties:
                  name:
                    type: string
                  value:
                    type: string
                required:
                  - name
                  - value
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
      summary: Create a service token
      tags:
        - Fleet service tokens
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/settings:
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/settings</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Get the global Fleet settings.<br/><br/>[Required authorization] Route required privileges: fleet-settings-read.
      operationId: get-fleet-settings
      parameters: []
      responses:
        '200':
          content:
            application/json:
              examples:
                getSettingsExample:
                  description: The current Fleet settings
                  value:
                    item:
                      delete_unenrolled_agents:
                        enabled: false
                        is_preconfigured: false
                      has_seen_add_data_notice: true
                      id: fleet-default-settings
                      otlp_output_requirements_met: true
                      output_secret_storage_requirements_met: true
                      prerelease_integrations_enabled: false
                      secret_storage_requirements_met: true
                      version: WzEsMV0=
              schema:
                additionalProperties: false
                type: object
                properties:
                  item:
                    additionalProperties: false
                    type: object
                    properties:
                      action_secret_storage_requirements_met:
                        type: boolean
                      delete_unenrolled_agents:
                        additionalProperties: false
                        type: object
                        properties:
                          enabled:
                            type: boolean
                          is_preconfigured:
                            type: boolean
                        required:
                          - enabled
                          - is_preconfigured
                      download_source_auth_secret_storage_requirements_met:
                        type: boolean
                      has_seen_add_data_notice:
                        type: boolean
                      id:
                        type: string
                      ilm_migration_status:
                        additionalProperties: false
                        type: object
                        properties:
                          logs:
                            enum:
                              - success
                              - null
                            nullable: true
                            type: string
                          metrics:
                            enum:
                              - success
                              - null
                            nullable: true
                            type: string
                          synthetics:
                            enum:
                              - success
                              - null
                            nullable: true
                            type: string
                      integration_knowledge_enabled:
                        type: boolean
                      otlp_output_requirements_met:
                        type: boolean
                      output_secret_storage_requirements_met:
                        type: boolean
                      preconfigured_fields:
                        items:
                          enum:
                            - fleet_server_hosts
                          type: string
                        maxItems: 1
                        type: array
                      prerelease_integrations_enabled:
                        type: boolean
                      secret_storage_requirements_met:
                        type: boolean
                      ssl_secret_storage_requirements_met:
                        type: boolean
                      use_space_awareness_migration_started_at:
                        nullable: true
                        type: string
                      use_space_awareness_migration_status:
                        enum:
                          - pending
                          - success
                          - error
                        type: string
                      version:
                        type: string
                required:
                  - item
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
        '404':
          content:
            application/json:
              examples:
                notFoundExample:
                  description: Fleet settings have not been initialized
                  value:
                    error: Not Found
                    message: Settings not found
                    statusCode: 404
              schema:
                additionalProperties: false
                type: object
                properties:
                  message:
                    type: string
                required:
                  - message
          description: Not Found
      summary: Get settings
      tags:
        - Fleet internals
      x-metaTags:
        - content: Kibana
          name: product_name
    put:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb put">put</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/settings</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Update the global Fleet settings.<br/><br/>[Required authorization] Route required privileges: fleet-settings-all.
      operationId: put-fleet-settings
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
      requestBody:
        content:
          application/json:
            examples:
              putSettingsRequestExample:
                description: Update Fleet settings to enable pre-release integrations
                value:
                  prerelease_integrations_enabled: true
            schema:
              additionalProperties: false
              type: object
              properties:
                additional_yaml_config:
                  deprecated: true
                  type: string
                delete_unenrolled_agents:
                  additionalProperties: false
                  type: object
                  properties:
                    enabled:
                      type: boolean
                    is_preconfigured:
                      type: boolean
                  required:
                    - enabled
                    - is_preconfigured
                has_seen_add_data_notice:
                  deprecated: true
                  type: boolean
                integration_knowledge_enabled:
                  type: boolean
                kibana_ca_sha256:
                  deprecated: true
                  type: string
                kibana_urls:
                  deprecated: true
                  items:
                    format: uri
                    type: string
                  maxItems: 10
                  type: array
                prerelease_integrations_enabled:
                  type: boolean
      responses:
        '200':
          content:
            application/json:
              examples:
                putSettingsExample:
                  description: The updated Fleet settings
                  value:
                    item:
                      delete_unenrolled_agents:
                        enabled: false
                        is_preconfigured: false
                      has_seen_add_data_notice: true
                      id: fleet-default-settings
                      otlp_output_requirements_met: true
                      output_secret_storage_requirements_met: true
                      prerelease_integrations_enabled: true
                      secret_storage_requirements_met: true
                      version: WzIsMV0=
              schema:
                additionalProperties: false
                type: object
                properties:
                  item:
                    additionalProperties: false
                    type: object
                    properties:
                      action_secret_storage_requirements_met:
                        type: boolean
                      delete_unenrolled_agents:
                        additionalProperties: false
                        type: object
                        properties:
                          enabled:
                            type: boolean
                          is_preconfigured:
                            type: boolean
                        required:
                          - enabled
                          - is_preconfigured
                      download_source_auth_secret_storage_requirements_met:
                        type: boolean
                      has_seen_add_data_notice:
                        type: boolean
                      id:
                        type: string
                      ilm_migration_status:
                        additionalProperties: false
                        type: object
                        properties:
                          logs:
                            enum:
                              - success
                              - null
                            nullable: true
                            type: string
                          metrics:
                            enum:
                              - success
                              - null
                            nullable: true
                            type: string
                          synthetics:
                            enum:
                              - success
                              - null
                            nullable: true
                            type: string
                      integration_knowledge_enabled:
                        type: boolean
                      otlp_output_requirements_met:
                        type: boolean
                      output_secret_storage_requirements_met:
                        type: boolean
                      preconfigured_fields:
                        items:
                          enum:
                            - fleet_server_hosts
                          type: string
                        maxItems: 1
                        type: array
                      prerelease_integrations_enabled:
                        type: boolean
                      secret_storage_requirements_met:
                        type: boolean
                      ssl_secret_storage_requirements_met:
                        type: boolean
                      use_space_awareness_migration_started_at:
                        nullable: true
                        type: string
                      use_space_awareness_migration_status:
                        enum:
                          - pending
                          - success
                          - error
                        type: string
                      version:
                        type: string
                required:
                  - item
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
        '404':
          content:
            application/json:
              examples:
                notFoundExample:
                  description: Fleet settings have not been initialized
                  value:
                    error: Not Found
                    message: Settings not found
                    statusCode: 404
              schema:
                additionalProperties: false
                type: object
                properties:
                  message:
                    type: string
                required:
                  - message
          description: Not Found
      summary: Update settings
      tags:
        - Fleet internals
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/setup:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/setup</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Initialize Fleet and create the necessary Elasticsearch resources for Fleet to operate. Safe to call multiple times (idempotent). Returns the initialization status and any non-fatal errors encountered during setup.<br/><br/>[Required authorization] Route required privileges: fleet-agents-read OR fleet-agent-policies-read OR fleet-settings-read OR fleet-setup.
      operationId: post-fleet-setup
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                fleetSetupSuccessExample:
                  description: Fleet initialized successfully with no non-fatal errors
                  value:
                    isInitialized: true
                    nonFatalErrors: []
                fleetSetupWithNonFatalErrorsExample:
                  description: Fleet initialized but encountered non-fatal errors during setup
                  value:
                    isInitialized: true
                    nonFatalErrors:
                      - message: Package fleet_server not found in registry
                        name: PackageNotFoundError
              schema:
                additionalProperties: false
                description: A summary of the result of Fleet's `setup` lifecycle. If `isInitialized` is true, Fleet is ready to accept agent enrollment. `nonFatalErrors` may include useful insight into non-blocking issues with Fleet setup.
                type: object
                properties:
                  isInitialized:
                    type: boolean
                  nonFatalErrors:
                    items:
                      additionalProperties: false
                      type: object
                      properties:
                        message:
                          type: string
                        name:
                          type: string
                      required:
                        - name
                        - message
                    maxItems: 10000
                    type: array
                required:
                  - isInitialized
                  - nonFatalErrors
          description: Fleet setup completed
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
        '500':
          content:
            application/json:
              examples:
                internalErrorResponseExample:
                  description: Example of an internal server error response
                  value:
                    error: Internal Server Error
                    message: An error message describing what went wrong
                    statusCode: 500
              schema:
                additionalProperties: false
                description: Internal Server Error
                type: object
                properties:
                  message:
                    type: string
                required:
                  - message
          description: Internal Server Error
      summary: Initiate Fleet setup
      tags:
        - Fleet internals
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/space_settings:
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/space_settings</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Get the Fleet settings for the current Kibana space.
      operationId: get-fleet-space-settings
      parameters: []
      responses:
        '200':
          content:
            application/json:
              examples:
                getSpaceSettingsExample:
                  description: The Fleet settings for the current Kibana space
                  value:
                    item:
                      allowed_namespace_prefixes:
                        - team-a
                        - team-b
              schema:
                additionalProperties: false
                type: object
                properties:
                  item:
                    additionalProperties: false
                    type: object
                    properties:
                      allowed_namespace_prefixes:
                        items:
                          type: string
                        maxItems: 100
                        type: array
                      managed_by:
                        type: string
                    required:
                      - allowed_namespace_prefixes
                required:
                  - item
          description: Successful response
      summary: Get space settings
      tags:
        - Fleet internals
      x-state: Generally available; added in 9.1.0
      x-metaTags:
        - content: Kibana
          name: product_name
    put:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb put">put</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/space_settings</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Create or update Fleet settings for the current Kibana space.<br/><br/>[Required authorization] Route required privileges: fleet-settings-all.
      operationId: put-fleet-space-settings
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
      requestBody:
        content:
          application/json:
            examples:
              putSpaceSettingsRequestExample:
                description: Update allowed namespace prefixes for the current Kibana space
                value:
                  allowed_namespace_prefixes:
                    - team-a
                    - team-b
            schema:
              additionalProperties: false
              type: object
              properties:
                allowed_namespace_prefixes:
                  items:
                    type: string
                  maxItems: 10
                  type: array
      responses:
        '200':
          content:
            application/json:
              examples:
                putSpaceSettingsExample:
                  description: The updated Fleet settings for the current Kibana space
                  value:
                    item:
                      allowed_namespace_prefixes:
                        - team-a
                        - team-b
              schema:
                additionalProperties: false
                type: object
                properties:
                  item:
                    additionalProperties: false
                    type: object
                    properties:
                      allowed_namespace_prefixes:
                        items:
                          type: string
                        maxItems: 100
                        type: array
                      managed_by:
                        type: string
                    required:
                      - allowed_namespace_prefixes
                required:
                  - item
          description: Successful response
      summary: Create space settings
      tags:
        - Fleet internals
      x-state: Generally available; added in 9.1.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/uninstall_tokens:
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/uninstall_tokens</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        List the metadata for the latest uninstall tokens per agent policy.<br/><br/>[Required authorization] Route required privileges: fleet-agents-all.
      operationId: get-fleet-uninstall-tokens
      parameters:
        - description: Partial match filtering for policy IDs
          in: query
          name: policyId
          required: false
          schema:
            maxLength: 50
            type: string
        - description: Partial match filtering for uninstall token values
          in: query
          name: search
          required: false
          schema:
            maxLength: 50
            type: string
        - description: The number of items to return
          in: query
          name: perPage
          required: false
          schema:
            minimum: 5
            type: number
        - description: Page number
          in: query
          name: page
          required: false
          schema:
            minimum: 1
            type: number
      responses:
        '200':
          content:
            application/json:
              examples:
                getUninstallTokensExample:
                  description: List of uninstall token metadata for agent policies
                  value:
                    items:
                      - created_at: '2024-01-01T00:00:00.000Z'
                        id: token-id-1
                        namespaces:
                          - default
                        policy_id: policy-id-1
                        policy_name: Default policy
                      - created_at: '2024-01-02T00:00:00.000Z'
                        id: token-id-2
                        namespaces:
                          - production
                        policy_id: policy-id-2
                        policy_name: Production policy
                    page: 1
                    perPage: 20
                    total: 2
              schema:
                additionalProperties: false
                type: object
                properties:
                  items:
                    items:
                      additionalProperties: false
                      type: object
                      properties:
                        created_at:
                          type: string
                        id:
                          type: string
                        namespaces:
                          items:
                            type: string
                          maxItems: 100
                          type: array
                        policy_id:
                          type: string
                        policy_name:
                          nullable: true
                          type: string
                      required:
                        - id
                        - policy_id
                        - created_at
                    maxItems: 10000
                    type: array
                  page:
                    type: number
                  perPage:
                    type: number
                  total:
                    type: number
                required:
                  - items
                  - total
                  - page
                  - perPage
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                conflictingQueryParamsExample:
                  description: Both policyId and search query parameters were provided
                  value:
                    error: Bad Request
                    message: Query parameters `policyId` and `search` cannot be used at the same time.
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
      summary: Get metadata for latest uninstall tokens
      tags:
        - Fleet uninstall tokens
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/uninstall_tokens/{agentPolicyId}/rotate:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/uninstall_tokens/{agentPolicyId}/rotate</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Rotate the uninstall token for an agent policy. Only applicable to policies with tamper protection enabled.<br/><br/>[Required authorization] Route required privileges: fleet-agents-all.
      operationId: post-fleet-uninstall-tokens-agentpolicyid-rotate
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: The ID of the agent policy whose uninstall token should be rotated
          in: path
          name: agentPolicyId
          required: true
          schema:
            maxLength: 255
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                rotateUninstallTokenExample:
                  description: Uninstall token rotated successfully for the given agent policy
                  value:
                    message: Uninstall token rotated successfully.
              schema:
                additionalProperties: false
                type: object
                properties:
                  message:
                    type: string
                required:
                  - message
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
                notProtectedExample:
                  description: Agent policy does not have tamper protection enabled
                  value:
                    error: Bad Request
                    message: Agent policy [policy-id-1] does not have tamper protection enabled. Uninstall tokens can only be rotated for protected policies.
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
        '404':
          content:
            application/json:
              examples:
                notFoundExample:
                  description: No agent policy was found with the given ID
                  value:
                    error: Not Found
                    message: Agent policy not found with id policy-id-1
                    statusCode: 404
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Not Found
      summary: Rotate an uninstall token
      tags:
        - Fleet uninstall tokens
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/uninstall_tokens/{uninstallTokenId}:
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/fleet/uninstall_tokens/{uninstallTokenId}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Get one decrypted uninstall token by its ID.<br/><br/>[Required authorization] Route required privileges: fleet-agents-all.
      operationId: get-fleet-uninstall-tokens-uninstalltokenid
      parameters:
        - description: The ID of the uninstall token
          in: path
          name: uninstallTokenId
          required: true
          schema:
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                getUninstallTokenExample:
                  description: Decrypted uninstall token for an agent policy
                  value:
                    item:
                      created_at: '2024-01-01T00:00:00.000Z'
                      id: token-id-1
                      namespaces:
                        - default
                      policy_id: policy-id-1
                      policy_name: Default policy
                      token: CKHJsJcBqNwIRcRBNDaE
              schema:
                additionalProperties: false
                type: object
                properties:
                  item:
                    additionalProperties: false
                    type: object
                    properties:
                      created_at:
                        type: string
                      id:
                        type: string
                      namespaces:
                        items:
                          type: string
                        maxItems: 100
                        type: array
                      policy_id:
                        type: string
                      policy_name:
                        nullable: true
                        type: string
                      token:
                        type: string
                    required:
                      - id
                      - policy_id
                      - created_at
                      - token
                required:
                  - item
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Generic Error
                type: object
                properties:
                  attributes:
                    nullable: true
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                required:
                  - message
                  - attributes
          description: Bad Request
        '404':
          content:
            application/json:
              examples:
                notFoundExample:
                  description: No uninstall token was found with the given ID
                  value:
                    error: Not Found
                    message: Uninstall Token not found with ID token-id-1
                    statusCode: 404
          description: Not Found
      summary: Get a decrypted uninstall token
      tags:
        - Fleet uninstall tokens
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/links:
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/links</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Returns a paginated list of links library items. Each result includes title, description, and metadata. Use `GET /api/links/{id}` to retrieve the complete state.
      operationId: get-links
      parameters:
        - description: The page of results to return.
          in: query
          name: page
          required: false
          schema:
            default: 1
            minimum: 1
            type: number
        - description: The number of results to return per page.
          in: query
          name: per_page
          required: false
          schema:
            default: 20
            maximum: 1000
            minimum: 1
            type: number
        - description: Filters results by `title` and `description` using Elasticsearch [`simple_query_string`](https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-simple-query-string-query) syntax. Multi-word terms require all words to match.
          in: query
          name: query
          required: false
          schema:
            type: string
        - description: A tag ID to include. Accepts a single tag ID or multiple tag IDs. When multiple are specified, library items matching any of the tag IDs are included.
          in: query
          name: tags
          required: false
          schema:
            default: []
            description: Tag IDs associated with this dashboard.
            items:
              maxLength: 250
              type: string
            maxItems: 100
            type: array
        - description: A tag ID to exclude. Accepts a single tag ID or multiple tag IDs. When multiple are specified, library items matching any of the tag IDs are excluded.
          in: query
          name: excluded_tags
          required: false
          schema:
            default: []
            description: Tag IDs associated with this dashboard.
            items:
              maxLength: 250
              type: string
            maxItems: 100
            type: array
        - description: A tag name to include. Accepts a single tag name or multiple tag names. When multiple are specified, library items matching any of the tag names are included. If the same name is shared by multiple tags, items matching any of those tags are included.
          in: query
          name: tag_names
          required: false
          schema:
            items:
              type: string
            maxItems: 100
            type: array
            x-state: Generally available; added in 9.6.0
        - description: A tag name to exclude. Accepts a single tag name or multiple tag names. When multiple are specified, library items matching any of the tag names are excluded. If the same name is shared by multiple tags, items matching any of those tags are excluded.
          in: query
          name: excluded_tag_names
          required: false
          schema:
            items:
              type: string
            maxItems: 100
            type: array
            x-state: Generally available; added in 9.6.0
      responses:
        '200':
          content:
            application/json:
              examples:
                searchLinks:
                  description: Returns a paginated list of links library items. Each result includes title, description, and metadata. Use `GET /api/links/{id}` to retrieve the complete state.
                  summary: Search links library items response
                  value:
                    data:
                      - data:
                          description: A collection of important links
                          title: Important Resources
                        id: 0ee9d0ea-06a0-4a30-bf4e-be4d3ca85bf3
                        meta:
                          created_at: '2026-06-03T23:33:39.979Z'
                          created_by: u_EWATCHX9oIEsmcXj8aA1FkcaY3DE-XEpsiGTjrR2PmM_0
                          managed: false
                          updated_at: '2026-06-03T23:33:39.979Z'
                          updated_by: u_EWATCHX9oIEsmcXj8aA1FkcaY3DE-XEpsiGTjrR2PmM_0
                          version: WzEwNywxXQ==
                    meta:
                      page: 1
                      per_page: 20
                      total: 1
              schema:
                additionalProperties: false
                type: object
                properties:
                  data:
                    description: List of links library items matching the query.
                    items:
                      additionalProperties: false
                      type: object
                      properties:
                        data:
                          additionalProperties: false
                          type: object
                          properties:
                            description:
                              description: A short description of the links library item.
                              maxLength: 10000
                              type: string
                            title:
                              description: The links library item title.
                              maxLength: 1000
                              type: string
                          required:
                            - title
                        id:
                          maxLength: 250
                          type: string
                        meta:
                          $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-as-code-meta'
                      required:
                        - id
                        - data
                        - meta
                    maxItems: 1000
                    minItems: 0
                    type: array
                  meta:
                    additionalProperties: false
                    type: object
                    properties:
                      page:
                        default: 1
                        description: The returned page of results.
                        minimum: 1
                        type: number
                      per_page:
                        default: 20
                        description: The number of results returned per page.
                        maximum: 1000
                        minimum: 1
                        type: number
                      total:
                        description: The total number of results matching the query.
                        type: number
                    required:
                      - total
                required:
                  - data
                  - meta
          description: success
        '403':
          description: forbidden
      summary: List links library items
      tags:
        - Links
      x-codeSamples:
        - label: Search links library items - cURL
          lang: cURL
          source: |
            curl -X GET "${KIBANA_URL}/api/links?query=welcome&per_page=10" \
              -H "Authorization: ApiKey ${API_KEY}"
        - label: Search links library items - Console
          lang: Console
          source: |
            GET kbn:/api/links?query=welcome&per_page=10
      x-state: Experimental; added in 9.6.0
      x-metaTags:
        - content: Kibana
          name: product_name
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/links</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Creates a new links library item and returns its ID, full state, and metadata.
      operationId: post-links
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
      requestBody:
        content:
          application/json:
            examples:
              createLinks:
                summary: Create a links library item
                value:
                  description: A collection of important links
                  layout: horizontal
                  links:
                    - destination: dashboard-abc-123
                      label: Overview
                      type: dashboardLink
                    - destination: https://www.elastic.co/docs
                      label: Elastic Documentation
                      type: externalLink
                  title: Important Resources
            schema:
              additionalProperties: false
              type: object
              properties:
                description:
                  type: string
                layout:
                  description: Whether to display the links in a horizontal or vertical layout.
                  enum:
                    - horizontal
                    - vertical
                  type: string
                links:
                  description: The list of links to display.
                  items:
                    discriminator:
                      mapping:
                        dashboardLink: '#/components/schemas/Kibana_HTTP_APIs_kbn-link-panel-type-dashboardLink'
                        externalLink: '#/components/schemas/Kibana_HTTP_APIs_kbn-link-type-externalLink'
                      propertyName: type
                    oneOf:
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-link-panel-type-dashboardLink'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-link-type-externalLink'
                  maxItems: 100
                  type: array
                tags:
                  default: []
                  description: Tag IDs associated with this library item.
                  items:
                    maxLength: 250
                    type: string
                  maxItems: 1000
                  type: array
                title:
                  type: string
              required:
                - links
                - title
      responses:
        '201':
          content:
            application/json:
              examples:
                createLinks:
                  description: Creates a new links library item and returns its ID, full state, and metadata.
                  summary: Create links library item response
                  value:
                    data:
                      description: A collection of important links
                      layout: horizontal
                      links:
                        - destination: dashboard-abc-123
                          label: Overview
                          options:
                            open_in_new_tab: false
                            use_filters: true
                            use_time_range: true
                          type: dashboardLink
                        - destination: https://www.elastic.co/docs
                          label: Elastic Documentation
                          options:
                            encode_url: true
                            open_in_new_tab: true
                          type: externalLink
                      title: Important Resources
                    id: 0ee9d0ea-06a0-4a30-bf4e-be4d3ca85bf3
                    meta:
                      created_at: '2026-06-03T23:33:39.979Z'
                      created_by: u_EWATCHX9oIEsmcXj8aA1FkcaY3DE-XEpsiGTjrR2PmM_0
                      managed: false
                      updated_at: '2026-06-03T23:33:39.979Z'
                      updated_by: u_EWATCHX9oIEsmcXj8aA1FkcaY3DE-XEpsiGTjrR2PmM_0
                      version: WzEwNywxXQ==
              schema:
                additionalProperties: false
                type: object
                properties:
                  data:
                    additionalProperties: false
                    type: object
                    properties:
                      description:
                        type: string
                      layout:
                        description: Whether to display the links in a horizontal or vertical layout.
                        enum:
                          - horizontal
                          - vertical
                        type: string
                      links:
                        description: The list of links to display.
                        items:
                          discriminator:
                            mapping:
                              dashboardLink: '#/components/schemas/Kibana_HTTP_APIs_kbn-link-panel-type-dashboardLink'
                              externalLink: '#/components/schemas/Kibana_HTTP_APIs_kbn-link-type-externalLink'
                            propertyName: type
                          oneOf:
                            - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-link-panel-type-dashboardLink'
                            - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-link-type-externalLink'
                        maxItems: 100
                        type: array
                      tags:
                        default: []
                        description: Tag IDs associated with this library item.
                        items:
                          maxLength: 250
                          type: string
                        maxItems: 1000
                        type: array
                      title:
                        type: string
                    required:
                      - links
                      - title
                  id:
                    description: The unique ID of the links library item, as returned by the create or search endpoints.
                    type: string
                  meta:
                    $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-as-code-meta'
                required:
                  - id
                  - data
                  - meta
          description: created
        '400':
          description: invalid request
        '403':
          description: forbidden
      summary: Create a links library item
      tags:
        - Links
      x-codeSamples:
        - label: Create a links library item - cURL
          lang: curl
          source: |-
            curl \
              -X POST "${KIBANA_URL}/api/links" \
              -H "Authorization: ApiKey ${API_KEY}" \
              -H "kbn-xsrf: true" \
              -H "Content-Type: application/json" \
              -d '{
              "title": "Important Resources",
              "description": "A collection of important links",
              "links": [
                {
                  "label": "Overview",
                  "type": "dashboardLink",
                  "destination": "dashboard-abc-123"
                },
                {
                  "label": "Elastic Documentation",
                  "type": "externalLink",
                  "destination": "https://www.elastic.co/docs"
                }
              ],
              "layout": "horizontal"
            }'
        - label: Create a links library item - Console
          lang: Console
          source: |
            POST kbn:/api/links
            {
              "summary": "Create a links library item",
              "value": {
                "title": "Important Resources",
                "description": "A collection of important links",
                "links": [
                  {
                    "label": "Overview",
                    "type": "dashboardLink",
                    "destination": "dashboard-abc-123"
                  },
                  {
                    "label": "Elastic Documentation",
                    "type": "externalLink",
                    "destination": "https://www.elastic.co/docs"
                  }
                ],
                "layout": "horizontal"
              }
            }
      x-state: Experimental; added in 9.6.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/links/{id}:
    delete:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb delete">delete</span>&nbsp;<span class="operation-path">/s/{space_id}/api/links/{id}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Permanently deletes a links library item by ID.
      operationId: delete-links-id
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: The unique ID of the links library item, as returned by the create or search endpoints.
          in: path
          name: id
          required: true
          schema:
            maxLength: 250
            type: string
      responses:
        '204':
          description: No content, the links library item was successfully deleted.
        '400':
          description: invalid request
        '403':
          description: forbidden
        '404':
          description: A links library item with the given ID was not found.
      summary: Delete a links library item
      tags:
        - Links
      x-codeSamples:
        - label: Delete a links library item - cURL
          lang: cURL
          source: |
            curl -X DELETE "${KIBANA_URL}/api/links/0ee9d0ea-06a0-4a30-bf4e-be4d3ca85bf3" \
              -H "Authorization: ApiKey ${API_KEY}" \
              -H "kbn-xsrf: true"
        - label: Delete a links library item - Console
          lang: Console
          source: |
            DELETE kbn:/api/links/0ee9d0ea-06a0-4a30-bf4e-be4d3ca85bf3
      x-state: Experimental; added in 9.6.0
      x-metaTags:
        - content: Kibana
          name: product_name
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/links/{id}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Returns the complete state of a links library item by ID.
      operationId: get-links-id
      parameters:
        - description: The unique ID of the links library item, as returned by the create or search endpoints.
          in: path
          name: id
          required: true
          schema:
            maxLength: 250
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                getLinksResponse:
                  description: The full links library item state including `links`, `layout`, `title`, `description`, and metadata.
                  summary: Get links library item response
                  value:
                    data:
                      description: A collection of important links
                      layout: horizontal
                      links:
                        - destination: dashboard-abc-123
                          label: Overview
                          options:
                            open_in_new_tab: false
                            use_filters: true
                            use_time_range: true
                          type: dashboardLink
                        - destination: https://www.elastic.co/docs
                          label: Elastic Documentation
                          options:
                            encode_url: true
                            open_in_new_tab: true
                          type: externalLink
                      title: Important Resources
                    id: 0ee9d0ea-06a0-4a30-bf4e-be4d3ca85bf3
                    meta:
                      created_at: '2026-04-13T10:00:00.000Z'
                      managed: false
                      updated_at: '2026-04-13T10:00:00.000Z'
                      version: WzU5LDFd
              schema:
                additionalProperties: false
                type: object
                properties:
                  data:
                    additionalProperties: false
                    type: object
                    properties:
                      description:
                        type: string
                      layout:
                        description: Whether to display the links in a horizontal or vertical layout.
                        enum:
                          - horizontal
                          - vertical
                        type: string
                      links:
                        description: The list of links to display.
                        items:
                          discriminator:
                            mapping:
                              dashboardLink: '#/components/schemas/Kibana_HTTP_APIs_kbn-link-panel-type-dashboardLink'
                              externalLink: '#/components/schemas/Kibana_HTTP_APIs_kbn-link-type-externalLink'
                            propertyName: type
                          oneOf:
                            - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-link-panel-type-dashboardLink'
                            - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-link-type-externalLink'
                        maxItems: 100
                        type: array
                      tags:
                        default: []
                        description: Tag IDs associated with this library item.
                        items:
                          maxLength: 250
                          type: string
                        maxItems: 1000
                        type: array
                      title:
                        type: string
                    required:
                      - links
                      - title
                  id:
                    description: The unique ID of the links library item, as returned by the create or search endpoints.
                    maxLength: 250
                    type: string
                  meta:
                    $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-as-code-meta'
                required:
                  - id
                  - data
                  - meta
          description: success
        '403':
          description: forbidden
        '404':
          description: A links library item with the given ID was not found.
      summary: Get a links library item by ID
      tags:
        - Links
      x-codeSamples:
        - label: Get a links library item - cURL
          lang: cURL
          source: |
            curl -X GET "${KIBANA_URL}/api/links/0ee9d0ea-06a0-4a30-bf4e-be4d3ca85bf3" \
              -H "Authorization: ApiKey ${API_KEY}"
        - label: Get a links library item - Console
          lang: Console
          source: |
            GET kbn:/api/links/0ee9d0ea-06a0-4a30-bf4e-be4d3ca85bf3
      x-state: Experimental; added in 9.6.0
      x-metaTags:
        - content: Kibana
          name: product_name
    put:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb put">put</span>&nbsp;<span class="operation-path">/s/{space_id}/api/links/{id}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Replaces the full state of a links library item. Partial updates are not supported.
        To make incremental changes, retrieve the item first, modify the fields you need, then send the complete object back.

        If no item exists with the specified ID, a new one is created.
      operationId: put-links-id
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: The unique ID of the links library item to be created or updated
          in: path
          name: id
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            examples:
              upsertLinks:
                summary: Upsert a links library item
                value:
                  description: A collection of important links
                  layout: vertical
                  links:
                    - destination: dashboard-abc-123
                      label: Overview
                      options:
                        open_in_new_tab: false
                        use_filters: true
                        use_time_range: true
                      type: dashboardLink
                    - destination: https://www.elastic.co/docs
                      label: Elastic Documentation
                      options:
                        encode_url: true
                        open_in_new_tab: true
                      type: externalLink
                  title: Important Resources
            schema:
              additionalProperties: false
              type: object
              properties:
                description:
                  type: string
                layout:
                  description: Whether to display the links in a horizontal or vertical layout.
                  enum:
                    - horizontal
                    - vertical
                  type: string
                links:
                  description: The list of links to display.
                  items:
                    discriminator:
                      mapping:
                        dashboardLink: '#/components/schemas/Kibana_HTTP_APIs_kbn-link-panel-type-dashboardLink'
                        externalLink: '#/components/schemas/Kibana_HTTP_APIs_kbn-link-type-externalLink'
                      propertyName: type
                    oneOf:
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-link-panel-type-dashboardLink'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-link-type-externalLink'
                  maxItems: 100
                  type: array
                tags:
                  default: []
                  description: Tag IDs associated with this library item.
                  items:
                    maxLength: 250
                    type: string
                  maxItems: 1000
                  type: array
                title:
                  type: string
              required:
                - links
                - title
      responses:
        '200':
          content:
            application/json:
              examples:
                upsertLinks:
                  description: The complete updated links library item state after a full replacement. PUT replaces the entire item, so any fields omitted from the request are reset to their defaults.
                  summary: Update links library item response
                  value:
                    data:
                      description: A collection of important links
                      layout: vertical
                      links:
                        - destination: dashboard-abc-123
                          label: Overview
                          options:
                            open_in_new_tab: false
                            use_filters: true
                            use_time_range: true
                          type: dashboardLink
                        - destination: https://www.elastic.co/docs
                          label: Elastic Documentation
                          options:
                            encode_url: true
                            open_in_new_tab: true
                          type: externalLink
                      title: Important Resources
                    id: 0ee9d0ea-06a0-4a30-bf4e-be4d3ca85bf3
                    meta:
                      created_at: '2026-04-13T10:00:00.000Z'
                      managed: false
                      updated_at: '2026-04-13T11:00:00.000Z'
                      version: WzYwLDFd
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_LinksItemResponse'
          description: updated
        '201':
          content:
            application/json:
              examples:
                createdLinks:
                  description: Returned when the upsert created a new item because no item existed with the specified ID.
                  summary: Create links library item response (via upsert)
                  value:
                    data:
                      description: A collection of important links
                      layout: horizontal
                      links:
                        - destination: dashboard-abc-123
                          label: Overview
                          options:
                            open_in_new_tab: false
                            use_filters: true
                            use_time_range: true
                          type: dashboardLink
                        - destination: https://www.elastic.co/docs
                          label: Elastic Documentation
                          options:
                            encode_url: true
                            open_in_new_tab: true
                          type: externalLink
                      title: Important Resources
                    id: 0ee9d0ea-06a0-4a30-bf4e-be4d3ca85bf3
                    meta:
                      created_at: '2026-04-13T10:00:00.000Z'
                      managed: false
                      updated_at: '2026-04-13T10:00:00.000Z'
                      version: WzU5LDFd
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_LinksItemResponse'
          description: created
        '400':
          description: invalid request
        '403':
          description: forbidden
        '409':
          description: conflict
      summary: Upsert links library item
      tags:
        - Links
      x-codeSamples:
        - label: Upsert a links library item - cURL
          lang: curl
          source: |-
            curl \
              -X PUT "${KIBANA_URL}/api/links/0ee9d0ea-06a0-4a30-bf4e-be4d3ca85bf3" \
              -H "Authorization: ApiKey ${API_KEY}" \
              -H "kbn-xsrf: true" \
              -H "Content-Type: application/json" \
              -d '{
              "title": "Important Resources",
              "description": "A collection of important links",
              "links": [
                {
                  "label": "Overview",
                  "type": "dashboardLink",
                  "destination": "dashboard-abc-123",
                  "options": {
                    "open_in_new_tab": false,
                    "use_time_range": true,
                    "use_filters": true
                  }
                },
                {
                  "label": "Elastic Documentation",
                  "type": "externalLink",
                  "destination": "https://www.elastic.co/docs",
                  "options": {
                    "encode_url": true,
                    "open_in_new_tab": true
                  }
                }
              ],
              "layout": "vertical"
            }'
        - label: Upsert a links library item - Console
          lang: Console
          source: |
            PUT kbn:/api/links/0ee9d0ea-06a0-4a30-bf4e-be4d3ca85bf3
            {
              "title": "Important Resources",
              "description": "A collection of important links",
              "links": [
                {
                  "label": "Overview",
                  "type": "dashboardLink",
                  "destination": "dashboard-abc-123",
                  "options": {
                    "open_in_new_tab": false,
                    "use_time_range": true,
                    "use_filters": true
                  }
                },
                {
                  "label": "Elastic Documentation",
                  "type": "externalLink",
                  "destination": "https://www.elastic.co/docs",
                  "options": {
                    "encode_url": true,
                    "open_in_new_tab": true
                  }
                }
              ],
              "layout": "vertical"
            }
      x-state: Experimental; added in 9.6.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/lists:
    delete:
      description: |
        **Spaces method and path for this operation:**

        <div><span class="operation-verb delete">delete</span>&nbsp;<span class="operation-path">/s/{space_id}/api/lists</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Delete a value list using the list ID.
        > info
        > When you delete a list, all of its list items are also deleted.
      operationId: DeleteList
      parameters:
        - description: Value list identifier to delete, including all of its list items.
          in: query
          name: id
          required: true
          schema:
            $ref: '#/components/schemas/Security_Lists_API_ListId'
        - description: Determines whether exception items referencing this value list should be deleted.
          in: query
          name: deleteReferences
          required: false
          schema:
            default: false
            example: false
            type: boolean
        - description: Determines whether to delete value list without performing any additional checks of where this list may be utilized.
          in: query
          name: ignoreReferences
          required: false
          schema:
            default: false
            example: false
            type: boolean
      responses:
        '200':
          content:
            application/json:
              examples:
                ipList:
                  value:
                    _version: WzIsMV0=
                    '@timestamp': '2025-01-08T04:47:34.273Z'
                    created_at: '2025-01-08T04:47:34.273Z'
                    created_by: elastic
                    description: List of bad internet ips.
                    id: 21b01cfb-058d-44b9-838c-282be16c91cd
                    immutable: false
                    name: Bad ips
                    tie_breaker_id: f5508188-b1e9-4e6e-9662-d039a7d89899
                    type: ip
                    updated_at: '2025-01-08T05:39:39.292Z'
                    updated_by: elastic
                    version: 3
              schema:
                $ref: '#/components/schemas/Security_Lists_API_List'
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                badRequest:
                  value:
                    error: Bad Request
                    message: '[request query]: id: Required'
                    statusCode: 400
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
                  - $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
          description: Invalid input data response
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: '[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]'
                    statusCode: 401
              schema:
                $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
          description: Unsuccessful authentication response
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  value:
                    error: Forbidden
                    message: API [DELETE /api/lists?id=ip_list] is unauthorized for user, this action is granted by the Kibana privileges [lists-all]
                    statusCode: 403
              schema:
                $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
          description: Not enough privileges response
        '404':
          content:
            application/json:
              examples:
                notFound:
                  value:
                    message: 'list id: \"ip_list\" was not found'
                    status_code: 404
              schema:
                $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
          description: List not found response
        '500':
          content:
            application/json:
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
              schema:
                $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
          description: Internal server error response
      summary: Delete a value list
      tags:
        - Security Lists API
      x-metaTags:
        - content: Kibana
          name: product_name
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/lists</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Get the details of a value list using the list ID.
      operationId: ReadList
      parameters:
        - description: Value list identifier (`id`) returned when the list was created.
          in: query
          name: id
          required: true
          schema:
            $ref: '#/components/schemas/Security_Lists_API_ListId'
      responses:
        '200':
          content:
            application/json:
              examples:
                ip:
                  value:
                    _version: WzEsMV0=
                    '@timestamp': '2025-01-08T04:47:34.273Z'
                    created_at: '2025-01-08T04:47:34.273Z'
                    created_by: elastic
                    description: This list describes bad internet ip
                    id: ip_list
                    immutable: false
                    name: My bad ips
                    tie_breaker_id: f5508188-b1e9-4e6e-9662-d039a7d89899
                    type: ip
                    updated_at: '2025-01-08T05:21:53.843Z'
                    updated_by: elastic
                    version: 1
              schema:
                $ref: '#/components/schemas/Security_Lists_API_List'
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                badRequest:
                  value:
                    error: Bad Request
                    message: '[request query]: id: Required'
                    statusCode: 400
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
                  - $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
          description: Invalid input data response
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: |-
                      [security_exception
                      	Root causes:
                      		security_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]
                    statusCode: 401
              schema:
                $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
          description: Unsuccessful authentication response
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  value:
                    error: Forbidden
                    message: API [GET /api/lists?id=ip_list] is unauthorized for user, this action is granted by the Kibana privileges [lists-read]
                    statusCode: 403
              schema:
                $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
          description: Not enough privileges response
        '404':
          content:
            application/json:
              examples:
                notFound:
                  value:
                    message: 'list id: \"foo\" not found'
                    status_code: 404
              schema:
                $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
          description: List not found response
        '500':
          content:
            application/json:
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
              schema:
                $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
          description: Internal server error response
      summary: Get value list details
      tags:
        - Security Lists API
      x-metaTags:
        - content: Kibana
          name: product_name
    patch:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb patch">patch</span>&nbsp;<span class="operation-path">/s/{space_id}/api/lists</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Update specific fields of an existing list using the list `id`.
      operationId: PatchList
      requestBody:
        content:
          application/json:
            examples:
              patchName:
                value:
                  id: ip_list
                  name: Bad ips list - UPDATED
            schema:
              example:
                id: ip_list
                name: Bad ips list - UPDATED
              type: object
              properties:
                _version:
                  $ref: '#/components/schemas/Security_Lists_API_ListVersionId'
                description:
                  $ref: '#/components/schemas/Security_Lists_API_ListDescription'
                id:
                  $ref: '#/components/schemas/Security_Lists_API_ListId'
                meta:
                  $ref: '#/components/schemas/Security_Lists_API_ListMetadata'
                name:
                  $ref: '#/components/schemas/Security_Lists_API_ListName'
                version:
                  $ref: '#/components/schemas/Security_Lists_API_ListVersion'
              required:
                - id
        description: Value list's properties
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                ip:
                  value:
                    _version: WzEsMV0=
                    '@timestamp': '2025-01-08T04:47:34.273Z'
                    created_at: '2025-01-08T04:47:34.273Z'
                    created_by: elastic
                    description: This list describes bad internet ips
                    id: ip_list
                    immutable: false
                    name: Bad ips list - UPDATED
                    tie_breaker_id: f5508188-b1e9-4e6e-9662-d039a7d89899
                    type: ip
                    updated_at: '2025-01-08T05:21:53.843Z'
                    updated_by: elastic
                    version: 2
              schema:
                $ref: '#/components/schemas/Security_Lists_API_List'
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                badRequest:
                  value:
                    error: Bad Request
                    message: '[request body]: name: Expected string, received number'
                    statusCode: 400
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
                  - $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
          description: Invalid input data response
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: '[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]'
                    statusCode: 401
              schema:
                $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
          description: Unsuccessful authentication response
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  value:
                    error: Forbidden
                    message: API [PATCH /api/lists] is unauthorized for user, this action is granted by the Kibana privileges [lists-all]
                    statusCode: 403
              schema:
                $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
          description: Not enough privileges response
        '404':
          content:
            application/json:
              examples:
                notFound:
                  value:
                    message: 'list id: \"foo\" not found'
                    status_code: 404
              schema:
                $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
          description: List not found response
        '500':
          content:
            application/json:
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
              schema:
                $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
          description: Internal server error response
      summary: Patch a value list
      tags:
        - Security Lists API
      x-metaTags:
        - content: Kibana
          name: product_name
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/lists</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Create a new value list.
      operationId: CreateList
      requestBody:
        content:
          application/json:
            examples:
              ip:
                value:
                  description: This list describes bad internet ips
                  id: ip_list
                  name: Simple list with ips
                  type: ip
              ip_range:
                value:
                  description: This list has ip ranges
                  id: ip_range_list
                  name: Simple list with ip ranges
                  type: ip_range
              keyword:
                value:
                  description: This list describes bad host names
                  id: keyword_list
                  name: Simple list with a keyword
                  type: keyword
              keyword_custom_format:
                value:
                  description: This parses the first found ipv4 only
                  id: keyword_custom_format_list
                  name: Simple list with a keyword using a custom format
                  type: keyword
            schema:
              type: object
              properties:
                description:
                  $ref: '#/components/schemas/Security_Lists_API_ListDescription'
                id:
                  $ref: '#/components/schemas/Security_Lists_API_ListId'
                meta:
                  $ref: '#/components/schemas/Security_Lists_API_ListMetadata'
                name:
                  $ref: '#/components/schemas/Security_Lists_API_ListName'
                type:
                  $ref: '#/components/schemas/Security_Lists_API_ListType'
                version:
                  default: 1
                  minimum: 1
                  type: integer
              required:
                - name
                - description
                - type
        description: Value list's properties
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                ip:
                  value:
                    _version: WzAsMV0=
                    '@timestamp': '2025-01-08T04:47:34.273Z'
                    created_at: '2025-01-08T04:47:34.273Z'
                    created_by: elastic
                    description: This list describes bad internet ips
                    id: ip_list
                    immutable: false
                    name: Simple list with ips
                    tie_breaker_id: f5508188-b1e9-4e6e-9662-d039a7d89899
                    type: ip
                    updated_at: '2025-01-08T04:47:34.273Z'
                    updated_by: elastic
                    version: 1
                ip_range:
                  value:
                    _version: WzAsMV0=
                    '@timestamp': '2025-01-09T18:23:52.241Z'
                    created_at: '2025-01-09T18:23:52.241Z'
                    created_by: elastic
                    description: This list has ip ranges
                    id: ip_range_list
                    immutable: false
                    name: Simple list with ip ranges
                    tie_breaker_id: 74aebdaf-601f-4940-b351-155728ff7003
                    type: ip_range
                    updated_at: '2025-01-09T18:23:52.241Z'
                    updated_by: elastic
                    version: 1
                keyword:
                  value:
                    _version: WzEsMV0=
                    '@timestamp': '2025-01-09T18:24:55.786Z'
                    created_at: '2025-01-09T18:24:55.786Z'
                    created_by: elastic
                    description: This list describes bad host names
                    id: keyword_list
                    immutable: false
                    name: Simple list with a keyword
                    tie_breaker_id: f7e7dbaa-daf7-4c9a-a3dc-56643923ef68
                    type: keyword
                    updated_at: '2025-01-09T18:24:55.786Z'
                    updated_by: elastic
                    version: 1
                keyword_custom_format:
                  value:
                    _version: WzIsMV0=
                    '@timestamp': '2025-01-09T18:25:39.604Z'
                    created_at: '2025-01-09T18:25:39.604Z'
                    created_by: elastic
                    description: This parses the first found ipv4 only
                    id: keyword_custom_format_list
                    immutable: false
                    name: Simple list with a keyword using a custom format
                    tie_breaker_id: 8247ae63-b780-47b8-9a89-948b643e9ec2
                    type: keyword
                    updated_at: '2025-01-09T18:25:39.604Z'
                    updated_by: elastic
                    version: 1
              schema:
                $ref: '#/components/schemas/Security_Lists_API_List'
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                notFound:
                  value:
                    message: To create a list, the data stream must exist first. Data stream \".lists-default\" does not exist
                    status_code: 400
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
                  - $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
          description: Invalid input data response
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: '[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]'
                    statusCode: 401
              schema:
                $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
          description: Unsuccessful authentication response
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  value:
                    error: Forbidden
                    message: API [POST /api/lists] is unauthorized for user, this action is granted by the Kibana privileges [lists-all]
                    statusCode: 403
              schema:
                $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
          description: Not enough privileges response
        '409':
          content:
            application/json:
              examples:
                alreadyExists:
                  value:
                    message: 'list id: "keyword_custom_format_list" already exists'
                    status_code: 409
              schema:
                $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
          description: List already exists response
        '500':
          content:
            application/json:
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
              schema:
                $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
          description: Internal server error response
      summary: Create a value list
      tags:
        - Security Lists API
      x-metaTags:
        - content: Kibana
          name: product_name
    put:
      description: |
        **Spaces method and path for this operation:**

        <div><span class="operation-verb put">put</span>&nbsp;<span class="operation-path">/s/{space_id}/api/lists</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Update a value list using the list `id`. The original list is replaced, and all unspecified fields are deleted.
        > info
        > You cannot modify the `id` value.
      operationId: UpdateList
      requestBody:
        content:
          application/json:
            examples:
              replaceList:
                value:
                  description: Latest list of bad ips
                  id: ip_list
                  name: Bad ips - updated
            schema:
              example:
                description: Latest list of bad ips
                id: ip_list
                name: Bad ips - updated
              type: object
              properties:
                _version:
                  $ref: '#/components/schemas/Security_Lists_API_ListVersionId'
                description:
                  $ref: '#/components/schemas/Security_Lists_API_ListDescription'
                id:
                  $ref: '#/components/schemas/Security_Lists_API_ListId'
                meta:
                  $ref: '#/components/schemas/Security_Lists_API_ListMetadata'
                name:
                  $ref: '#/components/schemas/Security_Lists_API_ListName'
                version:
                  $ref: '#/components/schemas/Security_Lists_API_ListVersion'
              required:
                - id
                - name
                - description
        description: Value list's properties
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                ip:
                  value:
                    _version: WzIsMV0=
                    '@timestamp': '2025-01-08T04:47:34.273Z'
                    created_at: '2025-01-08T04:47:34.273Z'
                    created_by: elastic
                    description: Latest list of bad ips
                    id: ip_list
                    immutable: false
                    name: Bad ips - updated
                    tie_breaker_id: f5508188-b1e9-4e6e-9662-d039a7d89899
                    type: ip
                    updated_at: '2025-01-08T05:39:39.292Z'
                    updated_by: elastic
                    version: 3
              schema:
                $ref: '#/components/schemas/Security_Lists_API_List'
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                badRequest:
                  value:
                    error: Bad Request
                    message: '[request body]: id: Expected string, received number'
                    statusCode: 400
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
                  - $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
          description: Invalid input data response
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: '[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]'
                    statusCode: 401
              schema:
                $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
          description: Unsuccessful authentication response
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  value:
                    error: Forbidden
                    message: API [PUT /api/lists] is unauthorized for user, this action is granted by the Kibana privileges [lists-all]
                    statusCode: 403
              schema:
                $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
          description: Not enough privileges response
        '404':
          content:
            application/json:
              examples:
                notFound:
                  value:
                    message: 'list id: \"foo\" not found'
                    status_code: 404
              schema:
                $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
          description: List not found response
        '500':
          content:
            application/json:
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
              schema:
                $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
          description: Internal server error response
      summary: Update a value list
      tags:
        - Security Lists API
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/lists/_find:
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/lists/_find</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Get a paginated subset of value lists. By default, the first page is returned, with 20 results per page.
      operationId: FindLists
      parameters:
        - description: The page number to return.
          in: query
          name: page
          required: false
          schema:
            example: 1
            type: integer
        - description: The number of value lists to return per page.
          in: query
          name: per_page
          required: false
          schema:
            example: 20
            type: integer
        - description: Determines which field is used to sort the results.
          in: query
          name: sort_field
          required: false
          schema:
            example: name
            format: nonempty
            minLength: 1
            type: string
        - description: Determines the sort order, which can be `desc` or `asc`
          in: query
          name: sort_order
          required: false
          schema:
            enum:
              - desc
              - asc
            example: asc
            type: string
        - description: Returns the lists that come after the last lists returned in the previous call (use the `cursor` value returned in the previous call). This parameter uses the `tie_breaker_id` field to ensure all lists are sorted and returned correctly.
          in: query
          name: cursor
          required: false
          schema:
            $ref: '#/components/schemas/Security_Lists_API_FindListsCursor'
        - description: |
            Filters the returned results according to the value of the specified field,
            using the <field name>:<field value> syntax.
          in: query
          name: filter
          required: false
          schema:
            $ref: '#/components/schemas/Security_Lists_API_FindListsFilter'
      responses:
        '200':
          content:
            application/json:
              examples:
                ipList:
                  value:
                    cursor: WzIwLFsiZjU1MDgxODgtYjFlOS00ZTZlLTk2NjItZDAzOWE3ZDg5ODk5Il1d
                    data:
                      - _version: WzAsMV0=
                        '@timestamp': |
                          2025-01-08T04:47:34.273Z
                        created_at: |
                          2025-01-08T04:47:34.273Z
                        created_by: elastic
                        description: This list describes bad internet ip
                        id: ip_list
                        immutable: false
                        name: Simple list with an ip
                        tie_breaker_id: f5508188-b1e9-4e6e-9662-d039a7d89899
                        type: ip
                        updated_at: |
                          2025-01-08T04:47:34.273Z
                        updated_by: elastic
                        version: 1
                    page: 1
                    per_page: 20
                    total: 1
              schema:
                type: object
                properties:
                  cursor:
                    $ref: '#/components/schemas/Security_Lists_API_FindListsCursor'
                  data:
                    items:
                      $ref: '#/components/schemas/Security_Lists_API_List'
                    type: array
                  page:
                    minimum: 0
                    type: integer
                  per_page:
                    minimum: 0
                    type: integer
                  total:
                    minimum: 0
                    type: integer
                required:
                  - data
                  - page
                  - per_page
                  - total
                  - cursor
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                badRequest:
                  value:
                    error: Bad Request
                    message: '[request query]: page: Expected number, received nan'
                    statusCode: 400
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
                  - $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
          description: Invalid input data response
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: '[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]'
                    statusCode: 401
              schema:
                $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
          description: Unsuccessful authentication response
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  value:
                    error: Forbidden
                    message: API [GET /api/lists/_find?page=1&per_page=20] is unauthorized for user, this action is granted by the Kibana privileges [lists-read]
                    statusCode: 403
              schema:
                $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
          description: Not enough privileges response
        '500':
          content:
            application/json:
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
              schema:
                $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
          description: Internal server error response
      summary: Get value lists
      tags:
        - Security Lists API
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/lists/index:
    delete:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb delete">delete</span>&nbsp;<span class="operation-path">/s/{space_id}/api/lists/index</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Delete the `.lists` and `.items` data streams.
      operationId: DeleteListIndex
      responses:
        '200':
          content:
            application/json:
              examples:
                acknowledged:
                  value:
                    acknowledged: true
              schema:
                type: object
                properties:
                  acknowledged:
                    type: boolean
                required:
                  - acknowledged
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                badRequest:
                  value:
                    message: 'Unable to delete value list data streams: invalid or missing index metadata'
                    status_code: 400
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
                  - $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
          description: Invalid input data response
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: '[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]'
                    statusCode: 401
              schema:
                $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
          description: Unsuccessful authentication response
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  value:
                    error: Forbidden
                    message: API [DELETE /api/lists/index] is not authorized; lists-all (or equivalent) is required to delete data streams
                    statusCode: 403
              schema:
                $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
          description: Not enough privileges response
        '404':
          content:
            application/json:
              examples:
                notFound:
                  value:
                    message: The value list data stream was not found in this space
                    status_code: 404
              schema:
                $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
          description: List data stream not found response
        '500':
          content:
            application/json:
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
              schema:
                $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
          description: Internal server error response
      summary: Delete value list data streams
      tags:
        - Security Lists API
      x-metaTags:
        - content: Kibana
          name: product_name
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/lists/index</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Verify that `.lists` and `.items` data streams exist.
      operationId: ReadListIndex
      responses:
        '200':
          content:
            application/json:
              examples:
                bothExist:
                  value:
                    list_index: true
                    list_item_index: true
              schema:
                type: object
                properties:
                  list_index:
                    type: boolean
                  list_item_index:
                    type: boolean
                required:
                  - list_index
                  - list_item_index
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                badRequest:
                  value:
                    message: Unable to read value list data stream status for this space
                    status_code: 400
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
                  - $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
          description: Invalid input data response
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: '[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]'
                    statusCode: 401
              schema:
                $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
          description: Unsuccessful authentication response
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  value:
                    error: Forbidden
                    message: API [GET /api/lists/index] is not authorized; list read permissions are required
                    statusCode: 403
              schema:
                $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
          description: Not enough privileges response
        '404':
          content:
            application/json:
              examples:
                notFound:
                  value:
                    message: Value list backing indices were not found for this space
                    status_code: 404
              schema:
                $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
          description: List data stream(s) not found response
        '500':
          content:
            application/json:
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
              schema:
                $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
          description: Internal server error response
      summary: Get status of value list data streams
      tags:
        - Security Lists API
      x-metaTags:
        - content: Kibana
          name: product_name
    post:
      deprecated: true
      description: |
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/lists/index</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        **DEPRECATED.** `deprecated: true` is set on this operation. Value list backing data streams for the space
        are now created as part of supported workflows; calling this explicitly is rarely required.
        **WARNING:** Do not use for new integrations. Prefer the UI or the list and list-item APIs after confirming
        indices exist with `GET /api/lists/index`.

        Creates the `.lists` and `.items` data streams in the current Kibana space.
      operationId: CreateListIndex
      responses:
        '200':
          content:
            application/json:
              examples:
                acknowledged:
                  value:
                    acknowledged: true
              schema:
                type: object
                properties:
                  acknowledged:
                    type: boolean
                required:
                  - acknowledged
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                badRequest:
                  value:
                    message: Indices exist but the request could not be completed for the current space. Check that Elasticsearch and Kibana privileges allow index creation for lists.
                    status_code: 400
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
                  - $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
          description: Invalid input data response
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: |
                      [security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]
                    statusCode: 401
              schema:
                $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
          description: Unsuccessful authentication response
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  value:
                    error: Forbidden
                    message: API [POST /api/lists/index] is unauthorized for user, this action is granted by the Kibana privileges [lists-all]
                    statusCode: 403
              schema:
                $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
          description: Not enough privileges response
        '409':
          content:
            application/json:
              examples:
                alreadyExists:
                  value:
                    message: 'data stream: \".lists-default\" and \".items-default\" already exists'
                    status_code: 409
              schema:
                $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
          description: List data stream exists response
        '500':
          content:
            application/json:
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
              schema:
                $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
          description: Internal server error response
      summary: Create list data streams
      tags:
        - Security Lists API
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/lists/items:
    delete:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb delete">delete</span>&nbsp;<span class="operation-path">/s/{space_id}/api/lists/items</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Delete a value list item using its `id`, or its `list_id` and `value` fields.
      operationId: DeleteListItem
      parameters:
        - description: Value list item's identifier. Required if `list_id` and `value` are not specified.
          in: query
          name: id
          required: false
          schema:
            $ref: '#/components/schemas/Security_Lists_API_ListItemId'
        - description: Value list's identifier. Required if `id` is not specified.
          in: query
          name: list_id
          required: false
          schema:
            $ref: '#/components/schemas/Security_Lists_API_ListId'
        - description: The value used to evaluate exceptions. Required if `id` is not specified.
          in: query
          name: value
          required: false
          schema:
            example: 255.255.255.255
            type: string
        - description: Determines when changes made by the request are made visible to search.
          in: query
          name: refresh
          required: false
          schema:
            default: 'false'
            enum:
              - 'true'
              - 'false'
              - wait_for
            example: false
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                ip:
                  value:
                    _version: WzIwLDFd
                    '@timestamp': '2025-01-08T05:15:05.159Z'
                    created_at: '2025-01-08T05:15:05.159Z'
                    created_by: elastic
                    id: pd1WRJQBs4HAK3VQeHFI
                    list_id: ip_list
                    tie_breaker_id: eee41dc7-1666-4876-982f-8b0f7b59eca3
                    type: ip
                    updated_at: '2025-01-08T05:44:14.009Z'
                    updated_by: elastic
                    value: 255.255.255.255
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Security_Lists_API_ListItem'
                  - items:
                      $ref: '#/components/schemas/Security_Lists_API_ListItem'
                    type: array
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                badRequest:
                  value:
                    message: Either \"list_id\" or \"id\" needs to be defined in the request
                    status_code: 400
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
                  - $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
          description: Invalid input data response
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: '[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]'
                    statusCode: 401
              schema:
                $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
          description: Unsuccessful authentication response
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  value:
                    error: Forbidden
                    message: API [DELETE /api/lists/items?id=pd1WRJQBs4HAK3VQeHFI] is unauthorized for user, this action is granted by the Kibana privileges [lists-all]
                    statusCode: 403
              schema:
                $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
          description: Not enough privileges response
        '404':
          content:
            application/json:
              examples:
                notFound:
                  value:
                    message: 'list item with id: \"pd1WRJQBs4HAK3VQeHFI\" not found'
                    status_code: 404
              schema:
                $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
          description: List item not found response
        '500':
          content:
            application/json:
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
              schema:
                $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
          description: Internal server error response
      summary: Delete a value list item
      tags:
        - Security Lists API
      x-metaTags:
        - content: Kibana
          name: product_name
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/lists/items</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Get the details of a value list item.
      operationId: ReadListItem
      parameters:
        - description: Value list item identifier. Required if `list_id` and `value` are not specified.
          in: query
          name: id
          required: false
          schema:
            $ref: '#/components/schemas/Security_Lists_API_ListId'
        - description: Value list item list's `id` identfier. Required if `id` is not specified.
          in: query
          name: list_id
          required: false
          schema:
            $ref: '#/components/schemas/Security_Lists_API_ListId'
        - description: The value used to evaluate exceptions. Required if `id` is not specified.
          in: query
          name: value
          required: false
          schema:
            example: 127.0.0.2
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                ip:
                  value:
                    _version: WzExLDFd
                    '@timestamp': '2025-01-08T05:16:25.882Z'
                    created_at: '2025-01-08T05:16:25.882Z'
                    created_by: elastic
                    id: qN1XRJQBs4HAK3VQs3Gc
                    list_id: ip_list
                    tie_breaker_id: a9a34c02-a385-436e-86a0-02a3942f3537
                    type: ip
                    updated_at: '2025-01-08T05:16:25.882Z'
                    updated_by: elastic
                    value: 127.0.0.2
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Security_Lists_API_ListItem'
                  - items:
                      $ref: '#/components/schemas/Security_Lists_API_ListItem'
                    type: array
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                badRequest:
                  value:
                    message: Either \"list_id\" or \"id\" needs to be defined in the request
                    status_code: 400
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
                  - $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
          description: Invalid input data response
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: '[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]'
                    statusCode: 401
              schema:
                $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
          description: Unsuccessful authentication response
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  value:
                    error: Forbidden
                    message: API [GET /api/lists/items?id=qN1XRJQBs4HAK3VQs3Gc] is unauthorized for user, this action is granted by the Kibana privileges [lists-read]
                    statusCode: 403
              schema:
                $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
          description: Not enough privileges response
        '404':
          content:
            application/json:
              examples:
                notFound:
                  value:
                    message: 'list item id: \"foo\" not found'
                    status_code: 404
              schema:
                $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
          description: List item not found response
        '500':
          content:
            application/json:
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
              schema:
                $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
          description: Internal server error response
      summary: Get a value list item
      tags:
        - Security Lists API
      x-metaTags:
        - content: Kibana
          name: product_name
    patch:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb patch">patch</span>&nbsp;<span class="operation-path">/s/{space_id}/api/lists/items</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Update specific fields of an existing value list item using the item `id`.
      operationId: PatchListItem
      requestBody:
        content:
          application/json:
            examples:
              changeValue:
                value:
                  id: pd1WRJQBs4HAK3VQeHFI
                  value: 255.255.255.255
            schema:
              type: object
              properties:
                _version:
                  $ref: '#/components/schemas/Security_Lists_API_ListVersionId'
                id:
                  $ref: '#/components/schemas/Security_Lists_API_ListItemId'
                meta:
                  $ref: '#/components/schemas/Security_Lists_API_ListItemMetadata'
                refresh:
                  description: Determines when changes made by the request are made visible to search.
                  enum:
                    - 'true'
                    - 'false'
                    - wait_for
                  type: string
                value:
                  $ref: '#/components/schemas/Security_Lists_API_ListItemValue'
              required:
                - id
        description: Value list item's properties
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                ipItem:
                  value:
                    _version: WzE5LDFd
                    '@timestamp': '2025-01-08T05:15:05.159Z'
                    created_at: '2025-01-08T05:15:05.159Z'
                    created_by: elastic
                    id: pd1WRJQBs4HAK3VQeHFI
                    list_id: ip_list
                    tie_breaker_id: eee41dc7-1666-4876-982f-8b0f7b59eca3
                    type: ip
                    updated_at: '2025-01-08T05:23:37.602Z'
                    updated_by: elastic
                    value: 255.255.255.255
              schema:
                $ref: '#/components/schemas/Security_Lists_API_ListItem'
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                badRequest:
                  value:
                    message: '{"took":15,"timed_out":false,"total":1,"updated":0,"deleted":0,"batches":1,"version_conflicts":0,"noops":0,"retries":{"bulk":0,"search":0},"throttled_millis":0,"requests_per_second":-1,"throttled_until_millis":0,"failures":[{"index":".ds-.items-default-2025.01.09-000001","id":"ip_item","cause":{"type":"document_parsing_exception","reason":"[1:107] failed to parse field [ip] of type [ip] in document with id ip_item. Preview of fields value: 2","caused_by":{"type":"illegal_argument_exception","reason":"2 is not an IP string literal."}},"status":400}]}'
                    status_code: 400
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
                  - $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
          description: Invalid input data response
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: '[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]'
                    statusCode: 401
              schema:
                $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
          description: Unsuccessful authentication response
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  value:
                    error: Forbidden
                    message: API [PATCH /api/lists/items] is unauthorized for user, this action is granted by the Kibana privileges [lists-all]
                    statusCode: 403
              schema:
                $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
          description: Not enough privileges response
        '404':
          content:
            application/json:
              examples:
                notFound:
                  value:
                    message: 'list item id: \"foo\" not found'
                    status_code: 404
              schema:
                $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
          description: List item not found response
        '500':
          content:
            application/json:
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
              schema:
                $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
          description: Internal server error response
      summary: Patch a value list item
      tags:
        - Security Lists API
      x-metaTags:
        - content: Kibana
          name: product_name
    post:
      description: |
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/lists/items</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Create a value list item and associate it with the specified value list.

        All value list items in the same list must be the same type. For example, each list item in an `ip` list must define a specific IP address.
        > info
        > Before creating a list item, you must create a list.
      operationId: CreateListItem
      requestBody:
        content:
          application/json:
            examples:
              ip:
                value:
                  list_id: ip_list
                  value: 127.0.0.1
              ip_range:
                value:
                  list_id: ip_range_list
                  value: 192.168.0.0/16
              keyword:
                value:
                  list_id: keyword_list
                  value: zeek
            schema:
              type: object
              properties:
                id:
                  $ref: '#/components/schemas/Security_Lists_API_ListItemId'
                list_id:
                  $ref: '#/components/schemas/Security_Lists_API_ListId'
                meta:
                  $ref: '#/components/schemas/Security_Lists_API_ListItemMetadata'
                refresh:
                  description: Determines when changes made by the request are made visible to search.
                  enum:
                    - 'true'
                    - 'false'
                    - wait_for
                  example: wait_for
                  type: string
                value:
                  $ref: '#/components/schemas/Security_Lists_API_ListItemValue'
              required:
                - list_id
                - value
        description: Value list item's properties
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                ip:
                  value:
                    _version: WzAsMV0=
                    '@timestamp': '2025-01-08T04:59:06.154Z'
                    created_at: '2025-01-08T04:59:06.154Z'
                    created_by: elastic
                    id: 21b01cfb-058d-44b9-838c-282be16c91cc
                    list_id: ip_list
                    tie_breaker_id: b57c762c-3036-465c-9bfb-7bfb5e6e515a
                    type: ip
                    updated_at: '2025-01-08T04:59:06.154Z'
                    updated_by: elastic
                    value: 127.0.0.1
                ip_range:
                  value:
                    _version: WzEsMV0=
                    '@timestamp': '2025-01-09T18:33:08.202Z'
                    created_at: '2025-01-09T18:33:08.202Z'
                    created_by: elastic
                    id: ip_range_item
                    list_id: ip_range_list
                    tie_breaker_id: ea1b4189-efda-4637-b8f9-74655a5ebb61
                    type: ip_range
                    updated_at: '2025-01-09T18:33:08.202Z'
                    updated_by: elastic
                    value: 192.168.0.0/16
                keyword:
                  value:
                    _version: WzIsMV0=
                    '@timestamp': '2025-01-09T18:34:29.422Z'
                    created_at: '2025-01-09T18:34:29.422Z'
                    created_by: elastic
                    id: 7f24737d-1da8-4626-a568-33070591bb4e
                    list_id: keyword_list
                    tie_breaker_id: 2108ced2-5e5d-401e-a88e-4dd69fc5fa27
                    type: keyword
                    updated_at: '2025-01-09T18:34:29.422Z'
                    updated_by: elastic
                    value: zeek
              schema:
                $ref: '#/components/schemas/Security_Lists_API_ListItem'
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                badRequest:
                  value:
                    error: Bad Request
                    message: uri [/api/lists/items] with method [post] exists but is not available with the current configuration
                    statusCode: 400
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
                  - $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
          description: Invalid input data response
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: '[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]'
                    statusCode: 401
              schema:
                $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
          description: Unsuccessful authentication response
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  value:
                    error: Forbidden
                    message: API [POST /api/lists/items] is unauthorized for user, this action is granted by the Kibana privileges [lists-all]
                    statusCode: 403
              schema:
                $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
          description: Not enough privileges response
        '404':
          content:
            application/json:
              examples:
                listNotFound:
                  value:
                    message: 'list id: \"ip_list\" does not exist'
                    status_code: 404
              schema:
                $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
          description: Not enough privileges response
        '409':
          content:
            application/json:
              examples:
                alreadyExists:
                  value:
                    message: 'list item id: \"ip_item\" already exists'
                    status_code: 409
              schema:
                $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
          description: List item already exists response
        '500':
          content:
            application/json:
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
              schema:
                $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
          description: Internal server error response
      summary: Create a value list item
      tags:
        - Security Lists API
      x-metaTags:
        - content: Kibana
          name: product_name
    put:
      description: |
        **Spaces method and path for this operation:**

        <div><span class="operation-verb put">put</span>&nbsp;<span class="operation-path">/s/{space_id}/api/lists/items</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Update a value list item using the list item ID. The original list item is replaced, and all unspecified fields are deleted.
        > info
        > You cannot modify the `id` value.
      operationId: UpdateListItem
      requestBody:
        content:
          application/json:
            examples:
              fullReplace:
                value:
                  id: ip_item
                  value: 255.255.255.255
            schema:
              example:
                id: ip_item
                value: 255.255.255.255
              type: object
              properties:
                _version:
                  $ref: '#/components/schemas/Security_Lists_API_ListVersionId'
                id:
                  $ref: '#/components/schemas/Security_Lists_API_ListItemId'
                meta:
                  $ref: '#/components/schemas/Security_Lists_API_ListItemMetadata'
                value:
                  $ref: '#/components/schemas/Security_Lists_API_ListItemValue'
              required:
                - id
                - value
        description: Value list item's properties
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                ip:
                  value:
                    _version: WzIwLDFd
                    '@timestamp': '2025-01-08T05:15:05.159Z'
                    created_at: '2025-01-08T05:15:05.159Z'
                    created_by: elastic
                    id: pd1WRJQBs4HAK3VQeHFI
                    list_id: ip_list
                    tie_breaker_id: eee41dc7-1666-4876-982f-8b0f7b59eca3
                    type: ip
                    updated_at: '2025-01-08T05:44:14.009Z'
                    updated_by: elastic
                    value: 255.255.255.255
              schema:
                $ref: '#/components/schemas/Security_Lists_API_ListItem'
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                badRequest:
                  value:
                    error: Bad Request
                    message: '[request body]: id: Expected string, received number'
                    statusCode: 400
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
                  - $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
          description: Invalid input data response
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: '[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]'
                    statusCode: 401
              schema:
                $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
          description: Unsuccessful authentication response
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  value:
                    error: Forbidden
                    message: API [PATCH /api/lists/items] is unauthorized for user, this action is granted by the Kibana privileges [lists-all]
                    statusCode: 403
              schema:
                $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
          description: Not enough privileges response
        '404':
          content:
            application/json:
              examples:
                notFound:
                  value:
                    message: 'list item id: \"foo\" not found'
                    status_code: 404
              schema:
                $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
          description: List item not found response
        '500':
          content:
            application/json:
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
              schema:
                $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
          description: Internal server error response
      summary: Update a value list item
      tags:
        - Security Lists API
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/lists/items/_export:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/lists/items/_export</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Export list item values from the specified value list.
      operationId: ExportListItems
      parameters:
        - description: Value list's `id` to export.
          in: query
          name: list_id
          required: true
          schema:
            $ref: '#/components/schemas/Security_Lists_API_ListId'
      responses:
        '200':
          content:
            application/ndjson:
              examples:
                ipLines:
                  value: |
                    127.0.0.1
                    127.0.0.2
                    127.0.0.3
              schema:
                description: A `.txt` file containing list items from the specified list
                example: |
                  127.0.0.1
                  127.0.0.2
                  127.0.0.3
                  127.0.0.4
                  127.0.0.5
                  127.0.0.6
                  127.0.0.7
                  127.0.0.8
                  127.0.0.9
                format: binary
                type: string
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                badRequest:
                  value:
                    error: 'Bad Request","message":"[request query]: list_id: Required'
                    statusCode: 400
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
                  - $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
          description: Invalid input data response
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: '[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]'
                    statusCode: 401
              schema:
                $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
          description: Unsuccessful authentication response
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  value:
                    error: Forbidden
                    message: API [POST /api/lists/items/_export?list_id=ips.txt] is unauthorized for user, this action is granted by the Kibana privileges [lists-read]
                    statusCode: 403
              schema:
                $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
          description: Not enough privileges response
        '404':
          content:
            application/json:
              examples:
                notFound:
                  value:
                    message: 'list id: "unknown_list" not found'
                    status_code: 404
              schema:
                $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
          description: List not found response
        '500':
          content:
            application/json:
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
              schema:
                $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
          description: Internal server error response
      summary: Export value list items
      tags:
        - Security Lists API
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/lists/items/_find:
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/lists/items/_find</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Get all value list items in the specified list.
      operationId: FindListItems
      parameters:
        - description: Parent value list's `id` to page through items for.
          in: query
          name: list_id
          required: true
          schema:
            $ref: '#/components/schemas/Security_Lists_API_ListId'
        - description: The page number to return.
          in: query
          name: page
          required: false
          schema:
            example: 1
            type: integer
        - description: The number of list items to return per page.
          in: query
          name: per_page
          required: false
          schema:
            example: 20
            type: integer
        - description: Determines which field is used to sort the results.
          in: query
          name: sort_field
          required: false
          schema:
            example: value
            format: nonempty
            minLength: 1
            type: string
        - description: Determines the sort order, which can be `desc` or `asc`
          in: query
          name: sort_order
          required: false
          schema:
            enum:
              - desc
              - asc
            example: asc
            type: string
        - description: |
            Opaque cursor returned in a previous response; pass it to continue listing from the next page. Omit on the first request.
          in: query
          name: cursor
          required: false
          schema:
            $ref: '#/components/schemas/Security_Lists_API_FindListItemsCursor'
        - description: |
            Filters the returned results according to the value of the specified field,
            using the <field name>:<field value> syntax.
          in: query
          name: filter
          required: false
          schema:
            $ref: '#/components/schemas/Security_Lists_API_FindListItemsFilter'
      responses:
        '200':
          content:
            application/json:
              examples:
                ip:
                  value:
                    cursor: WzIwLFsiYjU3Yzc2MmMtMzAzNi00NjVjLTliZmItN2JmYjVlNmU1MTVhIl1d
                    data:
                      - _version: WzAsMV0=
                        '@timestamp': '2025-01-08T04:59:06.154Z'
                        created_at: '2025-01-08T04:59:06.154Z'
                        created_by: elastic
                        id: 21b01cfb-058d-44b9-838c-282be16c91cc
                        list_id: ip_list
                        tie_breaker_id: b57c762c-3036-465c-9bfb-7bfb5e6e515a
                        type: ip
                        updated_at: '2025-01-08T04:59:06.154Z'
                        updated_by: elastic
                        value: 127.0.0.1
                    page: 1
                    per_page: 20
                    total: 1
              schema:
                type: object
                properties:
                  cursor:
                    $ref: '#/components/schemas/Security_Lists_API_FindListItemsCursor'
                  data:
                    items:
                      $ref: '#/components/schemas/Security_Lists_API_ListItem'
                    type: array
                  page:
                    minimum: 0
                    type: integer
                  per_page:
                    minimum: 0
                    type: integer
                  total:
                    minimum: 0
                    type: integer
                required:
                  - data
                  - page
                  - per_page
                  - total
                  - cursor
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                badRequest:
                  value:
                    error: Bad Request,
                    message: '[request query]: list_id: Required'
                    statusCode: 400,
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
                  - $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
          description: Invalid input data response
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: '[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]'
                    statusCode: 401
              schema:
                $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
          description: Unsuccessful authentication response
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  value:
                    error: Forbidden
                    message: API [GET /api/lists/items/_find?list_id=ip_list&page=1&per_page=20] is unauthorized for user, this action is granted by the Kibana privileges [lists-read]
                    statusCode: 403
              schema:
                $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
          description: Not enough privileges response
        '500':
          content:
            application/json:
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
              schema:
                $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
          description: Internal server error response
      summary: Get value list items
      tags:
        - Security Lists API
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/lists/items/_import:
    post:
      description: |
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/lists/items/_import</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Import value list items from a TXT or CSV file. The maximum file size is 9 million bytes.

        You can import items to a new or existing list.
      operationId: ImportListItems
      parameters:
        - description: |
            List's id.

            Required when importing to an existing list.
          in: query
          name: list_id
          required: false
          schema:
            $ref: '#/components/schemas/Security_Lists_API_ListId'
        - description: |
            Type of the importing list.

            Required when importing a new list whose list `id` is not specified.
          examples:
            ip:
              value: ip
          in: query
          name: type
          required: false
          schema:
            $ref: '#/components/schemas/Security_Lists_API_ListType'
        - description: Determines when changes made by the request are made visible to search.
          in: query
          name: refresh
          required: false
          schema:
            enum:
              - 'true'
              - 'false'
              - wait_for
            example: true
            type: string
      requestBody:
        content:
          multipart/form-data:
            examples:
              ipLinesFile:
                value:
                  file: list_values.txt
            schema:
              type: object
              properties:
                file:
                  description: A `.txt` or `.csv` file containing newline separated list items.
                  example: |
                    127.0.0.1
                    127.0.0.2
                    127.0.0.3
                    127.0.0.4
                    127.0.0.5
                    127.0.0.6
                    127.0.0.7
                    127.0.0.8
                    127.0.0.9
                  format: binary
                  type: string
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                ip:
                  value:
                    _version: WzAsMV0=
                    '@timestamp': '2025-01-08T04:47:34.273Z'
                    created_at: '2025-01-08T04:47:34.273Z'
                    created_by: elastic
                    description: This list describes bad internet ip
                    id: ip_list
                    immutable: false
                    name: Simple list with an ip
                    tie_breaker_id: f5508188-b1e9-4e6e-9662-d039a7d89899
                    type: ip
                    updated_at: '2025-01-08T04:47:34.273Z'
                    updated_by: elastic
                    version: 1
              schema:
                $ref: '#/components/schemas/Security_Lists_API_List'
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                badRequest:
                  value:
                    message: Either type or list_id need to be defined in the query
                    status_code: 400
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
                  - $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
          description: Invalid input data response
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: '[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]'
                    statusCode: 401
              schema:
                $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
          description: Unsuccessful authentication response
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  value:
                    error: Forbidden
                    message: API [POST /api/lists/items/_import?list_id=ip_list] is unauthorized for user, this action is granted by the Kibana privileges [lists-all]
                    statusCode: 403
              schema:
                $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
          description: Not enough privileges response
        '409':
          content:
            application/json:
              examples:
                conflict:
                  value:
                    message: List with the specified list_id does not exist, create the list or fix list_id to import to an existing one
                    status_code: 409
              schema:
                $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
          description: List with specified list_id does not exist response
        '500':
          content:
            application/json:
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
              schema:
                $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
          description: Internal server error response
      summary: Import value list items
      tags:
        - Security Lists API
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/lists/privileges:
    get:
      description: |
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/lists/privileges</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Returns the caller's authentication state and the Elasticsearch `cluster`, `index`, and `application`
        privileges for `.lists` and `.items` data streams in the current Kibana space. Use this to decide which list
        APIs (`read` vs `all` operations) are available before you create or import lists.
      operationId: ReadListPrivileges
      responses:
        '200':
          content:
            application/json:
              examples:
                privileges:
                  value:
                    is_authenticated: true
                    listItems:
                      application: {}
                      cluster:
                        all: true
                        manage: true
                        manage_api_key: true
                        manage_index_templates: true
                        manage_ml: true
                        manage_own_api_key: true
                        manage_pipeline: true
                        manage_security: true
                        manage_transform: true
                        monitor: true
                        monitor_ml: true
                        monitor_transform: true
                      has_all_requested: true
                      index:
                        .items-default:
                          all: true
                          create: true
                          create_doc: true
                          create_index: true
                          delete: true
                          delete_index: true
                          index: true
                          maintenance: true
                          manage: true
                          monitor: true
                          read: true
                          view_index_metadata: true
                          write: true
                      username: elastic
                    lists:
                      application: {}
                      cluster:
                        all: true
                        manage: true
                        manage_api_key: true
                        manage_index_templates: true
                        manage_ml: true
                        manage_own_api_key: true
                        manage_pipeline: true
                        manage_security: true
                        manage_transform: true
                        monitor: true
                        monitor_ml: true
                        monitor_transform: true
                      has_all_requested: true
                      index:
                        .lists-default:
                          all: true
                          create: true
                          create_doc: true
                          create_index: true
                          delete: true
                          delete_index: true
                          index: true
                          maintenance: true
                          manage: true
                          monitor: true
                          read: true
                          view_index_metadata: true
                          write: true
                      username: elastic
              schema:
                type: object
                properties:
                  is_authenticated:
                    type: boolean
                  listItems:
                    $ref: '#/components/schemas/Security_Lists_API_ListItemPrivileges'
                  lists:
                    $ref: '#/components/schemas/Security_Lists_API_ListPrivileges'
                required:
                  - lists
                  - listItems
                  - is_authenticated
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                badRequest:
                  value:
                    error: Bad Request
                    message: 'Unable to resolve list privileges: invalid or missing space context for this request'
                    statusCode: 400
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
                  - $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
          description: Invalid input data response
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: '[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]'
                    statusCode: 401
              schema:
                $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
          description: Unsuccessful authentication response
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  value:
                    error: Forbidden
                    message: API [GET /api/lists/privileges] is unauthorized for user, this action is granted by the Kibana privileges [lists-read]
                    statusCode: 403
              schema:
                $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
          description: Not enough privileges response
        '500':
          content:
            application/json:
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
              schema:
                $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
          description: Internal server error response
      summary: Get value list privileges
      tags:
        - Security Lists API
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/logstash/pipeline/{id}:
    delete:
      description: |
        Delete a centrally-managed Logstash pipeline.
        If your Elasticsearch cluster is protected with basic authentication, you must have either the `logstash_admin` built-in role or a customized Logstash writer role.
      externalDocs:
        description: Secure your connection
        url: https://www.elastic.co/docs/reference/logstash/secure-connection
      operationId: delete-logstash-pipeline
      parameters:
        - description: An identifier for the pipeline.
          in: path
          name: id
          required: true
          schema:
            type: string
      responses:
        '204':
          description: Indicates a successful call
      summary: Delete a Logstash pipeline
      tags:
        - logstash
      x-state: Technical Preview
      x-metaTags:
        - content: Kibana
          name: product_name
    get:
      description: |
        Get information for a centrally-managed Logstash pipeline.
        To use this API, you must have either the `logstash_admin` built-in role or a customized Logstash reader role.
      externalDocs:
        description: Secure your connection
        url: https://www.elastic.co/docs/reference/logstash/secure-connection
      operationId: get-logstash-pipeline
      parameters:
        - description: An identifier for the pipeline.
          in: path
          name: id
          required: true
          schema:
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                getLogstashPipelineResponseExample1:
                  value: |-
                    {
                      "id": "hello-world",
                      "description": "Just a simple pipeline",
                      "username": "elastic",
                      "pipeline": "input { stdin {} } output { stdout {} }",
                      "settings": {
                        "queue.type": "persistent"
                      }
                    }
              schema:
                type: object
          description: Indicates a successful call
      summary: Get a Logstash pipeline
      tags:
        - logstash
      x-state: Technical Preview
      x-metaTags:
        - content: Kibana
          name: product_name
    put:
      description: |
        Create a centrally-managed Logstash pipeline or update a pipeline.
        To use this API, you must have either the `logstash_admin` built-in role or a customized Logstash writer role.
      externalDocs:
        description: Secure your connection
        url: https://www.elastic.co/docs/reference/logstash/secure-connection
      operationId: put-logstash-pipeline
      parameters:
        - description: |
            An identifier for the pipeline. Pipeline ID must begin with a letter or underscore and can contain only letters, underscores, dashes, hyphens, and numbers.
          in: path
          name: id
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            examples:
              putLogstashPipelineRequestExample1:
                value: |-
                  {
                    "pipeline": "input { stdin {} } output { stdout {} }",
                    "settings": {
                      "queue.type": "persisted"
                    }
                  }
            schema:
              type: object
              properties:
                description:
                  description: A description of the pipeline.
                  maxLength: 1024
                  type: string
                pipeline:
                  description: A definition for the pipeline.
                  type: string
                settings:
                  description: |
                    Supported settings, represented as object keys, include the following:

                    - `pipeline.workers`
                    - `pipeline.batch.size`
                    - `pipeline.batch.delay`
                    - `pipeline.ecs_compatibility`
                    - `pipeline.ordered`
                    - `queue.type`
                    - `queue.max_bytes`
                    - `queue.checkpoint.writes`
                  type: object
              required:
                - pipeline
      responses:
        '204':
          description: Indicates a successful call
      summary: Create or update a Logstash pipeline
      tags:
        - logstash
      x-state: Technical Preview
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/logstash/pipelines:
    get:
      description: |
        Get a list of all centrally-managed Logstash pipelines.

        To use this API, you must have either the `logstash_admin` built-in role or a customized Logstash reader role.
        > info
        > Limit the number of pipelines to 10,000 or fewer. As the number of pipelines nears and surpasses 10,000, you may see performance issues on Kibana.

        The `username` property appears in the response when security is enabled and depends on when the pipeline was created or last updated.
      externalDocs:
        description: Secure your connection
        url: https://www.elastic.co/docs/reference/logstash/secure-connection
      operationId: get-logstash-pipelines
      responses:
        '200':
          content:
            application/json:
              examples:
                getLogstashPipelinesResponseExample1:
                  value: |-
                    {
                      "pipelines": [
                        {
                          "id": "hello-world",
                          "description": "Just a simple pipeline",
                          "last_modified": "2018-04-14T12:23:29.772Z",
                          "username": "elastic" 
                        },
                        {
                          "id": "sleepy-pipeline",
                          "description": "",
                          "last_modified": "2018-03-24T03:41:30.554Z"
                        }
                      ]
                    }
              schema:
                type: object
          description: Indicates a successful call
      summary: Get all Logstash pipelines
      tags:
        - logstash
      x-state: Technical Preview
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/maintenance_window:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/maintenance_window</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        [Required authorization] Route required privileges: write-maintenance-window.
      operationId: post-maintenance-window
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
      requestBody:
        content:
          application/json:
            examples:
              createMaintenanceWindowRequest:
                description: |
                  Create a maintenance window that recurs every week on Monday and Wednesday for two hours, with a scope that filters specific alerts using a KQL query.
                summary: Create a maintenance window
                value:
                  enabled: true
                  schedule:
                    custom:
                      duration: 2h
                      recurring:
                        every: 1w
                        occurrences: 10
                        onWeekDay:
                          - MO
                          - WE
                      start: '2025-03-01T08:00:00.000Z'
                      timezone: Europe/Amsterdam
                  scope:
                    alerting:
                      query:
                        kql: 'kibana.alert.tags: "infra"'
                  title: Weekly Maintenance Window
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_new_maintenance_window'
      responses:
        '200':
          content:
            application/json:
              examples:
                createMaintenanceWindowResponse:
                  description: |
                    The response returned when a maintenance window is successfully created.
                  summary: Create a maintenance window response
                  value:
                    created_at: '2025-02-25T10:00:00.000Z'
                    created_by: elastic
                    enabled: true
                    id: f0cb1780-537a-4e34-8adf-3b4336862858
                    schedule:
                      custom:
                        duration: 2h
                        recurring:
                          every: 1w
                          occurrences: 10
                          onWeekDay:
                            - MO
                            - WE
                        start: '2025-03-01T08:00:00.000Z'
                        timezone: Europe/Amsterdam
                    scope:
                      alerting:
                        query:
                          kql: 'kibana.alert.tags: "infra"'
                    status: upcoming
                    title: Weekly Maintenance Window
                    updated_at: '2025-02-25T10:00:00.000Z'
                    updated_by: elastic
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_maintenance_window_response'
          description: Indicates a successful call.
        '400':
          description: Indicates an invalid schema or parameters.
        '403':
          description: Indicates that this call is forbidden.
      summary: Create a maintenance window.
      tags:
        - maintenance-window
      x-state: Generally available; added in 9.1.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/maintenance_window/_find:
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/maintenance_window/_find</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        [Required authorization] Route required privileges: read-maintenance-window.
      operationId: get-maintenance-window-find
      parameters:
        - description: The title of the maintenance window.
          in: query
          name: title
          required: false
          schema:
            type: string
        - description: The user who created the maintenance window.
          in: query
          name: created_by
          required: false
          schema:
            type: string
        - description: The status of the maintenance window. It can be "running", "upcoming", "finished", "archived", or "disabled".
          in: query
          name: status
          required: false
          schema:
            items:
              enum:
                - running
                - finished
                - upcoming
                - archived
                - disabled
              type: string
            type: array
        - description: The page number to return.
          in: query
          name: page
          required: false
          schema:
            default: 1
            maximum: 100
            minimum: 1
            type: number
        - description: The number of maintenance windows to return per page.
          in: query
          name: per_page
          required: false
          schema:
            default: 10
            maximum: 100
            minimum: 1
            type: number
      responses:
        '200':
          content:
            application/json:
              examples:
                findMaintenanceWindowsResponse:
                  description: |
                    The response returned when maintenance windows are successfully found.
                  summary: Find maintenance windows response
                  value:
                    maintenanceWindows:
                      - created_at: '2025-02-25T10:00:00.000Z'
                        created_by: elastic
                        enabled: true
                        id: f0cb1780-537a-4e34-8adf-3b4336862858
                        schedule:
                          custom:
                            duration: 2h
                            recurring:
                              every: 1w
                              occurrences: 10
                              onWeekDay:
                                - MO
                                - WE
                            start: '2025-03-01T08:00:00.000Z'
                            timezone: Europe/Amsterdam
                        scope:
                          alerting:
                            query:
                              kql: 'kibana.alert.tags: "infra"'
                        status: upcoming
                        title: Weekly Maintenance Window
                        updated_at: '2025-02-25T10:00:00.000Z'
                        updated_by: elastic
                      - created_at: '2025-03-10T09:00:00.000Z'
                        created_by: elastic
                        enabled: true
                        id: a1c94560-6e3b-4ea1-9065-8e3f1b8c5f29
                        schedule:
                          custom:
                            duration: 1h
                            recurring:
                              end: '2025-12-31T00:00:00.000Z'
                              every: 2w
                              onWeekDay:
                                - FR
                            start: '2025-04-01T10:00:00.000Z'
                            timezone: US/Eastern
                        scope:
                          alerting:
                            query:
                              kql: 'kibana.alert.tags: "database"'
                        status: upcoming
                        title: Database Upgrade Window
                        updated_at: '2025-03-15T14:30:00.000Z'
                        updated_by: elastic
                    page: 1
                    per_page: 10
                    total: 2
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_find_maintenance_windows_response'
          description: Indicates a successful call.
        '400':
          description: Indicates an invalid schema or parameters.
        '403':
          description: Indicates that this call is forbidden.
      summary: Search for a maintenance window.
      tags:
        - maintenance-window
      x-state: Generally available; added in 9.2.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/maintenance_window/{id}:
    delete:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb delete">delete</span>&nbsp;<span class="operation-path">/s/{space_id}/api/maintenance_window/{id}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        [Required authorization] Route required privileges: write-maintenance-window.
      operationId: delete-maintenance-window-id
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: The identifier for the maintenance window to be deleted.
          in: path
          name: id
          required: true
          schema:
            type: string
      responses:
        '204':
          description: Indicates a successful call.
        '400':
          description: Indicates an invalid schema or parameters.
        '403':
          description: Indicates that this call is forbidden.
        '404':
          description: Indicates a maintenance window with the given ID does not exist.
      summary: Delete a maintenance window.
      tags:
        - maintenance-window
      x-state: Generally available; added in 9.1.0
      x-metaTags:
        - content: Kibana
          name: product_name
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/maintenance_window/{id}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        [Required authorization] Route required privileges: read-maintenance-window.
      operationId: get-maintenance-window-id
      parameters:
        - description: The identifier for the maintenance window.
          in: path
          name: id
          required: true
          schema:
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                getMaintenanceWindowResponse:
                  description: |
                    The response returned when a maintenance window is successfully retrieved.
                  summary: Get a maintenance window response
                  value:
                    created_at: '2025-02-25T10:00:00.000Z'
                    created_by: elastic
                    enabled: true
                    id: f0cb1780-537a-4e34-8adf-3b4336862858
                    schedule:
                      custom:
                        duration: 2h
                        recurring:
                          every: 1w
                          occurrences: 10
                          onWeekDay:
                            - MO
                            - WE
                        start: '2025-03-01T08:00:00.000Z'
                        timezone: Europe/Amsterdam
                    scope:
                      alerting:
                        query:
                          kql: 'kibana.alert.tags: "infra"'
                    status: upcoming
                    title: Weekly Maintenance Window
                    updated_at: '2025-02-25T10:00:00.000Z'
                    updated_by: elastic
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_maintenance_window_response'
          description: Indicates a successful call.
        '400':
          description: Indicates an invalid schema or parameters.
        '403':
          description: Indicates that this call is forbidden.
        '404':
          description: Indicates a maintenance window with the given ID does not exist.
      summary: Get maintenance window details.
      tags:
        - maintenance-window
      x-state: Generally available; added in 9.1.0
      x-metaTags:
        - content: Kibana
          name: product_name
    patch:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb patch">patch</span>&nbsp;<span class="operation-path">/s/{space_id}/api/maintenance_window/{id}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        [Required authorization] Route required privileges: write-maintenance-window.
      operationId: patch-maintenance-window-id
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: The identifier for the maintenance window.
          in: path
          name: id
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            examples:
              updateMaintenanceWindowRequest:
                description: |
                  Update a maintenance window to change its title, schedule, and scope.
                summary: Update a maintenance window
                value:
                  enabled: true
                  schedule:
                    custom:
                      duration: 1h
                      recurring:
                        end: '2025-12-31T00:00:00.000Z'
                        every: 2w
                        onWeekDay:
                          - FR
                      start: '2025-04-01T10:00:00.000Z'
                      timezone: US/Eastern
                  scope:
                    alerting:
                      query:
                        kql: 'kibana.alert.tags: "database"'
                  title: Updated maintenance window
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_update_maintenance_window'
      responses:
        '200':
          content:
            application/json:
              examples:
                updateMaintenanceWindowResponse:
                  description: |
                    The response returned when a maintenance window is successfully updated.
                  summary: Update a maintenance window response
                  value:
                    created_at: '2025-02-25T10:00:00.000Z'
                    created_by: elastic
                    enabled: true
                    id: f0cb1780-537a-4e34-8adf-3b4336862858
                    schedule:
                      custom:
                        duration: 1h
                        recurring:
                          end: '2025-12-31T00:00:00.000Z'
                          every: 2w
                          onWeekDay:
                            - FR
                        start: '2025-04-01T10:00:00.000Z'
                        timezone: US/Eastern
                    scope:
                      alerting:
                        query:
                          kql: 'kibana.alert.tags: "database"'
                    status: upcoming
                    title: Updated maintenance window
                    updated_at: '2025-03-15T14:30:00.000Z'
                    updated_by: elastic
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_maintenance_window_response'
          description: Indicates a successful call.
        '400':
          description: Indicates an invalid schema or parameters.
        '403':
          description: Indicates that this call is forbidden.
        '404':
          description: Indicates a maintenance window with the given ID does not exist.
        '409':
          description: Indicates that the maintenance window has already been updated by another user.
      summary: Update a maintenance window.
      tags:
        - maintenance-window
      x-state: Generally available; added in 9.1.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/maintenance_window/{id}/_archive:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/maintenance_window/{id}/_archive</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        [Required authorization] Route required privileges: write-maintenance-window.
      operationId: post-maintenance-window-id-archive
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: The identifier for the maintenance window to be archived.
          in: path
          name: id
          required: true
          schema:
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                archiveMaintenanceWindowResponse:
                  description: |
                    The response returned when a maintenance window is successfully archived.
                  summary: Archive a maintenance window response
                  value:
                    created_at: '2025-02-25T10:00:00.000Z'
                    created_by: elastic
                    enabled: true
                    id: f0cb1780-537a-4e34-8adf-3b4336862858
                    schedule:
                      custom:
                        duration: 2h
                        recurring:
                          every: 1w
                          occurrences: 10
                          onWeekDay:
                            - MO
                            - WE
                        start: '2025-03-01T08:00:00.000Z'
                        timezone: Europe/Amsterdam
                    scope:
                      alerting:
                        query:
                          kql: 'kibana.alert.tags: "infra"'
                    status: archived
                    title: Weekly Maintenance Window
                    updated_at: '2025-02-25T10:00:00.000Z'
                    updated_by: elastic
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_maintenance_window_response'
          description: Indicates a successful call.
        '400':
          description: Indicates an invalid schema or parameters.
        '403':
          description: Indicates that this call is forbidden.
        '404':
          description: Indicates a maintenance window with the given ID does not exist.
      summary: Archive a maintenance window.
      tags:
        - maintenance-window
      x-state: Generally available; added in 9.1.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/maintenance_window/{id}/_unarchive:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/maintenance_window/{id}/_unarchive</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        [Required authorization] Route required privileges: write-maintenance-window.
      operationId: post-maintenance-window-id-unarchive
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: The identifier for the maintenance window to be unarchived.
          in: path
          name: id
          required: true
          schema:
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                unarchiveMaintenanceWindowResponse:
                  description: |
                    The response returned when a maintenance window is successfully unarchived.
                  summary: Unarchive a maintenance window response
                  value:
                    created_at: '2025-02-25T10:00:00.000Z'
                    created_by: elastic
                    enabled: true
                    id: f0cb1780-537a-4e34-8adf-3b4336862858
                    schedule:
                      custom:
                        duration: 2h
                        recurring:
                          every: 1w
                          occurrences: 10
                          onWeekDay:
                            - MO
                            - WE
                        start: '2025-03-01T08:00:00.000Z'
                        timezone: Europe/Amsterdam
                    scope:
                      alerting:
                        query:
                          kql: 'kibana.alert.tags: "infra"'
                    status: upcoming
                    title: Weekly Maintenance Window
                    updated_at: '2025-02-25T10:00:00.000Z'
                    updated_by: elastic
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_maintenance_window_response'
          description: Indicates a successful call.
        '400':
          description: Indicates an invalid schema or parameters.
        '403':
          description: Indicates that this call is forbidden.
        '404':
          description: Indicates a maintenance window with the given ID does not exist.
      summary: Unarchive a maintenance window.
      tags:
        - maintenance-window
      x-state: Generally available; added in 9.1.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/markdowns:
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/markdowns</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Returns a paginated list of markdown library items. Each result includes title, description, and metadata, but not the content. Use `GET /api/markdowns/{id}` to retrieve the complete state.
      operationId: get-markdowns
      parameters:
        - description: The page of results to return.
          in: query
          name: page
          required: false
          schema:
            default: 1
            minimum: 1
            type: number
        - description: The number of results to return per page.
          in: query
          name: per_page
          required: false
          schema:
            default: 20
            maximum: 1000
            minimum: 1
            type: number
        - description: Filters results by `title` and `description` using Elasticsearch [`simple_query_string`](https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-simple-query-string-query) syntax. Multi-word terms require all words to match.
          in: query
          name: query
          required: false
          schema:
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                searchMarkdownsResponse:
                  description: Paginated list of markdown library item summaries. Each item includes the ID, a subset of state fields (`title` and `description`), and metadata. The full `content` is not included; use `GET /api/markdowns/{id}` to retrieve a specific item.
                  summary: Search markdown library items response
                  value:
                    data:
                      - data:
                          description: Intro and context for the web logs dashboard.
                          title: Web logs overview
                        id: 5e1f3a20-c4d6-11ef-be8b-3c7c2b9d1f4e
                        meta:
                          created_at: '2026-04-13T10:00:00.000Z'
                          managed: false
                          updated_at: '2026-04-13T10:00:00.000Z'
                          version: WzU5LDFd
                    meta:
                      page: 1
                      per_page: 20
                      total: 1
              schema:
                additionalProperties: false
                type: object
                properties:
                  data:
                    description: List of markdown library items matching the query.
                    items:
                      additionalProperties: false
                      type: object
                      properties:
                        data:
                          additionalProperties: false
                          type: object
                          properties:
                            description:
                              description: A short description of the markdown library item.
                              type: string
                            title:
                              description: The markdown library item title.
                              type: string
                          required:
                            - title
                        id:
                          description: The markdown library item ID.
                          type: string
                        meta:
                          $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-as-code-meta'
                      required:
                        - id
                        - data
                        - meta
                    maxItems: 1000
                    minItems: 0
                    type: array
                  meta:
                    additionalProperties: false
                    type: object
                    properties:
                      page:
                        default: 1
                        description: The returned page of results.
                        minimum: 1
                        type: number
                      per_page:
                        default: 20
                        description: The number of results returned per page.
                        maximum: 1000
                        minimum: 1
                        type: number
                      total:
                        description: The total number of results matching the query.
                        type: number
                    required:
                      - total
                required:
                  - data
                  - meta
          description: success
        '403':
          description: forbidden
      summary: List markdown library items
      tags:
        - Markdowns
      x-codeSamples:
        - label: Search markdown library items - cURL
          lang: cURL
          source: |
            curl -X GET "${KIBANA_URL}/api/markdowns?query=welcome&per_page=10" \
              -H "Authorization: ApiKey ${API_KEY}"
        - label: Search markdown library items - Console
          lang: Console
          source: |
            GET kbn:/api/markdowns?query=welcome&per_page=10
      x-state: Experimental; added in 9.6.0
      x-metaTags:
        - content: Kibana
          name: product_name
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/markdowns</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Creates a new markdown library item and returns its ID, full state, and metadata.
      operationId: post-markdowns
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
      requestBody:
        content:
          application/json:
            examples:
              createMarkdown:
                summary: Create a markdown library item
                value:
                  content: |
                    ## Web logs overview

                    A quick reference for the **Kibana sample web logs** dataset (`kibana_sample_data_logs`).

                    **Key metrics in this dashboard:**

                    - Total request count by HTTP method
                    - Average response size over time
                    - Geographic distribution of client IPs

                    > Use the time picker above to narrow the dashboard to an incident window.

                    For field reference, see the [sample data documentation](https://www.elastic.co/docs/manage-data/ingest/sample-data).
                  description: Intro and context for the web logs dashboard.
                  settings:
                    open_links_in_new_tab: true
                  title: Web logs overview
            schema:
              additionalProperties: false
              type: object
              properties:
                content:
                  description: The Markdown text rendered by the panel. Supports GitHub-flavored Markdown, including headings, paragraphs, lists, links, images, tables, blockquotes, and code blocks. Use `\n` for line breaks within JSON strings.
                  type: string
                description:
                  description: A short description of the markdown library item.
                  type: string
                settings:
                  additionalProperties: false
                  default:
                    open_links_in_new_tab: true
                  description: Display settings for the markdown panel.
                  type: object
                  properties:
                    open_links_in_new_tab:
                      default: true
                      description: Open links in a new browser tab.
                      type: boolean
                title:
                  description: The markdown library item title.
                  minLength: 1
                  type: string
              required:
                - content
                - title
      responses:
        '201':
          content:
            application/json:
              examples:
                createMarkdownResponse:
                  description: Response to creating a markdown library item. Returns the generated ID, the full item state in `data`, and metadata.
                  summary: Create markdown library item response
                  value:
                    data:
                      content: |
                        ## Web logs overview

                        A quick reference for the **Kibana sample web logs** dataset (`kibana_sample_data_logs`).

                        **Key metrics in this dashboard:**

                        - Total request count by HTTP method
                        - Average response size over time
                        - Geographic distribution of client IPs

                        > Use the time picker above to narrow the dashboard to an incident window.

                        For field reference, see the [sample data documentation](https://www.elastic.co/docs/manage-data/ingest/sample-data).
                      description: Intro and context for the web logs dashboard.
                      settings:
                        open_links_in_new_tab: true
                      title: Web logs overview
                    id: 5e1f3a20-c4d6-11ef-be8b-3c7c2b9d1f4e
                    meta:
                      created_at: '2026-04-13T10:00:00.000Z'
                      managed: false
                      updated_at: '2026-04-13T10:00:00.000Z'
                      version: WzU5LDFd
              schema:
                additionalProperties: false
                type: object
                properties:
                  data:
                    additionalProperties: false
                    type: object
                    properties:
                      content:
                        description: The Markdown text rendered by the panel. Supports GitHub-flavored Markdown, including headings, paragraphs, lists, links, images, tables, blockquotes, and code blocks. Use `\n` for line breaks within JSON strings.
                        type: string
                      description:
                        description: A short description of the markdown library item.
                        type: string
                      settings:
                        additionalProperties: false
                        default:
                          open_links_in_new_tab: true
                        description: Display settings for the markdown panel.
                        type: object
                        properties:
                          open_links_in_new_tab:
                            default: true
                            description: Open links in a new browser tab.
                            type: boolean
                      title:
                        description: The markdown library item title.
                        minLength: 1
                        type: string
                    required:
                      - content
                      - title
                  id:
                    description: The unique ID of the markdown library item, as returned by the create or search endpoints.
                    type: string
                  meta:
                    $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-as-code-meta'
                required:
                  - id
                  - data
                  - meta
          description: created
        '400':
          description: invalid request
        '403':
          description: forbidden
      summary: Create a markdown library item
      tags:
        - Markdowns
      x-codeSamples:
        - label: Create a markdown library item - cURL
          lang: cURL
          source: |
            curl -X POST "${KIBANA_URL}/api/markdowns" \
              -H "Authorization: ApiKey ${API_KEY}" \
              -H "kbn-xsrf: true" \
              -H "Content-Type: application/json" \
              -d '{
              "title": "Web logs overview",
              "description": "Intro and context for the web logs dashboard.",
              "content": "## Web logs overview\n\nA quick reference for the **Kibana sample web logs** dataset (`kibana_sample_data_logs`).\n\n**Key metrics in this dashboard:**\n\n- Total request count by HTTP method\n- Average response size over time\n- Geographic distribution of client IPs\n\n> Use the time picker above to narrow the dashboard to an incident window.\n\nFor field reference, see the [sample data documentation](https://www.elastic.co/docs/manage-data/ingest/sample-data).\n",
              "settings": {
                "open_links_in_new_tab": true
              }
            }'
        - label: Create a markdown library item - Console
          lang: Console
          source: |
            POST kbn:/api/markdowns
            {
              "title": "Web logs overview",
              "description": "Intro and context for the web logs dashboard.",
              "content": "## Web logs overview\n\nA quick reference for the **Kibana sample web logs** dataset (`kibana_sample_data_logs`).\n\n**Key metrics in this dashboard:**\n\n- Total request count by HTTP method\n- Average response size over time\n- Geographic distribution of client IPs\n\n> Use the time picker above to narrow the dashboard to an incident window.\n\nFor field reference, see the [sample data documentation](https://www.elastic.co/docs/manage-data/ingest/sample-data).\n",
              "settings": {
                "open_links_in_new_tab": true
              }
            }
      x-state: Experimental; added in 9.6.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/markdowns/{id}:
    delete:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb delete">delete</span>&nbsp;<span class="operation-path">/s/{space_id}/api/markdowns/{id}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Permanently deletes a markdown library item by ID.
      operationId: delete-markdowns-id
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: The markdown library item ID, as returned by the create or search endpoints.
          in: path
          name: id
          required: true
          schema:
            type: string
      responses:
        '204':
          description: No content, the markdown library item was successfully deleted.
        '403':
          description: forbidden
        '404':
          description: not found
      summary: Delete a markdown library item
      tags:
        - Markdowns
      x-codeSamples:
        - label: Delete a markdown library item - cURL
          lang: cURL
          source: |
            curl -X DELETE "${KIBANA_URL}/api/markdowns/5e1f3a20-c4d6-11ef-be8b-3c7c2b9d1f4e" \
              -H "Authorization: ApiKey ${API_KEY}" \
              -H "kbn-xsrf: true"
        - label: Delete a markdown library item - Console
          lang: Console
          source: |
            DELETE kbn:/api/markdowns/5e1f3a20-c4d6-11ef-be8b-3c7c2b9d1f4e
      x-state: Experimental; added in 9.6.0
      x-metaTags:
        - content: Kibana
          name: product_name
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/markdowns/{id}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Returns the complete state of a markdown library item by ID.
      operationId: get-markdowns-id
      parameters:
        - description: The markdown library item ID, as returned by the create or search endpoints.
          in: path
          name: id
          required: true
          schema:
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                getMarkdownResponse:
                  description: The full markdown library item state including `content`, `settings`, and metadata.
                  summary: Get markdown library item response
                  value:
                    data:
                      content: |
                        ## Web logs overview

                        A quick reference for the **Kibana sample web logs** dataset (`kibana_sample_data_logs`).

                        **Key metrics in this dashboard:**

                        - Total request count by HTTP method
                        - Average response size over time
                        - Geographic distribution of client IPs

                        > Use the time picker above to narrow the dashboard to an incident window.

                        For field reference, see the [sample data documentation](https://www.elastic.co/docs/manage-data/ingest/sample-data).
                      description: Intro and context for the web logs dashboard.
                      settings:
                        open_links_in_new_tab: true
                      title: Web logs overview
                    id: 5e1f3a20-c4d6-11ef-be8b-3c7c2b9d1f4e
                    meta:
                      created_at: '2026-04-13T10:00:00.000Z'
                      managed: false
                      updated_at: '2026-04-13T10:00:00.000Z'
                      version: WzU5LDFd
              schema:
                additionalProperties: false
                type: object
                properties:
                  data:
                    additionalProperties: false
                    type: object
                    properties:
                      content:
                        description: The Markdown text rendered by the panel. Supports GitHub-flavored Markdown, including headings, paragraphs, lists, links, images, tables, blockquotes, and code blocks. Use `\n` for line breaks within JSON strings.
                        type: string
                      description:
                        description: A short description of the markdown library item.
                        type: string
                      settings:
                        additionalProperties: false
                        default:
                          open_links_in_new_tab: true
                        description: Display settings for the markdown panel.
                        type: object
                        properties:
                          open_links_in_new_tab:
                            default: true
                            description: Open links in a new browser tab.
                            type: boolean
                      title:
                        description: The markdown library item title.
                        minLength: 1
                        type: string
                    required:
                      - content
                      - title
                  id:
                    description: The unique ID of the markdown library item, as returned by the create or search endpoints.
                    type: string
                  meta:
                    $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-as-code-meta'
                required:
                  - id
                  - data
                  - meta
          description: success
        '403':
          description: forbidden
        '404':
          description: not found
      summary: Get a markdown library item by ID
      tags:
        - Markdowns
      x-codeSamples:
        - label: Get a markdown library item - cURL
          lang: cURL
          source: |
            curl -X GET "${KIBANA_URL}/api/markdowns/5e1f3a20-c4d6-11ef-be8b-3c7c2b9d1f4e" \
              -H "Authorization: ApiKey ${API_KEY}"
        - label: Get a markdown library item - Console
          lang: Console
          source: |
            GET kbn:/api/markdowns/5e1f3a20-c4d6-11ef-be8b-3c7c2b9d1f4e
      x-state: Experimental; added in 9.6.0
      x-metaTags:
        - content: Kibana
          name: product_name
    put:
      description: |
        **Spaces method and path for this operation:**

        <div><span class="operation-verb put">put</span>&nbsp;<span class="operation-path">/s/{space_id}/api/markdowns/{id}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Replaces the full state of a markdown library item. Partial updates are not supported.
        To make incremental changes, retrieve the item first, modify the fields you need, then send the complete object back.

        If no item exists with the specified ID, a new one is created.
      operationId: put-markdowns-id
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: The unique ID of the markdown library item to be created or updated.
          in: path
          name: id
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            examples:
              upsertMarkdown:
                summary: Upsert a markdown library item
                value:
                  content: |
                    ## Web logs overview

                    A quick reference for the **Kibana sample web logs** dataset (`kibana_sample_data_logs`).

                    **Key metrics in this dashboard:**

                    - Total request count by HTTP method
                    - Average response size over time
                    - Geographic distribution of client IPs
                    - _New:_ error rate broken down by status code

                    > Use the time picker above to narrow the dashboard to an incident window.

                    For field reference, see the [sample data documentation](https://www.elastic.co/docs/manage-data/ingest/sample-data).
                  description: Intro and context for the web logs dashboard.
                  settings:
                    open_links_in_new_tab: true
                  title: Web logs overview
            schema:
              additionalProperties: false
              type: object
              properties:
                content:
                  description: The Markdown text rendered by the panel. Supports GitHub-flavored Markdown, including headings, paragraphs, lists, links, images, tables, blockquotes, and code blocks. Use `\n` for line breaks within JSON strings.
                  type: string
                description:
                  description: A short description of the markdown library item.
                  type: string
                settings:
                  additionalProperties: false
                  default:
                    open_links_in_new_tab: true
                  description: Display settings for the markdown panel.
                  type: object
                  properties:
                    open_links_in_new_tab:
                      default: true
                      description: Open links in a new browser tab.
                      type: boolean
                title:
                  description: The markdown library item title.
                  minLength: 1
                  type: string
              required:
                - content
                - title
      responses:
        '200':
          content:
            application/json:
              examples:
                updatedMarkdownResponse:
                  description: The complete updated markdown library item state after a full replacement. PUT replaces the entire item, so any fields omitted from the request are reset to their defaults.
                  summary: Update markdown library item response
                  value:
                    data:
                      content: |
                        ## Web logs overview

                        A quick reference for the **Kibana sample web logs** dataset (`kibana_sample_data_logs`).

                        **Key metrics in this dashboard:**

                        - Total request count by HTTP method
                        - Average response size over time
                        - Geographic distribution of client IPs
                        - _New:_ error rate broken down by status code

                        > Use the time picker above to narrow the dashboard to an incident window.

                        For field reference, see the [sample data documentation](https://www.elastic.co/docs/manage-data/ingest/sample-data).
                      description: Intro and context for the web logs dashboard.
                      settings:
                        open_links_in_new_tab: true
                      title: Web logs overview
                    id: 5e1f3a20-c4d6-11ef-be8b-3c7c2b9d1f4e
                    meta:
                      created_at: '2026-04-13T10:00:00.000Z'
                      managed: false
                      updated_at: '2026-04-13T11:00:00.000Z'
                      version: WzYwLDFd
              schema:
                additionalProperties: false
                type: object
                properties:
                  data:
                    additionalProperties: false
                    type: object
                    properties:
                      content:
                        description: The Markdown text rendered by the panel. Supports GitHub-flavored Markdown, including headings, paragraphs, lists, links, images, tables, blockquotes, and code blocks. Use `\n` for line breaks within JSON strings.
                        type: string
                      description:
                        description: A short description of the markdown library item.
                        type: string
                      settings:
                        additionalProperties: false
                        default:
                          open_links_in_new_tab: true
                        description: Display settings for the markdown panel.
                        type: object
                        properties:
                          open_links_in_new_tab:
                            default: true
                            description: Open links in a new browser tab.
                            type: boolean
                      title:
                        description: The markdown library item title.
                        minLength: 1
                        type: string
                    required:
                      - content
                      - title
                  id:
                    description: The unique ID of the markdown library item, as returned by the create or search endpoints.
                    type: string
                  meta:
                    $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-as-code-meta'
                required:
                  - id
                  - data
                  - meta
          description: updated
        '201':
          content:
            application/json:
              examples:
                createdMarkdownResponse:
                  description: Returned when the upsert created a new item because no item existed with the specified ID.
                  summary: Create markdown library item response (via upsert)
                  value:
                    data:
                      content: |
                        ## Web logs overview

                        A quick reference for the **Kibana sample web logs** dataset (`kibana_sample_data_logs`).

                        **Key metrics in this dashboard:**

                        - Total request count by HTTP method
                        - Average response size over time
                        - Geographic distribution of client IPs

                        > Use the time picker above to narrow the dashboard to an incident window.

                        For field reference, see the [sample data documentation](https://www.elastic.co/docs/manage-data/ingest/sample-data).
                      description: Intro and context for the web logs dashboard.
                      settings:
                        open_links_in_new_tab: true
                      title: Web logs overview
                    id: web-logs-overview
                    meta:
                      created_at: '2026-04-13T10:00:00.000Z'
                      managed: false
                      updated_at: '2026-04-13T10:00:00.000Z'
                      version: WzU5LDFd
              schema:
                additionalProperties: false
                type: object
                properties:
                  data:
                    additionalProperties: false
                    type: object
                    properties:
                      content:
                        description: The Markdown text rendered by the panel. Supports GitHub-flavored Markdown, including headings, paragraphs, lists, links, images, tables, blockquotes, and code blocks. Use `\n` for line breaks within JSON strings.
                        type: string
                      description:
                        description: A short description of the markdown library item.
                        type: string
                      settings:
                        additionalProperties: false
                        default:
                          open_links_in_new_tab: true
                        description: Display settings for the markdown panel.
                        type: object
                        properties:
                          open_links_in_new_tab:
                            default: true
                            description: Open links in a new browser tab.
                            type: boolean
                      title:
                        description: The markdown library item title.
                        minLength: 1
                        type: string
                    required:
                      - content
                      - title
                  id:
                    description: The unique ID of the markdown library item, as returned by the create or search endpoints.
                    type: string
                  meta:
                    $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-as-code-meta'
                required:
                  - id
                  - data
                  - meta
          description: created
        '400':
          description: invalid request
        '403':
          description: forbidden
      summary: Upsert a markdown library item
      tags:
        - Markdowns
      x-codeSamples:
        - label: Upsert a markdown library item - cURL
          lang: cURL
          source: |
            curl -X PUT "${KIBANA_URL}/api/markdowns/5e1f3a20-c4d6-11ef-be8b-3c7c2b9d1f4e" \
              -H "Authorization: ApiKey ${API_KEY}" \
              -H "kbn-xsrf: true" \
              -H "Content-Type: application/json" \
              -d '{
              "title": "Web logs overview",
              "description": "Intro and context for the web logs dashboard.",
              "content": "## Web logs overview\n\nA quick reference for the **Kibana sample web logs** dataset (`kibana_sample_data_logs`).\n\n**Key metrics in this dashboard:**\n\n- Total request count by HTTP method\n- Average response size over time\n- Geographic distribution of client IPs\n- _New:_ error rate broken down by status code\n\n> Use the time picker above to narrow the dashboard to an incident window.\n\nFor field reference, see the [sample data documentation](https://www.elastic.co/docs/manage-data/ingest/sample-data).\n",
              "settings": {
                "open_links_in_new_tab": true
              }
            }'
        - label: Upsert a markdown library item - Console
          lang: Console
          source: |
            PUT kbn:/api/markdowns/5e1f3a20-c4d6-11ef-be8b-3c7c2b9d1f4e
            {
              "title": "Web logs overview",
              "description": "Intro and context for the web logs dashboard.",
              "content": "## Web logs overview\n\nA quick reference for the **Kibana sample web logs** dataset (`kibana_sample_data_logs`).\n\n**Key metrics in this dashboard:**\n\n- Total request count by HTTP method\n- Average response size over time\n- Geographic distribution of client IPs\n- _New:_ error rate broken down by status code\n\n> Use the time picker above to narrow the dashboard to an incident window.\n\nFor field reference, see the [sample data documentation](https://www.elastic.co/docs/manage-data/ingest/sample-data).\n",
              "settings": {
                "open_links_in_new_tab": true
              }
            }
      x-state: Experimental; added in 9.6.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/ml/saved_objects/sync:
    get:
      description: |
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/ml/saved_objects/sync</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Synchronizes Kibana saved objects for machine learning jobs and trained models in the default space. You must have `all` privileges for the **Machine Learning** feature in the **Analytics** section of the Kibana feature privileges. This API runs automatically when you start Kibana and periodically thereafter.
      operationId: mlSync
      parameters:
        - $ref: '#/components/parameters/Machine_learning_APIs_simulateParam'
      responses:
        '200':
          content:
            application/json:
              examples:
                syncExample:
                  $ref: '#/components/examples/Machine_learning_APIs_mlSyncExample'
              schema:
                $ref: '#/components/schemas/Machine_learning_APIs_mlSync200Response'
          description: Indicates a successful call
        '401':
          content:
            application/json:
              examples:
                syncExample:
                  $ref: '#/components/examples/Machine_learning_APIs_mlSync401Example'
              schema:
                $ref: '#/components/schemas/Machine_learning_APIs_mlSync4xxResponse'
          description: Authorization information is missing or invalid.
      summary: Sync saved objects in the default space
      tags:
        - ml
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/ml/saved_objects/update_jobs_spaces:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/ml/saved_objects/update_jobs_spaces</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Update a list of jobs to add and/or remove them from given spaces.
      operationId: mlUpdateJobsSpaces
      requestBody:
        content:
          application/json:
            examples:
              updateADJobSpacesRequest:
                value:
                  jobIds:
                    - test-job
                  jobType: anomaly-detector
                  spacesToAdd:
                    - default
                  spacesToRemove:
                    - '*'
              updateDFAJobSpacesRequest:
                value:
                  jobIds:
                    - test-job
                  jobType: data-frame-analytics
                  spacesToAdd:
                    - default
                  spacesToRemove:
                    - '*'
      responses:
        '200':
          content:
            application/json:
              examples:
                successADResponse:
                  value:
                    test-job:
                      success: true
                      type: anomaly-detector
                successDFAResponse:
                  value:
                    test-job:
                      success: true
                      type: data-frame-analytics
          description: Indicates a successful call
      summary: Update jobs spaces
      tags:
        - ml
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/ml/saved_objects/update_trained_models_spaces:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/ml/saved_objects/update_trained_models_spaces</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Update a list of trained models to add and/or remove them from given spaces.
      operationId: mlUpdateTrainedModelsSpaces
      requestBody:
        content:
          application/json:
            examples:
              updateTrainedModelsSpacesRequest:
                value:
                  modelIds:
                    - test-model
                  spacesToAdd:
                    - default
                  spacesToRemove:
                    - '*'
      responses:
        '200':
          content:
            application/json:
              examples:
                successTMResponse:
                  value:
                    test-model:
                      success: true
                      type: trained-model"
          description: Indicates a successful call
      summary: Update trained models spaces
      tags:
        - ml
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/note:
    delete:
      description: |
        **Spaces method and path for this operation:**

        <div><span class="operation-verb delete">delete</span>&nbsp;<span class="operation-path">/s/{space_id}/api/note</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Deletes notes by saved object ID. Send either `noteId` (single ID) or `noteIds` (array of IDs) in the JSON body.

        The response has HTTP 200 with an empty body on success.

        Requires the **Timeline and Notes** write privilege (`notes_write`).
      operationId: DeleteNote
      requestBody:
        content:
          application/json:
            examples:
              deleteOne:
                summary: Delete a single note by id
                value:
                  noteId: 709f99c6-89b6-4953-9160-35945c8e174e
            schema:
              oneOf:
                - nullable: true
                  type: object
                  properties:
                    noteId:
                      description: Saved object ID of the note to delete.
                      type: string
                  required:
                    - noteId
                - nullable: true
                  type: object
                  properties:
                    noteIds:
                      description: Saved object IDs of the notes to delete.
                      items:
                        type: string
                      nullable: true
                      type: array
                  required:
                    - noteIds
        description: |
          Exactly one shape: `{ "noteId": "<id>" }` for a single delete, or `{ "noteIds": ["<id>", ...] }` for bulk delete.
          `noteIds` may be null in some clients; prefer an empty array or omit unused fields when possible.
        required: true
      responses:
        '200':
          description: The notes were deleted successfully. Response body is empty.
      summary: Delete one or more notes
      tags:
        - Security Timeline API
      x-metaTags:
        - content: Kibana
          name: product_name
    get:
      description: |
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/note</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Returns Security Timeline notes as saved objects.

        **Query modes (mutually exclusive branches on the server):**

        1. **`documentIds` is set** — Returns notes whose `eventId` matches the given Elasticsearch document `_id` (single string or array). Pagination query parameters (`page`, `perPage`, etc.) are **not** applied; the server uses a fixed page size (up to 10000 notes).

        2. **`savedObjectIds` is set** — Returns notes linked to the given Timeline saved object id(s). Same fixed cap as above; list-mode query parameters are **not** applied.

        3. **Neither `documentIds` nor `savedObjectIds`** — Lists notes using saved-objects find semantics: `page` (default 1), `perPage` (default 10), optional `search`, `sortField`, `sortOrder`, `filter`, `createdByFilter`, and `associatedFilter`.

        Requires the **Timeline and Notes** read privilege (`notes_read`).
      operationId: GetNotes
      parameters:
        - description: |
            Event document `_id` values to match against each note's `eventId`. When this parameter is present, the response is all matching notes (up to the server's hard limit), not a paged list using `page`/`perPage`.
          examples:
            multiple:
              summary: Multiple document ids (array)
              value:
                - id-one
                - id-two
            single:
              summary: Single document id
              value: d3a1d35a3e84a81b2f8f3859e064c224cdee1b4bcbf66f57d124dcc739c98e6b
          in: query
          name: documentIds
          schema:
            $ref: '#/components/schemas/Security_Timeline_API_DocumentIds'
        - description: |
            Timeline `savedObjectId` value(s). Returns notes that reference those timelines. When present, list-mode pagination parameters are not used; up to the server's hard limit of notes may be returned.
          examples:
            singleTimeline:
              summary: Single timeline id
              value: 15c1929b-0af7-42bd-85a8-56e234cc7c4e
          in: query
          name: savedObjectIds
          schema:
            $ref: '#/components/schemas/Security_Timeline_API_SavedObjectIds'
        - description: |
            Page number for list mode (when `documentIds` and `savedObjectIds` are omitted). Passed as a string; default 1.
          example: '1'
          in: query
          name: page
          schema:
            nullable: true
            type: string
        - description: |
            Page size for list mode (when `documentIds` and `savedObjectIds` are omitted). Passed as a string; default 10.
          example: '20'
          in: query
          name: perPage
          schema:
            nullable: true
            type: string
        - description: Search string for saved-objects find (list mode only).
          in: query
          name: search
          schema:
            nullable: true
            type: string
        - description: Field to sort by for saved-objects find (list mode only).
          in: query
          name: sortField
          schema:
            nullable: true
            type: string
        - description: Sort order (`asc` or `desc`) for saved-objects find (list mode only).
          example: desc
          in: query
          name: sortOrder
          schema:
            nullable: true
            type: string
        - description: |
            Kuery filter string combined with other list-mode filters (for example `createdByFilter` or `associatedFilter`). Typed as a string for API compatibility; interpreted by the saved-objects layer (list mode only).
          in: query
          name: filter
          schema:
            nullable: true
            type: string
        - description: |
            Kibana user profile **UID** (UUID). The server resolves the user's display identifiers and returns notes whose `createdBy` matches any of them (list mode only).
          example: f1c2d3e4-5b6a-7890-abcd-ef1234567890
          in: query
          name: createdByFilter
          schema:
            nullable: true
            type: string
        - description: |
            Restricts notes by how they relate to a Timeline and/or an event document (list mode only). Some values apply extra filtering after the query. Ignored when `documentIds` or `savedObjectIds` is used.
          in: query
          name: associatedFilter
          schema:
            $ref: '#/components/schemas/Security_Timeline_API_AssociatedFilterType'
      responses:
        '200':
          content:
            application/json:
              examples:
                notesPage:
                  summary: Paged notes for a timeline
                  value:
                    notes:
                      - eventId: d3a1d35a3e84a81b2f8f3859e064c224cdee1b4bc
                        note: Escalated to tier-2 analyst
                        noteId: 709f99c6-89b6-4953-9160-35945c8e174e
                        timelineId: 15c1929b-0af7-42bd-85a8-56e234cc7c4e
                        version: WzQ2LDFd
                    totalCount: 1
              schema:
                $ref: '#/components/schemas/Security_Timeline_API_GetNotesResult'
          description: Notes and total count for the requested mode.
      summary: Get notes
      tags:
        - Security Timeline API
      x-metaTags:
        - content: Kibana
          name: product_name
    patch:
      description: |
        **Spaces method and path for this operation:**

        <div><span class="operation-verb patch">patch</span>&nbsp;<span class="operation-path">/s/{space_id}/api/note</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Creates a new note or updates an existing one.

        **Create:** Send `note` and omit `noteId` to create a new saved object.

        **Update:** Send `note` with the changed fields and set `noteId` to the note's saved object ID. Optionally include `version` for optimistic concurrency when the client has it from a prior read.

        Requires the **Timeline and Notes** write privilege (`notes_write`).
      externalDocs:
        description: Add or update a note on a Timeline
        url: https://www.elastic.co/guide/en/security/current/timeline-api-update.html
      operationId: PersistNoteRoute
      requestBody:
        content:
          application/json:
            examples:
              addNote:
                summary: Add a note on an event
                value:
                  note:
                    eventId: d3a1d35a3e84a81b2f8f3859e064c224cdee1b4bc
                    note: Escalated to tier-2 analyst
                    timelineId: 15c1929b-0af7-42bd-85a8-56e234cc7c4e
            schema:
              type: object
              properties:
                note:
                  $ref: '#/components/schemas/Security_Timeline_API_BareNote'
                  description: Note payload (timeline, text, optional event linkage, metadata).
                noteId:
                  description: The `savedObjectId` of the note to update. Omit when creating a new note.
                  example: 709f99c6-89b6-4953-9160-35945c8e174e
                  nullable: true
                  type: string
                version:
                  description: Saved object version string from a previous read; optional on update.
                  example: WzQ2LDFd
                  nullable: true
                  type: string
              required:
                - note
        description: |
          Body must include the `note` object. For updates, include `noteId` (and optionally `version`).
          To attach a note to a specific event, set `note.eventId` to that event's document `_id`; for a timeline-wide note, omit or clear `eventId` per product rules.
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                persisted:
                  summary: Persisted note wrapper
                  value:
                    note:
                      eventId: d3a1d35a3e84a81b2f8f3859e064c224cdee1b4bc
                      note: Escalated to tier-2 analyst
                      noteId: 709f99c6-89b6-4953-9160-35945c8e174e
                      timelineId: 15c1929b-0af7-42bd-85a8-56e234cc7c4e
                      version: WzQ2LDFd
              schema:
                $ref: '#/components/schemas/Security_Timeline_API_ResponseNote'
          description: The persisted note, including `noteId` and `version`.
      summary: Add or update a note
      tags:
        - Security Timeline API
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/observability_ai_assistant/chat/complete:
    post:
      description: |
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/observability_ai_assistant/chat/complete</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Create a new chat completion by using the Observability AI Assistant.

        The API returns the model's response based on the current conversation context.

        It also handles any tool requests within the conversation, which may trigger multiple calls to the underlying large language model (LLM).

        This functionality is in technical preview and may be changed or removed in a future release. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features.
      operationId: observability-ai-assistant-chat-complete
      requestBody:
        content:
          application/json:
            examples:
              chatCompleteRequestExample:
                $ref: '#/components/examples/Observability_AI_Assistant_API_ChatCompleteRequestExample'
            schema:
              type: object
              properties:
                actions:
                  items:
                    $ref: '#/components/schemas/Observability_AI_Assistant_API_Function'
                  type: array
                connectorId:
                  description: A unique identifier for the connector.
                  type: string
                conversationId:
                  description: A unique identifier for the conversation if you are continuing an existing conversation.
                  type: string
                disableFunctions:
                  description: Flag indicating whether all function calls should be disabled for the conversation. If true, no calls to functions will be made.
                  type: boolean
                instructions:
                  description: An array of instruction objects, which can be either simple strings or detailed objects.
                  items:
                    $ref: '#/components/schemas/Observability_AI_Assistant_API_Instruction'
                  type: array
                messages:
                  description: An array of message objects containing the conversation history.
                  items:
                    $ref: '#/components/schemas/Observability_AI_Assistant_API_Message'
                  type: array
                persist:
                  description: Indicates whether the conversation should be saved to storage. If true, the conversation will be saved and will be available in Kibana.
                  type: boolean
                title:
                  description: A title for the conversation.
                  type: string
              required:
                - messages
                - connectorId
                - persist
      responses:
        '200':
          content:
            application/json:
              examples:
                chatCompleteResponseExample:
                  $ref: '#/components/examples/Observability_AI_Assistant_API_ChatCompleteResponseExample'
              schema:
                type: object
          description: Successful response
      summary: Generate a chat completion
      tags:
        - observability_ai_assistant
      x-codeSamples:
        - lang: cURL
          source: |
            curl --request POST 'localhost:5601/api/observability_ai_assistant/chat/complete' -u <username>:<password> -H 'kbn-xsrf: true' -H "Content-Type: application/json" --data '
            {
            "connectorId": "<connectorId>",
            "disableFunctions": false,
              "messages": [
                {
                  "@timestamp": "2025-06-25T23:45:00.000Z",
                  "message": {
                    "role": "user",
                    "content": "Is my Elasticsearch cluster healthy right now?"
                  }
                }
              ],
            "persist": false,
            "actions": [
              {
                "name": "get_cluster_health",
                "description": "Fetch the current Elasticsearch cluster-health status and key metrics.",
                "parameters": {
                  "type": "object",
                  "properties": {
                    "includeShardStats": {
                      "type": "boolean",
                      "default": false
                    }
                  }
                }
              }
            ],
            "instructions": ["When the user asks about Elasticsearch cluster health, use the get_cluster_health tool to retrieve cluster health, then summarize the response in plain English."]
            }'
      x-state: Technical Preview
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/osquery/history:
    get:
      description: |
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/osquery/history</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Get a unified, time-sorted history of live, rule-triggered, and scheduled osquery executions. The response uses cursor-based pagination.
      operationId: OsqueryGetUnifiedHistory
      parameters:
        - description: The number of results to return per page.
          in: query
          name: pageSize
          required: false
          schema:
            default: 20
            description: The number of results to return per page.
            maximum: 100
            minimum: 1
            type: integer
        - description: A base64-encoded cursor for pagination. Use the value from the previous response to fetch the next page.
          in: query
          name: nextPage
          required: false
          schema:
            description: A base64-encoded cursor for pagination. Use the value from the previous response to fetch the next page.
            type: string
        - description: A search string to filter history entries by pack name, query text, or query ID.
          in: query
          name: kuery
          required: false
          schema:
            description: A search string to filter history entries by pack name, query text, or query ID.
            type: string
        - description: Comma-separated list of user IDs to filter live query history.
          in: query
          name: userIds
          required: false
          schema:
            description: Comma-separated list of user IDs to filter live query history.
            example: elastic,admin
            type: string
        - description: Comma-separated list of source types to include. Valid values are `live`, `rule`, and `scheduled`.
          in: query
          name: sourceFilters
          required: false
          schema:
            description: Comma-separated list of source types to include. Valid values are `live`, `rule`, and `scheduled`.
            example: live,scheduled
            type: string
        - description: The start of the time range filter (ISO 8601).
          in: query
          name: startDate
          required: false
          schema:
            description: The start of the time range filter (ISO 8601).
            example: '2024-01-01T00:00:00Z'
            type: string
        - description: The end of the time range filter (ISO 8601).
          in: query
          name: endDate
          required: false
          schema:
            description: The end of the time range filter (ISO 8601).
            example: '2024-12-31T23:59:59Z'
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                unifiedHistoryExample:
                  summary: Example unified history response
                  value:
                    data:
                      - actionId: 609c4c66-ba3d-43fa-afdd-53e244577aa0
                        agentCount: 5
                        errorCount: 0
                        id: 3c42c847-eb30-4452-80e0-728584042334
                        queryName: uptime_query
                        queryText: select * from uptime;
                        source: Live
                        sourceType: live
                        successCount: 5
                        timestamp: '2024-07-26T09:59:32.220Z'
                        totalRows: 42
                        userId: elastic
                      - agentCount: 10
                        errorCount: 1
                        executionCount: 3
                        id: pack_my_pack_uptime_3
                        packId: 42ba9c50-0cc5-11ed-aa1d-2b27890bc90d
                        packName: My Pack
                        plannedTime: '2024-07-26T09:00:00.000Z'
                        queryName: uptime
                        queryText: select * from uptime;
                        scheduleId: pack_my_pack_uptime
                        source: Scheduled
                        sourceType: scheduled
                        successCount: 9
                        timestamp: '2024-07-26T09:00:00.000Z'
                        totalRows: 100
                    hasMore: true
                    nextPage: eyJhY3Rpb25TZWFyY2hBZnRlciI6WzE3...
              schema:
                $ref: '#/components/schemas/Security_Osquery_API_GetUnifiedHistoryResponse'
          description: Indicates a successful call.
      summary: Get unified query history
      tags:
        - Security Osquery API
      x-state: Generally available; Added in 9.4.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/osquery/live_queries:
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/osquery/live_queries</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Get a list of all live queries.
      operationId: OsqueryFindLiveQueries
      parameters:
        - description: A KQL search string to filter live queries.
          in: query
          name: kuery
          required: false
          schema:
            $ref: '#/components/schemas/Security_Osquery_API_KueryOrUndefined'
        - description: The page number to return.
          in: query
          name: page
          required: false
          schema:
            $ref: '#/components/schemas/Security_Osquery_API_PageOrUndefined'
        - description: The number of results to return per page.
          in: query
          name: pageSize
          required: false
          schema:
            $ref: '#/components/schemas/Security_Osquery_API_PageSizeOrUndefined'
        - description: The field to sort results by.
          in: query
          name: sort
          required: false
          schema:
            $ref: '#/components/schemas/Security_Osquery_API_SortOrUndefined'
        - description: The sort order.
          in: query
          name: sortOrder
          required: false
          schema:
            $ref: '#/components/schemas/Security_Osquery_API_SortOrderOrUndefined'
      responses:
        '200':
          content:
            application/json:
              examples:
                liveQueriesList:
                  summary: A list of recent live queries
                  value:
                    data:
                      items:
                        - _source:
                            '@timestamp': '2023-10-31T00:00:00Z'
                            action_id: 3c42c847-eb30-4452-80e0-728584042334
                            agents:
                              - 16d7caf5-efd2-4212-9b62-73dafc91fa13
                            expiration: '2023-10-31T00:00:00Z'
                            queries:
                              - action_id: 609c4c66-ba3d-43fa-afdd-53e244577aa0
                                agents:
                                  - 16d7caf5-efd2-4212-9b62-73dafc91fa13
                                ecs_mapping:
                                  host.uptime:
                                    field: total_seconds
                                id: 6724a474-cbba-41ef-a1aa-66aebf0879e2
                                query: select * from uptime;
                                saved_query_id: 42ba9c50-0cc5-11ed-aa1d-2b27890bc90d
                            user_id: elastic
                      total: 1
              schema:
                $ref: '#/components/schemas/Security_Osquery_API_FindLiveQueryResponse'
          description: Indicates a successful call.
      summary: Get live queries
      tags:
        - Security Osquery API
      x-metaTags:
        - content: Kibana
          name: product_name
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/osquery/live_queries</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Create and run a live query.
      operationId: OsqueryCreateLiveQuery
      requestBody:
        content:
          application/json:
            examples:
              singleQueryAllAgents:
                summary: Run a single query on all agents
                value:
                  agent_all: true
                  ecs_mapping:
                    host.uptime:
                      field: total_seconds
                  query: select * from uptime;
              targetedQuery:
                summary: Run a query against specific agents
                value:
                  agent_ids:
                    - 16d7caf5-efd2-4212-9b62-73dafc91fa13
                  query: select * from processes;
            schema:
              $ref: '#/components/schemas/Security_Osquery_API_CreateLiveQueryRequestBody'
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                liveQueryCreated:
                  summary: Live query created
                  value:
                    data:
                      '@timestamp': '2022-07-26T09:59:32.220Z'
                      action_id: 3c42c847-eb30-4452-80e0-728584042334
                      agent_all: true
                      agents:
                        - 16d7caf5-efd2-4212-9b62-73dafc91fa13
                      expiration: '2022-07-26T10:04:32.220Z'
                      input_type: osquery
                      queries:
                        - action_id: 609c4c66-ba3d-43fa-afdd-53e244577aa0
                          agents:
                            - 16d7caf5-efd2-4212-9b62-73dafc91fa13
                          id: 6724a474-cbba-41ef-a1aa-66aebf0879e2
                          query: select * from uptime;
                          timeout: 120
                      type: INPUT_ACTION
                      user_id: elastic
              schema:
                $ref: '#/components/schemas/Security_Osquery_API_CreateLiveQueryResponse'
          description: Indicates a successful call.
      summary: Create a live query
      tags:
        - Security Osquery API
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/osquery/live_queries/{id}:
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/osquery/live_queries/{id}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Get the details of a live query using the query ID.
      operationId: OsqueryGetLiveQueryDetails
      parameters:
        - description: The ID of the live query.
          in: path
          name: id
          required: true
          schema:
            description: The ID of the live query result you want to retrieve.
            example: 3c42c847-eb30-4452-80e0-728584042334
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                liveQueryDetails:
                  summary: Live query details with execution status
                  value:
                    data:
                      '@timestamp': '2022-07-26T09:59:32.220Z'
                      action_id: 3c42c847-eb30-4452-80e0-728584042334
                      agents:
                        - 16d7caf5-efd2-4212-9b62-73dafc91fa13
                      expiration: '2022-07-26T10:04:32.220Z'
                      queries:
                        - action_id: 609c4c66-ba3d-43fa-afdd-53e244577aa0
                          agents:
                            - 16d7caf5-efd2-4212-9b62-73dafc91fa13
                          docs: 1
                          failed: 0
                          id: 6724a474-cbba-41ef-a1aa-66aebf0879e2
                          pending: 0
                          query: select * from uptime;
                          responded: 1
                          status: completed
                          successful: 1
                      status: completed
                      user_id: elastic
              schema:
                $ref: '#/components/schemas/Security_Osquery_API_FindLiveQueryDetailsResponse'
          description: Indicates a successful call.
        '404':
          content:
            application/json:
              examples:
                actionNotFound:
                  summary: The live query does not exist in the current space
                  value:
                    message: Action not found
              schema:
                type: object
                properties:
                  message:
                    example: Action not found
                    type: string
          description: |
            No live query with this `id` exists in the current space. Live queries issued from another space also return 404.
      summary: Get live query details
      tags:
        - Security Osquery API
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/osquery/live_queries/{id}/results/{actionId}:
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/osquery/live_queries/{id}/results/{actionId}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Get the results of a live query using the query action ID.
      operationId: OsqueryGetLiveQueryResults
      parameters:
        - description: The ID of the live query.
          in: path
          name: id
          required: true
          schema:
            description: The ID of the live query result you want to retrieve.
            example: 3c42c847-eb30-4452-80e0-728584042334
            type: string
        - description: The ID of the query action.
          in: path
          name: actionId
          required: true
          schema:
            description: The ID of the query action that generated the live query results.
            example: 609c4c66-ba3d-43fa-afdd-53e244577aa0
            type: string
        - description: A KQL search string to filter results.
          in: query
          name: kuery
          required: false
          schema:
            $ref: '#/components/schemas/Security_Osquery_API_KueryOrUndefined'
        - description: The page number to return.
          in: query
          name: page
          required: false
          schema:
            $ref: '#/components/schemas/Security_Osquery_API_PageOrUndefined'
        - description: The number of results to return per page.
          in: query
          name: pageSize
          required: false
          schema:
            $ref: '#/components/schemas/Security_Osquery_API_PageSizeOrUndefined'
        - description: The field to sort results by.
          in: query
          name: sort
          required: false
          schema:
            $ref: '#/components/schemas/Security_Osquery_API_SortOrUndefined'
        - description: The sort order.
          in: query
          name: sortOrder
          required: false
          schema:
            $ref: '#/components/schemas/Security_Osquery_API_SortOrderOrUndefined'
      responses:
        '200':
          content:
            application/json:
              examples:
                liveQueryResults:
                  summary: Result rows from a live query execution
                  value:
                    data:
                      edges:
                        - _id: doc1
                          _source:
                            action_id: 609c4c66-ba3d-43fa-afdd-53e244577aa0
                            agent:
                              id: 16d7caf5-efd2-4212-9b62-73dafc91fa13
                            osquery:
                              total_seconds: '12345'
                        - _id: doc2
                          _source:
                            action_id: 609c4c66-ba3d-43fa-afdd-53e244577aa0
                            agent:
                              id: 16d7caf5-efd2-4212-9b62-73dafc91fa13
                            osquery:
                              total_seconds: '67890'
                      total: 2
              schema:
                $ref: '#/components/schemas/Security_Osquery_API_GetLiveQueryResultsResponse'
          description: Indicates a successful call.
        '404':
          content:
            application/json:
              examples:
                actionNotFound:
                  summary: The live query does not exist in the current space
                  value:
                    message: Action not found
                queryActionNotFound:
                  summary: The id/actionId pair refers to different queries
                  value:
                    message: Live query action not found
              schema:
                type: object
                properties:
                  message:
                    example: Action not found
                    type: string
          description: |
            Either no live query with this `id` exists in the current space (`Action not found`; live queries issued from another space also return 404), or it has no query whose `action_id` matches `{actionId}` (`Live query action not found`).
      summary: Get live query results
      tags:
        - Security Osquery API
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/osquery/live_queries/{id}/results/{actionId}/_export:
    post:
      description: |
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/osquery/live_queries/{id}/results/{actionId}/_export</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Export the results of a live query action as a downloadable file. The response is a streaming file attachment in the requested format.
      operationId: OsqueryExportLiveQueryResults
      parameters:
        - description: The ID of the live query (parent action ID).
          in: path
          name: id
          required: true
          schema:
            description: The ID of the live query.
            example: 3c42c847-eb30-4452-80e0-728584042334
            type: string
        - description: The query action ID whose results are exported. Filters the export to rows for this specific per-agent action.
          in: path
          name: actionId
          required: true
          schema:
            description: The ID of the query action.
            example: 609c4c66-ba3d-43fa-afdd-53e244577aa0
            type: string
        - description: The output format of the exported file.
          in: query
          name: format
          required: true
          schema:
            $ref: '#/components/schemas/Security_Osquery_API_ExportFormat'
      requestBody:
        content:
          application/json:
            examples:
              filteredExport:
                summary: Export only rows matching a KQL filter
                value:
                  kuery: 'user.name: "root"'
            schema:
              $ref: '#/components/schemas/Security_Osquery_API_ExportRequestBody'
        required: false
      responses:
        '200':
          content:
            application/json:
              examples:
                jsonExport:
                  summary: JSON export with metadata and results
                  value:
                    _meta:
                      action_id: 609c4c66-ba3d-43fa-afdd-53e244577aa0
                      exported_by: elastic
                      format: json
                      query: SELECT * FROM users;
                      timestamp: '2026-04-30T09:12:00.000Z'
                      total_results: 2
                    results:
                      - '@timestamp': '2026-04-30T09:11:58.321Z'
                        agent:
                          id: 980a6b73-0b03-4d1e-8915-67c202e4a980
                          name: prod-host-1
                        user:
                          id: '1000'
                          name: ubuntu
              schema:
                $ref: '#/components/schemas/Security_Osquery_API_ExportJsonResponse'
                description: |
                  A JSON object with `_meta` (export metadata) and `results` (all result rows). Rows are held in memory before writing; prefer `ndjson` for large exports.
            application/ndjson:
              examples:
                ndjsonExport:
                  summary: NDJSON export with a leading metadata line
                  value: |
                    {"_meta":{"action_id":"609c4c66-ba3d-43fa-afdd-53e244577aa0","query":"SELECT * FROM users;","timestamp":"2026-04-30T09:12:00.000Z","exported_by":"elastic","format":"ndjson","total_results":2}}
                    {"@timestamp":"2026-04-30T09:11:58.321Z","agent":{"id":"980a6b73-0b03-4d1e-8915-67c202e4a980","name":"prod-host-1"},"user":{"id":"1000","name":"ubuntu"}}
                    {"@timestamp":"2026-04-30T09:11:58.456Z","agent":{"id":"980a6b73-0b03-4d1e-8915-67c202e4a980","name":"prod-host-1"},"user":{"id":"0","name":"root"}}
              schema:
                description: |
                  Newline-delimited JSON stream. The first line is a metadata object; each subsequent line is a result row.
                format: binary
                type: string
            text/csv:
              examples:
                csvExport:
                  summary: CSV export with a header row
                  value: |
                    agent.name,agent.id,user.id,user.name
                    prod-host-1,980a6b73-0b03-4d1e-8915-67c202e4a980,1000,ubuntu
                    prod-host-1,980a6b73-0b03-4d1e-8915-67c202e4a980,0,root
              schema:
                description: |
                  CSV file with a header row derived from the ECS mapping of the originating query (when available). No metadata block is included in CSV output.
                format: binary
                type: string
          description: |
            A downloadable file in the requested format. The `Content-Disposition` header contains the suggested filename.
          headers:
            Content-Disposition:
              description: Attachment disposition with a generated filename, e.g. `attachment; filename="osquery-results-{actionId}-{timestamp}.ndjson"`.
              schema:
                example: attachment; filename="osquery-results-609c4c66-ba3d-43fa-afdd-53e244577aa0-2026-04-30T09-12-00-000Z.ndjson"
                type: string
        '400':
          content:
            application/json:
              examples:
                rowLimitExceeded:
                  summary: Result count exceeds the export limit
                  value:
                    message: Export limited to 500,000 results. Found 500,001. Please add filters to narrow results.
              schema:
                type: object
                properties:
                  message:
                    example: Export limited to 500,000 results. Found 500,001. Please add filters to narrow results.
                    type: string
          description: |
            Bad request. Possible causes: invalid or missing `format` query parameter, malformed KQL in the request body, invalid `esFilters`, or the result count exceeds the 500,000-row limit.
        '403':
          description: |
            The authenticated user does not have the `osquery-readLiveQueries` privilege required to export live query results.
        '404':
          content:
            application/json:
              examples:
                actionNotFound:
                  summary: The id/actionId pair refers to different queries
                  value:
                    message: Live query action not found
              schema:
                type: object
                properties:
                  message:
                    example: Live query action not found
                    type: string
          description: |
            The parent live query action `{id}` was found but does not contain a query whose `action_id` matches `{actionId}`. This typically means the `id` and `actionId` URL parameters refer to different queries.
      summary: Export live query results
      tags:
        - Security Osquery API
      x-state: Generally available; Added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/osquery/packs:
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/osquery/packs</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Get a list of all query packs.
      operationId: OsqueryFindPacks
      parameters:
        - description: The page number to return.
          in: query
          name: page
          required: false
          schema:
            $ref: '#/components/schemas/Security_Osquery_API_PageOrUndefined'
        - description: The number of results to return per page.
          in: query
          name: pageSize
          required: false
          schema:
            $ref: '#/components/schemas/Security_Osquery_API_PageSizeOrUndefined'
        - description: The field to sort results by.
          in: query
          name: sort
          required: false
          schema:
            $ref: '#/components/schemas/Security_Osquery_API_SortOrUndefined'
        - description: The sort order.
          in: query
          name: sortOrder
          required: false
          schema:
            $ref: '#/components/schemas/Security_Osquery_API_SortOrderOrUndefined'
      responses:
        '200':
          content:
            application/json:
              examples:
                packsList:
                  summary: A list of query packs
                  value:
                    data:
                      - created_at: '2025-02-26T13:37:30.452Z'
                        created_by: elastic
                        description: My pack
                        enabled: true
                        name: my_pack
                        queries:
                          - id: ports
                            interval: 60
                            query: SELECT * FROM listening_ports;
                            removed: false
                            snapshot: true
                            timeout: 120
                        saved_object_id: 1c266590-381f-428c-878f-c80c1334f856
                        updated_at: '2025-02-26T13:37:30.452Z'
                        updated_by: elastic
                        version: 1
                    page: 1
                    per_page: 20
                    total: 1
              schema:
                $ref: '#/components/schemas/Security_Osquery_API_FindPacksResponse'
          description: Indicates a successful call.
      summary: Get packs
      tags:
        - Security Osquery API
      x-metaTags:
        - content: Kibana
          name: product_name
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/osquery/packs</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Create a query pack.
      operationId: OsqueryCreatePacks
      requestBody:
        content:
          application/json:
            examples:
              createPack:
                summary: Create a pack with a single query
                value:
                  description: My pack
                  enabled: true
                  name: my_pack
                  policy_ids:
                    - my_policy_id
                  queries:
                    ports:
                      ecs_mapping:
                        client.port:
                          field: port
                      interval: 60
                      query: SELECT * FROM listening_ports;
                      timeout: 120
            schema:
              $ref: '#/components/schemas/Security_Osquery_API_CreatePacksRequestBody'
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                packCreated:
                  summary: Pack created
                  value:
                    data:
                      created_at: '2025-02-26T13:37:30.452Z'
                      created_by: elastic
                      description: My pack
                      enabled: true
                      name: my_pack
                      policy_ids:
                        - my_policy_id
                      queries:
                        ports:
                          interval: 60
                          query: SELECT * FROM listening_ports;
                          removed: false
                          snapshot: true
                          timeout: 120
                      saved_object_id: 1c266590-381f-428c-878f-c80c1334f856
                      shards: []
                      updated_at: '2025-02-26T13:37:30.452Z'
                      updated_by: elastic
                      version: 1
              schema:
                $ref: '#/components/schemas/Security_Osquery_API_CreatePacksResponse'
          description: Indicates a successful call.
      summary: Create a pack
      tags:
        - Security Osquery API
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/osquery/packs/{id}:
    delete:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb delete">delete</span>&nbsp;<span class="operation-path">/s/{space_id}/api/osquery/packs/{id}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Delete a query pack using the pack ID.
      operationId: OsqueryDeletePacks
      parameters:
        - description: The pack ID.
          in: path
          name: id
          required: true
          schema:
            $ref: '#/components/schemas/Security_Osquery_API_PackId'
      responses:
        '200':
          content:
            application/json:
              examples:
                packDeleted:
                  summary: Pack deleted (empty response body)
                  value: {}
              schema:
                type: object
                properties: {}
          description: Indicates a successful call.
      summary: Delete a pack
      tags:
        - Security Osquery API
      x-metaTags:
        - content: Kibana
          name: product_name
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/osquery/packs/{id}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Get the details of a query pack using the pack ID.
      operationId: OsqueryGetPacksDetails
      parameters:
        - description: The pack ID.
          in: path
          name: id
          required: true
          schema:
            $ref: '#/components/schemas/Security_Osquery_API_PackId'
      responses:
        '200':
          content:
            application/json:
              examples:
                packDetails:
                  summary: Pack details
                  value:
                    data:
                      created_at: '2025-02-26T13:37:30.452Z'
                      created_by: elastic
                      description: My pack
                      enabled: true
                      name: my_pack
                      policy_ids:
                        - my_policy_id
                      queries:
                        ports:
                          interval: 60
                          query: SELECT * FROM listening_ports;
                          removed: false
                          snapshot: true
                          timeout: 120
                      saved_object_id: 1c266590-381f-428c-878f-c80c1334f856
                      shards: {}
                      updated_at: '2025-02-26T13:37:30.452Z'
                      updated_by: elastic
                      version: 1
              schema:
                $ref: '#/components/schemas/Security_Osquery_API_FindPackResponse'
          description: Indicates a successful call.
      summary: Get pack details
      tags:
        - Security Osquery API
      x-metaTags:
        - content: Kibana
          name: product_name
    put:
      description: |
        **Spaces method and path for this operation:**

        <div><span class="operation-verb put">put</span>&nbsp;<span class="operation-path">/s/{space_id}/api/osquery/packs/{id}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Update a query pack using the pack ID.
        > info
        > You cannot update a prebuilt pack.
      operationId: OsqueryUpdatePacks
      parameters:
        - description: The pack ID.
          in: path
          name: id
          required: true
          schema:
            $ref: '#/components/schemas/Security_Osquery_API_PackId'
      requestBody:
        content:
          application/json:
            examples:
              renamePack:
                summary: Rename a pack and update its description
                value:
                  description: Updated pack description
                  enabled: true
                  name: my_pack_renamed
            schema:
              $ref: '#/components/schemas/Security_Osquery_API_UpdatePacksRequestBody'
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                packUpdated:
                  summary: Pack updated
                  value:
                    data:
                      description: Updated pack description
                      enabled: true
                      name: my_pack_renamed
                      policy_ids:
                        - my_policy_id
                      queries:
                        ports:
                          interval: 60
                          query: SELECT * FROM listening_ports;
                          removed: false
                          snapshot: true
                          timeout: 120
                      saved_object_id: 1c266590-381f-428c-878f-c80c1334f856
                      shards: []
                      updated_at: '2025-02-27T10:00:00.000Z'
                      updated_by: elastic
                      version: 2
              schema:
                $ref: '#/components/schemas/Security_Osquery_API_UpdatePacksResponse'
          description: Indicates a successful call.
      summary: Update a pack
      tags:
        - Security Osquery API
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/osquery/packs/{id}/copy:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/osquery/packs/{id}/copy</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Create a copy of a query pack with a unique name by appending a `_copy` suffix. If the name already exists, a numeric suffix is added (e.g., `_copy_2`). The copied pack is always created with `enabled` set to `false`.
      operationId: OsqueryCopyPacks
      parameters:
        - description: The ID of the pack to copy.
          in: path
          name: id
          required: true
          schema:
            $ref: '#/components/schemas/Security_Osquery_API_PackId'
      responses:
        '200':
          content:
            application/json:
              examples:
                copyPackExample:
                  summary: Example response for copying a pack
                  value:
                    data:
                      created_at: '2025-02-26T13:37:30.452Z'
                      created_by: elastic
                      description: My pack
                      enabled: false
                      name: my_pack_copy
                      policy_ids: []
                      queries:
                        - ecs_mapping:
                            - key: client.port
                              value:
                                field: port
                          id: ports
                          interval: 60
                          query: SELECT * FROM listening_ports;
                          removed: false
                          snapshot: true
                          timeout: 120
                      saved_object_id: 1c266590-381f-428c-878f-c80c1334f856
                      shards: []
                      updated_at: '2025-02-26T13:37:30.452Z'
                      updated_by: elastic
              schema:
                $ref: '#/components/schemas/Security_Osquery_API_CopyPacksResponse'
          description: Indicates a successful call.
      summary: Copy a pack
      tags:
        - Security Osquery API
      x-state: Generally available; Added in 9.4.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/osquery/saved_queries:
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/osquery/saved_queries</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Get a list of all saved queries.
      operationId: OsqueryFindSavedQueries
      parameters:
        - description: The page number to return.
          in: query
          name: page
          required: false
          schema:
            $ref: '#/components/schemas/Security_Osquery_API_PageOrUndefined'
        - description: The number of results to return per page.
          in: query
          name: pageSize
          required: false
          schema:
            $ref: '#/components/schemas/Security_Osquery_API_PageSizeOrUndefined'
        - description: The field to sort results by.
          in: query
          name: sort
          required: false
          schema:
            $ref: '#/components/schemas/Security_Osquery_API_SortOrUndefined'
        - description: The sort order.
          in: query
          name: sortOrder
          required: false
          schema:
            $ref: '#/components/schemas/Security_Osquery_API_SortOrderOrUndefined'
      responses:
        '200':
          content:
            application/json:
              examples:
                savedQueriesList:
                  summary: A list of saved queries
                  value:
                    data:
                      - created_at: '2025-02-26T13:37:30.452Z'
                        created_by: elastic
                        description: Saved query description
                        ecs_mapping:
                          host.uptime:
                            field: total_seconds
                        id: my_saved_query
                        interval: '60'
                        platform: linux,darwin
                        query: select * from uptime;
                        saved_object_id: 42ba1280-2172-11ee-8523-5765fca79a3c
                        timeout: 120
                        updated_at: '2025-02-26T13:37:30.452Z'
                        updated_by: elastic
                    page: 1
                    per_page: 20
                    total: 1
              schema:
                $ref: '#/components/schemas/Security_Osquery_API_FindSavedQueryResponse'
          description: Indicates a successful call.
      summary: Get saved queries
      tags:
        - Security Osquery API
      x-metaTags:
        - content: Kibana
          name: product_name
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/osquery/saved_queries</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Create and save a query for later use.
      operationId: OsqueryCreateSavedQuery
      requestBody:
        content:
          application/json:
            examples:
              createSavedQuery:
                summary: Create a saved query
                value:
                  description: Saved query description
                  ecs_mapping:
                    host.uptime:
                      field: total_seconds
                  id: my_saved_query
                  interval: '60'
                  platform: linux,darwin
                  query: select * from uptime;
                  timeout: 120
            schema:
              $ref: '#/components/schemas/Security_Osquery_API_CreateSavedQueryRequestBody'
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                savedQueryCreated:
                  summary: Saved query created
                  value:
                    data:
                      created_at: '2025-02-26T13:37:30.452Z'
                      created_by: elastic
                      description: Saved query description
                      ecs_mapping:
                        host.uptime:
                          field: total_seconds
                      id: my_saved_query
                      interval: '60'
                      platform: linux,darwin
                      query: select * from uptime;
                      saved_object_id: 42ba1280-2172-11ee-8523-5765fca79a3c
                      timeout: 120
                      updated_at: '2025-02-26T13:37:30.452Z'
                      updated_by: elastic
              schema:
                $ref: '#/components/schemas/Security_Osquery_API_CreateSavedQueryResponse'
          description: Indicates a successful call.
      summary: Create a saved query
      tags:
        - Security Osquery API
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/osquery/saved_queries/{id}:
    delete:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb delete">delete</span>&nbsp;<span class="operation-path">/s/{space_id}/api/osquery/saved_queries/{id}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Delete a saved query using the query ID.
      operationId: OsqueryDeleteSavedQuery
      parameters:
        - description: The saved query ID.
          in: path
          name: id
          required: true
          schema:
            $ref: '#/components/schemas/Security_Osquery_API_SavedQueryId'
      responses:
        '200':
          content:
            application/json:
              examples:
                savedQueryDeleted:
                  summary: Saved query deleted (empty response body)
                  value: {}
              schema:
                $ref: '#/components/schemas/Security_Osquery_API_DefaultSuccessResponse'
          description: Indicates a successful call.
      summary: Delete a saved query
      tags:
        - Security Osquery API
      x-metaTags:
        - content: Kibana
          name: product_name
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/osquery/saved_queries/{id}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Get the details of a saved query using the query ID.
      operationId: OsqueryGetSavedQueryDetails
      parameters:
        - description: The saved query ID.
          in: path
          name: id
          required: true
          schema:
            $ref: '#/components/schemas/Security_Osquery_API_SavedQueryId'
      responses:
        '200':
          content:
            application/json:
              examples:
                savedQueryDetails:
                  summary: Saved query details
                  value:
                    data:
                      created_at: '2025-02-26T13:37:30.452Z'
                      created_by: elastic
                      description: Saved query description
                      ecs_mapping:
                        host.uptime:
                          field: total_seconds
                      id: my_saved_query
                      interval: '60'
                      platform: linux,darwin
                      query: select * from uptime;
                      saved_object_id: 42ba1280-2172-11ee-8523-5765fca79a3c
                      timeout: 120
                      updated_at: '2025-02-26T13:37:30.452Z'
                      updated_by: elastic
              schema:
                $ref: '#/components/schemas/Security_Osquery_API_FindSavedQueryDetailResponse'
          description: Indicates a successful call.
      summary: Get saved query details
      tags:
        - Security Osquery API
      x-metaTags:
        - content: Kibana
          name: product_name
    put:
      description: |
        **Spaces method and path for this operation:**

        <div><span class="operation-verb put">put</span>&nbsp;<span class="operation-path">/s/{space_id}/api/osquery/saved_queries/{id}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Update a saved query using the query ID.
        > info
        > You cannot update a prebuilt saved query.
      operationId: OsqueryUpdateSavedQuery
      parameters:
        - description: The saved query ID.
          in: path
          name: id
          required: true
          schema:
            $ref: '#/components/schemas/Security_Osquery_API_SavedQueryId'
      requestBody:
        content:
          application/json:
            examples:
              updateSavedQuery:
                summary: Update a saved query
                value:
                  description: Updated saved query description
                  id: my_saved_query
                  interval: '120'
                  platform: linux,darwin
                  query: select * from osquery_info;
                  timeout: 60
            schema:
              $ref: '#/components/schemas/Security_Osquery_API_UpdateSavedQueryRequestBody'
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                savedQueryUpdated:
                  summary: Saved query updated
                  value:
                    data:
                      description: Updated saved query description
                      id: my_saved_query
                      interval: '120'
                      platform: linux,darwin
                      query: select * from osquery_info;
                      saved_object_id: 42ba1280-2172-11ee-8523-5765fca79a3c
                      timeout: 60
                      updated_at: '2025-02-27T10:00:00.000Z'
                      updated_by: elastic
              schema:
                $ref: '#/components/schemas/Security_Osquery_API_UpdateSavedQueryResponse'
          description: Indicates a successful call.
      summary: Update a saved query
      tags:
        - Security Osquery API
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/osquery/saved_queries/{id}/copy:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/osquery/saved_queries/{id}/copy</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Create a copy of a saved query with a unique name by appending a `_copy` suffix. If the name already exists, a numeric suffix is added (e.g., `_copy_2`).
      operationId: OsqueryCopySavedQuery
      parameters:
        - description: The ID of the saved query to copy.
          in: path
          name: id
          required: true
          schema:
            $ref: '#/components/schemas/Security_Osquery_API_SavedQueryId'
      responses:
        '200':
          content:
            application/json:
              examples:
                copySavedQueryExample:
                  summary: Example response for copying a saved query
                  value:
                    data:
                      created_at: '2025-02-26T13:37:30.452Z'
                      created_by: elastic
                      description: Saved query description
                      ecs_mapping:
                        host.uptime:
                          field: total_seconds
                      id: my_saved_query_copy
                      interval: '60'
                      platform: linux,darwin
                      query: select * from uptime;
                      removed: false
                      saved_object_id: 42ba1280-2172-11ee-8523-5765fca79a3c
                      snapshot: true
                      timeout: 120
                      updated_at: '2025-02-26T13:37:30.452Z'
                      updated_by: elastic
              schema:
                $ref: '#/components/schemas/Security_Osquery_API_CopySavedQueryResponse'
          description: Indicates a successful call.
      summary: Copy a saved query
      tags:
        - Security Osquery API
      x-state: Generally available; Added in 9.4.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/osquery/scheduled_results/{scheduleId}/{executionCount}:
    get:
      description: |
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/osquery/scheduled_results/{scheduleId}/{executionCount}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Get paginated per-agent action results for a specific scheduled query execution, with success/failure aggregation and execution metadata (pack name, query name/text, timestamp).
      operationId: OsqueryGetScheduledActionResults
      parameters:
        - description: The schedule ID of the scheduled query.
          in: path
          name: scheduleId
          required: true
          schema:
            description: The schedule ID of the scheduled query.
            example: pack_my_pack_uptime
            type: string
        - description: The execution count for this scheduled query run.
          in: path
          name: executionCount
          required: true
          schema:
            description: The execution count for this scheduled query run.
            example: 3
            type: integer
        - description: The kuery to filter the results by.
          in: query
          name: kuery
          required: false
          schema:
            $ref: '#/components/schemas/Security_Osquery_API_KueryOrUndefined'
        - description: The page number to return. The default is 1.
          in: query
          name: page
          required: false
          schema:
            $ref: '#/components/schemas/Security_Osquery_API_PageOrUndefined'
        - description: The number of results to return per page. The default is 20.
          in: query
          name: pageSize
          required: false
          schema:
            $ref: '#/components/schemas/Security_Osquery_API_PageSizeOrUndefined'
        - description: The field that is used to sort the results.
          in: query
          name: sort
          required: false
          schema:
            $ref: '#/components/schemas/Security_Osquery_API_SortOrUndefined'
        - description: Specifies the sort order.
          in: query
          name: sortOrder
          required: false
          schema:
            $ref: '#/components/schemas/Security_Osquery_API_SortOrderOrUndefined'
      responses:
        '200':
          content:
            application/json:
              examples:
                scheduledActionResultsExample:
                  summary: Example scheduled action results response
                  value:
                    aggregations:
                      failed: 1
                      pending: 0
                      successful: 9
                      totalResponded: 10
                      totalRowCount: 42
                    currentPage: 0
                    edges:
                      - _id: result-001
                        fields:
                          agent_id: 16d7caf5-efd2-4212-9b62-73dafc91fa13
                          rows_count: 5
                          status: success
                    metadata:
                      executionCount: 3
                      packId: 42ba9c50-0cc5-11ed-aa1d-2b27890bc90d
                      packName: My Pack
                      queryName: uptime
                      queryText: select * from uptime;
                      scheduleId: pack_my_pack_uptime
                      timestamp: '2024-07-26T09:00:00.000Z'
                    pageSize: 20
                    total: 10
                    totalPages: 1
              schema:
                $ref: '#/components/schemas/Security_Osquery_API_GetScheduledActionResultsResponse'
          description: Indicates a successful call.
      summary: Get scheduled action results
      tags:
        - Security Osquery API
      x-state: Generally available; Added in 9.4.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/osquery/scheduled_results/{scheduleId}/{executionCount}/_export:
    post:
      description: |
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/osquery/scheduled_results/{scheduleId}/{executionCount}/_export</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Export all result rows for a specific scheduled query execution as a downloadable file. The response is a streaming file attachment in the requested format.
      operationId: OsqueryExportScheduledQueryResults
      parameters:
        - description: The schedule ID of the scheduled query.
          in: path
          name: scheduleId
          required: true
          schema:
            description: The schedule ID of the scheduled query.
            example: 90f342ee-9c05-4844-849b-173993234f22
            type: string
        - description: The execution counter for the scheduled query run whose results are exported. Must be a non-negative integer.
          in: path
          name: executionCount
          required: true
          schema:
            description: The execution counter for this scheduled query run.
            example: 17384
            minimum: 0
            type: integer
        - description: The output format of the exported file.
          in: query
          name: format
          required: true
          schema:
            $ref: '#/components/schemas/Security_Osquery_API_ExportFormat'
      requestBody:
        content:
          application/json:
            examples:
              filteredExport:
                summary: Export only rows matching a KQL filter
                value:
                  kuery: 'agent.name: "prod-host-1"'
            schema:
              $ref: '#/components/schemas/Security_Osquery_API_ExportRequestBody'
        required: false
      responses:
        '200':
          content:
            application/json:
              examples:
                jsonExport:
                  summary: JSON export with metadata and results
                  value:
                    _meta:
                      action_id: 90f342ee-9c05-4844-849b-173993234f22
                      execution_count: 17384
                      exported_by: elastic
                      format: json
                      timestamp: '2026-04-30T09:12:00.000Z'
                      total_results: 1
                    results:
                      - '@timestamp': '2026-04-30T09:11:58.321Z'
                        agent:
                          id: 5b1bb334-a23d-4006-80fe-bd129b979c9f
                          name: prod-host-1
                        osquery:
                          uid: '1000'
                          username: ubuntu
              schema:
                $ref: '#/components/schemas/Security_Osquery_API_ExportJsonResponse'
                description: |
                  A JSON object with `_meta` (export metadata) and `results` (all result rows). Rows are held in memory before writing; prefer `ndjson` for large exports.
            application/ndjson:
              examples:
                ndjsonExport:
                  summary: NDJSON export with a leading metadata line
                  value: |
                    {"_meta":{"action_id":"90f342ee-9c05-4844-849b-173993234f22","execution_count":17384,"timestamp":"2026-04-30T09:12:00.000Z","exported_by":"elastic","format":"ndjson","total_results":32}}
                    {"@timestamp":"2026-04-30T09:11:58.321Z","agent":{"id":"5b1bb334-a23d-4006-80fe-bd129b979c9f","name":"prod-host-1"},"osquery":{"uid":"1000","username":"ubuntu"}}
              schema:
                description: |
                  Newline-delimited JSON stream. The first line is a metadata object (includes `execution_count`); each subsequent line is a result row.
                format: binary
                type: string
            text/csv:
              examples:
                csvExport:
                  summary: CSV export with a header row
                  value: |
                    osquery.description,agent.name,agent.id,osquery.uid,osquery.username
                    Ubuntu,prod-host-1,5b1bb334-a23d-4006-80fe-bd129b979c9f,1000,ubuntu
                    root,prod-host-1,5b1bb334-a23d-4006-80fe-bd129b979c9f,0,root
              schema:
                description: |
                  CSV file with a header row. No metadata block is included in CSV output.
                format: binary
                type: string
          description: |
            A downloadable file in the requested format. The `Content-Disposition` header contains the suggested filename.
          headers:
            Content-Disposition:
              description: Attachment disposition with a generated filename, e.g. `attachment; filename="osquery-scheduled-results-{scheduleId}-{executionCount}-{timestamp}.csv"`.
              schema:
                example: attachment; filename="osquery-scheduled-results-90f342ee-9c05-4844-849b-173993234f22-17384-2026-04-30T09-12-00-000Z.csv"
                type: string
        '400':
          content:
            application/json:
              examples:
                rowLimitExceeded:
                  summary: Result count exceeds the export limit
                  value:
                    message: Export limited to 500,000 results. Found 500,001. Please add filters to narrow results.
              schema:
                type: object
                properties:
                  message:
                    example: Export limited to 500,000 results. Found 500,001. Please add filters to narrow results.
                    type: string
          description: |
            Bad request. Possible causes: invalid or missing `format` query parameter, malformed KQL in the request body, invalid `esFilters`, or the result count exceeds the 500,000-row limit.
        '403':
          description: |
            The authenticated user does not have the `osquery-read` privilege required to export scheduled query results.
      summary: Export scheduled query results
      tags:
        - Security Osquery API
      x-state: Generally available; Added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/osquery/scheduled_results/{scheduleId}/{executionCount}/results:
    get:
      description: |
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/osquery/scheduled_results/{scheduleId}/{executionCount}/results</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Get paginated query result rows (the actual osquery output data) for a specific scheduled query execution.
      operationId: OsqueryGetScheduledQueryResults
      parameters:
        - description: The schedule ID of the scheduled query.
          in: path
          name: scheduleId
          required: true
          schema:
            description: The schedule ID of the scheduled query.
            example: pack_my_pack_uptime
            type: string
        - description: The execution count for this scheduled query run.
          in: path
          name: executionCount
          required: true
          schema:
            description: The execution count for this scheduled query run.
            example: 3
            type: integer
        - description: The kuery to filter the results by.
          in: query
          name: kuery
          required: false
          schema:
            $ref: '#/components/schemas/Security_Osquery_API_KueryOrUndefined'
        - description: The page number to return. The default is 1.
          in: query
          name: page
          required: false
          schema:
            $ref: '#/components/schemas/Security_Osquery_API_PageOrUndefined'
        - description: The number of results to return per page. The default is 20.
          in: query
          name: pageSize
          required: false
          schema:
            $ref: '#/components/schemas/Security_Osquery_API_PageSizeOrUndefined'
        - description: The field that is used to sort the results.
          in: query
          name: sort
          required: false
          schema:
            $ref: '#/components/schemas/Security_Osquery_API_SortOrUndefined'
        - description: Specifies the sort order.
          in: query
          name: sortOrder
          required: false
          schema:
            $ref: '#/components/schemas/Security_Osquery_API_SortOrderOrUndefined'
        - description: The start date filter (ISO 8601) to narrow down results.
          in: query
          name: startDate
          required: false
          schema:
            description: The start date filter (ISO 8601) to narrow down results.
            example: '2024-01-01T00:00:00Z'
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                scheduledQueryResultsExample:
                  summary: Example scheduled query results response
                  value:
                    data:
                      edges:
                        - _id: row-001
                          fields:
                            host.uptime:
                              - '12345'
                        - _id: row-002
                          fields:
                            host.uptime:
                              - '67890'
                      total: 2
              schema:
                $ref: '#/components/schemas/Security_Osquery_API_GetScheduledQueryResultsResponse'
          description: Indicates a successful call.
      summary: Get scheduled query results
      tags:
        - Security Osquery API
      x-state: Generally available; Added in 9.4.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/pinned_event:
    patch:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb patch">patch</span>&nbsp;<span class="operation-path">/s/{space_id}/api/pinned_event</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Pin/unpin an event to/from an existing Timeline.
      operationId: PersistPinnedEventRoute
      requestBody:
        content:
          application/json:
            examples:
              pinEvent:
                summary: Pin an event
                value:
                  eventId: d3a1d35a3e84a81b2f8f3859e064c224cdee1b4bc
                  timelineId: 15c1929b-0af7-42bd-85a8-56e234cc7c4e
            schema:
              type: object
              properties:
                eventId:
                  description: The `_id` of the associated event for this pinned event.
                  example: d3a1d35a3e84a81b2f8f3859e064c224cdee1b4bc
                  type: string
                pinnedEventId:
                  description: The `savedObjectId` of the pinned event you want to unpin.
                  example: 10r1929b-0af7-42bd-85a8-56e234f98h2f3
                  nullable: true
                  type: string
                timelineId:
                  description: The `savedObjectId` of the timeline that you want this pinned event unpinned from.
                  example: 15c1929b-0af7-42bd-85a8-56e234cc7c4e
                  type: string
              required:
                - eventId
                - timelineId
        description: The pinned event to add or unpin, along with additional metadata.
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                pinnedSaved:
                  summary: Pinned event saved object
                  value:
                    eventId: d3a1d35a3e84a81b2f8f3859e064c224cdee1b4bc
                    pinnedEventId: 10r1929b-0af7-42bd-85a8-56e234f98h2f3
                    timelineId: 15c1929b-0af7-42bd-85a8-56e234cc7c4e
                    version: WzQ2LDFe
                unpinned:
                  summary: Unpin response
                  value:
                    unpinned: true
              schema:
                $ref: '#/components/schemas/Security_Timeline_API_PersistPinnedEventResponse'
          description: Indicates a successful call.
      summary: Pin/unpin an event
      tags:
        - Security Timeline API
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/profiling/setup/es_resources:
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/profiling/setup/es_resources</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Check if Universal Profiling has been set up and configured properly<br/><br/>[Required authorization] Route required privileges: profiling.
      operationId: get-profiling-setup-es-resources
      parameters: []
      responses:
        '200':
          content:
            application/json:
              examples:
                notSetUp:
                  description: The Elasticsearch profiling plugin is enabled, but the required resources have not been created. Call `POST /api/profiling/setup/es_resources` to set them up.
                  summary: Not set up yet
                  value:
                    has_data: false
                    has_required_role: true
                    has_setup: false
                    pre_8_9_1_data: false
                    profiling_enabled: true
                profilingDisabled:
                  description: The Universal Profiling plugin is disabled in the Elasticsearch cluster, so setup cannot complete until it is enabled.
                  summary: Disabled in Elasticsearch
                  value:
                    has_data: false
                    has_required_role: true
                    has_setup: false
                    pre_8_9_1_data: false
                    profiling_enabled: false
                setUpWithData:
                  description: Universal Profiling is set up and profiling data has been ingested.
                  summary: Set up and receiving data
                  value:
                    has_data: true
                    has_required_role: true
                    has_setup: true
                    pre_8_9_1_data: false
                    profiling_enabled: true
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_profiling_setup_status_response'
          description: Indicates a successful call.
        '403':
          description: The user does not have the privileges required to read the Universal Profiling setup status.
        '500':
          description: An unexpected error occurred while checking the Universal Profiling setup status.
      summary: Get Universal Profiling setup status
      tags:
        - Universal Profiling
      x-metaTags:
        - content: Kibana
          name: product_name
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/profiling/setup/es_resources</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Set up Universal Profiling resources and configuration<br/><br/>[Required authorization] Route required privileges: profiling.
      operationId: post-profiling-setup-es-resources
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
      responses:
        '202':
          description: Setup was accepted. Enabling resource management in Elasticsearch is asynchronous and may not have completed by the time this response is sent.
        '403':
          description: The user does not have the privileges required to set up Universal Profiling.
        '500':
          description: An unexpected error occurred. Setup failed.
      summary: Initialize Universal Profiling setup
      tags:
        - Universal Profiling
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/risk_score/engine/dangerously_delete_data:
    delete:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb delete">delete</span>&nbsp;<span class="operation-path">/s/{space_id}/api/risk_score/engine/dangerously_delete_data</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Cleaning up the the Risk Engine by removing the indices, mapping and transforms
      operationId: CleanUpRiskEngine
      responses:
        '200':
          content:
            application/json:
              examples:
                CleanUpRiskEngineResponse:
                  summary: Successful cleanup response
                  value:
                    cleanup_successful: true
              schema:
                type: object
                properties:
                  cleanup_successful:
                    type: boolean
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                taskManagerUnavailable:
                  summary: Task manager is unavailable
                  value:
                    message: Task Manager is unavailable, but is required by the risk engine. Please enable the taskManager plugin and try again.
                    status_code: 400
              schema:
                $ref: '#/components/schemas/Security_Entity_Analytics_API_TaskManagerUnavailableResponse'
          description: Task manager is unavailable
        default:
          content:
            application/json:
              examples:
                cleanupFailed:
                  summary: Cleanup failed
                  value:
                    cleanup_successful: false
                    errors:
                      - error: Risk engine is disabled or deleted already.
                        seq: 1
              schema:
                $ref: '#/components/schemas/Security_Entity_Analytics_API_CleanUpRiskEngineErrorResponse'
          description: Unexpected error
      summary: Cleanup the Risk Engine
      tags:
        - Security Entity Analytics API
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/risk_score/engine/saved_object/configure:
    patch:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb patch">patch</span>&nbsp;<span class="operation-path">/s/{space_id}/api/risk_score/engine/saved_object/configure</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Configuring the Risk Engine Saved Object
      operationId: ConfigureRiskEngineSavedObject
      requestBody:
        content:
          application/json:
            examples:
              ConfigureRiskEngineSavedObjectRequest:
                summary: Configure the risk engine saved object
                value:
                  enable_reset_to_zero: false
                  exclude_alert_statuses:
                    - closed
                  exclude_alert_tags:
                    - low-priority
                  filters:
                    - entity_types:
                        - host
                        - user
                      filter: 'host.name: *'
                  range:
                    end: now
                    start: now-30d
            schema:
              type: object
              properties:
                enable_reset_to_zero:
                  type: boolean
                exclude_alert_statuses:
                  items:
                    type: string
                  type: array
                exclude_alert_tags:
                  items:
                    type: string
                  type: array
                filters:
                  items:
                    type: object
                    properties:
                      entity_types:
                        items:
                          enum:
                            - host
                            - user
                            - service
                          type: string
                        type: array
                      filter:
                        description: KQL filter string
                        type: string
                    required:
                      - entity_types
                      - filter
                  type: array
                page_size:
                  description: |
                    Number of entities to score per page. Higher values reduce total scoring time by reducing the number of alert-index scans, but cannot exceed the ES|QL result limit (10,000 by default).
                  maximum: 10000
                  minimum: 100
                  type: integer
                range:
                  type: object
                  properties:
                    end:
                      type: string
                    start:
                      type: string
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                ConfigureRiskEngineSavedObjectResponse:
                  summary: Successful configuration response
                  value:
                    risk_engine_saved_object_configured: true
              schema:
                type: object
                properties:
                  risk_engine_saved_object_configured:
                    type: boolean
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                taskManagerUnavailable:
                  summary: Task manager is unavailable
                  value:
                    message: Task Manager is unavailable, but is required by the risk engine. Please enable the taskManager plugin and try again.
                    status_code: 400
              schema:
                $ref: '#/components/schemas/Security_Entity_Analytics_API_TaskManagerUnavailableResponse'
          description: Task manager is unavailable
        default:
          content:
            application/json:
              examples:
                configureError:
                  summary: Configure saved object failed
                  value:
                    errors:
                      - error: Internal server error
                        seq: 1
                    risk_engine_saved_object_configured: false
              schema:
                $ref: '#/components/schemas/Security_Entity_Analytics_API_ConfigureRiskEngineSavedObjectErrorResponse'
          description: Unexpected error
      summary: Configure the Risk Engine Saved Object
      tags:
        - Security Entity Analytics API
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/risk_score/engine/schedule_now:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/risk_score/engine/schedule_now</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Schedule the risk scoring engine to run as soon as possible. You can use this to recalculate entity risk scores after updating their asset criticality.
      operationId: ScheduleRiskEngineNow
      requestBody:
        content:
          application/json:
            examples:
              emptyRequest:
                summary: No request body
                value: {}
            schema:
              type: object
      responses:
        '200':
          content:
            application/json:
              examples:
                ScheduleRiskEngineNowResponse:
                  summary: Successful schedule response
                  value:
                    success: true
              schema:
                $ref: '#/components/schemas/Security_Entity_Analytics_API_RiskEngineScheduleNowResponse'
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                taskManagerUnavailable:
                  summary: Task manager is unavailable
                  value:
                    message: Task Manager is unavailable, but is required by the risk engine. Please enable the taskManager plugin and try again.
                    status_code: 400
              schema:
                $ref: '#/components/schemas/Security_Entity_Analytics_API_TaskManagerUnavailableResponse'
          description: Task manager is unavailable
        default:
          content:
            application/json:
              examples:
                scheduleNowError:
                  summary: Schedule now failed
                  value:
                    full_error: '{}'
                    message: Internal server error
              schema:
                $ref: '#/components/schemas/Security_Entity_Analytics_API_RiskEngineScheduleNowErrorResponse'
          description: Unexpected error
      summary: Run the risk scoring engine
      tags:
        - Security Entity Analytics API
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/risk_score/history:
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/risk_score/history</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Returns time-ordered historical risk score entries from the risk score time-series index for a given entity.
      operationId: GetRiskScoreHistory
      parameters:
        - description: The type of entity to retrieve history for.
          in: query
          name: entity_type
          required: true
          schema:
            $ref: '#/components/schemas/Security_Entity_Analytics_API_IdentifierType'
        - description: The identifier of the entity to retrieve history for.
          in: query
          name: entity_id
          required: true
          schema:
            maxLength: 1000
            type: string
        - description: Start of the time range, in date-math syntax. Defaults to 90 days ago.
          in: query
          name: from
          required: false
          schema:
            default: now-90d
            maxLength: 100
            type: string
        - description: End of the time range, in date-math syntax. Defaults to now.
          in: query
          name: to
          required: false
          schema:
            default: now
            maxLength: 100
            type: string
        - description: Filter entries by the type of score recorded (`base`, `propagated`, or `resolution`).
          in: query
          name: score_type
          required: false
          schema:
            enum:
              - base
              - propagated
              - resolution
            type: string
        - description: When true, each entry also includes the contributions recorded for that scoring run (`inputs`, `modifiers`, category 2 fields, and `criticality_level`), when present on the underlying document.
          in: query
          name: include_contributions
          required: false
          schema:
            default: false
            type: boolean
      responses:
        '200':
          content:
            application/json:
              examples:
                riskScoreHistory:
                  summary: Risk score history for a user
                  value:
                    entity_id: alice
                    entity_type: user
                    entries:
                      - '@timestamp': '2026-05-20T12:00:00.000Z'
                        calculated_level: High
                        calculated_score: 145.2
                        calculated_score_norm: 72.4
                        category_1_count: 18
                        category_1_score: 102
                        score_type: base
              schema:
                $ref: '#/components/schemas/Security_Entity_Analytics_API_RiskScoreHistoryResponse'
          description: Successful response
        '400':
          description: Invalid request
      summary: Get risk score history for an entity
      tags:
        - Security Entity Analytics API
      x-state: Added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/saved_objects/_bulk_create:
    post:
      deprecated: true
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/saved_objects/_bulk_create</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        WARNING: This API is deprecated. This is a legacy Saved Objects API and may be removed in a future version of Kibana.

        Creates multiple Kibana saved objects in a single request.

        For transferring or backing up saved objects, prefer the import and export APIs (`POST /api/saved_objects/_import` and `POST /api/saved_objects/_export`).
      operationId: post-saved-objects-bulk-create
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: Overwrite existing saved objects that match the same type and ID.
          in: query
          name: overwrite
          required: false
          schema:
            default: false
            type: boolean
      requestBody:
        content:
          application/json:
            examples:
              bulkCreateRequest:
                summary: Create multiple saved objects (partial success)
                value:
                  - attributes:
                      title: Example dashboard 1
                    id: example-dashboard-1
                    references: []
                    type: dashboard
                  - attributes:
                      title: Example dashboard 2
                    id: example-dashboard-2
                    references: []
                    type: dashboard
            schema:
              items:
                additionalProperties: false
                type: object
                properties:
                  attributes:
                    additionalProperties:
                      nullable: true
                    type: object
                  coreMigrationVersion:
                    maxLength: 256
                    type: string
                  id:
                    maxLength: 512
                    type: string
                  initialNamespaces:
                    items:
                      maxLength: 512
                      type: string
                    maxItems: 100
                    minItems: 1
                    type: array
                  migrationVersion:
                    additionalProperties:
                      maxLength: 256
                      type: string
                    type: object
                  references:
                    items:
                      additionalProperties: false
                      type: object
                      properties:
                        id:
                          maxLength: 512
                          type: string
                        name:
                          maxLength: 1024
                          type: string
                        type:
                          maxLength: 256
                          type: string
                      required:
                        - name
                        - type
                        - id
                    maxItems: 1000
                    type: array
                  type:
                    maxLength: 256
                    type: string
                  typeMigrationVersion:
                    maxLength: 256
                    type: string
                  version:
                    maxLength: 256
                    type: string
                required:
                  - type
                  - attributes
              maxItems: 10000
              type: array
      responses:
        '200':
          content:
            application/json:
              examples:
                bulkCreateResponse:
                  summary: A bulk create response with one conflict
                  value:
                    saved_objects:
                      - attributes:
                          title: Example dashboard 1
                        id: example-dashboard-1
                        managed: false
                        namespaces:
                          - default
                        references: []
                        type: dashboard
                        updated_at: '2026-04-17T12:00:00.000Z'
                        version: WzEsMV0=
                      - error:
                          error: Conflict
                          message: Saved object [dashboard/example-dashboard-2] conflict
                          statusCode: 409
                        id: example-dashboard-2
                        type: dashboard
          description: A bulk create response.
        '400':
          content:
            application/json:
              examples:
                badRequestResponse:
                  summary: A bad request error
                  value:
                    error: Bad Request
                    message: 'Unsupported saved object type(s): unknownType'
                    statusCode: 400
          description: A bad request.
      summary: Create saved objects
      tags:
        - saved objects
      x-codeSamples:
        - lang: curl
          source: |
            curl \
              -X POST "${KIBANA_URL}/api/saved_objects/_bulk_create?overwrite=false" \
              -H "Authorization: ApiKey ${API_KEY}" \
              -H "kbn-xsrf: true" \
              -H "Content-Type: application/json" \
              -d '[{"type":"dashboard","id":"example-dashboard-1","attributes":{"title":"Example dashboard 1"},"references":[]},{"type":"dashboard","id":"example-dashboard-2","attributes":{"title":"Example dashboard 2"},"references":[]}]'
        - lang: Console
          source: |
            POST kbn://api/saved_objects/_bulk_create?overwrite=false
            [{"type":"dashboard","id":"example-dashboard-1","attributes":{"title":"Example dashboard 1"},"references":[]},{"type":"dashboard","id":"example-dashboard-2","attributes":{"title":"Example dashboard 2"},"references":[]}]
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/saved_objects/_bulk_delete:
    post:
      deprecated: true
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/saved_objects/_bulk_delete</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        WARNING: This API is deprecated. This is a legacy Saved Objects API and may be removed in a future version of Kibana.

        Deletes multiple Kibana saved objects in a single request.

        There is currently no complete replacement for deleting arbitrary saved objects via an HTTP API.
      operationId: post-saved-objects-bulk-delete
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: When true, force deletion of multi-namespace objects from all namespaces.
          in: query
          name: force
          required: false
          schema:
            type: boolean
      requestBody:
        content:
          application/json:
            examples:
              bulkDeleteRequest:
                summary: Delete multiple saved objects
                value:
                  - id: example-dashboard-1
                    type: dashboard
                  - id: does-not-exist
                    type: dashboard
            schema:
              items:
                additionalProperties: false
                type: object
                properties:
                  id:
                    maxLength: 512
                    type: string
                  type:
                    maxLength: 256
                    type: string
                required:
                  - type
                  - id
              maxItems: 10000
              type: array
      responses:
        '200':
          content:
            application/json:
              examples:
                bulkDeleteResponse:
                  summary: A bulk delete response with one not found result
                  value:
                    statuses:
                      - id: example-dashboard-1
                        success: true
                        type: dashboard
                      - error:
                          error: Not Found
                          message: Saved object [dashboard/does-not-exist] not found
                          statusCode: 404
                        id: does-not-exist
                        success: false
                        type: dashboard
          description: A bulk delete response.
        '400':
          content:
            application/json:
              examples:
                badRequestResponse:
                  summary: A bad request error
                  value:
                    error: Bad Request
                    message: 'Unsupported saved object type(s): unknownType'
                    statusCode: 400
          description: A bad request.
      summary: Delete saved objects
      tags:
        - saved objects
      x-codeSamples:
        - lang: curl
          source: |
            curl \
              -X POST "${KIBANA_URL}/api/saved_objects/_bulk_delete?force=false" \
              -H "Authorization: ApiKey ${API_KEY}" \
              -H "kbn-xsrf: true" \
              -H "Content-Type: application/json" \
              -d '[{"type":"dashboard","id":"example-dashboard-1"},{"type":"dashboard","id":"does-not-exist"}]'
        - lang: Console
          source: |
            POST kbn://api/saved_objects/_bulk_delete?force=false
            [{"type":"dashboard","id":"example-dashboard-1"},{"type":"dashboard","id":"does-not-exist"}]
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/saved_objects/_bulk_get:
    post:
      deprecated: true
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/saved_objects/_bulk_get</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        WARNING: This API is deprecated. This is a legacy Saved Objects API and may be removed in a future version of Kibana.

        Retrieves multiple Kibana saved objects by type and ID in a single request.

        For transferring or backing up saved objects, prefer the export API (`POST /api/saved_objects/_export`).
      operationId: post-saved-objects-bulk-get
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
      requestBody:
        content:
          application/json:
            examples:
              bulkGetRequest:
                summary: Get multiple saved objects
                value:
                  - id: example-dashboard-1
                    type: dashboard
                  - id: does-not-exist
                    type: dashboard
            schema:
              items:
                additionalProperties: false
                type: object
                properties:
                  fields:
                    items:
                      maxLength: 1024
                      type: string
                    maxItems: 100
                    type: array
                  id:
                    maxLength: 512
                    type: string
                  namespaces:
                    items:
                      maxLength: 512
                      type: string
                    maxItems: 100
                    type: array
                  type:
                    maxLength: 256
                    type: string
                required:
                  - type
                  - id
              maxItems: 10000
              type: array
      responses:
        '200':
          content:
            application/json:
              examples:
                bulkGetResponse:
                  summary: A bulk get response with one not found result
                  value:
                    saved_objects:
                      - attributes:
                          title: Example dashboard 1
                        id: example-dashboard-1
                        managed: false
                        namespaces:
                          - default
                        references: []
                        type: dashboard
                        updated_at: '2026-04-17T12:00:00.000Z'
                        version: WzEsMV0=
                      - error:
                          error: Not Found
                          message: Saved object [dashboard/does-not-exist] not found
                          statusCode: 404
                        id: does-not-exist
                        type: dashboard
          description: A bulk get response.
        '400':
          content:
            application/json:
              examples:
                badRequestResponse:
                  summary: A bad request error
                  value:
                    error: Bad Request
                    message: 'Unsupported saved object type(s): unknownType'
                    statusCode: 400
          description: A bad request.
      summary: Get saved objects
      tags:
        - saved objects
      x-codeSamples:
        - lang: curl
          source: |
            curl \
              -X POST "${KIBANA_URL}/api/saved_objects/_bulk_get" \
              -H "Authorization: ApiKey ${API_KEY}" \
              -H "kbn-xsrf: true" \
              -H "Content-Type: application/json" \
              -d '[{"type":"dashboard","id":"example-dashboard-1"},{"type":"dashboard","id":"does-not-exist"}]'
        - lang: Console
          source: |
            POST kbn://api/saved_objects/_bulk_get
            [{"type":"dashboard","id":"example-dashboard-1"},{"type":"dashboard","id":"does-not-exist"}]
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/saved_objects/_bulk_resolve:
    post:
      deprecated: true
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/saved_objects/_bulk_resolve</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        WARNING: This API is deprecated. This is a legacy Saved Objects API and may be removed in a future version of Kibana.

        Retrieve multiple Kibana saved objects by ID, using any legacy URL aliases if they exist.

        Under certain circumstances, when Kibana is upgraded, saved object migrations may necessitate regenerating some object IDs to enable new features. When an object's ID is regenerated, a legacy URL alias is created for that object, preserving its old ID. In such a scenario, that object can be retrieved with the bulk resolve API using either its new ID or its old ID.
      operationId: post-saved-objects-bulk-resolve
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
      requestBody:
        content:
          application/json:
            examples:
              bulkResolveRequest:
                summary: Resolve multiple saved objects
                value:
                  - id: example-dashboard-1
                    type: dashboard
                  - id: legacy-id
                    type: dashboard
            schema:
              items:
                additionalProperties: false
                type: object
                properties:
                  id:
                    maxLength: 512
                    type: string
                  type:
                    maxLength: 256
                    type: string
                required:
                  - type
                  - id
              maxItems: 10000
              type: array
      responses:
        '200':
          content:
            application/json:
              examples:
                bulkResolveResponse:
                  summary: A bulk resolve response with an exact and alias match
                  value:
                    resolved_objects:
                      - outcome: exactMatch
                        saved_object:
                          attributes:
                            title: Example dashboard 1
                          id: example-dashboard-1
                          managed: false
                          namespaces:
                            - default
                          references: []
                          type: dashboard
                          updated_at: '2026-04-17T12:00:00.000Z'
                          version: WzEsMV0=
                      - alias_target_id: example-dashboard-2
                        outcome: aliasMatch
                        saved_object:
                          attributes:
                            title: Example dashboard 2
                          id: example-dashboard-2
                          managed: false
                          namespaces:
                            - default
                          references: []
                          type: dashboard
                          updated_at: '2026-04-17T12:00:00.000Z'
                          version: WzEsMl0=
          description: A bulk resolve response.
        '400':
          content:
            application/json:
              examples:
                badRequestResponse:
                  summary: A bad request error
                  value:
                    error: Bad Request
                    message: 'Unsupported saved object type(s): unknownType'
                    statusCode: 400
          description: A bad request.
      summary: Resolve saved objects
      tags:
        - saved objects
      x-codeSamples:
        - lang: curl
          source: |
            curl \
              -X POST "${KIBANA_URL}/api/saved_objects/_bulk_resolve" \
              -H "Authorization: ApiKey ${API_KEY}" \
              -H "kbn-xsrf: true" \
              -H "Content-Type: application/json" \
              -d '[{"type":"dashboard","id":"example-dashboard-1"},{"type":"dashboard","id":"legacy-id"}]'
        - lang: Console
          source: |
            POST kbn://api/saved_objects/_bulk_resolve
            [{"type":"dashboard","id":"example-dashboard-1"},{"type":"dashboard","id":"legacy-id"}]
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/saved_objects/_bulk_update:
    put:
      deprecated: true
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb put">put</span>&nbsp;<span class="operation-path">/s/{space_id}/api/saved_objects/_bulk_update</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        WARNING: This API is deprecated. This is a legacy Saved Objects API and may be removed in a future version of Kibana.

        Updates multiple Kibana saved objects in a single request.

        For transferring or backing up saved objects, prefer the import and export APIs (`POST /api/saved_objects/_import` and `POST /api/saved_objects/_export`).
      operationId: put-saved-objects-bulk-update
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
      requestBody:
        content:
          application/json:
            examples:
              bulkUpdateRequest:
                summary: Update multiple saved objects (partial success)
                value:
                  - attributes:
                      title: Updated dashboard title
                    id: example-dashboard-1
                    references: []
                    type: dashboard
                  - attributes:
                      title: Updated dashboard title
                    id: does-not-exist
                    type: dashboard
            schema:
              items:
                additionalProperties: false
                type: object
                properties:
                  attributes:
                    additionalProperties:
                      nullable: true
                    type: object
                  id:
                    maxLength: 512
                    type: string
                  namespace:
                    maxLength: 512
                    minLength: 1
                    type: string
                  references:
                    items:
                      additionalProperties: false
                      type: object
                      properties:
                        id:
                          maxLength: 512
                          type: string
                        name:
                          maxLength: 1024
                          type: string
                        type:
                          maxLength: 256
                          type: string
                      required:
                        - name
                        - type
                        - id
                    maxItems: 1000
                    type: array
                  type:
                    maxLength: 256
                    type: string
                  version:
                    maxLength: 256
                    type: string
                required:
                  - type
                  - id
                  - attributes
              maxItems: 10000
              type: array
      responses:
        '200':
          content:
            application/json:
              examples:
                bulkUpdateResponse:
                  summary: A bulk update response with one not found result
                  value:
                    saved_objects:
                      - attributes:
                          title: Updated dashboard title
                        id: example-dashboard-1
                        managed: false
                        namespaces:
                          - default
                        references: []
                        type: dashboard
                        updated_at: '2026-04-17T12:00:00.000Z'
                        version: WzIsMV0=
                      - error:
                          error: Not Found
                          message: Saved object [dashboard/does-not-exist] not found
                          statusCode: 404
                        id: does-not-exist
                        type: dashboard
          description: A bulk update response.
        '400':
          content:
            application/json:
              examples:
                badRequestResponse:
                  summary: A bad request error
                  value:
                    error: Bad Request
                    message: 'Unsupported saved object type(s): unknownType'
                    statusCode: 400
          description: A bad request.
      summary: Update saved objects
      tags:
        - saved objects
      x-codeSamples:
        - lang: curl
          source: |
            curl \
              -X PUT "${KIBANA_URL}/api/saved_objects/_bulk_update" \
              -H "Authorization: ApiKey ${API_KEY}" \
              -H "kbn-xsrf: true" \
              -H "Content-Type: application/json" \
              -d '[{"type":"dashboard","id":"example-dashboard-1","attributes":{"title":"Updated dashboard title"},"references":[]},{"type":"dashboard","id":"does-not-exist","attributes":{"title":"Updated dashboard title"}}]'
        - lang: Console
          source: |
            PUT kbn://api/saved_objects/_bulk_update
            [{"type":"dashboard","id":"example-dashboard-1","attributes":{"title":"Updated dashboard title"},"references":[]},{"type":"dashboard","id":"does-not-exist","attributes":{"title":"Updated dashboard title"}}]
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/saved_objects/_export:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/saved_objects/_export</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Retrieve sets of saved objects that you want to import into Kibana. You must include `type` or `objects` in the request body. The output of exporting saved objects must be treated as opaque. Tampering with exported data risks introducing unspecified errors and data loss.

        Exported saved objects are not backwards compatible and cannot be imported into an older version of Kibana.

        NOTE: The exported saved objects include `coreMigrationVersion` and `typeMigrationVersion` metadata. If you store exported saved objects outside of Kibana (for example in NDJSON files) or generate them yourself, you must preserve or include these fields to retain forward compatibility across Kibana versions.

        NOTE: The `savedObjects.maxImportExportSize` configuration setting limits the number of saved objects which may be exported.
      operationId: post-saved-objects-export
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
      requestBody:
        content:
          application/json:
            examples:
              exportSavedObjectsRequest:
                summary: Export a specific saved object
                value:
                  excludeExportDetails: true
                  includeReferencesDeep: false
                  objects:
                    - id: example-dashboard-1
                      type: dashboard
            schema:
              additionalProperties: false
              type: object
              properties:
                excludeExportDetails:
                  default: false
                  description: Do not add export details entry at the end of the stream.
                  type: boolean
                hasReference:
                  anyOf:
                    - additionalProperties: false
                      type: object
                      properties:
                        id:
                          maxLength: 512
                          type: string
                        type:
                          maxLength: 256
                          type: string
                      required:
                        - type
                        - id
                    - items:
                        additionalProperties: false
                        type: object
                        properties:
                          id:
                            maxLength: 512
                            type: string
                          type:
                            maxLength: 256
                            type: string
                        required:
                          - type
                          - id
                      maxItems: 100
                      type: array
                includeReferencesDeep:
                  default: false
                  description: Includes all of the referenced objects in the exported objects.
                  type: boolean
                objects:
                  description: 'A list of objects to export. NOTE: this optional parameter cannot be combined with the `types` option'
                  items:
                    additionalProperties: false
                    type: object
                    properties:
                      id:
                        maxLength: 512
                        type: string
                      type:
                        maxLength: 256
                        type: string
                    required:
                      - type
                      - id
                  maxItems: 10000
                  type: array
                search:
                  description: Search for documents to export using the Elasticsearch Simple Query String syntax.
                  maxLength: 10000
                  type: string
                type:
                  anyOf:
                    - maxLength: 256
                      type: string
                    - items:
                        maxLength: 256
                        type: string
                      maxItems: 100
                      type: array
                  description: The saved object types to include in the export. Use `*` to export all the types. Valid options depend on enabled plugins, but may include `visualization`, `dashboard`, `search`, `index-pattern`, `tag`, `config`, `config-global`, `lens`, `map`, `event-annotation-group`, `query`, `url`, `action`, `alert`, `alerting_rule_template`, `apm-indices`, `cases-user-actions`, `cases`, `cases-comments`, `infrastructure-monitoring-log-view`, `ml-trained-model`, `osquery-saved-query`, `osquery-pack`, `osquery-pack-asset`.
      responses:
        '200':
          content:
            application/x-ndjson:
              examples:
                exportSavedObjectsResponse:
                  summary: The export response contains an NDJSON record for each exported object
                  value: |
                    {"id":"example-dashboard-1","type":"dashboard","attributes":{"title":"Example dashboard 1"},"references":[],"managed":false}
                    {"exportedCount":1,"missingRefCount":0,"missingReferences":[]}
              schema: {}
          description: Indicates a successfull call.
        '400':
          content:
            application/json:
              examples:
                badRequestResponse:
                  summary: A bad request error
                  value:
                    error: Bad Request
                    message: 'Either `type` or `objects` are required.: Bad Request'
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Indicates an unsuccessful response.
                type: object
                properties:
                  error:
                    type: string
                  message:
                    type: string
                  statusCode:
                    enum:
                      - 400
                    type: integer
                required:
                  - error
                  - message
                  - statusCode
          description: Bad request.
      summary: Export saved objects
      tags:
        - saved objects
      x-codeSamples:
        - lang: curl
          source: |
            curl \
              -X POST "${KIBANA_URL}/api/saved_objects/_export" \
              -H "Authorization: ApiKey ${API_KEY}" \
              -H "kbn-xsrf: true" \
              -H "Content-Type: application/json" \
              -d '{"objects":[{"type":"dashboard","id":"example-dashboard-1"}],"includeReferencesDeep":false,"excludeExportDetails":true}'
        - lang: Console
          source: |
            POST kbn://api/saved_objects/_export
            {"objects":[{"type":"dashboard","id":"example-dashboard-1"}],"includeReferencesDeep":false,"excludeExportDetails":true}
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/saved_objects/_find:
    get:
      deprecated: true
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/saved_objects/_find</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        WARNING: This API is deprecated. This is a legacy Saved Objects API and may be removed in a future version of Kibana.

        Searches for Kibana saved objects.

        For transferring or backing up saved objects, prefer the export API (`POST /api/saved_objects/_export`).
      operationId: get-saved-objects-find
      parameters:
        - description: The number of items per page.
          in: query
          name: per_page
          required: false
          schema:
            default: 20
            minimum: 0
            type: number
        - description: The page index to return.
          in: query
          name: page
          required: false
          schema:
            default: 1
            minimum: 0
            type: number
        - description: The saved object type or types to search for. Use multiple `type` values to search across types.
          in: query
          name: type
          required: true
          schema:
            items:
              maxLength: 256
              type: string
            maxItems: 100
            type: array
        - description: A text search string.
          in: query
          name: search
          required: false
          schema:
            maxLength: 10000
            type: string
        - description: The boolean operator to use when combining multiple values.
          in: query
          name: default_search_operator
          required: false
          schema:
            default: OR
            enum:
              - OR
              - AND
            type: string
        - description: The fields to search on.
          in: query
          name: search_fields
          required: false
          schema:
            items:
              maxLength: 1024
              type: string
            maxItems: 100
            type: array
        - description: The field to sort on.
          in: query
          name: sort_field
          required: false
          schema:
            maxLength: 1024
            type: string
        - description: Return only saved objects that have a reference to the specified saved object(s).
          in: query
          name: has_reference
          required: false
          schema:
            anyOf:
              - additionalProperties: false
                type: object
                properties:
                  id:
                    maxLength: 512
                    type: string
                  type:
                    maxLength: 256
                    type: string
                required:
                  - type
                  - id
              - items:
                  additionalProperties: false
                  type: object
                  properties:
                    id:
                      maxLength: 512
                      type: string
                    type:
                      maxLength: 256
                      type: string
                  required:
                    - type
                    - id
                maxItems: 100
                type: array
        - description: The boolean operator to use when combining multiple values.
          in: query
          name: has_reference_operator
          required: false
          schema:
            default: OR
            enum:
              - OR
              - AND
            type: string
        - description: Return only saved objects that do not have a reference to the specified saved object(s).
          in: query
          name: has_no_reference
          required: false
          schema:
            anyOf:
              - additionalProperties: false
                type: object
                properties:
                  id:
                    maxLength: 512
                    type: string
                  type:
                    maxLength: 256
                    type: string
                required:
                  - type
                  - id
              - items:
                  additionalProperties: false
                  type: object
                  properties:
                    id:
                      maxLength: 512
                      type: string
                    type:
                      maxLength: 256
                      type: string
                  required:
                    - type
                    - id
                maxItems: 100
                type: array
        - description: The boolean operator to use when combining multiple values.
          in: query
          name: has_no_reference_operator
          required: false
          schema:
            default: OR
            enum:
              - OR
              - AND
            type: string
        - description: The fields to return for each saved object.
          in: query
          name: fields
          required: false
          schema:
            items:
              maxLength: 1024
              type: string
            maxItems: 100
            type: array
        - description: A KQL filter to apply to the search.
          in: query
          name: filter
          required: false
          schema:
            maxLength: 10000
            type: string
        - description: Aggregations as a JSON string.
          in: query
          name: aggs
          required: false
          schema:
            maxLength: 100000
            type: string
        - description: The namespaces (spaces) to search in.
          in: query
          name: namespaces
          required: false
          schema:
            items:
              maxLength: 512
              type: string
            maxItems: 100
            type: array
      responses:
        '200':
          content:
            application/json:
              examples:
                findSavedObjectsResponse:
                  summary: A page of saved objects
                  value:
                    page: 1
                    per_page: 20
                    saved_objects:
                      - attributes:
                          title: Example dashboard 1
                        id: example-dashboard-1
                        managed: false
                        namespaces:
                          - default
                        references: []
                        type: dashboard
                        updated_at: '2026-04-17T12:00:00.000Z'
                        version: WzEsMV0=
                    total: 1
          description: A search response.
        '400':
          content:
            application/json:
              examples:
                badRequestResponse:
                  summary: A bad request error
                  value:
                    error: Bad Request
                    message: 'This type dashboard is not allowed: Bad Request'
                    statusCode: 400
          description: A bad request.
      summary: Search for saved objects
      tags:
        - saved objects
      x-codeSamples:
        - lang: curl
          source: |
            curl \
              -X GET "${KIBANA_URL}/api/saved_objects/_find?type=dashboard&fields=title&per_page=20&page=1" \
              -H "Authorization: ApiKey ${API_KEY}"
        - lang: Console
          source: |
            GET kbn://api/saved_objects/_find?type=dashboard&fields=title&per_page=20&page=1
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/saved_objects/_import:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/saved_objects/_import</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Create sets of Kibana saved objects from a file created by the export API. Saved objects can only be imported into the same version, a newer minor on the same major, or the next major. Tampering with exported data risks introducing unspecified errors and data loss.

        Exported saved objects are not backwards compatible and cannot be imported into an older version of Kibana.

        NOTE: The exported saved objects include `coreMigrationVersion` and `typeMigrationVersion` metadata. If you store exported saved objects outside of Kibana (for example in NDJSON files) or generate them yourself, you must preserve or include these fields to retain forwards compatibility across Kibana versions.
      operationId: post-saved-objects-import
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: 'Overwrites saved objects when they already exist. When used, potential conflict errors are automatically resolved by overwriting the destination object. NOTE: This option cannot be used with the `createNewCopies` option.'
          in: query
          name: overwrite
          required: false
          schema:
            default: false
            type: boolean
        - description: 'Creates copies of saved objects, regenerates each object ID, and resets the origin. When used, potential conflict errors are avoided. NOTE: This option cannot be used with the `overwrite` and `compatibilityMode` options.'
          in: query
          name: createNewCopies
          required: false
          schema:
            default: false
            type: boolean
        - description: 'Applies various adjustments to the saved objects that are being imported to maintain compatibility between different Kibana versions. Use this option only if you encounter issues with imported saved objects. NOTE: This option cannot be used with the `createNewCopies` option.'
          in: query
          name: compatibilityMode
          required: false
          schema:
            default: false
            type: boolean
      requestBody:
        content:
          multipart/form-data:
            examples:
              importObjectsRequest:
                summary: Import saved objects from an NDJSON file
                value:
                  file: file.ndjson
            schema:
              additionalProperties: false
              type: object
              properties:
                file:
                  description: 'A file exported using the export API. Changing the contents of the exported file in any way before importing it can cause errors, crashes or data loss. NOTE: The `savedObjects.maxImportExportSize` configuration setting limits the number of saved objects which may be included in this file. Similarly, the `savedObjects.maxImportPayloadBytes` setting limits the overall size of the file that can be imported.'
                  type: object
              required:
                - file
      responses:
        '200':
          content:
            application/json:
              examples:
                importObjectsResponse:
                  summary: A successful import response
                  value:
                    errors: []
                    success: true
                    successCount: 1
                    successResults:
                      - destinationId: example-dashboard-1-copy
                        id: example-dashboard-1
                        managed: false
                        type: dashboard
              schema:
                additionalProperties: false
                type: object
                properties:
                  errors:
                    description: |-
                      Indicates the import was unsuccessful and specifies the objects that failed to import.

                      NOTE: One object may result in multiple errors, which requires separate steps to resolve. For instance, a `missing_references` error and conflict error.
                    items:
                      additionalProperties: true
                      type: object
                      properties: {}
                    type: array
                  success:
                    description: Indicates when the import was successfully completed. When set to false, some objects may not have been created. For additional information, refer to the `errors` and `successResults` properties.
                    type: boolean
                  successCount:
                    description: Indicates the number of successfully imported records.
                    type: number
                  successResults:
                    description: |-
                      Indicates the objects that are successfully imported, with any metadata if applicable.

                      NOTE: Objects are created only when all resolvable errors are addressed, including conflicts and missing references. If objects are created as new copies, each entry in the `successResults` array includes a `destinationId` attribute.
                    items:
                      additionalProperties: true
                      type: object
                      properties: {}
                    type: array
                required:
                  - success
                  - successCount
                  - errors
                  - successResults
          description: Indicates a successful call.
        '400':
          content:
            application/json:
              examples:
                badRequestResponse:
                  summary: A bad request error
                  value:
                    error: Bad Request
                    message: Invalid file extension .txt
                    statusCode: 400
              schema:
                additionalProperties: false
                description: Indicates an unsuccessful response.
                type: object
                properties:
                  error:
                    type: string
                  message:
                    type: string
                  statusCode:
                    enum:
                      - 400
                    type: integer
                required:
                  - error
                  - message
                  - statusCode
          description: Bad request.
      summary: Import saved objects
      tags:
        - saved objects
      x-codeSamples:
        - lang: curl
          source: |
            curl \
              -X POST "${KIBANA_URL}/api/saved_objects/_import?createNewCopies=true" \
              -H "Authorization: ApiKey ${API_KEY}" \
              -H "kbn-xsrf: true" \
              --form file=@file.ndjson
        - lang: Console
          source: |
            POST kbn://api/saved_objects/_import?createNewCopies=true
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/saved_objects/_resolve_import_errors:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/saved_objects/_resolve_import_errors</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        To resolve errors from the import objects API, you can retry certain saved objects, overwrite specific saved objects, and change references to different saved objects
      operationId: post-saved-objects-resolve-import-errors
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: Creates copies of saved objects, regenerates each object ID, and resets the origin.
          in: query
          name: createNewCopies
          required: false
          schema:
            default: false
            type: boolean
        - description: Applies adjustments to maintain compatibility between different Kibana versions.
          in: query
          name: compatibilityMode
          required: false
          schema:
            default: false
            type: boolean
      requestBody:
        content:
          multipart/form-data:
            examples:
              resolveImportErrorsRequest:
                summary: Resolve import errors by retrying objects
                value:
                  file: file.ndjson
                  retries:
                    - id: example-dashboard-1
                      overwrite: true
                      replaceReferences: []
                      type: dashboard
            schema:
              additionalProperties: false
              type: object
              properties:
                file:
                  type: object
                retries:
                  items:
                    additionalProperties: false
                    type: object
                    properties:
                      createNewCopy:
                        type: boolean
                      destinationId:
                        maxLength: 512
                        type: string
                      id:
                        maxLength: 512
                        type: string
                      ignoreMissingReferences:
                        type: boolean
                      overwrite:
                        default: false
                        type: boolean
                      replaceReferences:
                        default: []
                        items:
                          additionalProperties: false
                          type: object
                          properties:
                            from:
                              maxLength: 512
                              type: string
                            to:
                              maxLength: 512
                              type: string
                            type:
                              maxLength: 256
                              type: string
                          required:
                            - type
                            - from
                            - to
                        maxItems: 100
                        type: array
                      type:
                        maxLength: 256
                        type: string
                    required:
                      - type
                      - id
                  maxItems: 10000
                  type: array
              required:
                - file
                - retries
      responses:
        '200':
          content:
            application/json:
              examples:
                resolveImportErrorsResponse:
                  summary: A successful resolve import errors response
                  value:
                    errors: []
                    success: true
                    successCount: 1
                    successResults:
                      - id: example-dashboard-1
                        managed: false
                        type: dashboard
          description: A successful resolve import errors response.
        '400':
          content:
            application/json:
              examples:
                badRequestResponse:
                  summary: A bad request error
                  value:
                    error: Bad Request
                    message: Invalid file extension .txt
                    statusCode: 400
          description: A bad request.
      summary: Resolve import errors
      tags:
        - saved objects
      x-codeSamples:
        - lang: curl
          source: |
            curl \
              -X POST "${KIBANA_URL}/api/saved_objects/_resolve_import_errors" \
              -H "Authorization: ApiKey ${API_KEY}" \
              -H "kbn-xsrf: true" \
              --form file=@file.ndjson \
              --form retries='[{"type":"dashboard","id":"example-dashboard-1","overwrite":true,"replaceReferences":[]}]'
        - lang: Console
          source: |
            POST kbn://api/saved_objects/_resolve_import_errors
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/saved_objects/{type}:
    post:
      deprecated: true
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/saved_objects/{type}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        WARNING: This API is deprecated. This is a legacy Saved Objects API and may be removed in a future version of Kibana.

        Creates a Kibana saved object; if an ID is provided it is used, otherwise Kibana generates one.

        For transferring or backing up saved objects, prefer the import and export APIs (`POST /api/saved_objects/_import` and `POST /api/saved_objects/_export`).
      operationId: post-saved-objects-type
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: The saved object type.
          in: path
          name: type
          required: true
          schema:
            maxLength: 256
            type: string
        - description: Overwrite an existing saved object.
          in: query
          name: overwrite
          required: false
          schema:
            default: false
            type: boolean
      requestBody:
        content:
          application/json:
            examples:
              createDashboardRequest:
                summary: Create a dashboard saved object
                value:
                  attributes:
                    title: Example dashboard
                  references: []
            schema:
              additionalProperties: false
              type: object
              properties:
                attributes:
                  additionalProperties:
                    nullable: true
                  type: object
                coreMigrationVersion:
                  maxLength: 256
                  type: string
                initialNamespaces:
                  items:
                    maxLength: 512
                    type: string
                  maxItems: 100
                  minItems: 1
                  type: array
                migrationVersion:
                  additionalProperties:
                    maxLength: 256
                    type: string
                  type: object
                references:
                  items:
                    additionalProperties: false
                    type: object
                    properties:
                      id:
                        maxLength: 512
                        type: string
                      name:
                        maxLength: 1024
                        type: string
                      type:
                        maxLength: 256
                        type: string
                    required:
                      - name
                      - type
                      - id
                  maxItems: 1000
                  type: array
                typeMigrationVersion:
                  maxLength: 256
                  type: string
              required:
                - attributes
      responses:
        '200':
          content:
            application/json:
              examples:
                createDashboardResponse:
                  summary: A created saved object
                  value:
                    attributes:
                      title: Example dashboard
                    id: example-dashboard-id
                    managed: false
                    namespaces:
                      - default
                    references: []
                    type: dashboard
                    updated_at: '2026-04-17T12:00:00.000Z'
                    version: WzEsMV0=
          description: A successful create response.
        '409':
          content:
            application/json:
              examples:
                conflictResponse:
                  summary: A conflict error
                  value:
                    error: Conflict
                    message: Saved object [dashboard/example-dashboard-id] conflict
                    statusCode: 409
          description: A conflict error.
      summary: Create a saved object
      tags:
        - saved objects
      x-codeSamples:
        - lang: curl
          source: |
            curl \
              -X POST "${KIBANA_URL}/api/saved_objects/dashboard/example-dashboard-id?overwrite=false" \
              -H "Authorization: ApiKey ${API_KEY}" \
              -H "kbn-xsrf: true" \
              -H "Content-Type: application/json" \
              -d '{"attributes":{"title":"Example dashboard"},"references":[]}'
        - lang: Console
          source: |
            POST kbn://api/saved_objects/dashboard/example-dashboard-id?overwrite=false
            {"attributes":{"title":"Example dashboard"},"references":[]}
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/saved_objects/{type}/{id}:
    delete:
      deprecated: true
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb delete">delete</span>&nbsp;<span class="operation-path">/s/{space_id}/api/saved_objects/{type}/{id}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        WARNING: This API is deprecated. This is a legacy Saved Objects API and may be removed in a future version of Kibana.

        Deletes a single Kibana saved object by type and ID.

        There is currently no complete replacement for deleting arbitrary saved objects via an HTTP API.
      operationId: delete-saved-objects-type-id
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: The saved object type.
          in: path
          name: type
          required: true
          schema:
            maxLength: 256
            type: string
        - description: The saved object identifier.
          in: path
          name: id
          required: true
          schema:
            maxLength: 512
            type: string
        - description: When true, force deletion of multi-namespace objects from all namespaces.
          in: query
          name: force
          required: false
          schema:
            type: boolean
      responses:
        '200':
          content:
            application/json:
              examples:
                deleteSavedObjectResponse:
                  summary: Successful delete
                  value: {}
          description: A successful delete response.
        '404':
          content:
            application/json:
              examples:
                notFoundResponse:
                  summary: A not found error
                  value:
                    error: Not Found
                    message: Saved object [dashboard/does-not-exist] not found
                    statusCode: 404
          description: Not found.
      summary: Delete a saved object
      tags:
        - saved objects
      x-codeSamples:
        - lang: curl
          source: |
            curl \
              -X DELETE "${KIBANA_URL}/api/saved_objects/dashboard/example-dashboard-1?force=false" \
              -H "Authorization: ApiKey ${API_KEY}" \
              -H "kbn-xsrf: true"
        - lang: Console
          source: |
            DELETE kbn://api/saved_objects/dashboard/example-dashboard-1?force=false
      x-metaTags:
        - content: Kibana
          name: product_name
    get:
      deprecated: true
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/saved_objects/{type}/{id}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        WARNING: This API is deprecated. This is a legacy Saved Objects API and may be removed in a future version of Kibana.

        Retrieves a single Kibana saved object by type and ID.

        For transferring or backing up saved objects, prefer the export API (`POST /api/saved_objects/_export`).
      operationId: get-saved-objects-type-id
      parameters:
        - description: The saved object type.
          in: path
          name: type
          required: true
          schema:
            maxLength: 256
            type: string
        - description: The saved object identifier.
          in: path
          name: id
          required: true
          schema:
            maxLength: 512
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                getSavedObjectResponse:
                  summary: A saved object
                  value:
                    attributes:
                      title: Example dashboard 1
                    id: example-dashboard-1
                    managed: false
                    namespaces:
                      - default
                    references: []
                    type: dashboard
                    updated_at: '2026-04-17T12:00:00.000Z'
                    version: WzEsMV0=
          description: A saved object.
        '400':
          content:
            application/json:
              examples:
                badRequestResponse:
                  summary: A bad request error
                  value:
                    error: Bad Request
                    message: 'Unsupported saved object type(s): unknownType'
                    statusCode: 400
          description: A bad request.
      summary: Get a saved object
      tags:
        - saved objects
      x-codeSamples:
        - lang: curl
          source: |
            curl \
              -X GET "${KIBANA_URL}/api/saved_objects/dashboard/example-dashboard-1" \
              -H "Authorization: ApiKey ${API_KEY}"
        - lang: Console
          source: |
            GET kbn://api/saved_objects/dashboard/example-dashboard-1
      x-metaTags:
        - content: Kibana
          name: product_name
    post:
      deprecated: true
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/saved_objects/{type}/{id}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        WARNING: This API is deprecated. This is a legacy Saved Objects API and may be removed in a future version of Kibana.

        Creates a Kibana saved object; if an ID is provided it is used, otherwise Kibana generates one.

        For transferring or backing up saved objects, prefer the import and export APIs (`POST /api/saved_objects/_import` and `POST /api/saved_objects/_export`).
      operationId: post-saved-objects-type-id
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: The saved object type.
          in: path
          name: type
          required: true
          schema:
            maxLength: 256
            type: string
        - description: The saved object identifier.
          in: path
          name: id
          required: true
          schema:
            maxLength: 512
            type: string
        - description: Overwrite an existing saved object.
          in: query
          name: overwrite
          required: false
          schema:
            default: false
            type: boolean
      requestBody:
        content:
          application/json:
            examples:
              createDashboardRequest:
                summary: Create a dashboard saved object
                value:
                  attributes:
                    title: Example dashboard
                  references: []
            schema:
              additionalProperties: false
              type: object
              properties:
                attributes:
                  additionalProperties:
                    nullable: true
                  type: object
                coreMigrationVersion:
                  maxLength: 256
                  type: string
                initialNamespaces:
                  items:
                    maxLength: 512
                    type: string
                  maxItems: 100
                  minItems: 1
                  type: array
                migrationVersion:
                  additionalProperties:
                    maxLength: 256
                    type: string
                  type: object
                references:
                  items:
                    additionalProperties: false
                    type: object
                    properties:
                      id:
                        maxLength: 512
                        type: string
                      name:
                        maxLength: 1024
                        type: string
                      type:
                        maxLength: 256
                        type: string
                    required:
                      - name
                      - type
                      - id
                  maxItems: 1000
                  type: array
                typeMigrationVersion:
                  maxLength: 256
                  type: string
              required:
                - attributes
      responses:
        '200':
          content:
            application/json:
              examples:
                createDashboardResponse:
                  summary: A created saved object
                  value:
                    attributes:
                      title: Example dashboard
                    id: example-dashboard-id
                    managed: false
                    namespaces:
                      - default
                    references: []
                    type: dashboard
                    updated_at: '2026-04-17T12:00:00.000Z'
                    version: WzEsMV0=
          description: A successful create response.
        '409':
          content:
            application/json:
              examples:
                conflictResponse:
                  summary: A conflict error
                  value:
                    error: Conflict
                    message: Saved object [dashboard/example-dashboard-id] conflict
                    statusCode: 409
          description: A conflict error.
      summary: Create a saved object
      tags:
        - saved objects
      x-codeSamples:
        - lang: curl
          source: |
            curl \
              -X POST "${KIBANA_URL}/api/saved_objects/dashboard/example-dashboard-id?overwrite=false" \
              -H "Authorization: ApiKey ${API_KEY}" \
              -H "kbn-xsrf: true" \
              -H "Content-Type: application/json" \
              -d '{"attributes":{"title":"Example dashboard"},"references":[]}'
        - lang: Console
          source: |
            POST kbn://api/saved_objects/dashboard/example-dashboard-id?overwrite=false
            {"attributes":{"title":"Example dashboard"},"references":[]}
      x-metaTags:
        - content: Kibana
          name: product_name
    put:
      deprecated: true
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb put">put</span>&nbsp;<span class="operation-path">/s/{space_id}/api/saved_objects/{type}/{id}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        WARNING: This API is deprecated. This is a legacy Saved Objects API and may be removed in a future version of Kibana.

        Updates a single Kibana saved object by type and ID.

        For transferring or backing up saved objects, prefer the import and export APIs (`POST /api/saved_objects/_import` and `POST /api/saved_objects/_export`).
      operationId: put-saved-objects-type-id
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: The saved object type.
          in: path
          name: type
          required: true
          schema:
            maxLength: 256
            type: string
        - description: The saved object identifier.
          in: path
          name: id
          required: true
          schema:
            maxLength: 512
            type: string
      requestBody:
        content:
          application/json:
            examples:
              updateDashboardRequest:
                summary: Update a dashboard saved object
                value:
                  attributes:
                    title: Updated dashboard title
                  references: []
            schema:
              additionalProperties: false
              type: object
              properties:
                attributes:
                  additionalProperties:
                    nullable: true
                  type: object
                references:
                  items:
                    additionalProperties: false
                    type: object
                    properties:
                      id:
                        maxLength: 512
                        type: string
                      name:
                        maxLength: 1024
                        type: string
                      type:
                        maxLength: 256
                        type: string
                    required:
                      - name
                      - type
                      - id
                  maxItems: 1000
                  type: array
                upsert:
                  additionalProperties:
                    nullable: true
                  type: object
                version:
                  maxLength: 256
                  type: string
              required:
                - attributes
      responses:
        '200':
          content:
            application/json:
              examples:
                updateDashboardResponse:
                  summary: An updated saved object
                  value:
                    attributes:
                      title: Updated dashboard title
                    id: example-dashboard-1
                    managed: false
                    namespaces:
                      - default
                    references: []
                    type: dashboard
                    updated_at: '2026-04-17T12:00:00.000Z'
                    version: WzIsMV0=
          description: A successful update response.
        '404':
          content:
            application/json:
              examples:
                notFoundResponse:
                  summary: A not found error
                  value:
                    error: Not Found
                    message: Saved object [dashboard/does-not-exist] not found
                    statusCode: 404
          description: Not found.
        '409':
          content:
            application/json:
              examples:
                conflictResponse:
                  summary: A conflict error
                  value:
                    error: Conflict
                    message: Saved object [dashboard/example-dashboard-1] conflict
                    statusCode: 409
          description: A conflict error.
      summary: Update a saved object
      tags:
        - saved objects
      x-codeSamples:
        - lang: curl
          source: |
            curl \
              -X PUT "${KIBANA_URL}/api/saved_objects/dashboard/example-dashboard-1" \
              -H "Authorization: ApiKey ${API_KEY}" \
              -H "kbn-xsrf: true" \
              -H "Content-Type: application/json" \
              -d '{"attributes":{"title":"Updated dashboard title"},"references":[]}'
        - lang: Console
          source: |
            PUT kbn://api/saved_objects/dashboard/example-dashboard-1
            {"attributes":{"title":"Updated dashboard title"},"references":[]}
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/saved_objects/resolve/{type}/{id}:
    get:
      deprecated: true
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/saved_objects/resolve/{type}/{id}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        WARNING: This API is deprecated. This is a legacy Saved Objects API and may be removed in a future version of Kibana.

        Retrieve a single Kibana saved object by ID, using any legacy URL alias if it exists.

        Under certain circumstances, when Kibana is upgraded, saved object migrations may necessitate regenerating some object IDs to enable new features. When an object's ID is regenerated, a legacy URL alias is created for that object, preserving its old ID. In such a scenario, that object can be retrieved with the resolve API using either its new ID or its old ID.
      operationId: get-saved-objects-resolve-type-id
      parameters:
        - description: The saved object type.
          in: path
          name: type
          required: true
          schema:
            maxLength: 256
            type: string
        - description: The saved object identifier.
          in: path
          name: id
          required: true
          schema:
            maxLength: 512
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                resolveSavedObjectResponse:
                  summary: A resolved saved object (alias match)
                  value:
                    alias_target_id: example-dashboard-2
                    outcome: aliasMatch
                    saved_object:
                      attributes:
                        title: Example dashboard 2
                      id: example-dashboard-2
                      managed: false
                      namespaces:
                        - default
                      references: []
                      type: dashboard
                      updated_at: '2026-04-17T12:00:00.000Z'
                      version: WzEsMl0=
          description: A resolve response.
        '400':
          content:
            application/json:
              examples:
                badRequestResponse:
                  summary: A bad request error
                  value:
                    error: Bad Request
                    message: 'Unsupported saved object type(s): unknownType'
                    statusCode: 400
          description: A bad request.
      summary: Resolve a saved object
      tags:
        - saved objects
      x-codeSamples:
        - lang: curl
          source: |
            curl \
              -X GET "${KIBANA_URL}/api/saved_objects/resolve/dashboard/legacy-id" \
              -H "Authorization: ApiKey ${API_KEY}"
        - lang: Console
          source: |
            GET kbn://api/saved_objects/resolve/dashboard/legacy-id
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/security_ai_assistant/anonymization_fields/_bulk_action:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/security_ai_assistant/anonymization_fields/_bulk_action</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Apply a bulk action to multiple anonymization fields. The bulk action is applied to all anonymization fields that match the filter or to the list of anonymization fields by their IDs.
      operationId: PerformAnonymizationFieldsBulkAction
      requestBody:
        content:
          application/json:
            examples:
              PerformAnonymizationFieldsBulkActionRequest:
                value:
                  create:
                    - allowed: true
                      anonymized: false
                      field: host.name
                    - allowed: false
                      anonymized: true
                      field: user.name
                  delete:
                    ids:
                      - field5
                      - field6
                    query: 'field: host.name'
                  update:
                    - allowed: true
                      anonymized: false
                      id: field8
                    - allowed: false
                      anonymized: true
                      id: field9
            schema:
              example:
                create:
                  - allowed: true
                    anonymized: false
                    field: host.name
                  - allowed: false
                    anonymized: true
                    field: user.name
                delete:
                  ids:
                    - field5
                    - field6
                  query: 'field: host.name'
                update:
                  - allowed: true
                    anonymized: false
                    id: field8
                  - allowed: false
                    anonymized: true
                    id: field9
              type: object
              properties:
                create:
                  description: Array of anonymization fields to create.
                  items:
                    $ref: '#/components/schemas/Security_AI_Assistant_API_AnonymizationFieldCreateProps'
                  type: array
                delete:
                  description: Object containing the query to filter anonymization fields and/or an array of anonymization field IDs to delete.
                  type: object
                  properties:
                    ids:
                      description: Array of IDs to apply the action to.
                      example:
                        - '1234'
                        - '5678'
                      items:
                        type: string
                      minItems: 1
                      type: array
                    query:
                      description: Query to filter the bulk action.
                      example: "status: 'inactive'"
                      type: string
                update:
                  description: Array of anonymization fields to update.
                  items:
                    $ref: '#/components/schemas/Security_AI_Assistant_API_AnonymizationFieldUpdateProps'
                  type: array
      responses:
        '200':
          content:
            application/json:
              examples:
                PerformAnonymizationFieldsBulkActionResponse200Example:
                  value:
                    anonymization_fields_count: 4
                    attributes:
                      results:
                        created:
                          - allowed: false
                            anonymized: true
                            createdAt: '2023-10-31T12:00:00Z'
                            createdBy: user1
                            field: host.name
                            id: field2
                            namespace: default
                            timestamp: '2023-10-31T12:00:00Z'
                            updatedAt: '2023-10-31T12:00:00Z'
                            updatedBy: user1
                        deleted:
                          - field3
                        skipped:
                          - id: field4
                            name: user.name
                            skip_reason: ANONYMIZATION_FIELD_NOT_MODIFIED
                        updated:
                          - allowed: true
                            anonymized: false
                            createdAt: '2023-10-31T12:00:00Z'
                            createdBy: user1
                            field: url.domain
                            id: field8
                            namespace: default
                            timestamp: '2023-10-31T12:00:00Z'
                            updatedAt: '2023-10-31T12:00:00Z'
                            updatedBy: user1
                      summary:
                        failed: 0
                        skipped: 1
                        succeeded: 3
                        total: 4
                    message: Bulk action completed successfully
                    status_code: 200
                    success: true
              schema:
                $ref: '#/components/schemas/Security_AI_Assistant_API_AnonymizationFieldsBulkCrudActionResponse'
          description: Indicates a successful call.
        '400':
          content:
            application/json:
              examples:
                PerformAnonymizationFieldsBulkActionResponse400Example:
                  value:
                    error: Bad Request
                    message: Invalid request body
                    statusCode: 400
              schema:
                type: object
                properties:
                  error:
                    description: Error type or name.
                    type: string
                  message:
                    description: Detailed error message.
                    type: string
                  statusCode:
                    description: Status code of the response.
                    type: number
          description: Bad Request response.
      summary: Apply a bulk action to anonymization fields
      tags:
        - Security AI Assistant API
      x-codeSamples:
        - label: Example request
          lang: curl
          source: |
            curl \
             --request POST 'http://localhost:5601/api/security_ai_assistant/anonymization_fields/_bulk_action' \
             --header "Authorization: $API_KEY" \
             --header "Content-Type: application/json" \
             --data '{"create":[{"field":"host.name","allowed":true,"anonymized":false}]}'
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/security_ai_assistant/anonymization_fields/_find:
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/security_ai_assistant/anonymization_fields/_find</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Get a list of all anonymization fields.
      operationId: FindAnonymizationFields
      parameters:
        - description: Fields to return
          example:
            - id
            - field
            - anonymized
            - allowed
          in: query
          name: fields
          required: false
          schema:
            items:
              type: string
            type: array
        - description: Search query
          example: 'field: "user.name"'
          in: query
          name: filter
          required: false
          schema:
            type: string
        - description: Field to sort by
          example: created_at
          in: query
          name: sort_field
          required: false
          schema:
            $ref: '#/components/schemas/Security_AI_Assistant_API_FindAnonymizationFieldsSortField'
        - description: Sort order
          example: asc
          in: query
          name: sort_order
          required: false
          schema:
            $ref: '#/components/schemas/Security_AI_Assistant_API_SortOrder'
        - description: Page number
          example: 1
          in: query
          name: page
          required: false
          schema:
            default: 1
            minimum: 1
            type: integer
        - description: AnonymizationFields per page
          example: 20
          in: query
          name: per_page
          required: false
          schema:
            default: 20
            minimum: 0
            type: integer
        - description: If true, additionally fetch all anonymization fields, otherwise fetch only the provided page
          in: query
          name: all_data
          required: false
          schema:
            type: boolean
      responses:
        '200':
          content:
            application/json:
              examples:
                FindAnonymizationFieldsResponse200Example:
                  value:
                    aggregations:
                      field_status:
                        buckets:
                          allowed:
                            doc_count: 1
                          anonymized:
                            doc_count: 1
                          denied:
                            doc_count: 1
                    all:
                      - allowed: true
                        anonymized: true
                        createdAt: '2023-10-31T12:00:00Z'
                        createdBy: user1
                        field: user.name
                        id: '1'
                        namespace: default
                        timestamp: '2023-10-31T12:00:00Z'
                        updatedAt: '2023-10-31T12:00:00Z'
                        updatedBy: user1
                    data:
                      - allowed: true
                        anonymized: true
                        createdAt: '2023-10-31T12:00:00Z'
                        createdBy: user1
                        field: user.name
                        id: '1'
                        namespace: default
                        timestamp: '2023-10-31T12:00:00Z'
                        updatedAt: '2023-10-31T12:00:00Z'
                        updatedBy: user1
                    page: 1
                    perPage: 20
                    total: 100
              schema:
                type: object
                properties:
                  aggregations:
                    type: object
                    properties:
                      field_status:
                        type: object
                        properties:
                          buckets:
                            type: object
                            properties:
                              allowed:
                                type: object
                                properties:
                                  doc_count:
                                    default: 0
                                    type: integer
                              anonymized:
                                type: object
                                properties:
                                  doc_count:
                                    default: 0
                                    type: integer
                              denied:
                                type: object
                                properties:
                                  doc_count:
                                    default: 0
                                    type: integer
                  all:
                    items:
                      $ref: '#/components/schemas/Security_AI_Assistant_API_AnonymizationFieldResponse'
                    type: array
                  data:
                    items:
                      $ref: '#/components/schemas/Security_AI_Assistant_API_AnonymizationFieldResponse'
                    type: array
                  page:
                    type: integer
                  perPage:
                    type: integer
                  total:
                    type: integer
                required:
                  - page
                  - perPage
                  - total
                  - data
          description: Indicates a successful call.
        '400':
          content:
            application/json:
              examples:
                FindAnonymizationFieldsResponse400Example:
                  value:
                    error: Bad Request
                    message: Invalid request parameters
                    statusCode: 400
              schema:
                type: object
                properties:
                  error:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
          description: Bad Request response.
      summary: Get anonymization fields
      tags:
        - Security AI Assistant API
      x-codeSamples:
        - label: Example request
          lang: curl
          source: |
            curl \
             --request GET 'http://localhost:5601/api/security_ai_assistant/anonymization_fields/_find?page=1&per_page=20' \
             --header "Authorization: $API_KEY"
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/security_ai_assistant/chat/complete:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/security_ai_assistant/chat/complete</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Create a model response for the given chat conversation.
      operationId: ChatComplete
      parameters:
        - description: If true, the response will not include content references.
          example: false
          in: query
          name: content_references_disabled
          required: false
          schema:
            default: false
            type: boolean
      requestBody:
        content:
          application/json:
            examples:
              ChatCompleteRequest:
                value:
                  connectorId: conn-001
                  conversationId: abc123
                  isStream: true
                  langSmithApiKey: <LANGSMITH_API_KEY>
                  langSmithProject: security_ai_project
                  messages:
                    - content: What are some common phishing techniques?
                      data:
                        user_id: user_789
                      fields_to_anonymize:
                        - user.name
                        - source.ip
                      role: user
                  model: gpt-4
                  persist: true
                  promptId: prompt_456
                  responseLanguage: en
            schema:
              $ref: '#/components/schemas/Security_AI_Assistant_API_ChatCompleteProps'
        required: true
      responses:
        '200':
          content:
            application/octet-stream:
              examples:
                ChatCompleteResponse200Example:
                  value: (streaming binary response)
              schema:
                format: binary
                type: string
          description: Indicates a successful model response call.
        '400':
          content:
            application/json:
              examples:
                ChatCompleteResponse400Example:
                  value:
                    error: Bad Request
                    message: Invalid request payload.
                    statusCode: 400
              schema:
                type: object
                properties:
                  error:
                    description: Error type.
                    example: Bad Request
                    type: string
                  message:
                    description: Human-readable error message.
                    example: Invalid request payload.
                    type: string
                  statusCode:
                    description: HTTP status code.
                    example: 400
                    type: number
          description: Bad Request response.
      summary: Create a model response
      tags:
        - Security AI Assistant API
      x-codeSamples:
        - label: Example request
          lang: curl
          source: |
            curl \
             --request POST 'http://localhost:5601/api/security_ai_assistant/chat/complete' \
             --header "Authorization: $API_KEY" \
             --header "Content-Type: application/json" \
             --data '{"connectorId":"conn-001","persist":true,"messages":[{"role":"user","content":"What are common phishing techniques?"}]}'
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/security_ai_assistant/current_user/conversations:
    delete:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb delete">delete</span>&nbsp;<span class="operation-path">/s/{space_id}/api/security_ai_assistant/current_user/conversations</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        This endpoint allows users to permanently delete all conversations.
      operationId: DeleteAllConversations
      requestBody:
        content:
          application/json:
            examples:
              DeleteAllConversationsRequest:
                value:
                  excludedIds:
                    - abc123
                    - def456
            schema:
              type: object
              properties:
                excludedIds:
                  description: Optional list of conversation IDs to delete.
                  example:
                    - abc123
                    - def456
                  items:
                    type: string
                  type: array
        required: false
      responses:
        '200':
          content:
            application/json:
              examples:
                DeleteAllConversationsResponse200Example:
                  value:
                    failures: []
                    success: true
                    totalDeleted: 10
              schema:
                type: object
                properties:
                  failures:
                    items:
                      type: string
                    type: array
                  success:
                    example: true
                    type: boolean
                  totalDeleted:
                    example: 10
                    type: number
          description: Indicates a successful call. The conversations were deleted successfully.
        '400':
          content:
            application/json:
              examples:
                DeleteAllConversationsResponse400Example:
                  value:
                    error: Bad Request
                    message: Invalid conversation ID
                    statusCode: 400
              schema:
                type: object
                properties:
                  error:
                    example: Bad Request
                    type: string
                  message:
                    example: Invalid conversation ID
                    type: string
                  statusCode:
                    example: 400
                    type: number
          description: Bad Request response.
      summary: Delete conversations
      tags:
        - Security AI Assistant API
      x-codeSamples:
        - label: Example request
          lang: curl
          source: |
            curl \
             --request DELETE 'http://localhost:5601/api/security_ai_assistant/current_user/conversations' \
             --header "Authorization: $API_KEY" \
             --header "Content-Type: application/json" \
             --data '{"excludedIds":["abc123"]}'
      x-metaTags:
        - content: Kibana
          name: product_name
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/security_ai_assistant/current_user/conversations</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Create a new Security AI Assistant conversation. This endpoint allows the user to initiate a conversation with the Security AI Assistant by providing the required parameters.
      operationId: CreateConversation
      requestBody:
        content:
          application/json:
            examples:
              CreateConversationRequest:
                value:
                  apiConfig:
                    actionTypeId: '67890'
                    connectorId: '12345'
                  category: assistant
                  excludeFromLastConversationStorage: false
                  messages:
                    - content: Hello, how can I assist you today?
                      role: system
                      timestamp: '2023-10-31T12:00:00Z'
                  replacements: {}
                  title: Security Discussion
            schema:
              $ref: '#/components/schemas/Security_AI_Assistant_API_ConversationCreateProps'
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                CreateConversationResponse200Example:
                  value:
                    apiConfig:
                      actionTypeId: '67890'
                      connectorId: '12345'
                    category: assistant
                    createdAt: '2023-10-31T12:01:00Z'
                    createdBy:
                      id: user1
                      name: John Doe
                    excludeFromLastConversationStorage: false
                    id: abc123
                    messages:
                      - content: Hello, how can I assist you today?
                        role: system
                        timestamp: '2023-10-31T12:00:00Z'
                    namespace: default
                    replacements: {}
                    title: Security Discussion
                    updatedAt: '2023-10-31T12:01:00Z'
                    users:
                      - id: user1
                        name: John Doe
              schema:
                $ref: '#/components/schemas/Security_AI_Assistant_API_ConversationResponse'
          description: Indicates a successful call. The conversation was created successfully.
        '400':
          content:
            application/json:
              examples:
                CreateConversationResponse400Example:
                  value:
                    error: Bad Request
                    message: 'Missing required parameter: title'
                    statusCode: 400
              schema:
                type: object
                properties:
                  error:
                    example: Bad Request
                    type: string
                  message:
                    example: 'Missing required parameter: title'
                    type: string
                  statusCode:
                    example: 400
                    type: number
          description: Bad Request response.
      summary: Create a conversation
      tags:
        - Security AI Assistant API
      x-codeSamples:
        - label: Example request
          lang: curl
          source: |
            curl \
             --request POST 'http://localhost:5601/api/security_ai_assistant/current_user/conversations' \
             --header "Authorization: $API_KEY" \
             --header "Content-Type: application/json" \
             --data '{"title":"Security Discussion","category":"assistant","messages":[{"content":"Hello","role":"system","timestamp":"2023-10-31T12:00:00Z"}],"apiConfig":{"connectorId":"12345","actionTypeId":"67890"},"replacements":{},"excludeFromLastConversationStorage":false}'
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/security_ai_assistant/current_user/conversations/_find:
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/security_ai_assistant/current_user/conversations/_find</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Get a list of all conversations for the current user. This endpoint allows users to search, filter, sort, and paginate through their conversations.
      operationId: FindConversations
      parameters:
        - description: A list of fields to include in the response. If omitted, all fields are returned.
          in: query
          name: fields
          required: false
          schema:
            example:
              - id
              - title
              - createdAt
            items:
              type: string
            type: array
        - description: A search query to filter the conversations. Can match against titles, messages, or other conversation attributes.
          in: query
          name: filter
          required: false
          schema:
            example: Security Issue
            type: string
        - description: The field by which to sort the results. Valid fields are `created_at`, `title`, and `updated_at`.
          in: query
          name: sort_field
          required: false
          schema:
            $ref: '#/components/schemas/Security_AI_Assistant_API_FindConversationsSortField'
            example: created_at
        - description: The order in which to sort the results. Can be either `asc` for ascending or `desc` for descending.
          in: query
          name: sort_order
          required: false
          schema:
            $ref: '#/components/schemas/Security_AI_Assistant_API_SortOrder'
            example: desc
        - description: The page number of the results to retrieve. Default is 1.
          in: query
          name: page
          required: false
          schema:
            default: 1
            example: 1
            minimum: 1
            type: integer
        - description: The number of conversations to return per page. Default is 20.
          in: query
          name: per_page
          required: false
          schema:
            default: 20
            example: 20
            minimum: 0
            type: integer
        - description: Whether to return conversations that the current user owns. If true, only conversations owned by the user are returned.
          in: query
          name: is_owner
          required: false
          schema:
            default: false
            example: true
            type: boolean
      responses:
        '200':
          content:
            application/json:
              examples:
                FindConversationsResponse200Example:
                  value:
                    data:
                      - category: assistant
                        createdAt: '2023-10-31T12:00:00Z'
                        createdBy:
                          id: user1
                          name: John Doe
                        excludeFromLastConversationStorage: false
                        id: conv-abc123
                        messages: []
                        namespace: default
                        replacements: {}
                        title: Security Discussion
                        updatedAt: '2023-10-31T12:05:00Z'
                        users:
                          - id: user1
                            name: John Doe
                    page: 1
                    perPage: 20
                    total: 5
              schema:
                type: object
                properties:
                  data:
                    description: A list of conversations.
                    items:
                      $ref: '#/components/schemas/Security_AI_Assistant_API_ConversationResponse'
                    type: array
                  page:
                    description: The current page of the results.
                    example: 1
                    type: integer
                  perPage:
                    description: The number of results returned per page.
                    example: 20
                    type: integer
                  total:
                    description: The total number of conversations matching the filter criteria.
                    example: 100
                    type: integer
                required:
                  - page
                  - perPage
                  - total
                  - data
          description: Successful response, returns a paginated list of conversations matching the specified criteria.
        '400':
          content:
            application/json:
              examples:
                FindConversationsResponse400Example:
                  value:
                    error: Bad Request
                    message: Invalid filter parameter.
                    statusCode: 400
              schema:
                type: object
                properties:
                  error:
                    example: Bad Request
                    type: string
                  message:
                    example: Invalid filter query parameter
                    type: string
                  statusCode:
                    example: 400
                    type: number
          description: Bad Request response.
      summary: Get conversations
      tags:
        - Security AI Assistant API
      x-codeSamples:
        - label: Example request
          lang: curl
          source: |
            curl \
             --request GET 'http://localhost:5601/api/security_ai_assistant/current_user/conversations/_find?page=1&per_page=20' \
             --header "Authorization: $API_KEY"
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/security_ai_assistant/current_user/conversations/{id}:
    delete:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb delete">delete</span>&nbsp;<span class="operation-path">/s/{space_id}/api/security_ai_assistant/current_user/conversations/{id}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Delete an existing conversation using the conversation ID. This endpoint allows users to permanently delete a conversation.
      operationId: DeleteConversation
      parameters:
        - description: The conversation's `id` value.
          example: abc123
          in: path
          name: id
          required: true
          schema:
            $ref: '#/components/schemas/Security_AI_Assistant_API_NonEmptyString'
      responses:
        '200':
          content:
            application/json:
              examples:
                DeleteConversationResponse200Example:
                  value:
                    apiConfig:
                      actionTypeId: '67890'
                      connectorId: '12345'
                    category: assistant
                    createdAt: '2023-10-31T12:01:00Z'
                    createdBy:
                      id: user1
                      name: John Doe
                    excludeFromLastConversationStorage: false
                    id: abc123
                    messages:
                      - content: The conversation has been deleted.
                        role: system
                        timestamp: '2023-10-31T12:35:00Z'
                    namespace: default
                    replacements: {}
                    title: Deleted Security Discussion
                    updatedAt: '2023-10-31T12:01:00Z'
                    users:
                      - id: user1
                        name: John Doe
              schema:
                $ref: '#/components/schemas/Security_AI_Assistant_API_ConversationResponse'
          description: Indicates a successful call. The conversation was deleted successfully.
        '400':
          content:
            application/json:
              examples:
                DeleteConversationResponse400Example:
                  value:
                    error: Bad Request
                    message: Invalid conversation ID
                    statusCode: 400
              schema:
                type: object
                properties:
                  error:
                    example: Bad Request
                    type: string
                  message:
                    example: Invalid conversation ID
                    type: string
                  statusCode:
                    example: 400
                    type: number
          description: Bad Request response.
      summary: Delete a conversation
      tags:
        - Security AI Assistant API
      x-codeSamples:
        - label: Example request
          lang: curl
          source: |
            curl \
             --request DELETE 'http://localhost:5601/api/security_ai_assistant/current_user/conversations/abc123' \
             --header "Authorization: $API_KEY"
      x-metaTags:
        - content: Kibana
          name: product_name
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/security_ai_assistant/current_user/conversations/{id}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Get the details of an existing conversation using the conversation ID. This allows users to fetch the specific conversation data by its unique ID.
      operationId: ReadConversation
      parameters:
        - description: The conversation's `id` value, a unique identifier for the conversation.
          example: abc123
          in: path
          name: id
          required: true
          schema:
            $ref: '#/components/schemas/Security_AI_Assistant_API_NonEmptyString'
      responses:
        '200':
          content:
            application/json:
              examples:
                ReadConversationResponse200Example:
                  value:
                    apiConfig:
                      actionTypeId: '67890'
                      connectorId: '12345'
                    category: assistant
                    createdAt: '2023-10-31T12:01:00Z'
                    createdBy:
                      id: user1
                      name: John Doe
                    excludeFromLastConversationStorage: false
                    id: abc123
                    messages:
                      - content: Hello, how can I assist you today?
                        role: system
                        timestamp: '2023-10-31T12:00:00Z'
                    namespace: default
                    replacements: {}
                    title: Security Discussion
                    updatedAt: '2023-10-31T12:01:00Z'
                    users:
                      - id: user1
                        name: John Doe
              schema:
                $ref: '#/components/schemas/Security_AI_Assistant_API_ConversationResponse'
          description: Indicates a successful call. The conversation details are returned.
        '400':
          content:
            application/json:
              examples:
                ReadConversationResponse400Example:
                  value:
                    error: Bad Request
                    message: Invalid conversation ID
                    statusCode: 400
              schema:
                type: object
                properties:
                  error:
                    example: Bad Request
                    type: string
                  message:
                    example: Invalid conversation ID
                    type: string
                  statusCode:
                    example: 400
                    type: number
          description: Bad Request response.
      summary: Get a conversation
      tags:
        - Security AI Assistant API
      x-codeSamples:
        - label: Example request
          lang: curl
          source: |
            curl \
             --request GET 'http://localhost:5601/api/security_ai_assistant/current_user/conversations/abc123' \
             --header "Authorization: $API_KEY"
      x-metaTags:
        - content: Kibana
          name: product_name
    put:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb put">put</span>&nbsp;<span class="operation-path">/s/{space_id}/api/security_ai_assistant/current_user/conversations/{id}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Update an existing conversation using the conversation ID. This endpoint allows users to modify the details of an existing conversation.
      operationId: UpdateConversation
      parameters:
        - description: The conversation's `id` value.
          example: abc123
          in: path
          name: id
          required: true
          schema:
            $ref: '#/components/schemas/Security_AI_Assistant_API_NonEmptyString'
      requestBody:
        content:
          application/json:
            examples:
              UpdateConversationRequest:
                value:
                  apiConfig:
                    actionTypeId: '09876'
                    connectorId: '54321'
                  category: insights
                  excludeFromLastConversationStorage: true
                  messages:
                    - content: The issue was resolved.
                      role: assistant
                      timestamp: '2023-10-31T12:30:00Z'
                  replacements: {}
                  title: Updated Security Discussion
            schema:
              $ref: '#/components/schemas/Security_AI_Assistant_API_ConversationUpdateProps'
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                UpdateConversationResponse200Example:
                  value:
                    apiConfig:
                      actionTypeId: '09876'
                      connectorId: '54321'
                    category: insights
                    createdAt: '2023-10-31T12:01:00Z'
                    createdBy:
                      id: user1
                      name: John Doe
                    excludeFromLastConversationStorage: true
                    id: abc123
                    messages:
                      - content: The issue was resolved.
                        role: assistant
                        timestamp: '2023-10-31T12:30:00Z'
                    namespace: default
                    replacements: {}
                    title: Updated Security Discussion
                    updatedAt: '2023-10-31T12:31:00Z'
                    users:
                      - id: user1
                        name: John Doe
              schema:
                $ref: '#/components/schemas/Security_AI_Assistant_API_ConversationResponse'
          description: Indicates a successful call. The conversation was updated successfully.
        '400':
          content:
            application/json:
              examples:
                UpdateConversationResponse400Example:
                  value:
                    error: Bad Request
                    message: 'Missing required field: title'
                    statusCode: 400
              schema:
                type: object
                properties:
                  error:
                    example: Bad Request
                    type: string
                  message:
                    example: 'Missing required field: title'
                    type: string
                  statusCode:
                    example: 400
                    type: number
          description: Bad Request response.
      summary: Update a conversation
      tags:
        - Security AI Assistant API
      x-codeSamples:
        - label: Example request
          lang: curl
          source: |
            curl \
             --request PUT 'http://localhost:5601/api/security_ai_assistant/current_user/conversations/abc123' \
             --header "Authorization: $API_KEY" \
             --header "Content-Type: application/json" \
             --data '{"title":"Updated Security Discussion","category":"insights","messages":[{"content":"Resolved.","role":"assistant","timestamp":"2023-10-31T12:30:00Z"}],"apiConfig":{"connectorId":"54321","actionTypeId":"09876"},"replacements":{},"excludeFromLastConversationStorage":true}'
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/security_ai_assistant/knowledge_base:
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/security_ai_assistant/knowledge_base</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Read a single KB
      operationId: GetKnowledgeBase
      responses:
        '200':
          content:
            application/json:
              examples:
                KnowledgeBaseReadResponse200Example2:
                  summary: A response that returns information about the knowledge base.
                  value:
                    defend_insights_exists: true
                    elser_exists: false
                    is_setup_available: true
                    is_setup_in_progress: true
                    product_documentation_status: installed
                    security_labs_exists: false
                    user_data_exists: true
              schema:
                $ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseReadResponse200'
          description: Indicates a successful call.
        '400':
          content:
            application/json:
              examples:
                GetKnowledgeBaseResponse400Example:
                  value:
                    error: Bad Request
                    message: Invalid resource ID provided.
                    statusCode: 400
              schema:
                $ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseResponse400'
          description: Bad Request response.
      summary: Read a KnowledgeBase
      tags:
        - Security AI Assistant API
      x-codeSamples:
        - label: Example request
          lang: curl
          source: |
            curl \
             --request GET 'http://localhost:5601/api/security_ai_assistant/knowledge_base' \
             --header "Authorization: $API_KEY"
      x-metaTags:
        - content: Kibana
          name: product_name
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/security_ai_assistant/knowledge_base</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Create a knowledge base. Use this endpoint when no specific resource identifier is needed.
      operationId: PostKnowledgeBase
      parameters:
        - description: ELSER modelId to use when setting up the Knowledge Base. If not provided, a default model will be used.
          example: elser-model-001
          in: query
          name: modelId
          required: false
          schema:
            type: string
        - description: Indicates whether we should or should not install Security Labs docs when setting up the Knowledge Base. Defaults to `false`.
          example: true
          in: query
          name: ignoreSecurityLabs
          required: false
          schema:
            default: false
            type: boolean
      responses:
        '200':
          content:
            application/json:
              examples:
                KnowledgeBaseResponse200Example2:
                  summary: A response that indicates that the request was successful.
                  value:
                    success: true
              schema:
                $ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseResponse'
          description: Indicates a successful call.
        '400':
          content:
            application/json:
              examples:
                KnowledgeBaseResponse400Example2:
                  summary: A response for a request that failed due to an invalid query parameter value.
                  value: |
                    statusCode: 400 error: Bad Request message: "[request query]: ignoreSecurityLabs: Invalid enum value. Expected 'true' | 'false', received 'yes', ignoreSecurityLabs: Expected boolean, received string"
              schema:
                $ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseResponse400'
          description: Bad Request response.
      summary: Create a KnowledgeBase
      tags:
        - Security AI Assistant API
      x-codeSamples:
        - label: Example request
          lang: curl
          source: |
            curl \
             --request POST 'http://localhost:5601/api/security_ai_assistant/knowledge_base?ignoreSecurityLabs=false' \
             --header "Authorization: $API_KEY"
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/security_ai_assistant/knowledge_base/{resource}:
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/security_ai_assistant/knowledge_base/{resource}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Read a knowledge base with a specific resource identifier.
      operationId: ReadKnowledgeBase
      parameters:
        - description: The KnowledgeBase `resource` value.
          example: kb12345
          in: path
          name: resource
          required: true
          schema:
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                KnowledgeBaseReadResponse200Example1:
                  summary: A response that returns information about the knowledge base.
                  value:
                    defend_insights_exists: true
                    elser_exists: false
                    is_setup_available: true
                    is_setup_in_progress: true
                    product_documentation_status: installed
                    security_labs_exists: false
                    user_data_exists: true
              schema:
                $ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseReadResponse200'
          description: Indicates a successful call.
        '400':
          content:
            application/json:
              examples:
                ReadKnowledgeBaseResponse400Example:
                  value:
                    error: Bad Request
                    message: Invalid resource ID provided.
                    statusCode: 400
              schema:
                $ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseResponse400'
          description: Bad Request response.
      summary: Read a KnowledgeBase for a resource
      tags:
        - Security AI Assistant API
      x-codeSamples:
        - label: Example request
          lang: curl
          source: |
            curl \
             --request GET 'http://localhost:5601/api/security_ai_assistant/knowledge_base/kb12345' \
             --header "Authorization: $API_KEY"
      x-metaTags:
        - content: Kibana
          name: product_name
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/security_ai_assistant/knowledge_base/{resource}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Create a knowledge base with a specific resource identifier.
      operationId: CreateKnowledgeBase
      parameters:
        - description: The KnowledgeBase `resource` value.
          example: kb12345
          in: path
          name: resource
          required: true
          schema:
            type: string
        - description: ELSER modelId to use when setting up the Knowledge Base. If not provided, a default model will be used.
          example: elser-model-001
          in: query
          name: modelId
          required: false
          schema:
            type: string
        - description: Indicates whether we should or should not install Security Labs docs when setting up the Knowledge Base. Defaults to `false`.
          example: true
          in: query
          name: ignoreSecurityLabs
          required: false
          schema:
            default: false
            type: boolean
      responses:
        '200':
          content:
            application/json:
              examples:
                KnowledgeBaseResponse200Example1:
                  summary: A response that indicates that the request was successful.
                  value:
                    success: true
              schema:
                $ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseResponse'
          description: Indicates a successful call.
        '400':
          content:
            application/json:
              examples:
                KnowledgeBaseResponse400Example1:
                  summary: A response for a request that failed due to an invalid query parameter value.
                  value: |
                    statusCode: 400 error: Bad Request message: "[request query]: ignoreSecurityLabs: Invalid enum value. Expected 'true' | 'false', received 'yes', ignoreSecurityLabs: Expected boolean, received string"
              schema:
                $ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseResponse400'
          description: Bad Request response.
      summary: Create a KnowledgeBase for a resource
      tags:
        - Security AI Assistant API
      x-codeSamples:
        - label: Example request
          lang: curl
          source: |
            curl \
             --request POST 'http://localhost:5601/api/security_ai_assistant/knowledge_base/kb12345?ignoreSecurityLabs=false' \
             --header "Authorization: $API_KEY"
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/security_ai_assistant/knowledge_base/entries:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/security_ai_assistant/knowledge_base/entries</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Create a Knowledge Base Entry
      operationId: CreateKnowledgeBaseEntry
      requestBody:
        content:
          application/json:
            examples:
              CreateKnowledgeBaseEntryRequest:
                value:
                  kbResource: user
                  name: How to reset a password
                  source: manual
                  text: To reset your password, go to the settings page and click 'Reset Password'.
                  type: document
            schema:
              $ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryCreateProps'
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                CreateKnowledgeBaseEntryResponse200Example:
                  value:
                    createdAt: '2024-01-15T10:00:00.000Z'
                    createdBy: user@example.com
                    global: false
                    id: '12345'
                    kbResource: user
                    name: How to reset a password
                    namespace: default
                    source: manual
                    text: To reset your password, go to the settings page and click 'Reset Password'.
                    type: document
                    updatedAt: '2024-01-15T10:00:00.000Z'
                    updatedBy: user@example.com
              schema:
                $ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryResponse'
          description: Successful request returning Knowledge Base Entries
        '400':
          content:
            application/json:
              examples:
                CreateKnowledgeBaseEntryResponse400Example:
                  value:
                    error: Invalid input
                    message: The 'name' field is required.
              schema:
                $ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryErrorSchema'
          description: Bad Request response.
      summary: Create a Knowledge Base Entry
      tags:
        - Security AI Assistant API
      x-codeSamples:
        - label: Example request
          lang: curl
          source: |
            curl \
             --request POST 'http://localhost:5601/api/security_ai_assistant/knowledge_base/entries' \
             --header "Authorization: $API_KEY" \
             --header "Content-Type: application/json" \
             --data '{"name":"How to reset a password","type":"document","kbResource":"user","source":"manual","text":"To reset your password, go to the settings page and click Reset Password."}'
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/security_ai_assistant/knowledge_base/entries/_bulk_action:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/security_ai_assistant/knowledge_base/entries/_bulk_action</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        The bulk action is applied to all Knowledge Base Entries that match the filter or to the list of Knowledge Base Entries by their IDs.
      operationId: PerformKnowledgeBaseEntryBulkAction
      requestBody:
        content:
          application/json:
            examples:
              PerformKnowledgeBaseEntryBulkActionRequest:
                value:
                  create:
                    - kbResource: user
                      name: New Entry
                      source: manual
                      text: This is the content of the new entry.
                      type: document
                  delete:
                    ids:
                      - '789'
                  update:
                    - id: '123'
                      kbResource: user
                      name: Updated Entry
                      source: manual
                      text: Updated content.
                      type: document
            schema:
              type: object
              properties:
                create:
                  description: List of Knowledge Base Entries to create.
                  example:
                    - kbResource: user
                      name: New Entry
                      source: manual
                      text: This is the content of the new entry.
                      type: document
                  items:
                    $ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryCreateProps'
                  type: array
                delete:
                  type: object
                  properties:
                    ids:
                      description: Array of Knowledge Base Entry IDs.
                      example:
                        - '123'
                        - '456'
                        - '789'
                      items:
                        type: string
                      minItems: 1
                      type: array
                    query:
                      description: Query to filter Knowledge Base Entries.
                      example: status:active AND category:technology
                      type: string
                update:
                  description: List of Knowledge Base Entries to update.
                  example:
                    - id: '123'
                      kbResource: user
                      name: Updated Entry
                      source: manual
                      text: Updated content.
                      type: document
                  items:
                    $ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryUpdateProps'
                  type: array
      responses:
        '200':
          content:
            application/json:
              examples:
                PerformKnowledgeBaseEntryBulkActionResponse200Example:
                  value:
                    attributes:
                      results:
                        created:
                          - createdAt: '2024-01-15T10:00:00.000Z'
                            createdBy: user@example.com
                            global: false
                            id: '456'
                            kbResource: user
                            name: New Entry
                            namespace: default
                            source: manual
                            text: This is the content of the new entry.
                            type: document
                            updatedAt: '2024-01-15T10:00:00.000Z'
                            updatedBy: user@example.com
                        deleted:
                          - '789'
                        skipped: []
                        updated:
                          - createdAt: '2024-01-14T09:00:00.000Z'
                            createdBy: user@example.com
                            global: false
                            id: '123'
                            kbResource: user
                            name: Updated Entry
                            namespace: default
                            source: manual
                            text: Updated content.
                            type: document
                            updatedAt: '2024-01-15T10:00:00.000Z'
                            updatedBy: user@example.com
                      summary:
                        failed: 0
                        skipped: 0
                        succeeded: 3
                        total: 3
                    knowledgeBaseEntriesCount: 3
                    message: Bulk action completed successfully.
                    statusCode: 200
                    success: true
              schema:
                $ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryBulkCrudActionResponse'
          description: Successful bulk operation request
        '400':
          content:
            application/json:
              examples:
                PerformKnowledgeBaseEntryBulkActionResponse400Example:
                  value:
                    error: Bad Request
                    message: Invalid request body.
                    statusCode: 400
              schema:
                $ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryErrorSchema'
          description: Bad Request response.
      summary: Applies a bulk action to multiple Knowledge Base Entries
      tags:
        - Security AI Assistant API
      x-codeSamples:
        - label: Example request
          lang: curl
          source: |
            curl \
             --request POST 'http://localhost:5601/api/security_ai_assistant/knowledge_base/entries/_bulk_action' \
             --header "Authorization: $API_KEY" \
             --header "Content-Type: application/json" \
             --data '{"create":[{"name":"Runbook","type":"document","kbResource":"user","source":"manual","text":"Steps to triage an alert."}]}'
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/security_ai_assistant/knowledge_base/entries/_find:
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/security_ai_assistant/knowledge_base/entries/_find</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Finds Knowledge Base Entries that match the given query.
      operationId: FindKnowledgeBaseEntries
      parameters:
        - description: A list of fields to include in the response. If not provided, all fields will be included.
          in: query
          name: fields
          required: false
          schema:
            example:
              - name
              - created_at
            items:
              type: string
            type: array
        - description: Search query to filter Knowledge Base Entries by specific criteria.
          in: query
          name: filter
          required: false
          schema:
            example: error handling
            type: string
        - description: Field to sort the Knowledge Base Entries by.
          in: query
          name: sort_field
          required: false
          schema:
            $ref: '#/components/schemas/Security_AI_Assistant_API_FindKnowledgeBaseEntriesSortField'
            example: created_at
        - description: Sort order for the results, either asc or desc.
          in: query
          name: sort_order
          required: false
          schema:
            $ref: '#/components/schemas/Security_AI_Assistant_API_SortOrder'
            example: asc
        - description: Page number for paginated results. Defaults to 1.
          in: query
          name: page
          required: false
          schema:
            default: 1
            example: 2
            minimum: 1
            type: integer
        - description: Number of Knowledge Base Entries to return per page. Defaults to 20.
          in: query
          name: per_page
          required: false
          schema:
            default: 20
            example: 10
            minimum: 0
            type: integer
      responses:
        '200':
          content:
            application/json:
              examples:
                FindKnowledgeBaseEntriesResponse200Example:
                  value:
                    data:
                      - createdAt: '2024-01-15T10:00:00.000Z'
                        createdBy: user@example.com
                        global: false
                        id: '12345'
                        kbResource: user
                        name: How to reset a password
                        namespace: default
                        source: manual
                        text: To reset your password, go to the settings page and click 'Reset Password'.
                        type: document
                        updatedAt: '2024-01-15T10:00:00.000Z'
                        updatedBy: user@example.com
                    page: 1
                    perPage: 20
                    total: 100
              schema:
                type: object
                properties:
                  data:
                    description: The list of Knowledge Base Entries for the current page.
                    items:
                      $ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryResponse'
                    type: array
                  page:
                    description: The current page number.
                    example: 1
                    type: integer
                  perPage:
                    description: The number of Knowledge Base Entries returned per page.
                    example: 20
                    type: integer
                  total:
                    description: The total number of Knowledge Base Entries available.
                    example: 100
                    type: integer
                required:
                  - page
                  - perPage
                  - total
                  - data
          description: Successful response containing the paginated Knowledge Base Entries.
        '400':
          content:
            application/json:
              examples:
                FindKnowledgeBaseEntriesResponse400Example:
                  value:
                    error: Bad Request
                    message: 'Invalid query parameter: sort_order'
                    statusCode: 400
              schema:
                type: object
                properties:
                  error:
                    description: A short description of the error.
                    example: Bad Request
                    type: string
                  message:
                    description: A detailed message explaining the error.
                    example: 'Invalid query parameter: sort_order'
                    type: string
                  statusCode:
                    description: The HTTP status code of the error.
                    example: 400
                    type: number
          description: Bad Request response.
      summary: Finds Knowledge Base Entries that match the given query.
      tags:
        - Security AI Assistant API
      x-codeSamples:
        - label: Example request
          lang: curl
          source: |
            curl \
             --request GET 'http://localhost:5601/api/security_ai_assistant/knowledge_base/entries/_find?page=1&per_page=20' \
             --header "Authorization: $API_KEY"
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/security_ai_assistant/knowledge_base/entries/{id}:
    delete:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb delete">delete</span>&nbsp;<span class="operation-path">/s/{space_id}/api/security_ai_assistant/knowledge_base/entries/{id}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Delete a Knowledge Base Entry by its unique `id`.
      operationId: DeleteKnowledgeBaseEntry
      parameters:
        - description: The unique identifier (`id`) of the Knowledge Base Entry to delete.
          example: '12345'
          in: path
          name: id
          required: true
          schema:
            $ref: '#/components/schemas/Security_AI_Assistant_API_NonEmptyString'
      responses:
        '200':
          content:
            application/json:
              examples:
                DeleteKnowledgeBaseEntryResponse200Example:
                  value:
                    id: '12345'
                    message: Knowledge Base Entry successfully deleted.
              schema:
                $ref: '#/components/schemas/Security_AI_Assistant_API_DeleteResponseFields'
          description: Successful request returning the `id` of the deleted Knowledge Base Entry.
        '400':
          content:
            application/json:
              examples:
                DeleteKnowledgeBaseEntryResponse400Example:
                  value:
                    error: Not Found
                    message: No Knowledge Base Entry found with the provided `id`.
              schema:
                $ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryErrorSchema'
          description: Bad Request response.
      summary: Deletes a single Knowledge Base Entry using the `id` field
      tags:
        - Security AI Assistant API
      x-codeSamples:
        - label: Example request
          lang: curl
          source: |
            curl \
             --request DELETE 'http://localhost:5601/api/security_ai_assistant/knowledge_base/entries/12345' \
             --header "Authorization: $API_KEY"
      x-metaTags:
        - content: Kibana
          name: product_name
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/security_ai_assistant/knowledge_base/entries/{id}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Retrieve a Knowledge Base Entry by its unique `id`.
      operationId: ReadKnowledgeBaseEntry
      parameters:
        - description: The unique identifier (`id`) of the Knowledge Base Entry to retrieve.
          example: '12345'
          in: path
          name: id
          required: true
          schema:
            $ref: '#/components/schemas/Security_AI_Assistant_API_NonEmptyString'
      responses:
        '200':
          content:
            application/json:
              examples:
                ReadKnowledgeBaseEntryResponse200Example:
                  value:
                    createdAt: '2024-01-15T10:00:00.000Z'
                    createdBy: user@example.com
                    global: false
                    id: '12345'
                    kbResource: user
                    name: How to reset a password
                    namespace: default
                    source: manual
                    text: To reset your password, go to the settings page and click 'Reset Password'.
                    type: document
                    updatedAt: '2024-01-15T10:00:00.000Z'
                    updatedBy: user@example.com
              schema:
                $ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryResponse'
          description: Successful request returning the requested Knowledge Base Entry.
        '400':
          content:
            application/json:
              examples:
                ReadKnowledgeBaseEntryResponse400Example:
                  value:
                    error: Not Found
                    message: No Knowledge Base Entry found with the provided `id`.
              schema:
                $ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryErrorSchema'
          description: Bad Request response.
      summary: Read a Knowledge Base Entry
      tags:
        - Security AI Assistant API
      x-codeSamples:
        - label: Example request
          lang: curl
          source: |
            curl \
             --request GET 'http://localhost:5601/api/security_ai_assistant/knowledge_base/entries/12345' \
             --header "Authorization: $API_KEY"
      x-metaTags:
        - content: Kibana
          name: product_name
    put:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb put">put</span>&nbsp;<span class="operation-path">/s/{space_id}/api/security_ai_assistant/knowledge_base/entries/{id}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Update an existing Knowledge Base Entry by its unique `id`.
      operationId: UpdateKnowledgeBaseEntry
      parameters:
        - description: The unique identifier (`id`) of the Knowledge Base Entry to update.
          example: '12345'
          in: path
          name: id
          required: true
          schema:
            $ref: '#/components/schemas/Security_AI_Assistant_API_NonEmptyString'
      requestBody:
        content:
          application/json:
            examples:
              UpdateKnowledgeBaseEntryRequest:
                value:
                  kbResource: user
                  name: How to reset a password (updated)
                  source: manual
                  text: 'Updated: go to settings and click Reset Password, then follow the on-screen instructions.'
                  type: document
            schema:
              $ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryUpdateRouteProps'
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                UpdateKnowledgeBaseEntryResponse200Example:
                  value:
                    createdAt: '2024-01-15T10:00:00.000Z'
                    createdBy: user@example.com
                    global: false
                    id: '12345'
                    kbResource: user
                    name: How to reset a password (updated)
                    namespace: default
                    source: manual
                    text: 'Updated: go to settings and click Reset Password, then follow the on-screen instructions.'
                    type: document
                    updatedAt: '2024-01-15T10:05:00.000Z'
                    updatedBy: user@example.com
              schema:
                $ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryResponse'
          description: Successful request returning the updated Knowledge Base Entry.
        '400':
          content:
            application/json:
              examples:
                UpdateKnowledgeBaseEntryResponse400Example:
                  value:
                    error: Invalid input
                    message: The 'text' field cannot be empty.
              schema:
                $ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryErrorSchema'
          description: Bad Request response.
      summary: Update a Knowledge Base Entry
      tags:
        - Security AI Assistant API
      x-codeSamples:
        - label: Example request
          lang: curl
          source: |
            curl \
             --request PUT 'http://localhost:5601/api/security_ai_assistant/knowledge_base/entries/12345' \
             --header "Authorization: $API_KEY" \
             --header "Content-Type: application/json" \
             --data '{"name":"How to reset a password (updated)","type":"document","kbResource":"user","source":"manual","text":"Updated: go to settings and click Reset Password, then follow the on-screen instructions."}'
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/security_ai_assistant/prompts/_bulk_action:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/security_ai_assistant/prompts/_bulk_action</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Apply a bulk action to multiple prompts. The bulk action is applied to all prompts that match the filter or to the list of prompts by their IDs. This action allows for bulk create, update, or delete operations.
      operationId: PerformPromptsBulkAction
      requestBody:
        content:
          application/json:
            examples:
              PerformPromptsBulkActionRequest:
                value:
                  create:
                    - content: Please verify the security settings.
                      name: New Security Prompt
                      promptType: system
                  delete:
                    ids:
                      - prompt1
                      - prompt2
                  update:
                    - content: Updated content for security prompt.
                      id: prompt123
            schema:
              type: object
              properties:
                create:
                  description: List of prompts to be created.
                  items:
                    $ref: '#/components/schemas/Security_AI_Assistant_API_PromptCreateProps'
                  type: array
                delete:
                  description: Criteria for deleting prompts in bulk.
                  type: object
                  properties:
                    ids:
                      description: Array of IDs to apply the action to.
                      example:
                        - '1234'
                        - '5678'
                      items:
                        type: string
                      minItems: 1
                      type: array
                    query:
                      description: Query to filter the bulk action.
                      example: "status: 'inactive'"
                      type: string
                update:
                  description: List of prompts to be updated.
                  items:
                    $ref: '#/components/schemas/Security_AI_Assistant_API_PromptUpdateProps'
                  type: array
      responses:
        '200':
          content:
            application/json:
              examples:
                success:
                  value:
                    attributes:
                      errors: []
                      results:
                        created:
                          - content: Please verify the security settings.
                            id: prompt6
                            name: New Security Prompt
                            promptType: system
                        deleted:
                          - prompt2
                          - prompt3
                        skipped:
                          - id: prompt4
                            name: Security Prompt
                            skip_reason: PROMPT_FIELD_NOT_MODIFIED
                        updated:
                          - content: Updated security settings prompt
                            id: prompt1
                            name: Security Prompt
                            promptType: system
                      summary:
                        failed: 0
                        skipped: 1
                        succeeded: 4
                        total: 5
                    message: Bulk action completed successfully.
                    prompts_count: 5
                    status_code: 200
                    success: true
              schema:
                $ref: '#/components/schemas/Security_AI_Assistant_API_PromptsBulkCrudActionResponse'
          description: Indicates a successful call with the results of the bulk action.
        '400':
          content:
            application/json:
              examples:
                PerformPromptsBulkActionResponse400Example:
                  value:
                    error: Bad Request
                    message: Invalid prompt ID or missing required fields.
                    statusCode: 400
              schema:
                type: object
                properties:
                  error:
                    description: A short error message.
                    example: Bad Request
                    type: string
                  message:
                    description: A detailed error message.
                    example: Invalid prompt ID or missing required fields.
                    type: string
                  statusCode:
                    description: The HTTP status code for the error.
                    example: 400
                    type: number
          description: Bad Request response.
      summary: Apply a bulk action to prompts
      tags:
        - Security AI Assistant API
      x-codeSamples:
        - label: Example request
          lang: curl
          source: |
            curl \
             --request POST 'http://localhost:5601/api/security_ai_assistant/prompts/_bulk_action' \
             --header "Authorization: $API_KEY" \
             --header "Content-Type: application/json" \
             --data '{"delete":{"query":"name: test","ids":[]}}'
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/security_ai_assistant/prompts/_find:
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/security_ai_assistant/prompts/_find</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Get a list of all prompts based on optional filters, sorting, and pagination.
      operationId: FindPrompts
      parameters:
        - description: List of specific fields to include in each returned prompt.
          in: query
          name: fields
          required: false
          schema:
            example:
              - id
              - name
              - content
            items:
              type: string
            type: array
        - description: Search query string to filter prompts by matching fields.
          in: query
          name: filter
          required: false
          schema:
            example: error handling
            type: string
        - description: Field to sort prompts by.
          in: query
          name: sort_field
          required: false
          schema:
            $ref: '#/components/schemas/Security_AI_Assistant_API_FindPromptsSortField'
        - description: Sort order, either asc or desc.
          in: query
          name: sort_order
          required: false
          schema:
            $ref: '#/components/schemas/Security_AI_Assistant_API_SortOrder'
        - description: Page number for pagination.
          in: query
          name: page
          required: false
          schema:
            default: 1
            example: 1
            minimum: 1
            type: integer
        - description: Number of prompts per page.
          in: query
          name: per_page
          required: false
          schema:
            default: 20
            example: 20
            minimum: 0
            type: integer
      responses:
        '200':
          content:
            application/json:
              examples:
                FindPromptsResponse200Example:
                  value:
                    data:
                      - categories:
                          - troubleshooting
                          - logging
                        color: '#FF5733'
                        consumer: security
                        content: If you encounter an error, check the logs and retry.
                        createdAt: '2025-04-20T21:00:00Z'
                        createdBy: jdoe
                        id: prompt-123
                        isDefault: true
                        isNewConversationDefault: false
                        name: Error Troubleshooting Prompt
                        namespace: default
                        promptType: standard
                        timestamp: '2025-04-30T22:30:00Z'
                        updatedAt: '2025-04-30T22:45:00Z'
                        updatedBy: jdoe
                        users:
                          - full_name: John Doe
                            username: jdoe
                    page: 1
                    perPage: 20
                    total: 142
              schema:
                example:
                  data:
                    - categories:
                        - troubleshooting
                        - logging
                      color: '#FF5733'
                      consumer: security
                      content: If you encounter an error, check the logs and retry.
                      createdAt: '2025-04-20T21:00:00Z'
                      createdBy: jdoe
                      id: prompt-123
                      isDefault: true
                      isNewConversationDefault: false
                      name: Error Troubleshooting Prompt
                      namespace: default
                      promptType: standard
                      timestamp: '2025-04-30T22:30:00Z'
                      updatedAt: '2025-04-30T22:45:00Z'
                      updatedBy: jdoe
                      users:
                        - full_name: John Doe
                          username: jdoe
                  page: 1
                  perPage: 20
                  total: 142
                type: object
                properties:
                  data:
                    description: The list of prompts returned based on the search query, sorting, and pagination.
                    items:
                      $ref: '#/components/schemas/Security_AI_Assistant_API_PromptResponse'
                    type: array
                  page:
                    description: Current page number.
                    example: 1
                    type: integer
                  perPage:
                    description: Number of prompts per page.
                    example: 20
                    type: integer
                  total:
                    description: Total number of prompts matching the query.
                    example: 142
                    type: integer
                required:
                  - page
                  - perPage
                  - total
                  - data
          description: Successful response containing a list of prompts.
        '400':
          content:
            application/json:
              examples:
                FindPromptsResponse400Example:
                  value:
                    error: Bad Request
                    message: Invalid sort order value provided.
                    statusCode: 400
              schema:
                type: object
                properties:
                  error:
                    description: Short error message.
                    example: Bad Request
                    type: string
                  message:
                    description: Detailed description of the error.
                    example: Invalid sort order value provided.
                    type: string
                  statusCode:
                    description: HTTP status code for the error.
                    example: 400
                    type: number
          description: Bad request due to invalid parameters or malformed query.
      summary: Get prompts
      tags:
        - Security AI Assistant API
      x-codeSamples:
        - label: Example request
          lang: curl
          source: |
            curl \
             --request GET 'http://localhost:5601/api/security_ai_assistant/prompts/_find?page=1&per_page=20' \
             --header "Authorization: $API_KEY"
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/security_solution/initialize:
    post:
      description: |
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/security_solution/initialize</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Run one or more Security Solution initialization flows for the current space.
        Each flow provisions a specific set of assets, for example list indices,
        security data views, prebuilt detection rules, endpoint protection, AI prompts,
        or detection rule monitoring assets. Only the requested flows are run, and the
        response reports a result for each one.
      operationId: InitializeSecuritySolution
      requestBody:
        content:
          application/json:
            examples:
              default:
                value:
                  flows:
                    - init-prebuilt-rules
                    - init-endpoint-protection
                    - init-ai-prompts
            schema:
              type: object
              properties:
                flows:
                  items:
                    $ref: '#/components/schemas/Security_Solution_Initialization_API_InitializationFlowId'
                  minItems: 1
                  type: array
              required:
                - flows
        description: The initialization flows to run.
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                default:
                  value:
                    flows:
                      init-ai-prompts:
                        payload:
                          install_status: installed
                          name: security_ai_prompts
                          version: 8.17.1
                        status: ready
                      init-endpoint-protection:
                        payload:
                          install_status: already_installed
                          name: endpoint
                          version: 8.17.1
                        status: ready
                      init-prebuilt-rules:
                        payload:
                          install_status: installed
                          name: security_detection_engine
                          version: 8.17.1
                        status: ready
              schema:
                type: object
                properties:
                  flows:
                    $ref: '#/components/schemas/Security_Solution_Initialization_API_InitializationFlowsResult'
                required:
                  - flows
          description: Indicates a successful call. Returns a result for each requested flow.
      summary: Initialize security solution flows
      tags:
        - Security Solution Initialization API
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/security/entity_store:
    put:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb put">put</span>&nbsp;<span class="operation-path">/s/{space_id}/api/security/entity_store</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Update the Entity Store configuration without reinstalling. Send `logExtraction` to change log extraction settings. Omitting a log extraction field leaves it unchanged. Sending `null` for a log extraction field clears that override and reverts to the default. Send `historySnapshot.frequency` to change the snapshot interval (at least 1 hour) and `historySnapshot.retentionDays` to change how long snapshots are kept. Omitting either history snapshot field leaves it unchanged. At least one of `logExtraction` or `historySnapshot` is required.<br/><br/>[Required authorization] Route required privileges: securitySolution.
      operationId: put-security-entity-store
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
      requestBody:
        content:
          application/json:
            examples:
              clearLogExtractionOverrideExample:
                description: Send null for any field to clear that override and revert it to the default value.
                summary: Clear log extraction overrides
                value:
                  logExtraction:
                    delay: null
                    frequency: null
              updateHistorySnapshotExample:
                description: Update the history snapshot interval and retention. Omit a field to leave it unchanged.
                summary: Update history snapshot settings
                value:
                  historySnapshot:
                    frequency: 12h
                    retentionDays: 90
              updateLogExtractionExample:
                description: Update the log extraction configuration with a new lookback period and frequency.
                summary: Update log extraction settings
                value:
                  logExtraction:
                    fieldHistoryLength: 15
                    frequency: 10m
                    lookbackPeriod: 6h
            schema:
              additionalProperties: false
              type: object
              properties:
                excludedUserNames:
                  items:
                    type: string
                  maxItems: 200
                  type: array
                historySnapshot:
                  additionalProperties: false
                  type: object
                  properties:
                    frequency:
                      maxLength: 32
                      pattern: '[smdh]$'
                      type: string
                    retentionDays:
                      maximum: 3650
                      minimum: 1
                      type: integer
                logExtraction:
                  additionalProperties: false
                  type: object
                  properties:
                    additionalIndexPatterns:
                      items:
                        maxLength: 2048
                        type: string
                      maxItems: 1000
                      nullable: true
                      type: array
                    delay:
                      maxLength: 32
                      nullable: true
                      pattern: '[smdh]$'
                      type: string
                    docsLimit:
                      maximum: 9007199254740991
                      minimum: 1
                      nullable: true
                      type: integer
                    excludedIndexPatterns:
                      items:
                        maxLength: 2048
                        type: string
                      maxItems: 1000
                      nullable: true
                      type: array
                    fieldHistoryLength:
                      maximum: 9007199254740991
                      minimum: -9007199254740991
                      nullable: true
                      type: integer
                    frequency:
                      maxLength: 32
                      nullable: true
                      pattern: '[smdh]$'
                      type: string
                    lookbackPeriod:
                      maxLength: 32
                      nullable: true
                      pattern: '[smdh]$'
                      type: string
                    maxLogsPerPage:
                      maximum: 9007199254740991
                      minimum: 1
                      nullable: true
                      type: integer
                    maxLogsPerWindow:
                      maximum: 9007199254740991
                      minimum: 0
                      nullable: true
                      type: integer
                    maxLogsPerWindowCapBehavior:
                      enum:
                        - defer
                        - drop
                      nullable: true
                      type: string
                    maxTimeWindowSize:
                      maxLength: 32
                      nullable: true
                      pattern: '[smdh]$'
                      type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                updateSuccessExample:
                  description: The Entity Store configuration was successfully updated.
                  summary: Entity Store updated
                  value:
                    ok: true
          description: Indicates a successful response.
        '400':
          content:
            application/json:
              examples:
                invalidDurationExample:
                  description: A log extraction parameter has an invalid duration format.
                  summary: Invalid duration parameter
                  value:
                    error: Bad Request
                    message: '[request body]: logExtraction.frequency: must be a valid duration of at least 30 seconds (e.g. 1m, 30s)'
                    statusCode: 400
                invalidHistorySnapshotFrequencyExample:
                  description: The history snapshot interval must be at least 1 hour.
                  summary: Invalid history snapshot interval
                  value:
                    error: Bad Request
                    message: '[request body]: historySnapshot.frequency: must be a valid duration of at least 1 hour (e.g. 1h, 24h)'
                    statusCode: 400
          description: Bad request.
        '404':
          content:
            application/json:
              examples:
                notFoundExample:
                  description: The Entity Store has not been installed yet.
                  summary: Entity Store not installed
                  value:
                    error: Not Found
                    message: Entity store is not installed
                    statusCode: 404
          description: Entity Store not found.
      summary: Update the Entity Store
      tags:
        - Security entity store
      x-codeSamples:
        - lang: curl
          source: |
            curl -X PUT -H "kbn-xsrf: true" -H "Authorization: ApiKey ${API_KEY}" \
              -H "Content-Type: application/json" \
              -d '{"logExtraction":{"lookbackPeriod":"6h","frequency":"10m","fieldHistoryLength":15}}' \
              "${KIBANA_URL}/api/security/entity_store"
        - lang: Console
          source: |
            PUT kbn://api/security/entity_store
            {
              "logExtraction": {
                "lookbackPeriod": "6h",
                "frequency": "10m",
                "fieldHistoryLength": 15
              }
            }
        - lang: curl
          source: |
            curl -X PUT -H "kbn-xsrf: true" -H "Authorization: ApiKey ${API_KEY}" \
              -H "Content-Type: application/json" \
              -d '{"historySnapshot":{"frequency":"12h","retentionDays":90}}' \
              "${KIBANA_URL}/api/security/entity_store"
        - lang: Console
          source: |
            PUT kbn://api/security/entity_store
            {
              "historySnapshot": {
                "frequency": "12h",
                "retentionDays": 90
              }
            }
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/security/entity_store/entities:
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/security/entity_store/entities</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        List entity records from the Entity Store with paging, sorting, and filtering. Supports two modes: page-based pagination (page/per_page) and cursor-based pagination (searchAfter). The two modes cannot be combined.<br/><br/>[Required authorization] Route required privileges: securitySolution.
      operationId: get-security-entity-store-entities
      parameters:
        - description: A Kibana Query Language (KQL) filter for the search-after mode.
          in: query
          name: filter
          required: false
          schema:
            type: string
        - description: Number of entities to return in search-after mode.
          in: query
          name: size
          required: false
          schema:
            maximum: 9007199254740991
            minimum: 1
            type: integer
        - description: JSON-encoded search_after value for cursor-based pagination.
          in: query
          name: searchAfter
          required: false
          schema:
            type: string
        - description: Fields to include in the response source.
          in: query
          name: source
          required: false
          schema:
            items:
              type: string
            type: array
        - description: Fields to include in the response.
          in: query
          name: fields
          required: false
          schema:
            items:
              type: string
            type: array
        - description: Field to sort results by in page mode.
          in: query
          name: sort_field
          required: false
          schema:
            type: string
        - description: Sort order in page mode.
          in: query
          name: sort_order
          required: false
          schema:
            enum:
              - asc
              - desc
            type: string
        - description: Page number to return (1-indexed) in page mode.
          in: query
          name: page
          required: false
          schema:
            maximum: 9007199254740991
            minimum: 1
            type: integer
        - description: Number of entities per page in page mode.
          in: query
          name: per_page
          required: false
          schema:
            maximum: 10000
            minimum: 1
            type: integer
        - description: An Elasticsearch query string to filter entities in page mode.
          in: query
          name: filterQuery
          required: false
          schema:
            type: string
        - description: Entity types to include in the results.
          in: query
          name: entity_types
          required: false
          schema:
            items:
              enum:
                - user
                - host
                - service
                - generic
              type: string
            type: array
      responses:
        '200':
          content:
            application/json:
              examples:
                emptyResultExample:
                  description: No entities matched the query.
                  summary: Empty result
                  value:
                    page: 1
                    per_page: 10
                    records: []
                    total: 0
                pageModeExample:
                  description: |
                    A paginated list of host entities sorted by timestamp in descending order, including query inspection data.
                  summary: Page mode response with host entities
                  value:
                    inspect:
                      dsl:
                        - '{"index":["entities-latest-default"],"body":{"terms":{"entity.EngineMetadata.Type":["host"]}}}'
                      response:
                        - '{"took":1,"timed_out":false,"hits":{"total":{"value":1,"relation":"eq"}}}'
                    page: 1
                    per_page: 10
                    records:
                      - '@timestamp': '2026-04-10T08:30:00.000Z'
                        asset:
                          criticality: high_impact
                          environment: production
                        entity:
                          attributes:
                            asset: true
                            managed: true
                          id: host:web-server-prod-01
                          lifecycle:
                            first_seen: '2026-01-15T10:00:00.000Z'
                            last_activity: '2026-04-10T08:30:00.000Z'
                          name: web-server-prod-01
                          risk:
                            calculated_level: Moderate
                            calculated_score: 47.5
                            calculated_score_norm: 47.5
                          source:
                            - logs
                          type: host
                        host:
                          hostname:
                            - web-server-prod-01.example.com
                          ip:
                            - 10.0.1.42
                          name: web-server-prod-01
                          os:
                            name: Ubuntu
                            type: linux
                    total: 1
                searchAfterModeExample:
                  description: |
                    A cursor-based response with entities and a search_after token for the next page.
                  summary: Search-after mode response
                  value:
                    entities:
                      - '@timestamp': '2026-04-10T08:30:00.000Z'
                        entity:
                          id: user:jane.doe@example.com
                          name: jane.doe
                          type: user
                        user:
                          email:
                            - jane.doe@example.com
                          name: jane.doe
                    nextSearchAfter:
                      - 1712736600000
                      - 1
          description: Indicates a successful response.
        '400':
          content:
            application/json:
              examples:
                invalidFilterExample:
                  description: The provided Kibana Query Language filter could not be parsed.
                  summary: Invalid filter
                  value:
                    error: Bad Request
                    message: |-
                      Invalid filter: Expected "(", "{", value, whitespace but ":" found.
                      invalid :: query
                      ---------^
                    statusCode: 400
                mixedModesExample:
                  description: Cannot combine page-based pagination with cursor-based pagination in the same request.
                  summary: Mixed pagination modes
                  value:
                    error: Bad Request
                    message: '[request query]: Cannot combine page/per_page with searchAfter'
                    statusCode: 400
          description: Bad request.
      summary: List entities
      tags:
        - Security entity store
      x-codeSamples:
        - lang: curl
          source: |
            curl -X GET -H "Authorization: ApiKey ${API_KEY}" \
              "${KIBANA_URL}/api/security/entity_store/entities?entity_types=host&page=1&per_page=10&sort_field=%40timestamp&sort_order=desc"
        - lang: Console
          source: |
            GET kbn://api/security/entity_store/entities?entity_types=host&page=1&per_page=10&sort_field=@timestamp&sort_order=desc
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/security/entity_store/entities/:
    delete:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb delete">delete</span>&nbsp;<span class="operation-path">/s/{space_id}/api/security/entity_store/entities/</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Delete a single entity record from the Entity Store. The entity is immediately removed from the latest index.<br/><br/>[Required authorization] Route required privileges: securitySolution.
      operationId: delete-security-entity-store-entities
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
      requestBody:
        content:
          application/json:
            examples:
              deleteEntityExample:
                description: Delete a single entity from the Entity Store using its entity identifier.
                summary: Delete an entity by identifier
                value:
                  entityId: host:web-server-prod-01
            schema:
              additionalProperties: false
              type: object
              properties:
                entityId:
                  description: The identifier of the entity to delete.
                  type: string
              required:
                - entityId
      responses:
        '200':
          content:
            application/json:
              examples:
                deleteSuccessExample:
                  description: The entity was found and successfully removed from the latest index.
                  summary: Entity deleted
                  value:
                    deleted: true
          description: Indicates the entity was successfully deleted.
        '404':
          content:
            application/json:
              examples:
                notFoundExample:
                  description: No entity with the specified identifier exists in the Entity Store.
                  summary: Entity not found
                  value:
                    error: Not Found
                    message: Entity ID 'host:web-server-prod-01' not found
                    statusCode: 404
          description: Entity not found.
      summary: Delete an entity
      tags:
        - Security entity store
      x-codeSamples:
        - lang: curl
          source: |
            curl -X DELETE -H "kbn-xsrf: true" -H "Authorization: ApiKey ${API_KEY}" \
              -H "Content-Type: application/json" \
              -d '{"entityId":"host:web-server-prod-01"}' \
              "${KIBANA_URL}/api/security/entity_store/entities/"
        - lang: Console
          source: |
            DELETE kbn://api/security/entity_store/entities/
            {
              "entityId": "host:web-server-prod-01"
            }
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/security/entity_store/entities/{entityType}:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/security/entity_store/entities/{entityType}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Create a new entity record in the Entity Store for the specified entity type.<br/><br/>[Required authorization] Route required privileges: securitySolution.
      operationId: post-security-entity-store-entities-entitytype
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: The entity type to create.
          in: path
          name: entityType
          required: true
          schema:
            enum:
              - user
              - host
              - service
              - generic
            type: string
      requestBody:
        content:
          application/json:
            examples:
              createHostEntityExample:
                description: Create a new host entity record with basic host and entity fields. The entity identifier must match the auto-generated format for the entity type.
                summary: Create a host entity
                value:
                  asset:
                    business_unit: Engineering
                    criticality: high_impact
                    environment: production
                  entity:
                    attributes:
                      asset: true
                      managed: true
                    id: host:web-server-prod-01
                    name: web-server-prod-01
                    source:
                      - manual
                    type: host
                  host:
                    hostname:
                      - web-server-prod-01.example.com
                    ip:
                      - 10.0.1.42
                    name: web-server-prod-01
            schema:
              anyOf:
                - additionalProperties: false
                  type: object
                  properties:
                    '@timestamp':
                      description: The time the entity record was last updated.
                      format: date-time
                      pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
                      type: string
                    asset:
                      additionalProperties: false
                      type: object
                      properties:
                        business_unit:
                          description: Business unit the asset belongs to.
                          type: string
                        criticality:
                          description: The criticality level assigned to this asset.
                          enum:
                            - low_impact
                            - medium_impact
                            - high_impact
                            - extreme_impact
                          nullable: true
                          type: string
                        environment:
                          description: Deployment environment (for example, production, staging).
                          type: string
                        id:
                          description: Unique identifier for the asset.
                          type: string
                        model:
                          description: Model name or number.
                          type: string
                        name:
                          description: Human-readable asset name.
                          type: string
                        owner:
                          description: The owner of the asset.
                          type: string
                        serial_number:
                          description: Serial number of the asset.
                          type: string
                        vendor:
                          description: Vendor or manufacturer.
                          type: string
                    entity:
                      additionalProperties: false
                      type: object
                      properties:
                        attributes:
                          additionalProperties: false
                          description: Boolean flags describing characteristics of the entity.
                          type: object
                          properties:
                            asset:
                              description: Whether the entity is classified as an asset.
                              type: boolean
                            known_redirects:
                              description: Known redirect URIs or URLs (e.g. OAuth application callbacks).
                              items:
                                type: string
                              type: array
                            managed:
                              description: Whether the entity is managed (for example, via a directory service).
                              type: boolean
                            mfa_enabled:
                              description: Whether multi-factor authentication is enabled for the entity.
                              type: boolean
                            oauth_consent_restriction:
                              description: OAuth consent restriction (e.g. admin_only, verified_only, unrestricted).
                              type: string
                            permissions:
                              description: Action-level permissions granted to this entity (not roles or groups).
                              items:
                                type: string
                              type: array
                            storage_class:
                              description: Storage tier or class assigned to a storage resource (e.g. hot, warm, cold, standard, archive).
                              type: string
                            watchlists:
                              description: Watchlist identifiers the entity belongs to (v2).
                              items:
                                type: string
                              type: array
                        behaviors:
                          additionalProperties: false
                          description: Behavioral signals observed for the entity.
                          type: object
                          properties:
                            anomaly_job_ids:
                              description: Machine learning anomaly job identifiers (v2).
                              items:
                                type: string
                              type: array
                            rule_names:
                              description: Detection rule names that flagged this entity (v2).
                              items:
                                type: string
                              type: array
                        created_by:
                          description: Identifies which engine created this entity (for example, logs_extraction or risk_score_maintainer).
                          type: string
                        EngineMetadata:
                          additionalProperties: false
                          type: object
                          properties:
                            Type:
                              description: The engine type that produced this entity record.
                              type: string
                        id:
                          description: Unique identifier for this entity.
                          type: string
                        lifecycle:
                          additionalProperties: false
                          description: Timestamps tracking the entity lifecycle.
                          type: object
                          properties:
                            first_seen:
                              description: When the entity was first observed.
                              format: date-time
                              pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
                              type: string
                            last_activity:
                              description: When the entity last generated activity.
                              format: date-time
                              pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
                              type: string
                            last_seen:
                              description: When the entity was last observed.
                              format: date-time
                              pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
                              type: string
                        name:
                          description: Human-readable name of the entity.
                          type: string
                        relationships:
                          additionalProperties: false
                          description: Connections between this entity and other entities.
                          type: object
                          properties:
                            accesses_frequently:
                              additionalProperties: false
                              description: Entities this entity accesses frequently.
                              type: object
                              properties:
                                ids:
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                  items:
                                    type: string
                                  type: array
                                raw_identifiers:
                                  additionalProperties: false
                                  type: object
                                  properties:
                                    entity.id:
                                      items:
                                        type: string
                                      type: array
                                    host.id:
                                      items:
                                        type: string
                                      type: array
                                    host.name:
                                      items:
                                        type: string
                                      type: array
                                    service.name:
                                      items:
                                        type: string
                                      type: array
                                    user.email:
                                      items:
                                        type: string
                                      type: array
                                    user.id:
                                      items:
                                        type: string
                                      type: array
                                    user.name:
                                      items:
                                        type: string
                                      type: array
                            accesses_infrequently:
                              additionalProperties: false
                              description: Entities this entity accesses infrequently.
                              type: object
                              properties:
                                ids:
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                  items:
                                    type: string
                                  type: array
                                raw_identifiers:
                                  additionalProperties: false
                                  type: object
                                  properties:
                                    entity.id:
                                      items:
                                        type: string
                                      type: array
                                    host.id:
                                      items:
                                        type: string
                                      type: array
                                    host.name:
                                      items:
                                        type: string
                                      type: array
                                    service.name:
                                      items:
                                        type: string
                                      type: array
                                    user.email:
                                      items:
                                        type: string
                                      type: array
                                    user.id:
                                      items:
                                        type: string
                                      type: array
                                    user.name:
                                      items:
                                        type: string
                                      type: array
                            administers:
                              additionalProperties: false
                              description: Entities this entity administers (for example, a user who is an admin of a service).
                              type: object
                              properties:
                                ids:
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                  items:
                                    type: string
                                  type: array
                                raw_identifiers:
                                  additionalProperties: false
                                  type: object
                                  properties:
                                    entity.id:
                                      items:
                                        type: string
                                      type: array
                                    host.id:
                                      items:
                                        type: string
                                      type: array
                                    host.name:
                                      items:
                                        type: string
                                      type: array
                                    service.name:
                                      items:
                                        type: string
                                      type: array
                                    user.email:
                                      items:
                                        type: string
                                      type: array
                                    user.id:
                                      items:
                                        type: string
                                      type: array
                                    user.name:
                                      items:
                                        type: string
                                      type: array
                            communicates_with:
                              additionalProperties: false
                              description: Entities this entity communicates with.
                              type: object
                              properties:
                                ids:
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                  items:
                                    type: string
                                  type: array
                                raw_identifiers:
                                  additionalProperties: false
                                  type: object
                                  properties:
                                    entity.id:
                                      items:
                                        type: string
                                      type: array
                                    host.id:
                                      items:
                                        type: string
                                      type: array
                                    host.name:
                                      items:
                                        type: string
                                      type: array
                                    service.name:
                                      items:
                                        type: string
                                      type: array
                                    user.email:
                                      items:
                                        type: string
                                      type: array
                                    user.id:
                                      items:
                                        type: string
                                      type: array
                                    user.name:
                                      items:
                                        type: string
                                      type: array
                            depends_on:
                              additionalProperties: false
                              description: Entities this entity depends on.
                              type: object
                              properties:
                                ids:
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                  items:
                                    type: string
                                  type: array
                                raw_identifiers:
                                  additionalProperties: false
                                  type: object
                                  properties:
                                    entity.id:
                                      items:
                                        type: string
                                      type: array
                                    host.id:
                                      items:
                                        type: string
                                      type: array
                                    host.name:
                                      items:
                                        type: string
                                      type: array
                                    service.name:
                                      items:
                                        type: string
                                      type: array
                                    user.email:
                                      items:
                                        type: string
                                      type: array
                                    user.id:
                                      items:
                                        type: string
                                      type: array
                                    user.name:
                                      items:
                                        type: string
                                      type: array
                            owns:
                              additionalProperties: false
                              description: Entities owned by this entity.
                              type: object
                              properties:
                                ids:
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                  items:
                                    type: string
                                  type: array
                                raw_identifiers:
                                  additionalProperties: false
                                  type: object
                                  properties:
                                    entity.id:
                                      items:
                                        type: string
                                      type: array
                                    host.id:
                                      items:
                                        type: string
                                      type: array
                                    host.name:
                                      items:
                                        type: string
                                      type: array
                                    service.name:
                                      items:
                                        type: string
                                      type: array
                                    user.email:
                                      items:
                                        type: string
                                      type: array
                                    user.id:
                                      items:
                                        type: string
                                      type: array
                                    user.name:
                                      items:
                                        type: string
                                      type: array
                            owns_inferred:
                              additionalProperties: false
                              description: Entities inferred to be owned by this entity.
                              type: object
                              properties:
                                ids:
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                  items:
                                    type: string
                                  type: array
                                raw_identifiers:
                                  additionalProperties: false
                                  type: object
                                  properties:
                                    entity.id:
                                      items:
                                        type: string
                                      type: array
                                    host.id:
                                      items:
                                        type: string
                                      type: array
                                    host.name:
                                      items:
                                        type: string
                                      type: array
                                    service.name:
                                      items:
                                        type: string
                                      type: array
                                    user.email:
                                      items:
                                        type: string
                                      type: array
                                    user.id:
                                      items:
                                        type: string
                                      type: array
                                    user.name:
                                      items:
                                        type: string
                                      type: array
                            resolution:
                              additionalProperties: false
                              description: Resolution metadata linking this entity to another.
                              type: object
                              properties:
                                resolved_to:
                                  description: entity.id of the entity this one resolves to
                                  type: string
                                risk:
                                  additionalProperties: false
                                  description: Aggregated risk score for the resolution group.
                                  type: object
                                  properties:
                                    calculated_level:
                                      description: Lexical description of the resolution group's aggregated risk.
                                      enum:
                                        - Unknown
                                        - Low
                                        - Moderate
                                        - High
                                        - Critical
                                      type: string
                                    calculated_score:
                                      description: The raw numeric value of the resolution group's aggregated risk score.
                                      type: number
                                    calculated_score_norm:
                                      description: The normalized numeric value of the resolution group's aggregated risk score.
                                      maximum: 100
                                      minimum: 0
                                      type: number
                            supervises:
                              additionalProperties: false
                              description: Entities supervised by this entity.
                              type: object
                              properties:
                                ids:
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                  items:
                                    type: string
                                  type: array
                                raw_identifiers:
                                  additionalProperties: false
                                  type: object
                                  properties:
                                    entity.id:
                                      items:
                                        type: string
                                      type: array
                                    host.id:
                                      items:
                                        type: string
                                      type: array
                                    host.name:
                                      items:
                                        type: string
                                      type: array
                                    service.name:
                                      items:
                                        type: string
                                      type: array
                                    user.email:
                                      items:
                                        type: string
                                      type: array
                                    user.id:
                                      items:
                                        type: string
                                      type: array
                                    user.name:
                                      items:
                                        type: string
                                      type: array
                        risk:
                          additionalProperties: false
                          description: Risk scoring information for the entity.
                          type: object
                          properties:
                            calculated_level:
                              description: Lexical description of the entity's risk.
                              enum:
                                - Unknown
                                - Low
                                - Moderate
                                - High
                                - Critical
                              type: string
                            calculated_score:
                              description: The raw numeric value of the given entity's risk score.
                              type: number
                            calculated_score_norm:
                              description: The normalized numeric value of the given entity's risk score. Useful for comparing with other entities.
                              maximum: 100
                              minimum: 0
                              type: number
                        schema_version:
                          description: Schema version of the entity record.
                          type: string
                        source:
                          description: Sources that produced this entity record.
                          items:
                            type: string
                          type: array
                        sub_type:
                          description: Optional sub-type classification for the entity.
                          type: string
                        type:
                          description: The entity type.
                          type: string
                        url:
                          description: URL associated with the entity.
                          type: string
                    event:
                      additionalProperties: false
                      type: object
                      properties:
                        ingested:
                          description: When the event was ingested into Elasticsearch.
                          format: date-time
                          pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
                          type: string
                    labels:
                      additionalProperties: {}
                      description: Custom key-value labels attached to the entity.
                      type: object
                      properties: {}
                    tags:
                      description: Tags attached to the entity.
                      items:
                        type: string
                      type: array
                    user:
                      additionalProperties: false
                      description: Elastic Common Schema (ECS) user fields collected on the entity.
                      type: object
                      properties:
                        domain:
                          description: Observed user domains.
                          items:
                            type: string
                          type: array
                        email:
                          description: Observed email addresses.
                          items:
                            type: string
                          type: array
                        full_name:
                          description: Observed full names of the user.
                          items:
                            type: string
                          type: array
                        hash:
                          description: Observed user hashes.
                          items:
                            type: string
                          type: array
                        id:
                          description: Observed user identifiers.
                          items:
                            type: string
                          type: array
                        name:
                          description: Primary user name.
                          type: string
                        risk:
                          additionalProperties: false
                          type: object
                          properties:
                            calculated_level:
                              description: Lexical description of the entity's risk.
                              enum:
                                - Unknown
                                - Low
                                - Moderate
                                - High
                                - Critical
                              type: string
                            calculated_score:
                              description: The raw numeric value of the given entity's risk score.
                              type: number
                            calculated_score_norm:
                              description: The normalized numeric value of the given entity's risk score.
                              maximum: 100
                              minimum: 0
                              type: number
                        roles:
                          description: Observed roles assigned to the user.
                          items:
                            type: string
                          type: array
                - additionalProperties: false
                  type: object
                  properties:
                    '@timestamp':
                      description: The time the entity record was last updated.
                      format: date-time
                      pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
                      type: string
                    asset:
                      additionalProperties: false
                      type: object
                      properties:
                        business_unit:
                          description: Business unit the asset belongs to.
                          type: string
                        criticality:
                          description: The criticality level assigned to this asset.
                          enum:
                            - low_impact
                            - medium_impact
                            - high_impact
                            - extreme_impact
                          nullable: true
                          type: string
                        environment:
                          description: Deployment environment (for example, production, staging).
                          type: string
                        id:
                          description: Unique identifier for the asset.
                          type: string
                        model:
                          description: Model name or number.
                          type: string
                        name:
                          description: Human-readable asset name.
                          type: string
                        owner:
                          description: The owner of the asset.
                          type: string
                        serial_number:
                          description: Serial number of the asset.
                          type: string
                        vendor:
                          description: Vendor or manufacturer.
                          type: string
                    entity:
                      additionalProperties: false
                      type: object
                      properties:
                        attributes:
                          additionalProperties: false
                          description: Boolean flags describing characteristics of the entity.
                          type: object
                          properties:
                            asset:
                              description: Whether the entity is classified as an asset.
                              type: boolean
                            known_redirects:
                              description: Known redirect URIs or URLs (e.g. OAuth application callbacks).
                              items:
                                type: string
                              type: array
                            managed:
                              description: Whether the entity is managed (for example, via a directory service).
                              type: boolean
                            mfa_enabled:
                              description: Whether multi-factor authentication is enabled for the entity.
                              type: boolean
                            oauth_consent_restriction:
                              description: OAuth consent restriction (e.g. admin_only, verified_only, unrestricted).
                              type: string
                            permissions:
                              description: Action-level permissions granted to this entity (not roles or groups).
                              items:
                                type: string
                              type: array
                            storage_class:
                              description: Storage tier or class assigned to a storage resource (e.g. hot, warm, cold, standard, archive).
                              type: string
                            watchlists:
                              description: Watchlist identifiers the entity belongs to (v2).
                              items:
                                type: string
                              type: array
                        behaviors:
                          additionalProperties: false
                          description: Behavioral signals observed for the entity.
                          type: object
                          properties:
                            anomaly_job_ids:
                              description: Machine learning anomaly job identifiers (v2).
                              items:
                                type: string
                              type: array
                            rule_names:
                              description: Detection rule names that flagged this entity (v2).
                              items:
                                type: string
                              type: array
                        created_by:
                          description: Identifies which engine created this entity (for example, logs_extraction or risk_score_maintainer).
                          type: string
                        EngineMetadata:
                          additionalProperties: false
                          type: object
                          properties:
                            Type:
                              description: The engine type that produced this entity record.
                              type: string
                        id:
                          description: Unique identifier for this entity.
                          type: string
                        lifecycle:
                          additionalProperties: false
                          description: Timestamps tracking the entity lifecycle.
                          type: object
                          properties:
                            first_seen:
                              description: When the entity was first observed.
                              format: date-time
                              pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
                              type: string
                            last_activity:
                              description: When the entity last generated activity.
                              format: date-time
                              pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
                              type: string
                            last_seen:
                              description: When the entity was last observed.
                              format: date-time
                              pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
                              type: string
                        name:
                          description: Human-readable name of the entity.
                          type: string
                        relationships:
                          additionalProperties: false
                          description: Connections between this entity and other entities.
                          type: object
                          properties:
                            accesses_frequently:
                              additionalProperties: false
                              description: Entities this entity accesses frequently.
                              type: object
                              properties:
                                ids:
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                  items:
                                    type: string
                                  type: array
                                raw_identifiers:
                                  additionalProperties: false
                                  type: object
                                  properties:
                                    entity.id:
                                      items:
                                        type: string
                                      type: array
                                    host.id:
                                      items:
                                        type: string
                                      type: array
                                    host.name:
                                      items:
                                        type: string
                                      type: array
                                    service.name:
                                      items:
                                        type: string
                                      type: array
                                    user.email:
                                      items:
                                        type: string
                                      type: array
                                    user.id:
                                      items:
                                        type: string
                                      type: array
                                    user.name:
                                      items:
                                        type: string
                                      type: array
                            accesses_infrequently:
                              additionalProperties: false
                              description: Entities this entity accesses infrequently.
                              type: object
                              properties:
                                ids:
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                  items:
                                    type: string
                                  type: array
                                raw_identifiers:
                                  additionalProperties: false
                                  type: object
                                  properties:
                                    entity.id:
                                      items:
                                        type: string
                                      type: array
                                    host.id:
                                      items:
                                        type: string
                                      type: array
                                    host.name:
                                      items:
                                        type: string
                                      type: array
                                    service.name:
                                      items:
                                        type: string
                                      type: array
                                    user.email:
                                      items:
                                        type: string
                                      type: array
                                    user.id:
                                      items:
                                        type: string
                                      type: array
                                    user.name:
                                      items:
                                        type: string
                                      type: array
                            administers:
                              additionalProperties: false
                              description: Entities this entity administers (for example, a user who is an admin of a service).
                              type: object
                              properties:
                                ids:
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                  items:
                                    type: string
                                  type: array
                                raw_identifiers:
                                  additionalProperties: false
                                  type: object
                                  properties:
                                    entity.id:
                                      items:
                                        type: string
                                      type: array
                                    host.id:
                                      items:
                                        type: string
                                      type: array
                                    host.name:
                                      items:
                                        type: string
                                      type: array
                                    service.name:
                                      items:
                                        type: string
                                      type: array
                                    user.email:
                                      items:
                                        type: string
                                      type: array
                                    user.id:
                                      items:
                                        type: string
                                      type: array
                                    user.name:
                                      items:
                                        type: string
                                      type: array
                            communicates_with:
                              additionalProperties: false
                              description: Entities this entity communicates with.
                              type: object
                              properties:
                                ids:
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                  items:
                                    type: string
                                  type: array
                                raw_identifiers:
                                  additionalProperties: false
                                  type: object
                                  properties:
                                    entity.id:
                                      items:
                                        type: string
                                      type: array
                                    host.id:
                                      items:
                                        type: string
                                      type: array
                                    host.name:
                                      items:
                                        type: string
                                      type: array
                                    service.name:
                                      items:
                                        type: string
                                      type: array
                                    user.email:
                                      items:
                                        type: string
                                      type: array
                                    user.id:
                                      items:
                                        type: string
                                      type: array
                                    user.name:
                                      items:
                                        type: string
                                      type: array
                            depends_on:
                              additionalProperties: false
                              description: Entities this entity depends on.
                              type: object
                              properties:
                                ids:
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                  items:
                                    type: string
                                  type: array
                                raw_identifiers:
                                  additionalProperties: false
                                  type: object
                                  properties:
                                    entity.id:
                                      items:
                                        type: string
                                      type: array
                                    host.id:
                                      items:
                                        type: string
                                      type: array
                                    host.name:
                                      items:
                                        type: string
                                      type: array
                                    service.name:
                                      items:
                                        type: string
                                      type: array
                                    user.email:
                                      items:
                                        type: string
                                      type: array
                                    user.id:
                                      items:
                                        type: string
                                      type: array
                                    user.name:
                                      items:
                                        type: string
                                      type: array
                            owns:
                              additionalProperties: false
                              description: Entities owned by this entity.
                              type: object
                              properties:
                                ids:
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                  items:
                                    type: string
                                  type: array
                                raw_identifiers:
                                  additionalProperties: false
                                  type: object
                                  properties:
                                    entity.id:
                                      items:
                                        type: string
                                      type: array
                                    host.id:
                                      items:
                                        type: string
                                      type: array
                                    host.name:
                                      items:
                                        type: string
                                      type: array
                                    service.name:
                                      items:
                                        type: string
                                      type: array
                                    user.email:
                                      items:
                                        type: string
                                      type: array
                                    user.id:
                                      items:
                                        type: string
                                      type: array
                                    user.name:
                                      items:
                                        type: string
                                      type: array
                            owns_inferred:
                              additionalProperties: false
                              description: Entities inferred to be owned by this entity.
                              type: object
                              properties:
                                ids:
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                  items:
                                    type: string
                                  type: array
                                raw_identifiers:
                                  additionalProperties: false
                                  type: object
                                  properties:
                                    entity.id:
                                      items:
                                        type: string
                                      type: array
                                    host.id:
                                      items:
                                        type: string
                                      type: array
                                    host.name:
                                      items:
                                        type: string
                                      type: array
                                    service.name:
                                      items:
                                        type: string
                                      type: array
                                    user.email:
                                      items:
                                        type: string
                                      type: array
                                    user.id:
                                      items:
                                        type: string
                                      type: array
                                    user.name:
                                      items:
                                        type: string
                                      type: array
                            resolution:
                              additionalProperties: false
                              description: Resolution metadata linking this entity to another.
                              type: object
                              properties:
                                resolved_to:
                                  description: entity.id of the entity this one resolves to
                                  type: string
                                risk:
                                  additionalProperties: false
                                  description: Aggregated risk score for the resolution group.
                                  type: object
                                  properties:
                                    calculated_level:
                                      description: Lexical description of the resolution group's aggregated risk.
                                      enum:
                                        - Unknown
                                        - Low
                                        - Moderate
                                        - High
                                        - Critical
                                      type: string
                                    calculated_score:
                                      description: The raw numeric value of the resolution group's aggregated risk score.
                                      type: number
                                    calculated_score_norm:
                                      description: The normalized numeric value of the resolution group's aggregated risk score.
                                      maximum: 100
                                      minimum: 0
                                      type: number
                            supervises:
                              additionalProperties: false
                              description: Entities supervised by this entity.
                              type: object
                              properties:
                                ids:
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                  items:
                                    type: string
                                  type: array
                                raw_identifiers:
                                  additionalProperties: false
                                  type: object
                                  properties:
                                    entity.id:
                                      items:
                                        type: string
                                      type: array
                                    host.id:
                                      items:
                                        type: string
                                      type: array
                                    host.name:
                                      items:
                                        type: string
                                      type: array
                                    service.name:
                                      items:
                                        type: string
                                      type: array
                                    user.email:
                                      items:
                                        type: string
                                      type: array
                                    user.id:
                                      items:
                                        type: string
                                      type: array
                                    user.name:
                                      items:
                                        type: string
                                      type: array
                        risk:
                          additionalProperties: false
                          description: Risk scoring information for the entity.
                          type: object
                          properties:
                            calculated_level:
                              description: Lexical description of the entity's risk.
                              enum:
                                - Unknown
                                - Low
                                - Moderate
                                - High
                                - Critical
                              type: string
                            calculated_score:
                              description: The raw numeric value of the given entity's risk score.
                              type: number
                            calculated_score_norm:
                              description: The normalized numeric value of the given entity's risk score. Useful for comparing with other entities.
                              maximum: 100
                              minimum: 0
                              type: number
                        schema_version:
                          description: Schema version of the entity record.
                          type: string
                        source:
                          description: Sources that produced this entity record.
                          items:
                            type: string
                          type: array
                        sub_type:
                          description: Optional sub-type classification for the entity.
                          type: string
                        type:
                          description: The entity type.
                          type: string
                        url:
                          description: URL associated with the entity.
                          type: string
                    event:
                      additionalProperties: false
                      type: object
                      properties:
                        ingested:
                          description: When the event was ingested into Elasticsearch.
                          format: date-time
                          pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
                          type: string
                    host:
                      additionalProperties: false
                      description: Elastic Common Schema (ECS) host fields collected on the entity.
                      type: object
                      properties:
                        architecture:
                          description: Observed CPU architectures.
                          items:
                            type: string
                          type: array
                        domain:
                          description: Observed host domains.
                          items:
                            type: string
                          type: array
                        hostname:
                          description: Observed hostnames.
                          items:
                            type: string
                          type: array
                        id:
                          description: Observed host identifiers.
                          items:
                            type: string
                          type: array
                        ip:
                          description: Observed IP addresses.
                          items:
                            type: string
                          type: array
                        mac:
                          description: Observed MAC addresses.
                          items:
                            type: string
                          type: array
                        name:
                          description: Primary host name.
                          type: string
                        os:
                          additionalProperties: false
                          description: Elastic Common Schema (ECS) host.os fields collected on the entity latest index (v2).
                          type: object
                          properties:
                            family:
                              type: string
                            full:
                              type: string
                            kernel:
                              type: string
                            name:
                              anyOf:
                                - type: string
                                - items:
                                    type: string
                                  type: array
                            platform:
                              type: string
                            type:
                              anyOf:
                                - type: string
                                - items:
                                    type: string
                                  type: array
                            version:
                              type: string
                        risk:
                          additionalProperties: false
                          type: object
                          properties:
                            calculated_level:
                              description: Lexical description of the entity's risk.
                              enum:
                                - Unknown
                                - Low
                                - Moderate
                                - High
                                - Critical
                              type: string
                            calculated_score:
                              description: The raw numeric value of the given entity's risk score.
                              type: number
                            calculated_score_norm:
                              description: The normalized numeric value of the given entity's risk score.
                              maximum: 100
                              minimum: 0
                              type: number
                        type:
                          description: Observed host types.
                          items:
                            type: string
                          type: array
                    labels:
                      additionalProperties: {}
                      description: Custom key-value labels attached to the entity.
                      type: object
                      properties: {}
                    tags:
                      description: Tags attached to the entity.
                      items:
                        type: string
                      type: array
                - additionalProperties: false
                  type: object
                  properties:
                    '@timestamp':
                      description: The time the entity record was last updated.
                      format: date-time
                      pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
                      type: string
                    asset:
                      additionalProperties: false
                      type: object
                      properties:
                        business_unit:
                          description: Business unit the asset belongs to.
                          type: string
                        criticality:
                          description: The criticality level assigned to this asset.
                          enum:
                            - low_impact
                            - medium_impact
                            - high_impact
                            - extreme_impact
                          nullable: true
                          type: string
                        environment:
                          description: Deployment environment (for example, production, staging).
                          type: string
                        id:
                          description: Unique identifier for the asset.
                          type: string
                        model:
                          description: Model name or number.
                          type: string
                        name:
                          description: Human-readable asset name.
                          type: string
                        owner:
                          description: The owner of the asset.
                          type: string
                        serial_number:
                          description: Serial number of the asset.
                          type: string
                        vendor:
                          description: Vendor or manufacturer.
                          type: string
                    entity:
                      additionalProperties: false
                      type: object
                      properties:
                        attributes:
                          additionalProperties: false
                          description: Boolean flags describing characteristics of the entity.
                          type: object
                          properties:
                            asset:
                              description: Whether the entity is classified as an asset.
                              type: boolean
                            known_redirects:
                              description: Known redirect URIs or URLs (e.g. OAuth application callbacks).
                              items:
                                type: string
                              type: array
                            managed:
                              description: Whether the entity is managed (for example, via a directory service).
                              type: boolean
                            mfa_enabled:
                              description: Whether multi-factor authentication is enabled for the entity.
                              type: boolean
                            oauth_consent_restriction:
                              description: OAuth consent restriction (e.g. admin_only, verified_only, unrestricted).
                              type: string
                            permissions:
                              description: Action-level permissions granted to this entity (not roles or groups).
                              items:
                                type: string
                              type: array
                            storage_class:
                              description: Storage tier or class assigned to a storage resource (e.g. hot, warm, cold, standard, archive).
                              type: string
                            watchlists:
                              description: Watchlist identifiers the entity belongs to (v2).
                              items:
                                type: string
                              type: array
                        behaviors:
                          additionalProperties: false
                          description: Behavioral signals observed for the entity.
                          type: object
                          properties:
                            anomaly_job_ids:
                              description: Machine learning anomaly job identifiers (v2).
                              items:
                                type: string
                              type: array
                            rule_names:
                              description: Detection rule names that flagged this entity (v2).
                              items:
                                type: string
                              type: array
                        created_by:
                          description: Identifies which engine created this entity (for example, logs_extraction or risk_score_maintainer).
                          type: string
                        EngineMetadata:
                          additionalProperties: false
                          type: object
                          properties:
                            Type:
                              description: The engine type that produced this entity record.
                              type: string
                        id:
                          description: Unique identifier for this entity.
                          type: string
                        lifecycle:
                          additionalProperties: false
                          description: Timestamps tracking the entity lifecycle.
                          type: object
                          properties:
                            first_seen:
                              description: When the entity was first observed.
                              format: date-time
                              pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
                              type: string
                            last_activity:
                              description: When the entity last generated activity.
                              format: date-time
                              pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
                              type: string
                            last_seen:
                              description: When the entity was last observed.
                              format: date-time
                              pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
                              type: string
                        name:
                          description: Human-readable name of the entity.
                          type: string
                        relationships:
                          additionalProperties: false
                          description: Connections between this entity and other entities.
                          type: object
                          properties:
                            accesses_frequently:
                              additionalProperties: false
                              description: Entities this entity accesses frequently.
                              type: object
                              properties:
                                ids:
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                  items:
                                    type: string
                                  type: array
                                raw_identifiers:
                                  additionalProperties: false
                                  type: object
                                  properties:
                                    entity.id:
                                      items:
                                        type: string
                                      type: array
                                    host.id:
                                      items:
                                        type: string
                                      type: array
                                    host.name:
                                      items:
                                        type: string
                                      type: array
                                    service.name:
                                      items:
                                        type: string
                                      type: array
                                    user.email:
                                      items:
                                        type: string
                                      type: array
                                    user.id:
                                      items:
                                        type: string
                                      type: array
                                    user.name:
                                      items:
                                        type: string
                                      type: array
                            accesses_infrequently:
                              additionalProperties: false
                              description: Entities this entity accesses infrequently.
                              type: object
                              properties:
                                ids:
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                  items:
                                    type: string
                                  type: array
                                raw_identifiers:
                                  additionalProperties: false
                                  type: object
                                  properties:
                                    entity.id:
                                      items:
                                        type: string
                                      type: array
                                    host.id:
                                      items:
                                        type: string
                                      type: array
                                    host.name:
                                      items:
                                        type: string
                                      type: array
                                    service.name:
                                      items:
                                        type: string
                                      type: array
                                    user.email:
                                      items:
                                        type: string
                                      type: array
                                    user.id:
                                      items:
                                        type: string
                                      type: array
                                    user.name:
                                      items:
                                        type: string
                                      type: array
                            administers:
                              additionalProperties: false
                              description: Entities this entity administers (for example, a user who is an admin of a service).
                              type: object
                              properties:
                                ids:
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                  items:
                                    type: string
                                  type: array
                                raw_identifiers:
                                  additionalProperties: false
                                  type: object
                                  properties:
                                    entity.id:
                                      items:
                                        type: string
                                      type: array
                                    host.id:
                                      items:
                                        type: string
                                      type: array
                                    host.name:
                                      items:
                                        type: string
                                      type: array
                                    service.name:
                                      items:
                                        type: string
                                      type: array
                                    user.email:
                                      items:
                                        type: string
                                      type: array
                                    user.id:
                                      items:
                                        type: string
                                      type: array
                                    user.name:
                                      items:
                                        type: string
                                      type: array
                            communicates_with:
                              additionalProperties: false
                              description: Entities this entity communicates with.
                              type: object
                              properties:
                                ids:
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                  items:
                                    type: string
                                  type: array
                                raw_identifiers:
                                  additionalProperties: false
                                  type: object
                                  properties:
                                    entity.id:
                                      items:
                                        type: string
                                      type: array
                                    host.id:
                                      items:
                                        type: string
                                      type: array
                                    host.name:
                                      items:
                                        type: string
                                      type: array
                                    service.name:
                                      items:
                                        type: string
                                      type: array
                                    user.email:
                                      items:
                                        type: string
                                      type: array
                                    user.id:
                                      items:
                                        type: string
                                      type: array
                                    user.name:
                                      items:
                                        type: string
                                      type: array
                            depends_on:
                              additionalProperties: false
                              description: Entities this entity depends on.
                              type: object
                              properties:
                                ids:
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                  items:
                                    type: string
                                  type: array
                                raw_identifiers:
                                  additionalProperties: false
                                  type: object
                                  properties:
                                    entity.id:
                                      items:
                                        type: string
                                      type: array
                                    host.id:
                                      items:
                                        type: string
                                      type: array
                                    host.name:
                                      items:
                                        type: string
                                      type: array
                                    service.name:
                                      items:
                                        type: string
                                      type: array
                                    user.email:
                                      items:
                                        type: string
                                      type: array
                                    user.id:
                                      items:
                                        type: string
                                      type: array
                                    user.name:
                                      items:
                                        type: string
                                      type: array
                            owns:
                              additionalProperties: false
                              description: Entities owned by this entity.
                              type: object
                              properties:
                                ids:
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                  items:
                                    type: string
                                  type: array
                                raw_identifiers:
                                  additionalProperties: false
                                  type: object
                                  properties:
                                    entity.id:
                                      items:
                                        type: string
                                      type: array
                                    host.id:
                                      items:
                                        type: string
                                      type: array
                                    host.name:
                                      items:
                                        type: string
                                      type: array
                                    service.name:
                                      items:
                                        type: string
                                      type: array
                                    user.email:
                                      items:
                                        type: string
                                      type: array
                                    user.id:
                                      items:
                                        type: string
                                      type: array
                                    user.name:
                                      items:
                                        type: string
                                      type: array
                            owns_inferred:
                              additionalProperties: false
                              description: Entities inferred to be owned by this entity.
                              type: object
                              properties:
                                ids:
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                  items:
                                    type: string
                                  type: array
                                raw_identifiers:
                                  additionalProperties: false
                                  type: object
                                  properties:
                                    entity.id:
                                      items:
                                        type: string
                                      type: array
                                    host.id:
                                      items:
                                        type: string
                                      type: array
                                    host.name:
                                      items:
                                        type: string
                                      type: array
                                    service.name:
                                      items:
                                        type: string
                                      type: array
                                    user.email:
                                      items:
                                        type: string
                                      type: array
                                    user.id:
                                      items:
                                        type: string
                                      type: array
                                    user.name:
                                      items:
                                        type: string
                                      type: array
                            resolution:
                              additionalProperties: false
                              description: Resolution metadata linking this entity to another.
                              type: object
                              properties:
                                resolved_to:
                                  description: entity.id of the entity this one resolves to
                                  type: string
                                risk:
                                  additionalProperties: false
                                  description: Aggregated risk score for the resolution group.
                                  type: object
                                  properties:
                                    calculated_level:
                                      description: Lexical description of the resolution group's aggregated risk.
                                      enum:
                                        - Unknown
                                        - Low
                                        - Moderate
                                        - High
                                        - Critical
                                      type: string
                                    calculated_score:
                                      description: The raw numeric value of the resolution group's aggregated risk score.
                                      type: number
                                    calculated_score_norm:
                                      description: The normalized numeric value of the resolution group's aggregated risk score.
                                      maximum: 100
                                      minimum: 0
                                      type: number
                            supervises:
                              additionalProperties: false
                              description: Entities supervised by this entity.
                              type: object
                              properties:
                                ids:
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                  items:
                                    type: string
                                  type: array
                                raw_identifiers:
                                  additionalProperties: false
                                  type: object
                                  properties:
                                    entity.id:
                                      items:
                                        type: string
                                      type: array
                                    host.id:
                                      items:
                                        type: string
                                      type: array
                                    host.name:
                                      items:
                                        type: string
                                      type: array
                                    service.name:
                                      items:
                                        type: string
                                      type: array
                                    user.email:
                                      items:
                                        type: string
                                      type: array
                                    user.id:
                                      items:
                                        type: string
                                      type: array
                                    user.name:
                                      items:
                                        type: string
                                      type: array
                        risk:
                          additionalProperties: false
                          description: Risk scoring information for the entity.
                          type: object
                          properties:
                            calculated_level:
                              description: Lexical description of the entity's risk.
                              enum:
                                - Unknown
                                - Low
                                - Moderate
                                - High
                                - Critical
                              type: string
                            calculated_score:
                              description: The raw numeric value of the given entity's risk score.
                              type: number
                            calculated_score_norm:
                              description: The normalized numeric value of the given entity's risk score. Useful for comparing with other entities.
                              maximum: 100
                              minimum: 0
                              type: number
                        schema_version:
                          description: Schema version of the entity record.
                          type: string
                        source:
                          description: Sources that produced this entity record.
                          items:
                            type: string
                          type: array
                        sub_type:
                          description: Optional sub-type classification for the entity.
                          type: string
                        type:
                          description: The entity type.
                          type: string
                        url:
                          description: URL associated with the entity.
                          type: string
                    event:
                      additionalProperties: false
                      type: object
                      properties:
                        ingested:
                          description: When the event was ingested into Elasticsearch.
                          format: date-time
                          pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
                          type: string
                    labels:
                      additionalProperties: {}
                      description: Custom key-value labels attached to the entity.
                      type: object
                      properties: {}
                    service:
                      additionalProperties: false
                      description: Elastic Common Schema (ECS) service fields collected on the entity.
                      type: object
                      properties:
                        address:
                          description: Service address.
                          type: string
                        environment:
                          description: Service environment (for example, production, staging).
                          type: string
                        ephemeral_id:
                          description: Ephemeral identifier of the service.
                          type: string
                        id:
                          description: Unique identifier of the service.
                          type: string
                        name:
                          description: Primary service name.
                          type: string
                        node:
                          additionalProperties: false
                          description: Node information for the service.
                          type: object
                          properties:
                            name:
                              description: Node name.
                              type: string
                            role:
                              description: Node role.
                              type: string
                            roles:
                              description: Node roles.
                              items:
                                type: string
                              type: array
                        risk:
                          additionalProperties: false
                          type: object
                          properties:
                            calculated_level:
                              description: Lexical description of the entity's risk.
                              enum:
                                - Unknown
                                - Low
                                - Moderate
                                - High
                                - Critical
                              type: string
                            calculated_score:
                              description: The raw numeric value of the given entity's risk score.
                              type: number
                            calculated_score_norm:
                              description: The normalized numeric value of the given entity's risk score.
                              maximum: 100
                              minimum: 0
                              type: number
                        state:
                          description: Current state of the service.
                          type: string
                        type:
                          description: Service type.
                          type: string
                        version:
                          description: Service version.
                          type: string
                    tags:
                      description: Tags attached to the entity.
                      items:
                        type: string
                      type: array
                - additionalProperties: false
                  type: object
                  properties:
                    '@timestamp':
                      description: The time the entity record was last updated.
                      format: date-time
                      pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
                      type: string
                    asset:
                      additionalProperties: false
                      type: object
                      properties:
                        business_unit:
                          description: Business unit the asset belongs to.
                          type: string
                        criticality:
                          description: The criticality level assigned to this asset.
                          enum:
                            - low_impact
                            - medium_impact
                            - high_impact
                            - extreme_impact
                          nullable: true
                          type: string
                        environment:
                          description: Deployment environment (for example, production, staging).
                          type: string
                        id:
                          description: Unique identifier for the asset.
                          type: string
                        model:
                          description: Model name or number.
                          type: string
                        name:
                          description: Human-readable asset name.
                          type: string
                        owner:
                          description: The owner of the asset.
                          type: string
                        serial_number:
                          description: Serial number of the asset.
                          type: string
                        vendor:
                          description: Vendor or manufacturer.
                          type: string
                    cloud:
                      additionalProperties: false
                      description: Elastic Common Schema (ECS) cloud fields for cloud-hosted entities.
                      type: object
                      properties:
                        account:
                          additionalProperties: false
                          type: object
                          properties:
                            id:
                              type: string
                            name:
                              type: string
                        availability_zone:
                          type: string
                        instance:
                          additionalProperties: false
                          type: object
                          properties:
                            id:
                              type: string
                            name:
                              type: string
                        machine:
                          additionalProperties: false
                          type: object
                          properties:
                            type:
                              type: string
                        project:
                          additionalProperties: false
                          type: object
                          properties:
                            id:
                              type: string
                            name:
                              type: string
                        provider:
                          type: string
                        region:
                          type: string
                        service:
                          additionalProperties: false
                          type: object
                          properties:
                            name:
                              type: string
                    entity:
                      additionalProperties: false
                      type: object
                      properties:
                        attributes:
                          additionalProperties: false
                          description: Boolean flags describing characteristics of the entity.
                          type: object
                          properties:
                            asset:
                              description: Whether the entity is classified as an asset.
                              type: boolean
                            known_redirects:
                              description: Known redirect URIs or URLs (e.g. OAuth application callbacks).
                              items:
                                type: string
                              type: array
                            managed:
                              description: Whether the entity is managed (for example, via a directory service).
                              type: boolean
                            mfa_enabled:
                              description: Whether multi-factor authentication is enabled for the entity.
                              type: boolean
                            oauth_consent_restriction:
                              description: OAuth consent restriction (e.g. admin_only, verified_only, unrestricted).
                              type: string
                            permissions:
                              description: Action-level permissions granted to this entity (not roles or groups).
                              items:
                                type: string
                              type: array
                            storage_class:
                              description: Storage tier or class assigned to a storage resource (e.g. hot, warm, cold, standard, archive).
                              type: string
                            watchlists:
                              description: Watchlist identifiers the entity belongs to (v2).
                              items:
                                type: string
                              type: array
                        behaviors:
                          additionalProperties: false
                          description: Behavioral signals observed for the entity.
                          type: object
                          properties:
                            anomaly_job_ids:
                              description: Machine learning anomaly job identifiers (v2).
                              items:
                                type: string
                              type: array
                            rule_names:
                              description: Detection rule names that flagged this entity (v2).
                              items:
                                type: string
                              type: array
                        created_by:
                          description: Identifies which engine created this entity (for example, logs_extraction or risk_score_maintainer).
                          type: string
                        EngineMetadata:
                          additionalProperties: false
                          type: object
                          properties:
                            Type:
                              description: The engine type that produced this entity record.
                              type: string
                        id:
                          description: Unique identifier for this entity.
                          type: string
                        lifecycle:
                          additionalProperties: false
                          description: Timestamps tracking the entity lifecycle.
                          type: object
                          properties:
                            first_seen:
                              description: When the entity was first observed.
                              format: date-time
                              pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
                              type: string
                            last_activity:
                              description: When the entity last generated activity.
                              format: date-time
                              pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
                              type: string
                            last_seen:
                              description: When the entity was last observed.
                              format: date-time
                              pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
                              type: string
                        name:
                          description: Human-readable name of the entity.
                          type: string
                        relationships:
                          additionalProperties: false
                          description: Connections between this entity and other entities.
                          type: object
                          properties:
                            accesses_frequently:
                              additionalProperties: false
                              description: Entities this entity accesses frequently.
                              type: object
                              properties:
                                ids:
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                  items:
                                    type: string
                                  type: array
                                raw_identifiers:
                                  additionalProperties: false
                                  type: object
                                  properties:
                                    entity.id:
                                      items:
                                        type: string
                                      type: array
                                    host.id:
                                      items:
                                        type: string
                                      type: array
                                    host.name:
                                      items:
                                        type: string
                                      type: array
                                    service.name:
                                      items:
                                        type: string
                                      type: array
                                    user.email:
                                      items:
                                        type: string
                                      type: array
                                    user.id:
                                      items:
                                        type: string
                                      type: array
                                    user.name:
                                      items:
                                        type: string
                                      type: array
                            accesses_infrequently:
                              additionalProperties: false
                              description: Entities this entity accesses infrequently.
                              type: object
                              properties:
                                ids:
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                  items:
                                    type: string
                                  type: array
                                raw_identifiers:
                                  additionalProperties: false
                                  type: object
                                  properties:
                                    entity.id:
                                      items:
                                        type: string
                                      type: array
                                    host.id:
                                      items:
                                        type: string
                                      type: array
                                    host.name:
                                      items:
                                        type: string
                                      type: array
                                    service.name:
                                      items:
                                        type: string
                                      type: array
                                    user.email:
                                      items:
                                        type: string
                                      type: array
                                    user.id:
                                      items:
                                        type: string
                                      type: array
                                    user.name:
                                      items:
                                        type: string
                                      type: array
                            administers:
                              additionalProperties: false
                              description: Entities this entity administers (for example, a user who is an admin of a service).
                              type: object
                              properties:
                                ids:
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                  items:
                                    type: string
                                  type: array
                                raw_identifiers:
                                  additionalProperties: false
                                  type: object
                                  properties:
                                    entity.id:
                                      items:
                                        type: string
                                      type: array
                                    host.id:
                                      items:
                                        type: string
                                      type: array
                                    host.name:
                                      items:
                                        type: string
                                      type: array
                                    service.name:
                                      items:
                                        type: string
                                      type: array
                                    user.email:
                                      items:
                                        type: string
                                      type: array
                                    user.id:
                                      items:
                                        type: string
                                      type: array
                                    user.name:
                                      items:
                                        type: string
                                      type: array
                            communicates_with:
                              additionalProperties: false
                              description: Entities this entity communicates with.
                              type: object
                              properties:
                                ids:
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                  items:
                                    type: string
                                  type: array
                                raw_identifiers:
                                  additionalProperties: false
                                  type: object
                                  properties:
                                    entity.id:
                                      items:
                                        type: string
                                      type: array
                                    host.id:
                                      items:
                                        type: string
                                      type: array
                                    host.name:
                                      items:
                                        type: string
                                      type: array
                                    service.name:
                                      items:
                                        type: string
                                      type: array
                                    user.email:
                                      items:
                                        type: string
                                      type: array
                                    user.id:
                                      items:
                                        type: string
                                      type: array
                                    user.name:
                                      items:
                                        type: string
                                      type: array
                            depends_on:
                              additionalProperties: false
                              description: Entities this entity depends on.
                              type: object
                              properties:
                                ids:
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                  items:
                                    type: string
                                  type: array
                                raw_identifiers:
                                  additionalProperties: false
                                  type: object
                                  properties:
                                    entity.id:
                                      items:
                                        type: string
                                      type: array
                                    host.id:
                                      items:
                                        type: string
                                      type: array
                                    host.name:
                                      items:
                                        type: string
                                      type: array
                                    service.name:
                                      items:
                                        type: string
                                      type: array
                                    user.email:
                                      items:
                                        type: string
                                      type: array
                                    user.id:
                                      items:
                                        type: string
                                      type: array
                                    user.name:
                                      items:
                                        type: string
                                      type: array
                            owns:
                              additionalProperties: false
                              description: Entities owned by this entity.
                              type: object
                              properties:
                                ids:
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                  items:
                                    type: string
                                  type: array
                                raw_identifiers:
                                  additionalProperties: false
                                  type: object
                                  properties:
                                    entity.id:
                                      items:
                                        type: string
                                      type: array
                                    host.id:
                                      items:
                                        type: string
                                      type: array
                                    host.name:
                                      items:
                                        type: string
                                      type: array
                                    service.name:
                                      items:
                                        type: string
                                      type: array
                                    user.email:
                                      items:
                                        type: string
                                      type: array
                                    user.id:
                                      items:
                                        type: string
                                      type: array
                                    user.name:
                                      items:
                                        type: string
                                      type: array
                            owns_inferred:
                              additionalProperties: false
                              description: Entities inferred to be owned by this entity.
                              type: object
                              properties:
                                ids:
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                  items:
                                    type: string
                                  type: array
                                raw_identifiers:
                                  additionalProperties: false
                                  type: object
                                  properties:
                                    entity.id:
                                      items:
                                        type: string
                                      type: array
                                    host.id:
                                      items:
                                        type: string
                                      type: array
                                    host.name:
                                      items:
                                        type: string
                                      type: array
                                    service.name:
                                      items:
                                        type: string
                                      type: array
                                    user.email:
                                      items:
                                        type: string
                                      type: array
                                    user.id:
                                      items:
                                        type: string
                                      type: array
                                    user.name:
                                      items:
                                        type: string
                                      type: array
                            resolution:
                              additionalProperties: false
                              description: Resolution metadata linking this entity to another.
                              type: object
                              properties:
                                resolved_to:
                                  description: entity.id of the entity this one resolves to
                                  type: string
                                risk:
                                  additionalProperties: false
                                  description: Aggregated risk score for the resolution group.
                                  type: object
                                  properties:
                                    calculated_level:
                                      description: Lexical description of the resolution group's aggregated risk.
                                      enum:
                                        - Unknown
                                        - Low
                                        - Moderate
                                        - High
                                        - Critical
                                      type: string
                                    calculated_score:
                                      description: The raw numeric value of the resolution group's aggregated risk score.
                                      type: number
                                    calculated_score_norm:
                                      description: The normalized numeric value of the resolution group's aggregated risk score.
                                      maximum: 100
                                      minimum: 0
                                      type: number
                            supervises:
                              additionalProperties: false
                              description: Entities supervised by this entity.
                              type: object
                              properties:
                                ids:
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                  items:
                                    type: string
                                  type: array
                                raw_identifiers:
                                  additionalProperties: false
                                  type: object
                                  properties:
                                    entity.id:
                                      items:
                                        type: string
                                      type: array
                                    host.id:
                                      items:
                                        type: string
                                      type: array
                                    host.name:
                                      items:
                                        type: string
                                      type: array
                                    service.name:
                                      items:
                                        type: string
                                      type: array
                                    user.email:
                                      items:
                                        type: string
                                      type: array
                                    user.id:
                                      items:
                                        type: string
                                      type: array
                                    user.name:
                                      items:
                                        type: string
                                      type: array
                        risk:
                          additionalProperties: false
                          description: Risk scoring information for the entity.
                          type: object
                          properties:
                            calculated_level:
                              description: Lexical description of the entity's risk.
                              enum:
                                - Unknown
                                - Low
                                - Moderate
                                - High
                                - Critical
                              type: string
                            calculated_score:
                              description: The raw numeric value of the given entity's risk score.
                              type: number
                            calculated_score_norm:
                              description: The normalized numeric value of the given entity's risk score. Useful for comparing with other entities.
                              maximum: 100
                              minimum: 0
                              type: number
                        schema_version:
                          description: Schema version of the entity record.
                          type: string
                        source:
                          description: Sources that produced this entity record.
                          items:
                            type: string
                          type: array
                        sub_type:
                          description: Optional sub-type classification for the entity.
                          type: string
                        type:
                          description: The entity type.
                          type: string
                        url:
                          description: URL associated with the entity.
                          type: string
                    event:
                      additionalProperties: false
                      type: object
                      properties:
                        ingested:
                          format: date-time
                          pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
                          type: string
                    labels:
                      additionalProperties: {}
                      type: object
                      properties: {}
                    orchestrator:
                      additionalProperties: false
                      description: Elastic Common Schema (ECS) orchestrator fields for container-orchestrated entities.
                      type: object
                      properties:
                        api_version:
                          type: string
                        cluster:
                          additionalProperties: false
                          type: object
                          properties:
                            id:
                              type: string
                            name:
                              type: string
                            url:
                              type: string
                            version:
                              type: string
                        namespace:
                          type: string
                        organization:
                          type: string
                        resource:
                          additionalProperties: false
                          type: object
                          properties:
                            annotation:
                              type: string
                            id:
                              type: string
                            ip:
                              type: string
                            label:
                              type: string
                            name:
                              type: string
                            parent:
                              additionalProperties: false
                              type: object
                              properties:
                                type:
                                  type: string
                            type:
                              type: string
                        type:
                          type: string
                    tags:
                      items:
                        type: string
                      type: array
      responses:
        '200':
          content:
            application/json:
              examples:
                createSuccessExample:
                  description: The entity record was successfully created in the Entity Store.
                  summary: Entity created
                  value:
                    ok: true
          description: Indicates the entity was successfully created.
        '400':
          content:
            application/json:
              examples:
                euidMismatchExample:
                  description: The supplied entity identifier does not match the auto-generated identifier derived from the entity fields.
                  summary: Entity identifier mismatch
                  value:
                    error: Bad Request
                    message: 'Bad request: Supplied ID my-custom-id does not match generated EUID host:web-server-prod-01'
                    statusCode: 400
          description: Bad request.
        '409':
          content:
            application/json:
              examples:
                conflictExample:
                  description: An entity with the specified identifier already exists.
                  summary: Entity already exists
                  value:
                    error: Conflict
                    message: Entity ID 'host:web-server-prod-01' already exists
                    statusCode: 409
          description: Conflict.
      summary: Create an entity
      tags:
        - Security entity store
      x-codeSamples:
        - lang: curl
          source: |
            curl -X POST -H "kbn-xsrf: true" -H "Authorization: ApiKey ${API_KEY}" \
              -H "Content-Type: application/json" \
              -d '{"entity":{"id":"host:web-server-prod-01","name":"web-server-prod-01","type":"host","source":["manual"],"attributes":{"asset":true}},"host":{"name":"web-server-prod-01","ip":["10.0.1.42"]}}' \
              "${KIBANA_URL}/api/security/entity_store/entities/host"
        - lang: Console
          source: |
            POST kbn://api/security/entity_store/entities/host
            {
              "entity": {
                "id": "host:web-server-prod-01",
                "name": "web-server-prod-01",
                "type": "host",
                "source": ["manual"],
                "attributes": { "asset": true }
              },
              "host": {
                "name": "web-server-prod-01",
                "ip": ["10.0.1.42"]
              }
            }
      x-metaTags:
        - content: Kibana
          name: product_name
    put:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb put">put</span>&nbsp;<span class="operation-path">/s/{space_id}/api/security/entity_store/entities/{entityType}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Update an existing entity record in the Entity Store. By default only certain fields can be updated. Set the `force` query parameter to `true` to update protected fields.<br/><br/>[Required authorization] Route required privileges: securitySolution.
      operationId: put-security-entity-store-entities-entitytype
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: The entity type to update.
          in: path
          name: entityType
          required: true
          schema:
            enum:
              - user
              - host
              - service
              - generic
            type: string
        - description: When true, allows updating protected fields.
          in: query
          name: force
          required: false
          schema:
            anyOf:
              - enum:
                  - 'true'
                  - 'false'
                type: string
              - type: boolean
            default: false
      requestBody:
        content:
          application/json:
            examples:
              updateEntityAttributesExample:
                description: Update the attributes of an existing user entity. Fields like entity.name and entity.type are protected and require the force query parameter.
                summary: Update entity attributes
                value:
                  entity:
                    attributes:
                      managed: true
                      mfa_enabled: true
                    id: user:jane.doe@example.com
                    lifecycle:
                      last_activity: '2026-04-10T14:30:00.000Z'
                    name: jane.doe
                    type: user
                  user:
                    email:
                      - jane.doe@example.com
                    name: jane.doe
                    roles:
                      - admin
                      - analyst
            schema:
              anyOf:
                - additionalProperties: false
                  type: object
                  properties:
                    '@timestamp':
                      description: The time the entity record was last updated.
                      format: date-time
                      pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
                      type: string
                    asset:
                      additionalProperties: false
                      type: object
                      properties:
                        business_unit:
                          description: Business unit the asset belongs to.
                          type: string
                        criticality:
                          description: The criticality level assigned to this asset.
                          enum:
                            - low_impact
                            - medium_impact
                            - high_impact
                            - extreme_impact
                          nullable: true
                          type: string
                        environment:
                          description: Deployment environment (for example, production, staging).
                          type: string
                        id:
                          description: Unique identifier for the asset.
                          type: string
                        model:
                          description: Model name or number.
                          type: string
                        name:
                          description: Human-readable asset name.
                          type: string
                        owner:
                          description: The owner of the asset.
                          type: string
                        serial_number:
                          description: Serial number of the asset.
                          type: string
                        vendor:
                          description: Vendor or manufacturer.
                          type: string
                    entity:
                      additionalProperties: false
                      type: object
                      properties:
                        attributes:
                          additionalProperties: false
                          description: Boolean flags describing characteristics of the entity.
                          type: object
                          properties:
                            asset:
                              description: Whether the entity is classified as an asset.
                              type: boolean
                            known_redirects:
                              description: Known redirect URIs or URLs (e.g. OAuth application callbacks).
                              items:
                                type: string
                              type: array
                            managed:
                              description: Whether the entity is managed (for example, via a directory service).
                              type: boolean
                            mfa_enabled:
                              description: Whether multi-factor authentication is enabled for the entity.
                              type: boolean
                            oauth_consent_restriction:
                              description: OAuth consent restriction (e.g. admin_only, verified_only, unrestricted).
                              type: string
                            permissions:
                              description: Action-level permissions granted to this entity (not roles or groups).
                              items:
                                type: string
                              type: array
                            storage_class:
                              description: Storage tier or class assigned to a storage resource (e.g. hot, warm, cold, standard, archive).
                              type: string
                            watchlists:
                              description: Watchlist identifiers the entity belongs to (v2).
                              items:
                                type: string
                              type: array
                        behaviors:
                          additionalProperties: false
                          description: Behavioral signals observed for the entity.
                          type: object
                          properties:
                            anomaly_job_ids:
                              description: Machine learning anomaly job identifiers (v2).
                              items:
                                type: string
                              type: array
                            rule_names:
                              description: Detection rule names that flagged this entity (v2).
                              items:
                                type: string
                              type: array
                        created_by:
                          description: Identifies which engine created this entity (for example, logs_extraction or risk_score_maintainer).
                          type: string
                        EngineMetadata:
                          additionalProperties: false
                          type: object
                          properties:
                            Type:
                              description: The engine type that produced this entity record.
                              type: string
                        id:
                          description: Unique identifier for this entity.
                          type: string
                        lifecycle:
                          additionalProperties: false
                          description: Timestamps tracking the entity lifecycle.
                          type: object
                          properties:
                            first_seen:
                              description: When the entity was first observed.
                              format: date-time
                              pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
                              type: string
                            last_activity:
                              description: When the entity last generated activity.
                              format: date-time
                              pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
                              type: string
                            last_seen:
                              description: When the entity was last observed.
                              format: date-time
                              pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
                              type: string
                        name:
                          description: Human-readable name of the entity.
                          type: string
                        relationships:
                          additionalProperties: false
                          description: Connections between this entity and other entities.
                          type: object
                          properties:
                            accesses_frequently:
                              additionalProperties: false
                              description: Entities this entity accesses frequently.
                              type: object
                              properties:
                                ids:
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                  items:
                                    type: string
                                  type: array
                                raw_identifiers:
                                  additionalProperties: false
                                  type: object
                                  properties:
                                    entity.id:
                                      items:
                                        type: string
                                      type: array
                                    host.id:
                                      items:
                                        type: string
                                      type: array
                                    host.name:
                                      items:
                                        type: string
                                      type: array
                                    service.name:
                                      items:
                                        type: string
                                      type: array
                                    user.email:
                                      items:
                                        type: string
                                      type: array
                                    user.id:
                                      items:
                                        type: string
                                      type: array
                                    user.name:
                                      items:
                                        type: string
                                      type: array
                            accesses_infrequently:
                              additionalProperties: false
                              description: Entities this entity accesses infrequently.
                              type: object
                              properties:
                                ids:
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                  items:
                                    type: string
                                  type: array
                                raw_identifiers:
                                  additionalProperties: false
                                  type: object
                                  properties:
                                    entity.id:
                                      items:
                                        type: string
                                      type: array
                                    host.id:
                                      items:
                                        type: string
                                      type: array
                                    host.name:
                                      items:
                                        type: string
                                      type: array
                                    service.name:
                                      items:
                                        type: string
                                      type: array
                                    user.email:
                                      items:
                                        type: string
                                      type: array
                                    user.id:
                                      items:
                                        type: string
                                      type: array
                                    user.name:
                                      items:
                                        type: string
                                      type: array
                            administers:
                              additionalProperties: false
                              description: Entities this entity administers (for example, a user who is an admin of a service).
                              type: object
                              properties:
                                ids:
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                  items:
                                    type: string
                                  type: array
                                raw_identifiers:
                                  additionalProperties: false
                                  type: object
                                  properties:
                                    entity.id:
                                      items:
                                        type: string
                                      type: array
                                    host.id:
                                      items:
                                        type: string
                                      type: array
                                    host.name:
                                      items:
                                        type: string
                                      type: array
                                    service.name:
                                      items:
                                        type: string
                                      type: array
                                    user.email:
                                      items:
                                        type: string
                                      type: array
                                    user.id:
                                      items:
                                        type: string
                                      type: array
                                    user.name:
                                      items:
                                        type: string
                                      type: array
                            communicates_with:
                              additionalProperties: false
                              description: Entities this entity communicates with.
                              type: object
                              properties:
                                ids:
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                  items:
                                    type: string
                                  type: array
                                raw_identifiers:
                                  additionalProperties: false
                                  type: object
                                  properties:
                                    entity.id:
                                      items:
                                        type: string
                                      type: array
                                    host.id:
                                      items:
                                        type: string
                                      type: array
                                    host.name:
                                      items:
                                        type: string
                                      type: array
                                    service.name:
                                      items:
                                        type: string
                                      type: array
                                    user.email:
                                      items:
                                        type: string
                                      type: array
                                    user.id:
                                      items:
                                        type: string
                                      type: array
                                    user.name:
                                      items:
                                        type: string
                                      type: array
                            depends_on:
                              additionalProperties: false
                              description: Entities this entity depends on.
                              type: object
                              properties:
                                ids:
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                  items:
                                    type: string
                                  type: array
                                raw_identifiers:
                                  additionalProperties: false
                                  type: object
                                  properties:
                                    entity.id:
                                      items:
                                        type: string
                                      type: array
                                    host.id:
                                      items:
                                        type: string
                                      type: array
                                    host.name:
                                      items:
                                        type: string
                                      type: array
                                    service.name:
                                      items:
                                        type: string
                                      type: array
                                    user.email:
                                      items:
                                        type: string
                                      type: array
                                    user.id:
                                      items:
                                        type: string
                                      type: array
                                    user.name:
                                      items:
                                        type: string
                                      type: array
                            owns:
                              additionalProperties: false
                              description: Entities owned by this entity.
                              type: object
                              properties:
                                ids:
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                  items:
                                    type: string
                                  type: array
                                raw_identifiers:
                                  additionalProperties: false
                                  type: object
                                  properties:
                                    entity.id:
                                      items:
                                        type: string
                                      type: array
                                    host.id:
                                      items:
                                        type: string
                                      type: array
                                    host.name:
                                      items:
                                        type: string
                                      type: array
                                    service.name:
                                      items:
                                        type: string
                                      type: array
                                    user.email:
                                      items:
                                        type: string
                                      type: array
                                    user.id:
                                      items:
                                        type: string
                                      type: array
                                    user.name:
                                      items:
                                        type: string
                                      type: array
                            owns_inferred:
                              additionalProperties: false
                              description: Entities inferred to be owned by this entity.
                              type: object
                              properties:
                                ids:
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                  items:
                                    type: string
                                  type: array
                                raw_identifiers:
                                  additionalProperties: false
                                  type: object
                                  properties:
                                    entity.id:
                                      items:
                                        type: string
                                      type: array
                                    host.id:
                                      items:
                                        type: string
                                      type: array
                                    host.name:
                                      items:
                                        type: string
                                      type: array
                                    service.name:
                                      items:
                                        type: string
                                      type: array
                                    user.email:
                                      items:
                                        type: string
                                      type: array
                                    user.id:
                                      items:
                                        type: string
                                      type: array
                                    user.name:
                                      items:
                                        type: string
                                      type: array
                            resolution:
                              additionalProperties: false
                              description: Resolution metadata linking this entity to another.
                              type: object
                              properties:
                                resolved_to:
                                  description: entity.id of the entity this one resolves to
                                  type: string
                                risk:
                                  additionalProperties: false
                                  description: Aggregated risk score for the resolution group.
                                  type: object
                                  properties:
                                    calculated_level:
                                      description: Lexical description of the resolution group's aggregated risk.
                                      enum:
                                        - Unknown
                                        - Low
                                        - Moderate
                                        - High
                                        - Critical
                                      type: string
                                    calculated_score:
                                      description: The raw numeric value of the resolution group's aggregated risk score.
                                      type: number
                                    calculated_score_norm:
                                      description: The normalized numeric value of the resolution group's aggregated risk score.
                                      maximum: 100
                                      minimum: 0
                                      type: number
                            supervises:
                              additionalProperties: false
                              description: Entities supervised by this entity.
                              type: object
                              properties:
                                ids:
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                  items:
                                    type: string
                                  type: array
                                raw_identifiers:
                                  additionalProperties: false
                                  type: object
                                  properties:
                                    entity.id:
                                      items:
                                        type: string
                                      type: array
                                    host.id:
                                      items:
                                        type: string
                                      type: array
                                    host.name:
                                      items:
                                        type: string
                                      type: array
                                    service.name:
                                      items:
                                        type: string
                                      type: array
                                    user.email:
                                      items:
                                        type: string
                                      type: array
                                    user.id:
                                      items:
                                        type: string
                                      type: array
                                    user.name:
                                      items:
                                        type: string
                                      type: array
                        risk:
                          additionalProperties: false
                          description: Risk scoring information for the entity.
                          type: object
                          properties:
                            calculated_level:
                              description: Lexical description of the entity's risk.
                              enum:
                                - Unknown
                                - Low
                                - Moderate
                                - High
                                - Critical
                              type: string
                            calculated_score:
                              description: The raw numeric value of the given entity's risk score.
                              type: number
                            calculated_score_norm:
                              description: The normalized numeric value of the given entity's risk score. Useful for comparing with other entities.
                              maximum: 100
                              minimum: 0
                              type: number
                        schema_version:
                          description: Schema version of the entity record.
                          type: string
                        source:
                          description: Sources that produced this entity record.
                          items:
                            type: string
                          type: array
                        sub_type:
                          description: Optional sub-type classification for the entity.
                          type: string
                        type:
                          description: The entity type.
                          type: string
                        url:
                          description: URL associated with the entity.
                          type: string
                    event:
                      additionalProperties: false
                      type: object
                      properties:
                        ingested:
                          description: When the event was ingested into Elasticsearch.
                          format: date-time
                          pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
                          type: string
                    labels:
                      additionalProperties: {}
                      description: Custom key-value labels attached to the entity.
                      type: object
                      properties: {}
                    tags:
                      description: Tags attached to the entity.
                      items:
                        type: string
                      type: array
                    user:
                      additionalProperties: false
                      description: Elastic Common Schema (ECS) user fields collected on the entity.
                      type: object
                      properties:
                        domain:
                          description: Observed user domains.
                          items:
                            type: string
                          type: array
                        email:
                          description: Observed email addresses.
                          items:
                            type: string
                          type: array
                        full_name:
                          description: Observed full names of the user.
                          items:
                            type: string
                          type: array
                        hash:
                          description: Observed user hashes.
                          items:
                            type: string
                          type: array
                        id:
                          description: Observed user identifiers.
                          items:
                            type: string
                          type: array
                        name:
                          description: Primary user name.
                          type: string
                        risk:
                          additionalProperties: false
                          type: object
                          properties:
                            calculated_level:
                              description: Lexical description of the entity's risk.
                              enum:
                                - Unknown
                                - Low
                                - Moderate
                                - High
                                - Critical
                              type: string
                            calculated_score:
                              description: The raw numeric value of the given entity's risk score.
                              type: number
                            calculated_score_norm:
                              description: The normalized numeric value of the given entity's risk score.
                              maximum: 100
                              minimum: 0
                              type: number
                        roles:
                          description: Observed roles assigned to the user.
                          items:
                            type: string
                          type: array
                - additionalProperties: false
                  type: object
                  properties:
                    '@timestamp':
                      description: The time the entity record was last updated.
                      format: date-time
                      pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
                      type: string
                    asset:
                      additionalProperties: false
                      type: object
                      properties:
                        business_unit:
                          description: Business unit the asset belongs to.
                          type: string
                        criticality:
                          description: The criticality level assigned to this asset.
                          enum:
                            - low_impact
                            - medium_impact
                            - high_impact
                            - extreme_impact
                          nullable: true
                          type: string
                        environment:
                          description: Deployment environment (for example, production, staging).
                          type: string
                        id:
                          description: Unique identifier for the asset.
                          type: string
                        model:
                          description: Model name or number.
                          type: string
                        name:
                          description: Human-readable asset name.
                          type: string
                        owner:
                          description: The owner of the asset.
                          type: string
                        serial_number:
                          description: Serial number of the asset.
                          type: string
                        vendor:
                          description: Vendor or manufacturer.
                          type: string
                    entity:
                      additionalProperties: false
                      type: object
                      properties:
                        attributes:
                          additionalProperties: false
                          description: Boolean flags describing characteristics of the entity.
                          type: object
                          properties:
                            asset:
                              description: Whether the entity is classified as an asset.
                              type: boolean
                            known_redirects:
                              description: Known redirect URIs or URLs (e.g. OAuth application callbacks).
                              items:
                                type: string
                              type: array
                            managed:
                              description: Whether the entity is managed (for example, via a directory service).
                              type: boolean
                            mfa_enabled:
                              description: Whether multi-factor authentication is enabled for the entity.
                              type: boolean
                            oauth_consent_restriction:
                              description: OAuth consent restriction (e.g. admin_only, verified_only, unrestricted).
                              type: string
                            permissions:
                              description: Action-level permissions granted to this entity (not roles or groups).
                              items:
                                type: string
                              type: array
                            storage_class:
                              description: Storage tier or class assigned to a storage resource (e.g. hot, warm, cold, standard, archive).
                              type: string
                            watchlists:
                              description: Watchlist identifiers the entity belongs to (v2).
                              items:
                                type: string
                              type: array
                        behaviors:
                          additionalProperties: false
                          description: Behavioral signals observed for the entity.
                          type: object
                          properties:
                            anomaly_job_ids:
                              description: Machine learning anomaly job identifiers (v2).
                              items:
                                type: string
                              type: array
                            rule_names:
                              description: Detection rule names that flagged this entity (v2).
                              items:
                                type: string
                              type: array
                        created_by:
                          description: Identifies which engine created this entity (for example, logs_extraction or risk_score_maintainer).
                          type: string
                        EngineMetadata:
                          additionalProperties: false
                          type: object
                          properties:
                            Type:
                              description: The engine type that produced this entity record.
                              type: string
                        id:
                          description: Unique identifier for this entity.
                          type: string
                        lifecycle:
                          additionalProperties: false
                          description: Timestamps tracking the entity lifecycle.
                          type: object
                          properties:
                            first_seen:
                              description: When the entity was first observed.
                              format: date-time
                              pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
                              type: string
                            last_activity:
                              description: When the entity last generated activity.
                              format: date-time
                              pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
                              type: string
                            last_seen:
                              description: When the entity was last observed.
                              format: date-time
                              pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
                              type: string
                        name:
                          description: Human-readable name of the entity.
                          type: string
                        relationships:
                          additionalProperties: false
                          description: Connections between this entity and other entities.
                          type: object
                          properties:
                            accesses_frequently:
                              additionalProperties: false
                              description: Entities this entity accesses frequently.
                              type: object
                              properties:
                                ids:
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                  items:
                                    type: string
                                  type: array
                                raw_identifiers:
                                  additionalProperties: false
                                  type: object
                                  properties:
                                    entity.id:
                                      items:
                                        type: string
                                      type: array
                                    host.id:
                                      items:
                                        type: string
                                      type: array
                                    host.name:
                                      items:
                                        type: string
                                      type: array
                                    service.name:
                                      items:
                                        type: string
                                      type: array
                                    user.email:
                                      items:
                                        type: string
                                      type: array
                                    user.id:
                                      items:
                                        type: string
                                      type: array
                                    user.name:
                                      items:
                                        type: string
                                      type: array
                            accesses_infrequently:
                              additionalProperties: false
                              description: Entities this entity accesses infrequently.
                              type: object
                              properties:
                                ids:
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                  items:
                                    type: string
                                  type: array
                                raw_identifiers:
                                  additionalProperties: false
                                  type: object
                                  properties:
                                    entity.id:
                                      items:
                                        type: string
                                      type: array
                                    host.id:
                                      items:
                                        type: string
                                      type: array
                                    host.name:
                                      items:
                                        type: string
                                      type: array
                                    service.name:
                                      items:
                                        type: string
                                      type: array
                                    user.email:
                                      items:
                                        type: string
                                      type: array
                                    user.id:
                                      items:
                                        type: string
                                      type: array
                                    user.name:
                                      items:
                                        type: string
                                      type: array
                            administers:
                              additionalProperties: false
                              description: Entities this entity administers (for example, a user who is an admin of a service).
                              type: object
                              properties:
                                ids:
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                  items:
                                    type: string
                                  type: array
                                raw_identifiers:
                                  additionalProperties: false
                                  type: object
                                  properties:
                                    entity.id:
                                      items:
                                        type: string
                                      type: array
                                    host.id:
                                      items:
                                        type: string
                                      type: array
                                    host.name:
                                      items:
                                        type: string
                                      type: array
                                    service.name:
                                      items:
                                        type: string
                                      type: array
                                    user.email:
                                      items:
                                        type: string
                                      type: array
                                    user.id:
                                      items:
                                        type: string
                                      type: array
                                    user.name:
                                      items:
                                        type: string
                                      type: array
                            communicates_with:
                              additionalProperties: false
                              description: Entities this entity communicates with.
                              type: object
                              properties:
                                ids:
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                  items:
                                    type: string
                                  type: array
                                raw_identifiers:
                                  additionalProperties: false
                                  type: object
                                  properties:
                                    entity.id:
                                      items:
                                        type: string
                                      type: array
                                    host.id:
                                      items:
                                        type: string
                                      type: array
                                    host.name:
                                      items:
                                        type: string
                                      type: array
                                    service.name:
                                      items:
                                        type: string
                                      type: array
                                    user.email:
                                      items:
                                        type: string
                                      type: array
                                    user.id:
                                      items:
                                        type: string
                                      type: array
                                    user.name:
                                      items:
                                        type: string
                                      type: array
                            depends_on:
                              additionalProperties: false
                              description: Entities this entity depends on.
                              type: object
                              properties:
                                ids:
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                  items:
                                    type: string
                                  type: array
                                raw_identifiers:
                                  additionalProperties: false
                                  type: object
                                  properties:
                                    entity.id:
                                      items:
                                        type: string
                                      type: array
                                    host.id:
                                      items:
                                        type: string
                                      type: array
                                    host.name:
                                      items:
                                        type: string
                                      type: array
                                    service.name:
                                      items:
                                        type: string
                                      type: array
                                    user.email:
                                      items:
                                        type: string
                                      type: array
                                    user.id:
                                      items:
                                        type: string
                                      type: array
                                    user.name:
                                      items:
                                        type: string
                                      type: array
                            owns:
                              additionalProperties: false
                              description: Entities owned by this entity.
                              type: object
                              properties:
                                ids:
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                  items:
                                    type: string
                                  type: array
                                raw_identifiers:
                                  additionalProperties: false
                                  type: object
                                  properties:
                                    entity.id:
                                      items:
                                        type: string
                                      type: array
                                    host.id:
                                      items:
                                        type: string
                                      type: array
                                    host.name:
                                      items:
                                        type: string
                                      type: array
                                    service.name:
                                      items:
                                        type: string
                                      type: array
                                    user.email:
                                      items:
                                        type: string
                                      type: array
                                    user.id:
                                      items:
                                        type: string
                                      type: array
                                    user.name:
                                      items:
                                        type: string
                                      type: array
                            owns_inferred:
                              additionalProperties: false
                              description: Entities inferred to be owned by this entity.
                              type: object
                              properties:
                                ids:
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                  items:
                                    type: string
                                  type: array
                                raw_identifiers:
                                  additionalProperties: false
                                  type: object
                                  properties:
                                    entity.id:
                                      items:
                                        type: string
                                      type: array
                                    host.id:
                                      items:
                                        type: string
                                      type: array
                                    host.name:
                                      items:
                                        type: string
                                      type: array
                                    service.name:
                                      items:
                                        type: string
                                      type: array
                                    user.email:
                                      items:
                                        type: string
                                      type: array
                                    user.id:
                                      items:
                                        type: string
                                      type: array
                                    user.name:
                                      items:
                                        type: string
                                      type: array
                            resolution:
                              additionalProperties: false
                              description: Resolution metadata linking this entity to another.
                              type: object
                              properties:
                                resolved_to:
                                  description: entity.id of the entity this one resolves to
                                  type: string
                                risk:
                                  additionalProperties: false
                                  description: Aggregated risk score for the resolution group.
                                  type: object
                                  properties:
                                    calculated_level:
                                      description: Lexical description of the resolution group's aggregated risk.
                                      enum:
                                        - Unknown
                                        - Low
                                        - Moderate
                                        - High
                                        - Critical
                                      type: string
                                    calculated_score:
                                      description: The raw numeric value of the resolution group's aggregated risk score.
                                      type: number
                                    calculated_score_norm:
                                      description: The normalized numeric value of the resolution group's aggregated risk score.
                                      maximum: 100
                                      minimum: 0
                                      type: number
                            supervises:
                              additionalProperties: false
                              description: Entities supervised by this entity.
                              type: object
                              properties:
                                ids:
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                  items:
                                    type: string
                                  type: array
                                raw_identifiers:
                                  additionalProperties: false
                                  type: object
                                  properties:
                                    entity.id:
                                      items:
                                        type: string
                                      type: array
                                    host.id:
                                      items:
                                        type: string
                                      type: array
                                    host.name:
                                      items:
                                        type: string
                                      type: array
                                    service.name:
                                      items:
                                        type: string
                                      type: array
                                    user.email:
                                      items:
                                        type: string
                                      type: array
                                    user.id:
                                      items:
                                        type: string
                                      type: array
                                    user.name:
                                      items:
                                        type: string
                                      type: array
                        risk:
                          additionalProperties: false
                          description: Risk scoring information for the entity.
                          type: object
                          properties:
                            calculated_level:
                              description: Lexical description of the entity's risk.
                              enum:
                                - Unknown
                                - Low
                                - Moderate
                                - High
                                - Critical
                              type: string
                            calculated_score:
                              description: The raw numeric value of the given entity's risk score.
                              type: number
                            calculated_score_norm:
                              description: The normalized numeric value of the given entity's risk score. Useful for comparing with other entities.
                              maximum: 100
                              minimum: 0
                              type: number
                        schema_version:
                          description: Schema version of the entity record.
                          type: string
                        source:
                          description: Sources that produced this entity record.
                          items:
                            type: string
                          type: array
                        sub_type:
                          description: Optional sub-type classification for the entity.
                          type: string
                        type:
                          description: The entity type.
                          type: string
                        url:
                          description: URL associated with the entity.
                          type: string
                    event:
                      additionalProperties: false
                      type: object
                      properties:
                        ingested:
                          description: When the event was ingested into Elasticsearch.
                          format: date-time
                          pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
                          type: string
                    host:
                      additionalProperties: false
                      description: Elastic Common Schema (ECS) host fields collected on the entity.
                      type: object
                      properties:
                        architecture:
                          description: Observed CPU architectures.
                          items:
                            type: string
                          type: array
                        domain:
                          description: Observed host domains.
                          items:
                            type: string
                          type: array
                        hostname:
                          description: Observed hostnames.
                          items:
                            type: string
                          type: array
                        id:
                          description: Observed host identifiers.
                          items:
                            type: string
                          type: array
                        ip:
                          description: Observed IP addresses.
                          items:
                            type: string
                          type: array
                        mac:
                          description: Observed MAC addresses.
                          items:
                            type: string
                          type: array
                        name:
                          description: Primary host name.
                          type: string
                        os:
                          additionalProperties: false
                          description: Elastic Common Schema (ECS) host.os fields collected on the entity latest index (v2).
                          type: object
                          properties:
                            family:
                              type: string
                            full:
                              type: string
                            kernel:
                              type: string
                            name:
                              anyOf:
                                - type: string
                                - items:
                                    type: string
                                  type: array
                            platform:
                              type: string
                            type:
                              anyOf:
                                - type: string
                                - items:
                                    type: string
                                  type: array
                            version:
                              type: string
                        risk:
                          additionalProperties: false
                          type: object
                          properties:
                            calculated_level:
                              description: Lexical description of the entity's risk.
                              enum:
                                - Unknown
                                - Low
                                - Moderate
                                - High
                                - Critical
                              type: string
                            calculated_score:
                              description: The raw numeric value of the given entity's risk score.
                              type: number
                            calculated_score_norm:
                              description: The normalized numeric value of the given entity's risk score.
                              maximum: 100
                              minimum: 0
                              type: number
                        type:
                          description: Observed host types.
                          items:
                            type: string
                          type: array
                    labels:
                      additionalProperties: {}
                      description: Custom key-value labels attached to the entity.
                      type: object
                      properties: {}
                    tags:
                      description: Tags attached to the entity.
                      items:
                        type: string
                      type: array
                - additionalProperties: false
                  type: object
                  properties:
                    '@timestamp':
                      description: The time the entity record was last updated.
                      format: date-time
                      pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
                      type: string
                    asset:
                      additionalProperties: false
                      type: object
                      properties:
                        business_unit:
                          description: Business unit the asset belongs to.
                          type: string
                        criticality:
                          description: The criticality level assigned to this asset.
                          enum:
                            - low_impact
                            - medium_impact
                            - high_impact
                            - extreme_impact
                          nullable: true
                          type: string
                        environment:
                          description: Deployment environment (for example, production, staging).
                          type: string
                        id:
                          description: Unique identifier for the asset.
                          type: string
                        model:
                          description: Model name or number.
                          type: string
                        name:
                          description: Human-readable asset name.
                          type: string
                        owner:
                          description: The owner of the asset.
                          type: string
                        serial_number:
                          description: Serial number of the asset.
                          type: string
                        vendor:
                          description: Vendor or manufacturer.
                          type: string
                    entity:
                      additionalProperties: false
                      type: object
                      properties:
                        attributes:
                          additionalProperties: false
                          description: Boolean flags describing characteristics of the entity.
                          type: object
                          properties:
                            asset:
                              description: Whether the entity is classified as an asset.
                              type: boolean
                            known_redirects:
                              description: Known redirect URIs or URLs (e.g. OAuth application callbacks).
                              items:
                                type: string
                              type: array
                            managed:
                              description: Whether the entity is managed (for example, via a directory service).
                              type: boolean
                            mfa_enabled:
                              description: Whether multi-factor authentication is enabled for the entity.
                              type: boolean
                            oauth_consent_restriction:
                              description: OAuth consent restriction (e.g. admin_only, verified_only, unrestricted).
                              type: string
                            permissions:
                              description: Action-level permissions granted to this entity (not roles or groups).
                              items:
                                type: string
                              type: array
                            storage_class:
                              description: Storage tier or class assigned to a storage resource (e.g. hot, warm, cold, standard, archive).
                              type: string
                            watchlists:
                              description: Watchlist identifiers the entity belongs to (v2).
                              items:
                                type: string
                              type: array
                        behaviors:
                          additionalProperties: false
                          description: Behavioral signals observed for the entity.
                          type: object
                          properties:
                            anomaly_job_ids:
                              description: Machine learning anomaly job identifiers (v2).
                              items:
                                type: string
                              type: array
                            rule_names:
                              description: Detection rule names that flagged this entity (v2).
                              items:
                                type: string
                              type: array
                        created_by:
                          description: Identifies which engine created this entity (for example, logs_extraction or risk_score_maintainer).
                          type: string
                        EngineMetadata:
                          additionalProperties: false
                          type: object
                          properties:
                            Type:
                              description: The engine type that produced this entity record.
                              type: string
                        id:
                          description: Unique identifier for this entity.
                          type: string
                        lifecycle:
                          additionalProperties: false
                          description: Timestamps tracking the entity lifecycle.
                          type: object
                          properties:
                            first_seen:
                              description: When the entity was first observed.
                              format: date-time
                              pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
                              type: string
                            last_activity:
                              description: When the entity last generated activity.
                              format: date-time
                              pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
                              type: string
                            last_seen:
                              description: When the entity was last observed.
                              format: date-time
                              pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
                              type: string
                        name:
                          description: Human-readable name of the entity.
                          type: string
                        relationships:
                          additionalProperties: false
                          description: Connections between this entity and other entities.
                          type: object
                          properties:
                            accesses_frequently:
                              additionalProperties: false
                              description: Entities this entity accesses frequently.
                              type: object
                              properties:
                                ids:
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                  items:
                                    type: string
                                  type: array
                                raw_identifiers:
                                  additionalProperties: false
                                  type: object
                                  properties:
                                    entity.id:
                                      items:
                                        type: string
                                      type: array
                                    host.id:
                                      items:
                                        type: string
                                      type: array
                                    host.name:
                                      items:
                                        type: string
                                      type: array
                                    service.name:
                                      items:
                                        type: string
                                      type: array
                                    user.email:
                                      items:
                                        type: string
                                      type: array
                                    user.id:
                                      items:
                                        type: string
                                      type: array
                                    user.name:
                                      items:
                                        type: string
                                      type: array
                            accesses_infrequently:
                              additionalProperties: false
                              description: Entities this entity accesses infrequently.
                              type: object
                              properties:
                                ids:
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                  items:
                                    type: string
                                  type: array
                                raw_identifiers:
                                  additionalProperties: false
                                  type: object
                                  properties:
                                    entity.id:
                                      items:
                                        type: string
                                      type: array
                                    host.id:
                                      items:
                                        type: string
                                      type: array
                                    host.name:
                                      items:
                                        type: string
                                      type: array
                                    service.name:
                                      items:
                                        type: string
                                      type: array
                                    user.email:
                                      items:
                                        type: string
                                      type: array
                                    user.id:
                                      items:
                                        type: string
                                      type: array
                                    user.name:
                                      items:
                                        type: string
                                      type: array
                            administers:
                              additionalProperties: false
                              description: Entities this entity administers (for example, a user who is an admin of a service).
                              type: object
                              properties:
                                ids:
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                  items:
                                    type: string
                                  type: array
                                raw_identifiers:
                                  additionalProperties: false
                                  type: object
                                  properties:
                                    entity.id:
                                      items:
                                        type: string
                                      type: array
                                    host.id:
                                      items:
                                        type: string
                                      type: array
                                    host.name:
                                      items:
                                        type: string
                                      type: array
                                    service.name:
                                      items:
                                        type: string
                                      type: array
                                    user.email:
                                      items:
                                        type: string
                                      type: array
                                    user.id:
                                      items:
                                        type: string
                                      type: array
                                    user.name:
                                      items:
                                        type: string
                                      type: array
                            communicates_with:
                              additionalProperties: false
                              description: Entities this entity communicates with.
                              type: object
                              properties:
                                ids:
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                  items:
                                    type: string
                                  type: array
                                raw_identifiers:
                                  additionalProperties: false
                                  type: object
                                  properties:
                                    entity.id:
                                      items:
                                        type: string
                                      type: array
                                    host.id:
                                      items:
                                        type: string
                                      type: array
                                    host.name:
                                      items:
                                        type: string
                                      type: array
                                    service.name:
                                      items:
                                        type: string
                                      type: array
                                    user.email:
                                      items:
                                        type: string
                                      type: array
                                    user.id:
                                      items:
                                        type: string
                                      type: array
                                    user.name:
                                      items:
                                        type: string
                                      type: array
                            depends_on:
                              additionalProperties: false
                              description: Entities this entity depends on.
                              type: object
                              properties:
                                ids:
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                  items:
                                    type: string
                                  type: array
                                raw_identifiers:
                                  additionalProperties: false
                                  type: object
                                  properties:
                                    entity.id:
                                      items:
                                        type: string
                                      type: array
                                    host.id:
                                      items:
                                        type: string
                                      type: array
                                    host.name:
                                      items:
                                        type: string
                                      type: array
                                    service.name:
                                      items:
                                        type: string
                                      type: array
                                    user.email:
                                      items:
                                        type: string
                                      type: array
                                    user.id:
                                      items:
                                        type: string
                                      type: array
                                    user.name:
                                      items:
                                        type: string
                                      type: array
                            owns:
                              additionalProperties: false
                              description: Entities owned by this entity.
                              type: object
                              properties:
                                ids:
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                  items:
                                    type: string
                                  type: array
                                raw_identifiers:
                                  additionalProperties: false
                                  type: object
                                  properties:
                                    entity.id:
                                      items:
                                        type: string
                                      type: array
                                    host.id:
                                      items:
                                        type: string
                                      type: array
                                    host.name:
                                      items:
                                        type: string
                                      type: array
                                    service.name:
                                      items:
                                        type: string
                                      type: array
                                    user.email:
                                      items:
                                        type: string
                                      type: array
                                    user.id:
                                      items:
                                        type: string
                                      type: array
                                    user.name:
                                      items:
                                        type: string
                                      type: array
                            owns_inferred:
                              additionalProperties: false
                              description: Entities inferred to be owned by this entity.
                              type: object
                              properties:
                                ids:
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                  items:
                                    type: string
                                  type: array
                                raw_identifiers:
                                  additionalProperties: false
                                  type: object
                                  properties:
                                    entity.id:
                                      items:
                                        type: string
                                      type: array
                                    host.id:
                                      items:
                                        type: string
                                      type: array
                                    host.name:
                                      items:
                                        type: string
                                      type: array
                                    service.name:
                                      items:
                                        type: string
                                      type: array
                                    user.email:
                                      items:
                                        type: string
                                      type: array
                                    user.id:
                                      items:
                                        type: string
                                      type: array
                                    user.name:
                                      items:
                                        type: string
                                      type: array
                            resolution:
                              additionalProperties: false
                              description: Resolution metadata linking this entity to another.
                              type: object
                              properties:
                                resolved_to:
                                  description: entity.id of the entity this one resolves to
                                  type: string
                                risk:
                                  additionalProperties: false
                                  description: Aggregated risk score for the resolution group.
                                  type: object
                                  properties:
                                    calculated_level:
                                      description: Lexical description of the resolution group's aggregated risk.
                                      enum:
                                        - Unknown
                                        - Low
                                        - Moderate
                                        - High
                                        - Critical
                                      type: string
                                    calculated_score:
                                      description: The raw numeric value of the resolution group's aggregated risk score.
                                      type: number
                                    calculated_score_norm:
                                      description: The normalized numeric value of the resolution group's aggregated risk score.
                                      maximum: 100
                                      minimum: 0
                                      type: number
                            supervises:
                              additionalProperties: false
                              description: Entities supervised by this entity.
                              type: object
                              properties:
                                ids:
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                  items:
                                    type: string
                                  type: array
                                raw_identifiers:
                                  additionalProperties: false
                                  type: object
                                  properties:
                                    entity.id:
                                      items:
                                        type: string
                                      type: array
                                    host.id:
                                      items:
                                        type: string
                                      type: array
                                    host.name:
                                      items:
                                        type: string
                                      type: array
                                    service.name:
                                      items:
                                        type: string
                                      type: array
                                    user.email:
                                      items:
                                        type: string
                                      type: array
                                    user.id:
                                      items:
                                        type: string
                                      type: array
                                    user.name:
                                      items:
                                        type: string
                                      type: array
                        risk:
                          additionalProperties: false
                          description: Risk scoring information for the entity.
                          type: object
                          properties:
                            calculated_level:
                              description: Lexical description of the entity's risk.
                              enum:
                                - Unknown
                                - Low
                                - Moderate
                                - High
                                - Critical
                              type: string
                            calculated_score:
                              description: The raw numeric value of the given entity's risk score.
                              type: number
                            calculated_score_norm:
                              description: The normalized numeric value of the given entity's risk score. Useful for comparing with other entities.
                              maximum: 100
                              minimum: 0
                              type: number
                        schema_version:
                          description: Schema version of the entity record.
                          type: string
                        source:
                          description: Sources that produced this entity record.
                          items:
                            type: string
                          type: array
                        sub_type:
                          description: Optional sub-type classification for the entity.
                          type: string
                        type:
                          description: The entity type.
                          type: string
                        url:
                          description: URL associated with the entity.
                          type: string
                    event:
                      additionalProperties: false
                      type: object
                      properties:
                        ingested:
                          description: When the event was ingested into Elasticsearch.
                          format: date-time
                          pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
                          type: string
                    labels:
                      additionalProperties: {}
                      description: Custom key-value labels attached to the entity.
                      type: object
                      properties: {}
                    service:
                      additionalProperties: false
                      description: Elastic Common Schema (ECS) service fields collected on the entity.
                      type: object
                      properties:
                        address:
                          description: Service address.
                          type: string
                        environment:
                          description: Service environment (for example, production, staging).
                          type: string
                        ephemeral_id:
                          description: Ephemeral identifier of the service.
                          type: string
                        id:
                          description: Unique identifier of the service.
                          type: string
                        name:
                          description: Primary service name.
                          type: string
                        node:
                          additionalProperties: false
                          description: Node information for the service.
                          type: object
                          properties:
                            name:
                              description: Node name.
                              type: string
                            role:
                              description: Node role.
                              type: string
                            roles:
                              description: Node roles.
                              items:
                                type: string
                              type: array
                        risk:
                          additionalProperties: false
                          type: object
                          properties:
                            calculated_level:
                              description: Lexical description of the entity's risk.
                              enum:
                                - Unknown
                                - Low
                                - Moderate
                                - High
                                - Critical
                              type: string
                            calculated_score:
                              description: The raw numeric value of the given entity's risk score.
                              type: number
                            calculated_score_norm:
                              description: The normalized numeric value of the given entity's risk score.
                              maximum: 100
                              minimum: 0
                              type: number
                        state:
                          description: Current state of the service.
                          type: string
                        type:
                          description: Service type.
                          type: string
                        version:
                          description: Service version.
                          type: string
                    tags:
                      description: Tags attached to the entity.
                      items:
                        type: string
                      type: array
                - additionalProperties: false
                  type: object
                  properties:
                    '@timestamp':
                      description: The time the entity record was last updated.
                      format: date-time
                      pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
                      type: string
                    asset:
                      additionalProperties: false
                      type: object
                      properties:
                        business_unit:
                          description: Business unit the asset belongs to.
                          type: string
                        criticality:
                          description: The criticality level assigned to this asset.
                          enum:
                            - low_impact
                            - medium_impact
                            - high_impact
                            - extreme_impact
                          nullable: true
                          type: string
                        environment:
                          description: Deployment environment (for example, production, staging).
                          type: string
                        id:
                          description: Unique identifier for the asset.
                          type: string
                        model:
                          description: Model name or number.
                          type: string
                        name:
                          description: Human-readable asset name.
                          type: string
                        owner:
                          description: The owner of the asset.
                          type: string
                        serial_number:
                          description: Serial number of the asset.
                          type: string
                        vendor:
                          description: Vendor or manufacturer.
                          type: string
                    cloud:
                      additionalProperties: false
                      description: Elastic Common Schema (ECS) cloud fields for cloud-hosted entities.
                      type: object
                      properties:
                        account:
                          additionalProperties: false
                          type: object
                          properties:
                            id:
                              type: string
                            name:
                              type: string
                        availability_zone:
                          type: string
                        instance:
                          additionalProperties: false
                          type: object
                          properties:
                            id:
                              type: string
                            name:
                              type: string
                        machine:
                          additionalProperties: false
                          type: object
                          properties:
                            type:
                              type: string
                        project:
                          additionalProperties: false
                          type: object
                          properties:
                            id:
                              type: string
                            name:
                              type: string
                        provider:
                          type: string
                        region:
                          type: string
                        service:
                          additionalProperties: false
                          type: object
                          properties:
                            name:
                              type: string
                    entity:
                      additionalProperties: false
                      type: object
                      properties:
                        attributes:
                          additionalProperties: false
                          description: Boolean flags describing characteristics of the entity.
                          type: object
                          properties:
                            asset:
                              description: Whether the entity is classified as an asset.
                              type: boolean
                            known_redirects:
                              description: Known redirect URIs or URLs (e.g. OAuth application callbacks).
                              items:
                                type: string
                              type: array
                            managed:
                              description: Whether the entity is managed (for example, via a directory service).
                              type: boolean
                            mfa_enabled:
                              description: Whether multi-factor authentication is enabled for the entity.
                              type: boolean
                            oauth_consent_restriction:
                              description: OAuth consent restriction (e.g. admin_only, verified_only, unrestricted).
                              type: string
                            permissions:
                              description: Action-level permissions granted to this entity (not roles or groups).
                              items:
                                type: string
                              type: array
                            storage_class:
                              description: Storage tier or class assigned to a storage resource (e.g. hot, warm, cold, standard, archive).
                              type: string
                            watchlists:
                              description: Watchlist identifiers the entity belongs to (v2).
                              items:
                                type: string
                              type: array
                        behaviors:
                          additionalProperties: false
                          description: Behavioral signals observed for the entity.
                          type: object
                          properties:
                            anomaly_job_ids:
                              description: Machine learning anomaly job identifiers (v2).
                              items:
                                type: string
                              type: array
                            rule_names:
                              description: Detection rule names that flagged this entity (v2).
                              items:
                                type: string
                              type: array
                        created_by:
                          description: Identifies which engine created this entity (for example, logs_extraction or risk_score_maintainer).
                          type: string
                        EngineMetadata:
                          additionalProperties: false
                          type: object
                          properties:
                            Type:
                              description: The engine type that produced this entity record.
                              type: string
                        id:
                          description: Unique identifier for this entity.
                          type: string
                        lifecycle:
                          additionalProperties: false
                          description: Timestamps tracking the entity lifecycle.
                          type: object
                          properties:
                            first_seen:
                              description: When the entity was first observed.
                              format: date-time
                              pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
                              type: string
                            last_activity:
                              description: When the entity last generated activity.
                              format: date-time
                              pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
                              type: string
                            last_seen:
                              description: When the entity was last observed.
                              format: date-time
                              pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
                              type: string
                        name:
                          description: Human-readable name of the entity.
                          type: string
                        relationships:
                          additionalProperties: false
                          description: Connections between this entity and other entities.
                          type: object
                          properties:
                            accesses_frequently:
                              additionalProperties: false
                              description: Entities this entity accesses frequently.
                              type: object
                              properties:
                                ids:
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                  items:
                                    type: string
                                  type: array
                                raw_identifiers:
                                  additionalProperties: false
                                  type: object
                                  properties:
                                    entity.id:
                                      items:
                                        type: string
                                      type: array
                                    host.id:
                                      items:
                                        type: string
                                      type: array
                                    host.name:
                                      items:
                                        type: string
                                      type: array
                                    service.name:
                                      items:
                                        type: string
                                      type: array
                                    user.email:
                                      items:
                                        type: string
                                      type: array
                                    user.id:
                                      items:
                                        type: string
                                      type: array
                                    user.name:
                                      items:
                                        type: string
                                      type: array
                            accesses_infrequently:
                              additionalProperties: false
                              description: Entities this entity accesses infrequently.
                              type: object
                              properties:
                                ids:
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                  items:
                                    type: string
                                  type: array
                                raw_identifiers:
                                  additionalProperties: false
                                  type: object
                                  properties:
                                    entity.id:
                                      items:
                                        type: string
                                      type: array
                                    host.id:
                                      items:
                                        type: string
                                      type: array
                                    host.name:
                                      items:
                                        type: string
                                      type: array
                                    service.name:
                                      items:
                                        type: string
                                      type: array
                                    user.email:
                                      items:
                                        type: string
                                      type: array
                                    user.id:
                                      items:
                                        type: string
                                      type: array
                                    user.name:
                                      items:
                                        type: string
                                      type: array
                            administers:
                              additionalProperties: false
                              description: Entities this entity administers (for example, a user who is an admin of a service).
                              type: object
                              properties:
                                ids:
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                  items:
                                    type: string
                                  type: array
                                raw_identifiers:
                                  additionalProperties: false
                                  type: object
                                  properties:
                                    entity.id:
                                      items:
                                        type: string
                                      type: array
                                    host.id:
                                      items:
                                        type: string
                                      type: array
                                    host.name:
                                      items:
                                        type: string
                                      type: array
                                    service.name:
                                      items:
                                        type: string
                                      type: array
                                    user.email:
                                      items:
                                        type: string
                                      type: array
                                    user.id:
                                      items:
                                        type: string
                                      type: array
                                    user.name:
                                      items:
                                        type: string
                                      type: array
                            communicates_with:
                              additionalProperties: false
                              description: Entities this entity communicates with.
                              type: object
                              properties:
                                ids:
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                  items:
                                    type: string
                                  type: array
                                raw_identifiers:
                                  additionalProperties: false
                                  type: object
                                  properties:
                                    entity.id:
                                      items:
                                        type: string
                                      type: array
                                    host.id:
                                      items:
                                        type: string
                                      type: array
                                    host.name:
                                      items:
                                        type: string
                                      type: array
                                    service.name:
                                      items:
                                        type: string
                                      type: array
                                    user.email:
                                      items:
                                        type: string
                                      type: array
                                    user.id:
                                      items:
                                        type: string
                                      type: array
                                    user.name:
                                      items:
                                        type: string
                                      type: array
                            depends_on:
                              additionalProperties: false
                              description: Entities this entity depends on.
                              type: object
                              properties:
                                ids:
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                  items:
                                    type: string
                                  type: array
                                raw_identifiers:
                                  additionalProperties: false
                                  type: object
                                  properties:
                                    entity.id:
                                      items:
                                        type: string
                                      type: array
                                    host.id:
                                      items:
                                        type: string
                                      type: array
                                    host.name:
                                      items:
                                        type: string
                                      type: array
                                    service.name:
                                      items:
                                        type: string
                                      type: array
                                    user.email:
                                      items:
                                        type: string
                                      type: array
                                    user.id:
                                      items:
                                        type: string
                                      type: array
                                    user.name:
                                      items:
                                        type: string
                                      type: array
                            owns:
                              additionalProperties: false
                              description: Entities owned by this entity.
                              type: object
                              properties:
                                ids:
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                  items:
                                    type: string
                                  type: array
                                raw_identifiers:
                                  additionalProperties: false
                                  type: object
                                  properties:
                                    entity.id:
                                      items:
                                        type: string
                                      type: array
                                    host.id:
                                      items:
                                        type: string
                                      type: array
                                    host.name:
                                      items:
                                        type: string
                                      type: array
                                    service.name:
                                      items:
                                        type: string
                                      type: array
                                    user.email:
                                      items:
                                        type: string
                                      type: array
                                    user.id:
                                      items:
                                        type: string
                                      type: array
                                    user.name:
                                      items:
                                        type: string
                                      type: array
                            owns_inferred:
                              additionalProperties: false
                              description: Entities inferred to be owned by this entity.
                              type: object
                              properties:
                                ids:
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                  items:
                                    type: string
                                  type: array
                                raw_identifiers:
                                  additionalProperties: false
                                  type: object
                                  properties:
                                    entity.id:
                                      items:
                                        type: string
                                      type: array
                                    host.id:
                                      items:
                                        type: string
                                      type: array
                                    host.name:
                                      items:
                                        type: string
                                      type: array
                                    service.name:
                                      items:
                                        type: string
                                      type: array
                                    user.email:
                                      items:
                                        type: string
                                      type: array
                                    user.id:
                                      items:
                                        type: string
                                      type: array
                                    user.name:
                                      items:
                                        type: string
                                      type: array
                            resolution:
                              additionalProperties: false
                              description: Resolution metadata linking this entity to another.
                              type: object
                              properties:
                                resolved_to:
                                  description: entity.id of the entity this one resolves to
                                  type: string
                                risk:
                                  additionalProperties: false
                                  description: Aggregated risk score for the resolution group.
                                  type: object
                                  properties:
                                    calculated_level:
                                      description: Lexical description of the resolution group's aggregated risk.
                                      enum:
                                        - Unknown
                                        - Low
                                        - Moderate
                                        - High
                                        - Critical
                                      type: string
                                    calculated_score:
                                      description: The raw numeric value of the resolution group's aggregated risk score.
                                      type: number
                                    calculated_score_norm:
                                      description: The normalized numeric value of the resolution group's aggregated risk score.
                                      maximum: 100
                                      minimum: 0
                                      type: number
                            supervises:
                              additionalProperties: false
                              description: Entities supervised by this entity.
                              type: object
                              properties:
                                ids:
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                  items:
                                    type: string
                                  type: array
                                raw_identifiers:
                                  additionalProperties: false
                                  type: object
                                  properties:
                                    entity.id:
                                      items:
                                        type: string
                                      type: array
                                    host.id:
                                      items:
                                        type: string
                                      type: array
                                    host.name:
                                      items:
                                        type: string
                                      type: array
                                    service.name:
                                      items:
                                        type: string
                                      type: array
                                    user.email:
                                      items:
                                        type: string
                                      type: array
                                    user.id:
                                      items:
                                        type: string
                                      type: array
                                    user.name:
                                      items:
                                        type: string
                                      type: array
                        risk:
                          additionalProperties: false
                          description: Risk scoring information for the entity.
                          type: object
                          properties:
                            calculated_level:
                              description: Lexical description of the entity's risk.
                              enum:
                                - Unknown
                                - Low
                                - Moderate
                                - High
                                - Critical
                              type: string
                            calculated_score:
                              description: The raw numeric value of the given entity's risk score.
                              type: number
                            calculated_score_norm:
                              description: The normalized numeric value of the given entity's risk score. Useful for comparing with other entities.
                              maximum: 100
                              minimum: 0
                              type: number
                        schema_version:
                          description: Schema version of the entity record.
                          type: string
                        source:
                          description: Sources that produced this entity record.
                          items:
                            type: string
                          type: array
                        sub_type:
                          description: Optional sub-type classification for the entity.
                          type: string
                        type:
                          description: The entity type.
                          type: string
                        url:
                          description: URL associated with the entity.
                          type: string
                    event:
                      additionalProperties: false
                      type: object
                      properties:
                        ingested:
                          format: date-time
                          pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
                          type: string
                    labels:
                      additionalProperties: {}
                      type: object
                      properties: {}
                    orchestrator:
                      additionalProperties: false
                      description: Elastic Common Schema (ECS) orchestrator fields for container-orchestrated entities.
                      type: object
                      properties:
                        api_version:
                          type: string
                        cluster:
                          additionalProperties: false
                          type: object
                          properties:
                            id:
                              type: string
                            name:
                              type: string
                            url:
                              type: string
                            version:
                              type: string
                        namespace:
                          type: string
                        organization:
                          type: string
                        resource:
                          additionalProperties: false
                          type: object
                          properties:
                            annotation:
                              type: string
                            id:
                              type: string
                            ip:
                              type: string
                            label:
                              type: string
                            name:
                              type: string
                            parent:
                              additionalProperties: false
                              type: object
                              properties:
                                type:
                                  type: string
                            type:
                              type: string
                        type:
                          type: string
                    tags:
                      items:
                        type: string
                      type: array
      responses:
        '200':
          content:
            application/json:
              examples:
                updateSuccessExample:
                  description: The entity record was successfully updated.
                  summary: Entity updated
                  value:
                    ok: true
          description: Indicates the entity was successfully updated.
        '400':
          content:
            application/json:
              examples:
                protectedFieldsExample:
                  description: The request attempts to update protected fields without the force query parameter.
                  summary: Protected fields without force
                  value:
                    error: Bad Request
                    message: 'Bad request: The following attributes are not allowed to be updated without forcing it (?force=true): entity.name, entity.type'
                    statusCode: 400
          description: Bad request.
        '404':
          content:
            application/json:
              examples:
                notFoundExample:
                  description: No entity with the specified identifier exists.
                  summary: Entity not found
                  value:
                    error: Not Found
                    message: Entity ID 'user:jane.doe@example.com' not found
                    statusCode: 404
          description: Entity not found.
      summary: Update an entity
      tags:
        - Security entity store
      x-codeSamples:
        - lang: curl
          source: |
            curl -X PUT -H "kbn-xsrf: true" -H "Authorization: ApiKey ${API_KEY}" \
              -H "Content-Type: application/json" \
              -d '{"entity":{"id":"user:jane.doe@example.com","name":"jane.doe","type":"user","attributes":{"managed":true,"mfa_enabled":true}},"user":{"name":"jane.doe"}}' \
              "${KIBANA_URL}/api/security/entity_store/entities/user?force=true"
        - lang: Console
          source: |
            PUT kbn://api/security/entity_store/entities/user?force=true
            {
              "entity": {
                "id": "user:jane.doe@example.com",
                "name": "jane.doe",
                "type": "user",
                "attributes": { "managed": true, "mfa_enabled": true }
              },
              "user": { "name": "jane.doe" }
            }
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/security/entity_store/entities/bulk:
    put:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb put">put</span>&nbsp;<span class="operation-path">/s/{space_id}/api/security/entity_store/entities/bulk</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Update multiple entity records in the Entity Store in a single request.<br/><br/>[Required authorization] Route required privileges: securitySolution.
      operationId: put-security-entity-store-entities-bulk
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: When true, allows updating protected fields.
          in: query
          name: force
          required: false
          schema:
            anyOf:
              - enum:
                  - 'true'
                  - 'false'
                type: string
              - type: boolean
            default: false
      requestBody:
        content:
          application/json:
            examples:
              bulkUpdateExample:
                description: Update a host entity and a user entity in a single request.
                summary: Bulk update multiple entities
                value:
                  entities:
                    - doc:
                        entity:
                          attributes:
                            asset: true
                          id: host:web-server-prod-01
                          name: web-server-prod-01
                          type: host
                        host:
                          name: web-server-prod-01
                      type: host
                    - doc:
                        entity:
                          attributes:
                            managed: true
                          id: user:jane.doe@example.com
                          name: jane.doe
                          type: user
                        user:
                          name: jane.doe
                      type: user
            schema:
              additionalProperties: false
              type: object
              properties:
                entities:
                  description: The entities to update.
                  items:
                    type: object
                    properties:
                      doc:
                        anyOf:
                          - additionalProperties: false
                            type: object
                            properties:
                              '@timestamp':
                                description: The time the entity record was last updated.
                                format: date-time
                                pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
                                type: string
                              asset:
                                additionalProperties: false
                                type: object
                                properties:
                                  business_unit:
                                    description: Business unit the asset belongs to.
                                    type: string
                                  criticality:
                                    description: The criticality level assigned to this asset.
                                    enum:
                                      - low_impact
                                      - medium_impact
                                      - high_impact
                                      - extreme_impact
                                    nullable: true
                                    type: string
                                  environment:
                                    description: Deployment environment (for example, production, staging).
                                    type: string
                                  id:
                                    description: Unique identifier for the asset.
                                    type: string
                                  model:
                                    description: Model name or number.
                                    type: string
                                  name:
                                    description: Human-readable asset name.
                                    type: string
                                  owner:
                                    description: The owner of the asset.
                                    type: string
                                  serial_number:
                                    description: Serial number of the asset.
                                    type: string
                                  vendor:
                                    description: Vendor or manufacturer.
                                    type: string
                              entity:
                                additionalProperties: false
                                type: object
                                properties:
                                  attributes:
                                    additionalProperties: false
                                    description: Boolean flags describing characteristics of the entity.
                                    type: object
                                    properties:
                                      asset:
                                        description: Whether the entity is classified as an asset.
                                        type: boolean
                                      known_redirects:
                                        description: Known redirect URIs or URLs (e.g. OAuth application callbacks).
                                        items:
                                          type: string
                                        type: array
                                      managed:
                                        description: Whether the entity is managed (for example, via a directory service).
                                        type: boolean
                                      mfa_enabled:
                                        description: Whether multi-factor authentication is enabled for the entity.
                                        type: boolean
                                      oauth_consent_restriction:
                                        description: OAuth consent restriction (e.g. admin_only, verified_only, unrestricted).
                                        type: string
                                      permissions:
                                        description: Action-level permissions granted to this entity (not roles or groups).
                                        items:
                                          type: string
                                        type: array
                                      storage_class:
                                        description: Storage tier or class assigned to a storage resource (e.g. hot, warm, cold, standard, archive).
                                        type: string
                                      watchlists:
                                        description: Watchlist identifiers the entity belongs to (v2).
                                        items:
                                          type: string
                                        type: array
                                  behaviors:
                                    additionalProperties: false
                                    description: Behavioral signals observed for the entity.
                                    type: object
                                    properties:
                                      anomaly_job_ids:
                                        description: Machine learning anomaly job identifiers (v2).
                                        items:
                                          type: string
                                        type: array
                                      rule_names:
                                        description: Detection rule names that flagged this entity (v2).
                                        items:
                                          type: string
                                        type: array
                                  created_by:
                                    description: Identifies which engine created this entity (for example, logs_extraction or risk_score_maintainer).
                                    type: string
                                  EngineMetadata:
                                    additionalProperties: false
                                    type: object
                                    properties:
                                      Type:
                                        description: The engine type that produced this entity record.
                                        type: string
                                  id:
                                    description: Unique identifier for this entity.
                                    type: string
                                  lifecycle:
                                    additionalProperties: false
                                    description: Timestamps tracking the entity lifecycle.
                                    type: object
                                    properties:
                                      first_seen:
                                        description: When the entity was first observed.
                                        format: date-time
                                        pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
                                        type: string
                                      last_activity:
                                        description: When the entity last generated activity.
                                        format: date-time
                                        pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
                                        type: string
                                      last_seen:
                                        description: When the entity was last observed.
                                        format: date-time
                                        pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
                                        type: string
                                  name:
                                    description: Human-readable name of the entity.
                                    type: string
                                  relationships:
                                    additionalProperties: false
                                    description: Connections between this entity and other entities.
                                    type: object
                                    properties:
                                      accesses_frequently:
                                        additionalProperties: false
                                        description: Entities this entity accesses frequently.
                                        type: object
                                        properties:
                                          ids:
                                            description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                            items:
                                              type: string
                                            type: array
                                          raw_identifiers:
                                            additionalProperties: false
                                            type: object
                                            properties:
                                              entity.id:
                                                items:
                                                  type: string
                                                type: array
                                              host.id:
                                                items:
                                                  type: string
                                                type: array
                                              host.name:
                                                items:
                                                  type: string
                                                type: array
                                              service.name:
                                                items:
                                                  type: string
                                                type: array
                                              user.email:
                                                items:
                                                  type: string
                                                type: array
                                              user.id:
                                                items:
                                                  type: string
                                                type: array
                                              user.name:
                                                items:
                                                  type: string
                                                type: array
                                      accesses_infrequently:
                                        additionalProperties: false
                                        description: Entities this entity accesses infrequently.
                                        type: object
                                        properties:
                                          ids:
                                            description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                            items:
                                              type: string
                                            type: array
                                          raw_identifiers:
                                            additionalProperties: false
                                            type: object
                                            properties:
                                              entity.id:
                                                items:
                                                  type: string
                                                type: array
                                              host.id:
                                                items:
                                                  type: string
                                                type: array
                                              host.name:
                                                items:
                                                  type: string
                                                type: array
                                              service.name:
                                                items:
                                                  type: string
                                                type: array
                                              user.email:
                                                items:
                                                  type: string
                                                type: array
                                              user.id:
                                                items:
                                                  type: string
                                                type: array
                                              user.name:
                                                items:
                                                  type: string
                                                type: array
                                      administers:
                                        additionalProperties: false
                                        description: Entities this entity administers (for example, a user who is an admin of a service).
                                        type: object
                                        properties:
                                          ids:
                                            description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                            items:
                                              type: string
                                            type: array
                                          raw_identifiers:
                                            additionalProperties: false
                                            type: object
                                            properties:
                                              entity.id:
                                                items:
                                                  type: string
                                                type: array
                                              host.id:
                                                items:
                                                  type: string
                                                type: array
                                              host.name:
                                                items:
                                                  type: string
                                                type: array
                                              service.name:
                                                items:
                                                  type: string
                                                type: array
                                              user.email:
                                                items:
                                                  type: string
                                                type: array
                                              user.id:
                                                items:
                                                  type: string
                                                type: array
                                              user.name:
                                                items:
                                                  type: string
                                                type: array
                                      communicates_with:
                                        additionalProperties: false
                                        description: Entities this entity communicates with.
                                        type: object
                                        properties:
                                          ids:
                                            description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                            items:
                                              type: string
                                            type: array
                                          raw_identifiers:
                                            additionalProperties: false
                                            type: object
                                            properties:
                                              entity.id:
                                                items:
                                                  type: string
                                                type: array
                                              host.id:
                                                items:
                                                  type: string
                                                type: array
                                              host.name:
                                                items:
                                                  type: string
                                                type: array
                                              service.name:
                                                items:
                                                  type: string
                                                type: array
                                              user.email:
                                                items:
                                                  type: string
                                                type: array
                                              user.id:
                                                items:
                                                  type: string
                                                type: array
                                              user.name:
                                                items:
                                                  type: string
                                                type: array
                                      depends_on:
                                        additionalProperties: false
                                        description: Entities this entity depends on.
                                        type: object
                                        properties:
                                          ids:
                                            description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                            items:
                                              type: string
                                            type: array
                                          raw_identifiers:
                                            additionalProperties: false
                                            type: object
                                            properties:
                                              entity.id:
                                                items:
                                                  type: string
                                                type: array
                                              host.id:
                                                items:
                                                  type: string
                                                type: array
                                              host.name:
                                                items:
                                                  type: string
                                                type: array
                                              service.name:
                                                items:
                                                  type: string
                                                type: array
                                              user.email:
                                                items:
                                                  type: string
                                                type: array
                                              user.id:
                                                items:
                                                  type: string
                                                type: array
                                              user.name:
                                                items:
                                                  type: string
                                                type: array
                                      owns:
                                        additionalProperties: false
                                        description: Entities owned by this entity.
                                        type: object
                                        properties:
                                          ids:
                                            description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                            items:
                                              type: string
                                            type: array
                                          raw_identifiers:
                                            additionalProperties: false
                                            type: object
                                            properties:
                                              entity.id:
                                                items:
                                                  type: string
                                                type: array
                                              host.id:
                                                items:
                                                  type: string
                                                type: array
                                              host.name:
                                                items:
                                                  type: string
                                                type: array
                                              service.name:
                                                items:
                                                  type: string
                                                type: array
                                              user.email:
                                                items:
                                                  type: string
                                                type: array
                                              user.id:
                                                items:
                                                  type: string
                                                type: array
                                              user.name:
                                                items:
                                                  type: string
                                                type: array
                                      owns_inferred:
                                        additionalProperties: false
                                        description: Entities inferred to be owned by this entity.
                                        type: object
                                        properties:
                                          ids:
                                            description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                            items:
                                              type: string
                                            type: array
                                          raw_identifiers:
                                            additionalProperties: false
                                            type: object
                                            properties:
                                              entity.id:
                                                items:
                                                  type: string
                                                type: array
                                              host.id:
                                                items:
                                                  type: string
                                                type: array
                                              host.name:
                                                items:
                                                  type: string
                                                type: array
                                              service.name:
                                                items:
                                                  type: string
                                                type: array
                                              user.email:
                                                items:
                                                  type: string
                                                type: array
                                              user.id:
                                                items:
                                                  type: string
                                                type: array
                                              user.name:
                                                items:
                                                  type: string
                                                type: array
                                      resolution:
                                        additionalProperties: false
                                        description: Resolution metadata linking this entity to another.
                                        type: object
                                        properties:
                                          resolved_to:
                                            description: entity.id of the entity this one resolves to
                                            type: string
                                          risk:
                                            additionalProperties: false
                                            description: Aggregated risk score for the resolution group.
                                            type: object
                                            properties:
                                              calculated_level:
                                                description: Lexical description of the resolution group's aggregated risk.
                                                enum:
                                                  - Unknown
                                                  - Low
                                                  - Moderate
                                                  - High
                                                  - Critical
                                                type: string
                                              calculated_score:
                                                description: The raw numeric value of the resolution group's aggregated risk score.
                                                type: number
                                              calculated_score_norm:
                                                description: The normalized numeric value of the resolution group's aggregated risk score.
                                                maximum: 100
                                                minimum: 0
                                                type: number
                                      supervises:
                                        additionalProperties: false
                                        description: Entities supervised by this entity.
                                        type: object
                                        properties:
                                          ids:
                                            description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                            items:
                                              type: string
                                            type: array
                                          raw_identifiers:
                                            additionalProperties: false
                                            type: object
                                            properties:
                                              entity.id:
                                                items:
                                                  type: string
                                                type: array
                                              host.id:
                                                items:
                                                  type: string
                                                type: array
                                              host.name:
                                                items:
                                                  type: string
                                                type: array
                                              service.name:
                                                items:
                                                  type: string
                                                type: array
                                              user.email:
                                                items:
                                                  type: string
                                                type: array
                                              user.id:
                                                items:
                                                  type: string
                                                type: array
                                              user.name:
                                                items:
                                                  type: string
                                                type: array
                                  risk:
                                    additionalProperties: false
                                    description: Risk scoring information for the entity.
                                    type: object
                                    properties:
                                      calculated_level:
                                        description: Lexical description of the entity's risk.
                                        enum:
                                          - Unknown
                                          - Low
                                          - Moderate
                                          - High
                                          - Critical
                                        type: string
                                      calculated_score:
                                        description: The raw numeric value of the given entity's risk score.
                                        type: number
                                      calculated_score_norm:
                                        description: The normalized numeric value of the given entity's risk score. Useful for comparing with other entities.
                                        maximum: 100
                                        minimum: 0
                                        type: number
                                  schema_version:
                                    description: Schema version of the entity record.
                                    type: string
                                  source:
                                    description: Sources that produced this entity record.
                                    items:
                                      type: string
                                    type: array
                                  sub_type:
                                    description: Optional sub-type classification for the entity.
                                    type: string
                                  type:
                                    description: The entity type.
                                    type: string
                                  url:
                                    description: URL associated with the entity.
                                    type: string
                              event:
                                additionalProperties: false
                                type: object
                                properties:
                                  ingested:
                                    description: When the event was ingested into Elasticsearch.
                                    format: date-time
                                    pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
                                    type: string
                              labels:
                                additionalProperties: {}
                                description: Custom key-value labels attached to the entity.
                                type: object
                                properties: {}
                              tags:
                                description: Tags attached to the entity.
                                items:
                                  type: string
                                type: array
                              user:
                                additionalProperties: false
                                description: Elastic Common Schema (ECS) user fields collected on the entity.
                                type: object
                                properties:
                                  domain:
                                    description: Observed user domains.
                                    items:
                                      type: string
                                    type: array
                                  email:
                                    description: Observed email addresses.
                                    items:
                                      type: string
                                    type: array
                                  full_name:
                                    description: Observed full names of the user.
                                    items:
                                      type: string
                                    type: array
                                  hash:
                                    description: Observed user hashes.
                                    items:
                                      type: string
                                    type: array
                                  id:
                                    description: Observed user identifiers.
                                    items:
                                      type: string
                                    type: array
                                  name:
                                    description: Primary user name.
                                    type: string
                                  risk:
                                    additionalProperties: false
                                    type: object
                                    properties:
                                      calculated_level:
                                        description: Lexical description of the entity's risk.
                                        enum:
                                          - Unknown
                                          - Low
                                          - Moderate
                                          - High
                                          - Critical
                                        type: string
                                      calculated_score:
                                        description: The raw numeric value of the given entity's risk score.
                                        type: number
                                      calculated_score_norm:
                                        description: The normalized numeric value of the given entity's risk score.
                                        maximum: 100
                                        minimum: 0
                                        type: number
                                  roles:
                                    description: Observed roles assigned to the user.
                                    items:
                                      type: string
                                    type: array
                          - additionalProperties: false
                            type: object
                            properties:
                              '@timestamp':
                                description: The time the entity record was last updated.
                                format: date-time
                                pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
                                type: string
                              asset:
                                additionalProperties: false
                                type: object
                                properties:
                                  business_unit:
                                    description: Business unit the asset belongs to.
                                    type: string
                                  criticality:
                                    description: The criticality level assigned to this asset.
                                    enum:
                                      - low_impact
                                      - medium_impact
                                      - high_impact
                                      - extreme_impact
                                    nullable: true
                                    type: string
                                  environment:
                                    description: Deployment environment (for example, production, staging).
                                    type: string
                                  id:
                                    description: Unique identifier for the asset.
                                    type: string
                                  model:
                                    description: Model name or number.
                                    type: string
                                  name:
                                    description: Human-readable asset name.
                                    type: string
                                  owner:
                                    description: The owner of the asset.
                                    type: string
                                  serial_number:
                                    description: Serial number of the asset.
                                    type: string
                                  vendor:
                                    description: Vendor or manufacturer.
                                    type: string
                              entity:
                                additionalProperties: false
                                type: object
                                properties:
                                  attributes:
                                    additionalProperties: false
                                    description: Boolean flags describing characteristics of the entity.
                                    type: object
                                    properties:
                                      asset:
                                        description: Whether the entity is classified as an asset.
                                        type: boolean
                                      known_redirects:
                                        description: Known redirect URIs or URLs (e.g. OAuth application callbacks).
                                        items:
                                          type: string
                                        type: array
                                      managed:
                                        description: Whether the entity is managed (for example, via a directory service).
                                        type: boolean
                                      mfa_enabled:
                                        description: Whether multi-factor authentication is enabled for the entity.
                                        type: boolean
                                      oauth_consent_restriction:
                                        description: OAuth consent restriction (e.g. admin_only, verified_only, unrestricted).
                                        type: string
                                      permissions:
                                        description: Action-level permissions granted to this entity (not roles or groups).
                                        items:
                                          type: string
                                        type: array
                                      storage_class:
                                        description: Storage tier or class assigned to a storage resource (e.g. hot, warm, cold, standard, archive).
                                        type: string
                                      watchlists:
                                        description: Watchlist identifiers the entity belongs to (v2).
                                        items:
                                          type: string
                                        type: array
                                  behaviors:
                                    additionalProperties: false
                                    description: Behavioral signals observed for the entity.
                                    type: object
                                    properties:
                                      anomaly_job_ids:
                                        description: Machine learning anomaly job identifiers (v2).
                                        items:
                                          type: string
                                        type: array
                                      rule_names:
                                        description: Detection rule names that flagged this entity (v2).
                                        items:
                                          type: string
                                        type: array
                                  created_by:
                                    description: Identifies which engine created this entity (for example, logs_extraction or risk_score_maintainer).
                                    type: string
                                  EngineMetadata:
                                    additionalProperties: false
                                    type: object
                                    properties:
                                      Type:
                                        description: The engine type that produced this entity record.
                                        type: string
                                  id:
                                    description: Unique identifier for this entity.
                                    type: string
                                  lifecycle:
                                    additionalProperties: false
                                    description: Timestamps tracking the entity lifecycle.
                                    type: object
                                    properties:
                                      first_seen:
                                        description: When the entity was first observed.
                                        format: date-time
                                        pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
                                        type: string
                                      last_activity:
                                        description: When the entity last generated activity.
                                        format: date-time
                                        pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
                                        type: string
                                      last_seen:
                                        description: When the entity was last observed.
                                        format: date-time
                                        pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
                                        type: string
                                  name:
                                    description: Human-readable name of the entity.
                                    type: string
                                  relationships:
                                    additionalProperties: false
                                    description: Connections between this entity and other entities.
                                    type: object
                                    properties:
                                      accesses_frequently:
                                        additionalProperties: false
                                        description: Entities this entity accesses frequently.
                                        type: object
                                        properties:
                                          ids:
                                            description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                            items:
                                              type: string
                                            type: array
                                          raw_identifiers:
                                            additionalProperties: false
                                            type: object
                                            properties:
                                              entity.id:
                                                items:
                                                  type: string
                                                type: array
                                              host.id:
                                                items:
                                                  type: string
                                                type: array
                                              host.name:
                                                items:
                                                  type: string
                                                type: array
                                              service.name:
                                                items:
                                                  type: string
                                                type: array
                                              user.email:
                                                items:
                                                  type: string
                                                type: array
                                              user.id:
                                                items:
                                                  type: string
                                                type: array
                                              user.name:
                                                items:
                                                  type: string
                                                type: array
                                      accesses_infrequently:
                                        additionalProperties: false
                                        description: Entities this entity accesses infrequently.
                                        type: object
                                        properties:
                                          ids:
                                            description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                            items:
                                              type: string
                                            type: array
                                          raw_identifiers:
                                            additionalProperties: false
                                            type: object
                                            properties:
                                              entity.id:
                                                items:
                                                  type: string
                                                type: array
                                              host.id:
                                                items:
                                                  type: string
                                                type: array
                                              host.name:
                                                items:
                                                  type: string
                                                type: array
                                              service.name:
                                                items:
                                                  type: string
                                                type: array
                                              user.email:
                                                items:
                                                  type: string
                                                type: array
                                              user.id:
                                                items:
                                                  type: string
                                                type: array
                                              user.name:
                                                items:
                                                  type: string
                                                type: array
                                      administers:
                                        additionalProperties: false
                                        description: Entities this entity administers (for example, a user who is an admin of a service).
                                        type: object
                                        properties:
                                          ids:
                                            description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                            items:
                                              type: string
                                            type: array
                                          raw_identifiers:
                                            additionalProperties: false
                                            type: object
                                            properties:
                                              entity.id:
                                                items:
                                                  type: string
                                                type: array
                                              host.id:
                                                items:
                                                  type: string
                                                type: array
                                              host.name:
                                                items:
                                                  type: string
                                                type: array
                                              service.name:
                                                items:
                                                  type: string
                                                type: array
                                              user.email:
                                                items:
                                                  type: string
                                                type: array
                                              user.id:
                                                items:
                                                  type: string
                                                type: array
                                              user.name:
                                                items:
                                                  type: string
                                                type: array
                                      communicates_with:
                                        additionalProperties: false
                                        description: Entities this entity communicates with.
                                        type: object
                                        properties:
                                          ids:
                                            description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                            items:
                                              type: string
                                            type: array
                                          raw_identifiers:
                                            additionalProperties: false
                                            type: object
                                            properties:
                                              entity.id:
                                                items:
                                                  type: string
                                                type: array
                                              host.id:
                                                items:
                                                  type: string
                                                type: array
                                              host.name:
                                                items:
                                                  type: string
                                                type: array
                                              service.name:
                                                items:
                                                  type: string
                                                type: array
                                              user.email:
                                                items:
                                                  type: string
                                                type: array
                                              user.id:
                                                items:
                                                  type: string
                                                type: array
                                              user.name:
                                                items:
                                                  type: string
                                                type: array
                                      depends_on:
                                        additionalProperties: false
                                        description: Entities this entity depends on.
                                        type: object
                                        properties:
                                          ids:
                                            description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                            items:
                                              type: string
                                            type: array
                                          raw_identifiers:
                                            additionalProperties: false
                                            type: object
                                            properties:
                                              entity.id:
                                                items:
                                                  type: string
                                                type: array
                                              host.id:
                                                items:
                                                  type: string
                                                type: array
                                              host.name:
                                                items:
                                                  type: string
                                                type: array
                                              service.name:
                                                items:
                                                  type: string
                                                type: array
                                              user.email:
                                                items:
                                                  type: string
                                                type: array
                                              user.id:
                                                items:
                                                  type: string
                                                type: array
                                              user.name:
                                                items:
                                                  type: string
                                                type: array
                                      owns:
                                        additionalProperties: false
                                        description: Entities owned by this entity.
                                        type: object
                                        properties:
                                          ids:
                                            description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                            items:
                                              type: string
                                            type: array
                                          raw_identifiers:
                                            additionalProperties: false
                                            type: object
                                            properties:
                                              entity.id:
                                                items:
                                                  type: string
                                                type: array
                                              host.id:
                                                items:
                                                  type: string
                                                type: array
                                              host.name:
                                                items:
                                                  type: string
                                                type: array
                                              service.name:
                                                items:
                                                  type: string
                                                type: array
                                              user.email:
                                                items:
                                                  type: string
                                                type: array
                                              user.id:
                                                items:
                                                  type: string
                                                type: array
                                              user.name:
                                                items:
                                                  type: string
                                                type: array
                                      owns_inferred:
                                        additionalProperties: false
                                        description: Entities inferred to be owned by this entity.
                                        type: object
                                        properties:
                                          ids:
                                            description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                            items:
                                              type: string
                                            type: array
                                          raw_identifiers:
                                            additionalProperties: false
                                            type: object
                                            properties:
                                              entity.id:
                                                items:
                                                  type: string
                                                type: array
                                              host.id:
                                                items:
                                                  type: string
                                                type: array
                                              host.name:
                                                items:
                                                  type: string
                                                type: array
                                              service.name:
                                                items:
                                                  type: string
                                                type: array
                                              user.email:
                                                items:
                                                  type: string
                                                type: array
                                              user.id:
                                                items:
                                                  type: string
                                                type: array
                                              user.name:
                                                items:
                                                  type: string
                                                type: array
                                      resolution:
                                        additionalProperties: false
                                        description: Resolution metadata linking this entity to another.
                                        type: object
                                        properties:
                                          resolved_to:
                                            description: entity.id of the entity this one resolves to
                                            type: string
                                          risk:
                                            additionalProperties: false
                                            description: Aggregated risk score for the resolution group.
                                            type: object
                                            properties:
                                              calculated_level:
                                                description: Lexical description of the resolution group's aggregated risk.
                                                enum:
                                                  - Unknown
                                                  - Low
                                                  - Moderate
                                                  - High
                                                  - Critical
                                                type: string
                                              calculated_score:
                                                description: The raw numeric value of the resolution group's aggregated risk score.
                                                type: number
                                              calculated_score_norm:
                                                description: The normalized numeric value of the resolution group's aggregated risk score.
                                                maximum: 100
                                                minimum: 0
                                                type: number
                                      supervises:
                                        additionalProperties: false
                                        description: Entities supervised by this entity.
                                        type: object
                                        properties:
                                          ids:
                                            description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                            items:
                                              type: string
                                            type: array
                                          raw_identifiers:
                                            additionalProperties: false
                                            type: object
                                            properties:
                                              entity.id:
                                                items:
                                                  type: string
                                                type: array
                                              host.id:
                                                items:
                                                  type: string
                                                type: array
                                              host.name:
                                                items:
                                                  type: string
                                                type: array
                                              service.name:
                                                items:
                                                  type: string
                                                type: array
                                              user.email:
                                                items:
                                                  type: string
                                                type: array
                                              user.id:
                                                items:
                                                  type: string
                                                type: array
                                              user.name:
                                                items:
                                                  type: string
                                                type: array
                                  risk:
                                    additionalProperties: false
                                    description: Risk scoring information for the entity.
                                    type: object
                                    properties:
                                      calculated_level:
                                        description: Lexical description of the entity's risk.
                                        enum:
                                          - Unknown
                                          - Low
                                          - Moderate
                                          - High
                                          - Critical
                                        type: string
                                      calculated_score:
                                        description: The raw numeric value of the given entity's risk score.
                                        type: number
                                      calculated_score_norm:
                                        description: The normalized numeric value of the given entity's risk score. Useful for comparing with other entities.
                                        maximum: 100
                                        minimum: 0
                                        type: number
                                  schema_version:
                                    description: Schema version of the entity record.
                                    type: string
                                  source:
                                    description: Sources that produced this entity record.
                                    items:
                                      type: string
                                    type: array
                                  sub_type:
                                    description: Optional sub-type classification for the entity.
                                    type: string
                                  type:
                                    description: The entity type.
                                    type: string
                                  url:
                                    description: URL associated with the entity.
                                    type: string
                              event:
                                additionalProperties: false
                                type: object
                                properties:
                                  ingested:
                                    description: When the event was ingested into Elasticsearch.
                                    format: date-time
                                    pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
                                    type: string
                              host:
                                additionalProperties: false
                                description: Elastic Common Schema (ECS) host fields collected on the entity.
                                type: object
                                properties:
                                  architecture:
                                    description: Observed CPU architectures.
                                    items:
                                      type: string
                                    type: array
                                  domain:
                                    description: Observed host domains.
                                    items:
                                      type: string
                                    type: array
                                  hostname:
                                    description: Observed hostnames.
                                    items:
                                      type: string
                                    type: array
                                  id:
                                    description: Observed host identifiers.
                                    items:
                                      type: string
                                    type: array
                                  ip:
                                    description: Observed IP addresses.
                                    items:
                                      type: string
                                    type: array
                                  mac:
                                    description: Observed MAC addresses.
                                    items:
                                      type: string
                                    type: array
                                  name:
                                    description: Primary host name.
                                    type: string
                                  os:
                                    additionalProperties: false
                                    description: Elastic Common Schema (ECS) host.os fields collected on the entity latest index (v2).
                                    type: object
                                    properties:
                                      family:
                                        type: string
                                      full:
                                        type: string
                                      kernel:
                                        type: string
                                      name:
                                        anyOf:
                                          - type: string
                                          - items:
                                              type: string
                                            type: array
                                      platform:
                                        type: string
                                      type:
                                        anyOf:
                                          - type: string
                                          - items:
                                              type: string
                                            type: array
                                      version:
                                        type: string
                                  risk:
                                    additionalProperties: false
                                    type: object
                                    properties:
                                      calculated_level:
                                        description: Lexical description of the entity's risk.
                                        enum:
                                          - Unknown
                                          - Low
                                          - Moderate
                                          - High
                                          - Critical
                                        type: string
                                      calculated_score:
                                        description: The raw numeric value of the given entity's risk score.
                                        type: number
                                      calculated_score_norm:
                                        description: The normalized numeric value of the given entity's risk score.
                                        maximum: 100
                                        minimum: 0
                                        type: number
                                  type:
                                    description: Observed host types.
                                    items:
                                      type: string
                                    type: array
                              labels:
                                additionalProperties: {}
                                description: Custom key-value labels attached to the entity.
                                type: object
                                properties: {}
                              tags:
                                description: Tags attached to the entity.
                                items:
                                  type: string
                                type: array
                          - additionalProperties: false
                            type: object
                            properties:
                              '@timestamp':
                                description: The time the entity record was last updated.
                                format: date-time
                                pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
                                type: string
                              asset:
                                additionalProperties: false
                                type: object
                                properties:
                                  business_unit:
                                    description: Business unit the asset belongs to.
                                    type: string
                                  criticality:
                                    description: The criticality level assigned to this asset.
                                    enum:
                                      - low_impact
                                      - medium_impact
                                      - high_impact
                                      - extreme_impact
                                    nullable: true
                                    type: string
                                  environment:
                                    description: Deployment environment (for example, production, staging).
                                    type: string
                                  id:
                                    description: Unique identifier for the asset.
                                    type: string
                                  model:
                                    description: Model name or number.
                                    type: string
                                  name:
                                    description: Human-readable asset name.
                                    type: string
                                  owner:
                                    description: The owner of the asset.
                                    type: string
                                  serial_number:
                                    description: Serial number of the asset.
                                    type: string
                                  vendor:
                                    description: Vendor or manufacturer.
                                    type: string
                              entity:
                                additionalProperties: false
                                type: object
                                properties:
                                  attributes:
                                    additionalProperties: false
                                    description: Boolean flags describing characteristics of the entity.
                                    type: object
                                    properties:
                                      asset:
                                        description: Whether the entity is classified as an asset.
                                        type: boolean
                                      known_redirects:
                                        description: Known redirect URIs or URLs (e.g. OAuth application callbacks).
                                        items:
                                          type: string
                                        type: array
                                      managed:
                                        description: Whether the entity is managed (for example, via a directory service).
                                        type: boolean
                                      mfa_enabled:
                                        description: Whether multi-factor authentication is enabled for the entity.
                                        type: boolean
                                      oauth_consent_restriction:
                                        description: OAuth consent restriction (e.g. admin_only, verified_only, unrestricted).
                                        type: string
                                      permissions:
                                        description: Action-level permissions granted to this entity (not roles or groups).
                                        items:
                                          type: string
                                        type: array
                                      storage_class:
                                        description: Storage tier or class assigned to a storage resource (e.g. hot, warm, cold, standard, archive).
                                        type: string
                                      watchlists:
                                        description: Watchlist identifiers the entity belongs to (v2).
                                        items:
                                          type: string
                                        type: array
                                  behaviors:
                                    additionalProperties: false
                                    description: Behavioral signals observed for the entity.
                                    type: object
                                    properties:
                                      anomaly_job_ids:
                                        description: Machine learning anomaly job identifiers (v2).
                                        items:
                                          type: string
                                        type: array
                                      rule_names:
                                        description: Detection rule names that flagged this entity (v2).
                                        items:
                                          type: string
                                        type: array
                                  created_by:
                                    description: Identifies which engine created this entity (for example, logs_extraction or risk_score_maintainer).
                                    type: string
                                  EngineMetadata:
                                    additionalProperties: false
                                    type: object
                                    properties:
                                      Type:
                                        description: The engine type that produced this entity record.
                                        type: string
                                  id:
                                    description: Unique identifier for this entity.
                                    type: string
                                  lifecycle:
                                    additionalProperties: false
                                    description: Timestamps tracking the entity lifecycle.
                                    type: object
                                    properties:
                                      first_seen:
                                        description: When the entity was first observed.
                                        format: date-time
                                        pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
                                        type: string
                                      last_activity:
                                        description: When the entity last generated activity.
                                        format: date-time
                                        pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
                                        type: string
                                      last_seen:
                                        description: When the entity was last observed.
                                        format: date-time
                                        pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
                                        type: string
                                  name:
                                    description: Human-readable name of the entity.
                                    type: string
                                  relationships:
                                    additionalProperties: false
                                    description: Connections between this entity and other entities.
                                    type: object
                                    properties:
                                      accesses_frequently:
                                        additionalProperties: false
                                        description: Entities this entity accesses frequently.
                                        type: object
                                        properties:
                                          ids:
                                            description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                            items:
                                              type: string
                                            type: array
                                          raw_identifiers:
                                            additionalProperties: false
                                            type: object
                                            properties:
                                              entity.id:
                                                items:
                                                  type: string
                                                type: array
                                              host.id:
                                                items:
                                                  type: string
                                                type: array
                                              host.name:
                                                items:
                                                  type: string
                                                type: array
                                              service.name:
                                                items:
                                                  type: string
                                                type: array
                                              user.email:
                                                items:
                                                  type: string
                                                type: array
                                              user.id:
                                                items:
                                                  type: string
                                                type: array
                                              user.name:
                                                items:
                                                  type: string
                                                type: array
                                      accesses_infrequently:
                                        additionalProperties: false
                                        description: Entities this entity accesses infrequently.
                                        type: object
                                        properties:
                                          ids:
                                            description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                            items:
                                              type: string
                                            type: array
                                          raw_identifiers:
                                            additionalProperties: false
                                            type: object
                                            properties:
                                              entity.id:
                                                items:
                                                  type: string
                                                type: array
                                              host.id:
                                                items:
                                                  type: string
                                                type: array
                                              host.name:
                                                items:
                                                  type: string
                                                type: array
                                              service.name:
                                                items:
                                                  type: string
                                                type: array
                                              user.email:
                                                items:
                                                  type: string
                                                type: array
                                              user.id:
                                                items:
                                                  type: string
                                                type: array
                                              user.name:
                                                items:
                                                  type: string
                                                type: array
                                      administers:
                                        additionalProperties: false
                                        description: Entities this entity administers (for example, a user who is an admin of a service).
                                        type: object
                                        properties:
                                          ids:
                                            description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                            items:
                                              type: string
                                            type: array
                                          raw_identifiers:
                                            additionalProperties: false
                                            type: object
                                            properties:
                                              entity.id:
                                                items:
                                                  type: string
                                                type: array
                                              host.id:
                                                items:
                                                  type: string
                                                type: array
                                              host.name:
                                                items:
                                                  type: string
                                                type: array
                                              service.name:
                                                items:
                                                  type: string
                                                type: array
                                              user.email:
                                                items:
                                                  type: string
                                                type: array
                                              user.id:
                                                items:
                                                  type: string
                                                type: array
                                              user.name:
                                                items:
                                                  type: string
                                                type: array
                                      communicates_with:
                                        additionalProperties: false
                                        description: Entities this entity communicates with.
                                        type: object
                                        properties:
                                          ids:
                                            description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                            items:
                                              type: string
                                            type: array
                                          raw_identifiers:
                                            additionalProperties: false
                                            type: object
                                            properties:
                                              entity.id:
                                                items:
                                                  type: string
                                                type: array
                                              host.id:
                                                items:
                                                  type: string
                                                type: array
                                              host.name:
                                                items:
                                                  type: string
                                                type: array
                                              service.name:
                                                items:
                                                  type: string
                                                type: array
                                              user.email:
                                                items:
                                                  type: string
                                                type: array
                                              user.id:
                                                items:
                                                  type: string
                                                type: array
                                              user.name:
                                                items:
                                                  type: string
                                                type: array
                                      depends_on:
                                        additionalProperties: false
                                        description: Entities this entity depends on.
                                        type: object
                                        properties:
                                          ids:
                                            description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                            items:
                                              type: string
                                            type: array
                                          raw_identifiers:
                                            additionalProperties: false
                                            type: object
                                            properties:
                                              entity.id:
                                                items:
                                                  type: string
                                                type: array
                                              host.id:
                                                items:
                                                  type: string
                                                type: array
                                              host.name:
                                                items:
                                                  type: string
                                                type: array
                                              service.name:
                                                items:
                                                  type: string
                                                type: array
                                              user.email:
                                                items:
                                                  type: string
                                                type: array
                                              user.id:
                                                items:
                                                  type: string
                                                type: array
                                              user.name:
                                                items:
                                                  type: string
                                                type: array
                                      owns:
                                        additionalProperties: false
                                        description: Entities owned by this entity.
                                        type: object
                                        properties:
                                          ids:
                                            description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                            items:
                                              type: string
                                            type: array
                                          raw_identifiers:
                                            additionalProperties: false
                                            type: object
                                            properties:
                                              entity.id:
                                                items:
                                                  type: string
                                                type: array
                                              host.id:
                                                items:
                                                  type: string
                                                type: array
                                              host.name:
                                                items:
                                                  type: string
                                                type: array
                                              service.name:
                                                items:
                                                  type: string
                                                type: array
                                              user.email:
                                                items:
                                                  type: string
                                                type: array
                                              user.id:
                                                items:
                                                  type: string
                                                type: array
                                              user.name:
                                                items:
                                                  type: string
                                                type: array
                                      owns_inferred:
                                        additionalProperties: false
                                        description: Entities inferred to be owned by this entity.
                                        type: object
                                        properties:
                                          ids:
                                            description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                            items:
                                              type: string
                                            type: array
                                          raw_identifiers:
                                            additionalProperties: false
                                            type: object
                                            properties:
                                              entity.id:
                                                items:
                                                  type: string
                                                type: array
                                              host.id:
                                                items:
                                                  type: string
                                                type: array
                                              host.name:
                                                items:
                                                  type: string
                                                type: array
                                              service.name:
                                                items:
                                                  type: string
                                                type: array
                                              user.email:
                                                items:
                                                  type: string
                                                type: array
                                              user.id:
                                                items:
                                                  type: string
                                                type: array
                                              user.name:
                                                items:
                                                  type: string
                                                type: array
                                      resolution:
                                        additionalProperties: false
                                        description: Resolution metadata linking this entity to another.
                                        type: object
                                        properties:
                                          resolved_to:
                                            description: entity.id of the entity this one resolves to
                                            type: string
                                          risk:
                                            additionalProperties: false
                                            description: Aggregated risk score for the resolution group.
                                            type: object
                                            properties:
                                              calculated_level:
                                                description: Lexical description of the resolution group's aggregated risk.
                                                enum:
                                                  - Unknown
                                                  - Low
                                                  - Moderate
                                                  - High
                                                  - Critical
                                                type: string
                                              calculated_score:
                                                description: The raw numeric value of the resolution group's aggregated risk score.
                                                type: number
                                              calculated_score_norm:
                                                description: The normalized numeric value of the resolution group's aggregated risk score.
                                                maximum: 100
                                                minimum: 0
                                                type: number
                                      supervises:
                                        additionalProperties: false
                                        description: Entities supervised by this entity.
                                        type: object
                                        properties:
                                          ids:
                                            description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                            items:
                                              type: string
                                            type: array
                                          raw_identifiers:
                                            additionalProperties: false
                                            type: object
                                            properties:
                                              entity.id:
                                                items:
                                                  type: string
                                                type: array
                                              host.id:
                                                items:
                                                  type: string
                                                type: array
                                              host.name:
                                                items:
                                                  type: string
                                                type: array
                                              service.name:
                                                items:
                                                  type: string
                                                type: array
                                              user.email:
                                                items:
                                                  type: string
                                                type: array
                                              user.id:
                                                items:
                                                  type: string
                                                type: array
                                              user.name:
                                                items:
                                                  type: string
                                                type: array
                                  risk:
                                    additionalProperties: false
                                    description: Risk scoring information for the entity.
                                    type: object
                                    properties:
                                      calculated_level:
                                        description: Lexical description of the entity's risk.
                                        enum:
                                          - Unknown
                                          - Low
                                          - Moderate
                                          - High
                                          - Critical
                                        type: string
                                      calculated_score:
                                        description: The raw numeric value of the given entity's risk score.
                                        type: number
                                      calculated_score_norm:
                                        description: The normalized numeric value of the given entity's risk score. Useful for comparing with other entities.
                                        maximum: 100
                                        minimum: 0
                                        type: number
                                  schema_version:
                                    description: Schema version of the entity record.
                                    type: string
                                  source:
                                    description: Sources that produced this entity record.
                                    items:
                                      type: string
                                    type: array
                                  sub_type:
                                    description: Optional sub-type classification for the entity.
                                    type: string
                                  type:
                                    description: The entity type.
                                    type: string
                                  url:
                                    description: URL associated with the entity.
                                    type: string
                              event:
                                additionalProperties: false
                                type: object
                                properties:
                                  ingested:
                                    description: When the event was ingested into Elasticsearch.
                                    format: date-time
                                    pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
                                    type: string
                              labels:
                                additionalProperties: {}
                                description: Custom key-value labels attached to the entity.
                                type: object
                                properties: {}
                              service:
                                additionalProperties: false
                                description: Elastic Common Schema (ECS) service fields collected on the entity.
                                type: object
                                properties:
                                  address:
                                    description: Service address.
                                    type: string
                                  environment:
                                    description: Service environment (for example, production, staging).
                                    type: string
                                  ephemeral_id:
                                    description: Ephemeral identifier of the service.
                                    type: string
                                  id:
                                    description: Unique identifier of the service.
                                    type: string
                                  name:
                                    description: Primary service name.
                                    type: string
                                  node:
                                    additionalProperties: false
                                    description: Node information for the service.
                                    type: object
                                    properties:
                                      name:
                                        description: Node name.
                                        type: string
                                      role:
                                        description: Node role.
                                        type: string
                                      roles:
                                        description: Node roles.
                                        items:
                                          type: string
                                        type: array
                                  risk:
                                    additionalProperties: false
                                    type: object
                                    properties:
                                      calculated_level:
                                        description: Lexical description of the entity's risk.
                                        enum:
                                          - Unknown
                                          - Low
                                          - Moderate
                                          - High
                                          - Critical
                                        type: string
                                      calculated_score:
                                        description: The raw numeric value of the given entity's risk score.
                                        type: number
                                      calculated_score_norm:
                                        description: The normalized numeric value of the given entity's risk score.
                                        maximum: 100
                                        minimum: 0
                                        type: number
                                  state:
                                    description: Current state of the service.
                                    type: string
                                  type:
                                    description: Service type.
                                    type: string
                                  version:
                                    description: Service version.
                                    type: string
                              tags:
                                description: Tags attached to the entity.
                                items:
                                  type: string
                                type: array
                          - additionalProperties: false
                            type: object
                            properties:
                              '@timestamp':
                                description: The time the entity record was last updated.
                                format: date-time
                                pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
                                type: string
                              asset:
                                additionalProperties: false
                                type: object
                                properties:
                                  business_unit:
                                    description: Business unit the asset belongs to.
                                    type: string
                                  criticality:
                                    description: The criticality level assigned to this asset.
                                    enum:
                                      - low_impact
                                      - medium_impact
                                      - high_impact
                                      - extreme_impact
                                    nullable: true
                                    type: string
                                  environment:
                                    description: Deployment environment (for example, production, staging).
                                    type: string
                                  id:
                                    description: Unique identifier for the asset.
                                    type: string
                                  model:
                                    description: Model name or number.
                                    type: string
                                  name:
                                    description: Human-readable asset name.
                                    type: string
                                  owner:
                                    description: The owner of the asset.
                                    type: string
                                  serial_number:
                                    description: Serial number of the asset.
                                    type: string
                                  vendor:
                                    description: Vendor or manufacturer.
                                    type: string
                              cloud:
                                additionalProperties: false
                                description: Elastic Common Schema (ECS) cloud fields for cloud-hosted entities.
                                type: object
                                properties:
                                  account:
                                    additionalProperties: false
                                    type: object
                                    properties:
                                      id:
                                        type: string
                                      name:
                                        type: string
                                  availability_zone:
                                    type: string
                                  instance:
                                    additionalProperties: false
                                    type: object
                                    properties:
                                      id:
                                        type: string
                                      name:
                                        type: string
                                  machine:
                                    additionalProperties: false
                                    type: object
                                    properties:
                                      type:
                                        type: string
                                  project:
                                    additionalProperties: false
                                    type: object
                                    properties:
                                      id:
                                        type: string
                                      name:
                                        type: string
                                  provider:
                                    type: string
                                  region:
                                    type: string
                                  service:
                                    additionalProperties: false
                                    type: object
                                    properties:
                                      name:
                                        type: string
                              entity:
                                additionalProperties: false
                                type: object
                                properties:
                                  attributes:
                                    additionalProperties: false
                                    description: Boolean flags describing characteristics of the entity.
                                    type: object
                                    properties:
                                      asset:
                                        description: Whether the entity is classified as an asset.
                                        type: boolean
                                      known_redirects:
                                        description: Known redirect URIs or URLs (e.g. OAuth application callbacks).
                                        items:
                                          type: string
                                        type: array
                                      managed:
                                        description: Whether the entity is managed (for example, via a directory service).
                                        type: boolean
                                      mfa_enabled:
                                        description: Whether multi-factor authentication is enabled for the entity.
                                        type: boolean
                                      oauth_consent_restriction:
                                        description: OAuth consent restriction (e.g. admin_only, verified_only, unrestricted).
                                        type: string
                                      permissions:
                                        description: Action-level permissions granted to this entity (not roles or groups).
                                        items:
                                          type: string
                                        type: array
                                      storage_class:
                                        description: Storage tier or class assigned to a storage resource (e.g. hot, warm, cold, standard, archive).
                                        type: string
                                      watchlists:
                                        description: Watchlist identifiers the entity belongs to (v2).
                                        items:
                                          type: string
                                        type: array
                                  behaviors:
                                    additionalProperties: false
                                    description: Behavioral signals observed for the entity.
                                    type: object
                                    properties:
                                      anomaly_job_ids:
                                        description: Machine learning anomaly job identifiers (v2).
                                        items:
                                          type: string
                                        type: array
                                      rule_names:
                                        description: Detection rule names that flagged this entity (v2).
                                        items:
                                          type: string
                                        type: array
                                  created_by:
                                    description: Identifies which engine created this entity (for example, logs_extraction or risk_score_maintainer).
                                    type: string
                                  EngineMetadata:
                                    additionalProperties: false
                                    type: object
                                    properties:
                                      Type:
                                        description: The engine type that produced this entity record.
                                        type: string
                                  id:
                                    description: Unique identifier for this entity.
                                    type: string
                                  lifecycle:
                                    additionalProperties: false
                                    description: Timestamps tracking the entity lifecycle.
                                    type: object
                                    properties:
                                      first_seen:
                                        description: When the entity was first observed.
                                        format: date-time
                                        pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
                                        type: string
                                      last_activity:
                                        description: When the entity last generated activity.
                                        format: date-time
                                        pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
                                        type: string
                                      last_seen:
                                        description: When the entity was last observed.
                                        format: date-time
                                        pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
                                        type: string
                                  name:
                                    description: Human-readable name of the entity.
                                    type: string
                                  relationships:
                                    additionalProperties: false
                                    description: Connections between this entity and other entities.
                                    type: object
                                    properties:
                                      accesses_frequently:
                                        additionalProperties: false
                                        description: Entities this entity accesses frequently.
                                        type: object
                                        properties:
                                          ids:
                                            description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                            items:
                                              type: string
                                            type: array
                                          raw_identifiers:
                                            additionalProperties: false
                                            type: object
                                            properties:
                                              entity.id:
                                                items:
                                                  type: string
                                                type: array
                                              host.id:
                                                items:
                                                  type: string
                                                type: array
                                              host.name:
                                                items:
                                                  type: string
                                                type: array
                                              service.name:
                                                items:
                                                  type: string
                                                type: array
                                              user.email:
                                                items:
                                                  type: string
                                                type: array
                                              user.id:
                                                items:
                                                  type: string
                                                type: array
                                              user.name:
                                                items:
                                                  type: string
                                                type: array
                                      accesses_infrequently:
                                        additionalProperties: false
                                        description: Entities this entity accesses infrequently.
                                        type: object
                                        properties:
                                          ids:
                                            description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                            items:
                                              type: string
                                            type: array
                                          raw_identifiers:
                                            additionalProperties: false
                                            type: object
                                            properties:
                                              entity.id:
                                                items:
                                                  type: string
                                                type: array
                                              host.id:
                                                items:
                                                  type: string
                                                type: array
                                              host.name:
                                                items:
                                                  type: string
                                                type: array
                                              service.name:
                                                items:
                                                  type: string
                                                type: array
                                              user.email:
                                                items:
                                                  type: string
                                                type: array
                                              user.id:
                                                items:
                                                  type: string
                                                type: array
                                              user.name:
                                                items:
                                                  type: string
                                                type: array
                                      administers:
                                        additionalProperties: false
                                        description: Entities this entity administers (for example, a user who is an admin of a service).
                                        type: object
                                        properties:
                                          ids:
                                            description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                            items:
                                              type: string
                                            type: array
                                          raw_identifiers:
                                            additionalProperties: false
                                            type: object
                                            properties:
                                              entity.id:
                                                items:
                                                  type: string
                                                type: array
                                              host.id:
                                                items:
                                                  type: string
                                                type: array
                                              host.name:
                                                items:
                                                  type: string
                                                type: array
                                              service.name:
                                                items:
                                                  type: string
                                                type: array
                                              user.email:
                                                items:
                                                  type: string
                                                type: array
                                              user.id:
                                                items:
                                                  type: string
                                                type: array
                                              user.name:
                                                items:
                                                  type: string
                                                type: array
                                      communicates_with:
                                        additionalProperties: false
                                        description: Entities this entity communicates with.
                                        type: object
                                        properties:
                                          ids:
                                            description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                            items:
                                              type: string
                                            type: array
                                          raw_identifiers:
                                            additionalProperties: false
                                            type: object
                                            properties:
                                              entity.id:
                                                items:
                                                  type: string
                                                type: array
                                              host.id:
                                                items:
                                                  type: string
                                                type: array
                                              host.name:
                                                items:
                                                  type: string
                                                type: array
                                              service.name:
                                                items:
                                                  type: string
                                                type: array
                                              user.email:
                                                items:
                                                  type: string
                                                type: array
                                              user.id:
                                                items:
                                                  type: string
                                                type: array
                                              user.name:
                                                items:
                                                  type: string
                                                type: array
                                      depends_on:
                                        additionalProperties: false
                                        description: Entities this entity depends on.
                                        type: object
                                        properties:
                                          ids:
                                            description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                            items:
                                              type: string
                                            type: array
                                          raw_identifiers:
                                            additionalProperties: false
                                            type: object
                                            properties:
                                              entity.id:
                                                items:
                                                  type: string
                                                type: array
                                              host.id:
                                                items:
                                                  type: string
                                                type: array
                                              host.name:
                                                items:
                                                  type: string
                                                type: array
                                              service.name:
                                                items:
                                                  type: string
                                                type: array
                                              user.email:
                                                items:
                                                  type: string
                                                type: array
                                              user.id:
                                                items:
                                                  type: string
                                                type: array
                                              user.name:
                                                items:
                                                  type: string
                                                type: array
                                      owns:
                                        additionalProperties: false
                                        description: Entities owned by this entity.
                                        type: object
                                        properties:
                                          ids:
                                            description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                            items:
                                              type: string
                                            type: array
                                          raw_identifiers:
                                            additionalProperties: false
                                            type: object
                                            properties:
                                              entity.id:
                                                items:
                                                  type: string
                                                type: array
                                              host.id:
                                                items:
                                                  type: string
                                                type: array
                                              host.name:
                                                items:
                                                  type: string
                                                type: array
                                              service.name:
                                                items:
                                                  type: string
                                                type: array
                                              user.email:
                                                items:
                                                  type: string
                                                type: array
                                              user.id:
                                                items:
                                                  type: string
                                                type: array
                                              user.name:
                                                items:
                                                  type: string
                                                type: array
                                      owns_inferred:
                                        additionalProperties: false
                                        description: Entities inferred to be owned by this entity.
                                        type: object
                                        properties:
                                          ids:
                                            description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                            items:
                                              type: string
                                            type: array
                                          raw_identifiers:
                                            additionalProperties: false
                                            type: object
                                            properties:
                                              entity.id:
                                                items:
                                                  type: string
                                                type: array
                                              host.id:
                                                items:
                                                  type: string
                                                type: array
                                              host.name:
                                                items:
                                                  type: string
                                                type: array
                                              service.name:
                                                items:
                                                  type: string
                                                type: array
                                              user.email:
                                                items:
                                                  type: string
                                                type: array
                                              user.id:
                                                items:
                                                  type: string
                                                type: array
                                              user.name:
                                                items:
                                                  type: string
                                                type: array
                                      resolution:
                                        additionalProperties: false
                                        description: Resolution metadata linking this entity to another.
                                        type: object
                                        properties:
                                          resolved_to:
                                            description: entity.id of the entity this one resolves to
                                            type: string
                                          risk:
                                            additionalProperties: false
                                            description: Aggregated risk score for the resolution group.
                                            type: object
                                            properties:
                                              calculated_level:
                                                description: Lexical description of the resolution group's aggregated risk.
                                                enum:
                                                  - Unknown
                                                  - Low
                                                  - Moderate
                                                  - High
                                                  - Critical
                                                type: string
                                              calculated_score:
                                                description: The raw numeric value of the resolution group's aggregated risk score.
                                                type: number
                                              calculated_score_norm:
                                                description: The normalized numeric value of the resolution group's aggregated risk score.
                                                maximum: 100
                                                minimum: 0
                                                type: number
                                      supervises:
                                        additionalProperties: false
                                        description: Entities supervised by this entity.
                                        type: object
                                        properties:
                                          ids:
                                            description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                            items:
                                              type: string
                                            type: array
                                          raw_identifiers:
                                            additionalProperties: false
                                            type: object
                                            properties:
                                              entity.id:
                                                items:
                                                  type: string
                                                type: array
                                              host.id:
                                                items:
                                                  type: string
                                                type: array
                                              host.name:
                                                items:
                                                  type: string
                                                type: array
                                              service.name:
                                                items:
                                                  type: string
                                                type: array
                                              user.email:
                                                items:
                                                  type: string
                                                type: array
                                              user.id:
                                                items:
                                                  type: string
                                                type: array
                                              user.name:
                                                items:
                                                  type: string
                                                type: array
                                  risk:
                                    additionalProperties: false
                                    description: Risk scoring information for the entity.
                                    type: object
                                    properties:
                                      calculated_level:
                                        description: Lexical description of the entity's risk.
                                        enum:
                                          - Unknown
                                          - Low
                                          - Moderate
                                          - High
                                          - Critical
                                        type: string
                                      calculated_score:
                                        description: The raw numeric value of the given entity's risk score.
                                        type: number
                                      calculated_score_norm:
                                        description: The normalized numeric value of the given entity's risk score. Useful for comparing with other entities.
                                        maximum: 100
                                        minimum: 0
                                        type: number
                                  schema_version:
                                    description: Schema version of the entity record.
                                    type: string
                                  source:
                                    description: Sources that produced this entity record.
                                    items:
                                      type: string
                                    type: array
                                  sub_type:
                                    description: Optional sub-type classification for the entity.
                                    type: string
                                  type:
                                    description: The entity type.
                                    type: string
                                  url:
                                    description: URL associated with the entity.
                                    type: string
                              event:
                                additionalProperties: false
                                type: object
                                properties:
                                  ingested:
                                    format: date-time
                                    pattern: ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$
                                    type: string
                              labels:
                                additionalProperties: {}
                                type: object
                                properties: {}
                              orchestrator:
                                additionalProperties: false
                                description: Elastic Common Schema (ECS) orchestrator fields for container-orchestrated entities.
                                type: object
                                properties:
                                  api_version:
                                    type: string
                                  cluster:
                                    additionalProperties: false
                                    type: object
                                    properties:
                                      id:
                                        type: string
                                      name:
                                        type: string
                                      url:
                                        type: string
                                      version:
                                        type: string
                                  namespace:
                                    type: string
                                  organization:
                                    type: string
                                  resource:
                                    additionalProperties: false
                                    type: object
                                    properties:
                                      annotation:
                                        type: string
                                      id:
                                        type: string
                                      ip:
                                        type: string
                                      label:
                                        type: string
                                      name:
                                        type: string
                                      parent:
                                        additionalProperties: false
                                        type: object
                                        properties:
                                          type:
                                            type: string
                                      type:
                                        type: string
                                  type:
                                    type: string
                              tags:
                                items:
                                  type: string
                                type: array
                      type:
                        description: The entity type of this record.
                        enum:
                          - user
                          - host
                          - service
                          - generic
                        type: string
                    required:
                      - type
                  type: array
              required:
                - entities
      responses:
        '200':
          content:
            application/json:
              examples:
                bulkUpdatePartialExample:
                  description: Some entities were updated but others encountered Elasticsearch-level errors.
                  summary: Partial success with errors
                  value:
                    errors:
                      - _id: 5de9f93a68a72532e736bf5a6184b06300b9cabf
                        reason: '[5de9f93a68a72532e736bf5a6184b06300b9cabf]: document missing'
                        status: 404
                        type: document_missing_exception
                    ok: true
                bulkUpdateSuccessExample:
                  description: All entities were successfully updated with no errors.
                  summary: All entities updated
                  value:
                    errors: []
                    ok: true
          description: Indicates a successful response.
        '400':
          content:
            application/json:
              examples:
                protectedFieldsExample:
                  description: The request attempts to update protected fields without the force query parameter.
                  summary: Protected fields without force
                  value:
                    error: Bad Request
                    message: 'Bad request: The following attributes are not allowed to be updated without forcing it (?force=true): entity.name, entity.type'
                    statusCode: 400
          description: Bad request.
      summary: Bulk update entities
      tags:
        - Security entity store
      x-codeSamples:
        - lang: curl
          source: |
            curl -X PUT -H "kbn-xsrf: true" -H "Authorization: ApiKey ${API_KEY}" \
              -H "Content-Type: application/json" \
              -d '{"entities":[{"type":"host","doc":{"entity":{"id":"host:web-server-prod-01","name":"web-server-prod-01","type":"host","attributes":{"asset":true}},"host":{"name":"web-server-prod-01"}}}]}' \
              "${KIBANA_URL}/api/security/entity_store/entities/bulk?force=true"
        - lang: Console
          source: |
            PUT kbn://api/security/entity_store/entities/bulk?force=true
            {
              "entities": [
                {
                  "type": "host",
                  "doc": {
                    "entity": {
                      "id": "host:web-server-prod-01",
                      "name": "web-server-prod-01",
                      "type": "host",
                      "attributes": { "asset": true }
                    },
                    "host": { "name": "web-server-prod-01" }
                  }
                }
              ]
            }
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/security/entity_store/history_snapshot/disable:
    put:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb put">put</span>&nbsp;<span class="operation-path">/s/{space_id}/api/security/entity_store/history_snapshot/disable</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Disable the Entity Store history snapshot task for this space so it no longer creates snapshot indices. Existing snapshot indices remain unless you set `clearHistorySnapshots` to `true`. Returns 404 if the Entity Store is not installed in the current space.<br/><br/>[Required authorization] Route required privileges: securitySolution.
      operationId: put-security-entity-store-history-snapshot-disable
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
      requestBody:
        content:
          application/json:
            examples:
              disableAndClear:
                summary: Disable and clear snapshot indices
                value:
                  clearHistorySnapshots: true
              disableOnly:
                summary: Disable without clearing
                value: {}
            schema:
              additionalProperties: false
              type: object
              properties:
                clearHistorySnapshots:
                  default: false
                  description: When `true`, deletes existing history snapshot indices for this space in the background after the task is disabled. The response returns immediately and does not wait for deletion to finish. Deletion failures are logged and are not returned to the caller. If the task is already disabled, the request succeeds and does not delete indices. Defaults to `false`.
                  type: boolean
      responses:
        '200':
          content:
            application/json:
              examples:
                disableSuccessExample:
                  description: The Entity Store history snapshot task was disabled.
                  summary: History snapshot task disabled
                  value:
                    ok: true
          description: Indicates a successful response.
        '404':
          content:
            application/json:
              examples:
                notInstalledExample:
                  description: The Entity Store history snapshot task cannot be disabled because the entity store is not installed.
                  summary: Entity store not installed
                  value:
                    error: Not Found
                    message: Entity store is not installed
                    statusCode: 404
          description: Entity store is not installed.
      summary: Disable the history snapshot task
      tags:
        - Security entity store
      x-codeSamples:
        - lang: curl
          source: |
            curl -X PUT -H "kbn-xsrf: true" -H "Content-Type: application/json" \
              -H "Authorization: ApiKey ${API_KEY}" \
              -d '{}' \
              "${KIBANA_URL}/api/security/entity_store/history_snapshot/disable"
        - label: Disable and clear indices
          lang: curl
          source: |
            curl -X PUT -H "kbn-xsrf: true" -H "Content-Type: application/json" \
              -H "Authorization: ApiKey ${API_KEY}" \
              -d '{"clearHistorySnapshots":true}' \
              "${KIBANA_URL}/api/security/entity_store/history_snapshot/disable"
        - lang: Console
          source: |
            PUT kbn://api/security/entity_store/history_snapshot/disable
            {}
        - label: Disable and clear indices
          lang: Console
          source: |
            PUT kbn://api/security/entity_store/history_snapshot/disable
            {
              "clearHistorySnapshots": true
            }
      x-state: Generally available; added in 9.6.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/security/entity_store/history_snapshot/enable:
    put:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb put">put</span>&nbsp;<span class="operation-path">/s/{space_id}/api/security/entity_store/history_snapshot/enable</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Enable the Entity Store history snapshot task for this space. After a successful enable, Kibana schedules an immediate snapshot run. If that immediate run fails, the response is still 200 and the task remains enabled for the next scheduled interval. If the task is already enabled, the request succeeds and does not start an extra run. Returns 404 if the Entity Store is not installed in the current space.<br/><br/>[Required authorization] Route required privileges: securitySolution.
      operationId: put-security-entity-store-history-snapshot-enable
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                enableSuccessExample:
                  description: The Entity Store history snapshot task was enabled.
                  summary: History snapshot task enabled
                  value:
                    ok: true
          description: Indicates a successful response.
        '404':
          content:
            application/json:
              examples:
                notInstalledExample:
                  description: The Entity Store history snapshot task cannot be enabled because the entity store is not installed.
                  summary: Entity store not installed
                  value:
                    error: Not Found
                    message: Entity store is not installed
                    statusCode: 404
          description: Entity store is not installed.
      summary: Enable the history snapshot task
      tags:
        - Security entity store
      x-codeSamples:
        - lang: curl
          source: |
            curl -X PUT -H "kbn-xsrf: true" -H "Authorization: ApiKey ${API_KEY}" \
              "${KIBANA_URL}/api/security/entity_store/history_snapshot/enable"
        - lang: Console
          source: |
            PUT kbn://api/security/entity_store/history_snapshot/enable
      x-state: Generally available; added in 9.6.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/security/entity_store/install:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/security/entity_store/install</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Install the Entity Store and create engines for the specified entity types. A single `logExtraction` configuration is shared across all entity types. Supply it once at install to customize settings; omit it (or send an empty object) to use defaults on first install or preserve the existing configuration on re-install. Omitting a field leaves it unchanged. Sending `null` for a field clears that override and reverts to the default value. To change settings after install, use the update endpoint.<br/><br/>[Required authorization] Route required privileges: securitySolution.
      operationId: post-security-entity-store-install
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
      requestBody:
        content:
          application/json:
            examples:
              installDefaultExample:
                description: Install the Entity Store for all entity types with default log extraction settings.
                summary: Install with default entity types
                value:
                  entityTypes:
                    - user
                    - host
                    - service
                    - generic
                  logExtraction: {}
              installWithCustomSettingsExample:
                description: Install the Entity Store for host entities only with a custom lookback period and field history length.
                summary: Install with custom log extraction
                value:
                  entityTypes:
                    - host
                  logExtraction:
                    delay: 2m
                    fieldHistoryLength: 20
                    frequency: 5m
                    lookbackPeriod: 12h
            schema:
              additionalProperties: false
              type: object
              properties:
                entityTypes:
                  default:
                    - user
                    - host
                    - service
                    - generic
                  items:
                    enum:
                      - user
                      - host
                      - service
                      - generic
                    type: string
                  type: array
                excludedUserNames:
                  items:
                    type: string
                  maxItems: 200
                  type: array
                historySnapshot:
                  additionalProperties: false
                  type: object
                  properties:
                    frequency:
                      maxLength: 32
                      pattern: '[smdh]$'
                      type: string
                    retentionDays:
                      maximum: 3650
                      minimum: 1
                      type: integer
                logExtraction:
                  additionalProperties: false
                  type: object
                  properties:
                    additionalIndexPatterns:
                      items:
                        maxLength: 2048
                        type: string
                      maxItems: 1000
                      nullable: true
                      type: array
                    delay:
                      maxLength: 32
                      nullable: true
                      pattern: '[smdh]$'
                      type: string
                    docsLimit:
                      maximum: 9007199254740991
                      minimum: 1
                      nullable: true
                      type: integer
                    excludedIndexPatterns:
                      items:
                        maxLength: 2048
                        type: string
                      maxItems: 1000
                      nullable: true
                      type: array
                    fieldHistoryLength:
                      maximum: 9007199254740991
                      minimum: -9007199254740991
                      nullable: true
                      type: integer
                    frequency:
                      maxLength: 32
                      nullable: true
                      pattern: '[smdh]$'
                      type: string
                    lookbackPeriod:
                      maxLength: 32
                      nullable: true
                      pattern: '[smdh]$'
                      type: string
                    maxLogsPerPage:
                      maximum: 9007199254740991
                      minimum: 1
                      nullable: true
                      type: integer
                    maxLogsPerWindow:
                      maximum: 9007199254740991
                      minimum: 0
                      nullable: true
                      type: integer
                    maxLogsPerWindowCapBehavior:
                      enum:
                        - defer
                        - drop
                      nullable: true
                      type: string
                    maxTimeWindowSize:
                      maxLength: 32
                      nullable: true
                      pattern: '[smdh]$'
                      type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                alreadyInstalledExample:
                  description: All requested entity types were already installed.
                  summary: Already installed
                  value:
                    ok: true
          description: Indicates all requested entity types are already installed.
        '201':
          content:
            application/json:
              examples:
                installSuccessExample:
                  description: The Entity Store was installed and engines are being created.
                  summary: Entity Store installed
                  value:
                    ok: true
          description: Indicates the Entity Store was successfully installed.
        '403':
          content:
            application/json:
              examples:
                forbiddenExample:
                  description: The user does not have the required Elasticsearch privileges.
                  summary: Insufficient privileges
                  value:
                    error: Forbidden
                    message: User 'analyst' has insufficient privileges
                    statusCode: 403
          description: Insufficient privileges.
      summary: Install the Entity Store
      tags:
        - Security entity store
      x-codeSamples:
        - lang: curl
          source: |
            curl -X POST -H "kbn-xsrf: true" -H "Authorization: ApiKey ${API_KEY}" \
              -H "Content-Type: application/json" \
              -d '{"entityTypes":["user","host","service","generic"],"logExtraction":{}}' \
              "${KIBANA_URL}/api/security/entity_store/install"
        - lang: Console
          source: |
            POST kbn://api/security/entity_store/install
            {
              "entityTypes": ["user", "host", "service", "generic"],
              "logExtraction": {}
            }
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/security/entity_store/resolution/group:
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/security/entity_store/resolution/group</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Get the resolution group for a given entity, returning all linked entities.<br/><br/>[Required authorization] Route required privileges: securitySolution AND securitySolution-entity-analytics.
      operationId: get-security-entity-store-resolution-group
      parameters:
        - description: The entity identifier to look up the resolution group for.
          in: query
          name: entity_id
          required: true
          schema:
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                resolutionGroupExample:
                  description: Returns the resolution group for an entity, including the target entity, all aliases, and the group size.
                  summary: Resolution group with linked entities
                  value:
                    aliases:
                      - '@timestamp': '2026-04-10T08:25:00.000Z'
                        entity:
                          id: user:jdoe@example.com
                          name: jdoe
                          relationships:
                            resolution:
                              resolved_to: user:jane.doe@example.com
                          type: user
                        user:
                          name: jdoe
                    entity_type: user
                    group_size: 2
                    target:
                      '@timestamp': '2026-04-10T08:30:00.000Z'
                      entity:
                        id: user:jane.doe@example.com
                        name: jane.doe
                        type: user
                      user:
                        email:
                          - jane.doe@example.com
                        name: jane.doe
          description: Indicates a successful response.
        '400':
          content:
            application/json:
              examples:
                truncatedSearchExample:
                  description: The resolution search returned too many results and was truncated.
                  summary: Search results truncated
                  value:
                    error: Bad Request
                    message: Resolution search truncated
                    statusCode: 400
          description: Bad request.
        '404':
          content:
            application/json:
              examples:
                notFoundExample:
                  description: The specified entity does not exist or has no resolution group.
                  summary: Entity not found
                  value:
                    error: Not Found
                    message: 'Entities not found: [user:nonexistent@example.com]'
                    statusCode: 404
          description: Entity not found.
      summary: Get resolution group
      tags:
        - Security entity store
      x-codeSamples:
        - lang: curl
          source: |
            curl -X GET -H "Authorization: ApiKey ${API_KEY}" \
              "${KIBANA_URL}/api/security/entity_store/resolution/group?entity_id=user%3Ajane.doe%40example.com"
        - lang: Console
          source: |
            GET kbn://api/security/entity_store/resolution/group?entity_id=user:jane.doe@example.com
      x-state: Generally available; added in 9.4.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/security/entity_store/resolution/link:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/security/entity_store/resolution/link</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Link one or more entities to a target entity, creating a resolution group. Changes become visible on subsequent reads after the next index refresh (typically <1s).<br/><br/>[Required authorization] Route required privileges: securitySolution AND securitySolution-entity-analytics.
      operationId: post-security-entity-store-resolution-link
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
      requestBody:
        content:
          application/json:
            examples:
              linkEntitiesExample:
                description: Link two user entities to a target entity, creating a resolution group.
                summary: Link entities to a target
                value:
                  entity_ids:
                    - user:jdoe@example.com
                    - user:j.doe@example.com
                  target_id: user:jane.doe@example.com
            schema:
              additionalProperties: false
              type: object
              properties:
                entity_ids:
                  description: Entity identifiers to link to the target entity. Minimum 1, maximum 1000.
                  items:
                    type: string
                  maxItems: 1000
                  minItems: 1
                  type: array
                target_id:
                  description: The entity identifier to resolve the linked entities to.
                  type: string
              required:
                - target_id
                - entity_ids
      responses:
        '200':
          content:
            application/json:
              examples:
                linkSuccessExample:
                  description: The entities were successfully linked to the target entity.
                  summary: Entities linked
                  value:
                    entity_type: user
                    linked:
                      - user:jdoe@example.com
                      - user:j.doe@example.com
                    skipped: []
                    target_id: user:jane.doe@example.com
          description: Indicates a successful response.
        '400':
          content:
            application/json:
              examples:
                mixedTypesExample:
                  description: All entities in a resolution group must be of the same type.
                  summary: Mixed entity types
                  value:
                    error: Bad Request
                    message: Cannot link entities of different types
                    statusCode: 400
                notFoundExample:
                  description: One or more of the specified entity identifiers were not found.
                  summary: Entities not found
                  value:
                    error: Bad Request
                    message: 'Entities not found: [user:nonexistent@example.com, user:also-nonexistent@example.com]'
                    statusCode: 400
                selfLinkExample:
                  description: Cannot link an entity to itself.
                  summary: Self-link error
                  value:
                    error: Bad Request
                    message: Cannot link entity 'user:jane.doe@example.com' to itself.
                    statusCode: 400
          description: Bad request.
      summary: Link entities
      tags:
        - Security entity store
      x-codeSamples:
        - lang: curl
          source: |
            curl -X POST -H "kbn-xsrf: true" -H "Authorization: ApiKey ${API_KEY}" \
              -H "Content-Type: application/json" \
              -d '{"target_id":"user:jane.doe@example.com","entity_ids":["user:jdoe@example.com"]}' \
              "${KIBANA_URL}/api/security/entity_store/resolution/link"
        - lang: Console
          source: |
            POST kbn://api/security/entity_store/resolution/link
            {
              "target_id": "user:jane.doe@example.com",
              "entity_ids": ["user:jdoe@example.com"]
            }
      x-state: Generally available; added in 9.4.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/security/entity_store/resolution/rules:
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/security/entity_store/resolution/rules</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        List managed entity resolution rules and their effective enabled state for this space. Each rule description states what it bridges, which data sources it needs, and when to disable it.<br/><br/>[Required authorization] Route required privileges: securitySolution AND securitySolution-entity-analytics.
      operationId: get-security-entity-store-resolution-rules
      parameters: []
      responses:
        '200':
          content:
            application/json:
              examples:
                rulesListExample:
                  description: Lists the managed resolution rules and their enabled state in the current space.
                  summary: Managed resolution rules
                  value:
                    rules:
                      - description: Links user entities that share the same email address, compared case-insensitively, across identity providers. Several `local` users with that email (one per user name per host) are linked too. Unlinked users in the same identity provider that share an address are left unlinked. Disable if shared mailboxes or role accounts produce false links.
                        enabled: true
                        id: email_exact_match
                        kind: same_field
                        managed: true
                      - description: Links user entities that share the same SID (`user.id`), including several `local` Windows or CrowdStrike endpoint users on different hosts. Windows domain accounts seen on several hosts are linked even before the Active Directory user is ingested; Active Directory entity analytics is needed only to link or retarget to that AD user once it arrives. A SID names one account, so duplicates in any namespace are the same account (identifier drift), not a collision. Excludes well-known SIDs such as LocalSystem and Linux numeric UIDs. Needs Windows or CrowdStrike endpoint events (which create `local` user entities). Disable if well-known SID exclusions are not enough for your environment.
                        enabled: true
                        id: windows_sid_bridge
                        kind: same_field
                        managed: true
                      - description: Links Microsoft Defender (`m365_defender`) identities to Entra ID by GUID-shaped `user.id`. Needs Defender identity events and Entra entity analytics. Disable if Defender SID IAM events leak through the GUID gate.
                        enabled: true
                        id: entra_guid_bridge
                        kind: same_field
                        managed: true
                      - description: Links leftover CrowdStrike-namespace user entities to Active Directory by SID (`user.id`). A SID names one account, so duplicates in any namespace are the same account (identifier drift), not a collision. Excludes well-known SIDs such as LocalSystem and Linux numeric UIDs. CrowdStrike FDR events now create `local` entities, which the Windows SID bridge covers. Disabled by default because the crowdstrike namespace no longer receives entities; enable if leftover CrowdStrike-namespace users should still link.
                        enabled: false
                        id: crowdstrike_sid_bridge
                        kind: same_field
                        managed: true
                      - description: 'Links Microsoft 365 audit actors (`user.id` UPN) to Entra users (`user.name` UPN), compared case-insensitively. Needs o365 audit events that create user entities (`event.kind: asset`) and Entra entity analytics. Disabled by default because those events currently do not create entities; enable if your environment emits them as asset events.'
                        enabled: false
                        id: upn_cross_field_bridge
                        kind: cross_field
                        managed: true
                      - description: Related user alias resolution across identity providers
                        enabled: false
                        id: related_user_alias_resolution
                        kind: related_user_alias_resolution
                        managed: true
          description: Entity resolution rules.
      summary: List entity resolution rules
      tags:
        - Security entity store
      x-state: Generally available; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/security/entity_store/resolution/rules/{id}/disable:
    put:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb put">put</span>&nbsp;<span class="operation-path">/s/{space_id}/api/security/entity_store/resolution/rules/{id}/disable</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Disable a managed entity resolution rule in this space.<br/><br/>[Required authorization] Route required privileges: securitySolution AND securitySolution-entity-analytics.
      operationId: put-security-entity-store-resolution-rules-id-disable
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: The stable identifier of the entity resolution rule.
          in: path
          name: id
          required: true
          schema:
            maxLength: 100
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                ruleDisabledExample:
                  description: The related user alias resolution rule was disabled in the current space.
                  summary: Rule disabled
                  value:
                    description: Related user alias resolution across identity providers
                    enabled: false
                    id: related_user_alias_resolution
                    kind: related_user_alias_resolution
                    managed: true
          description: Updated entity resolution rule.
        '404':
          content:
            application/json:
              examples:
                notFoundExample:
                  description: The requested entity resolution rule does not exist.
                  summary: Unknown rule
                  value:
                    error: Not Found
                    message: Saved object [entity-resolution-rule/unknown] not found
                    statusCode: 404
          description: Unknown entity resolution rule.
      summary: Disable an entity resolution rule
      tags:
        - Security entity store
      x-state: Generally available; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/security/entity_store/resolution/rules/{id}/enable:
    put:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb put">put</span>&nbsp;<span class="operation-path">/s/{space_id}/api/security/entity_store/resolution/rules/{id}/enable</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Enable a managed entity resolution rule in this space.<br/><br/>[Required authorization] Route required privileges: securitySolution AND securitySolution-entity-analytics.
      operationId: put-security-entity-store-resolution-rules-id-enable
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: The stable identifier of the entity resolution rule.
          in: path
          name: id
          required: true
          schema:
            maxLength: 100
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                ruleEnabledExample:
                  description: The related user alias resolution rule was enabled in the current space.
                  summary: Rule enabled
                  value:
                    description: Related user alias resolution across identity providers
                    enabled: true
                    id: related_user_alias_resolution
                    kind: related_user_alias_resolution
                    managed: true
          description: Updated entity resolution rule.
        '404':
          content:
            application/json:
              examples:
                notFoundExample:
                  description: The requested entity resolution rule does not exist.
                  summary: Unknown rule
                  value:
                    error: Not Found
                    message: Saved object [entity-resolution-rule/unknown] not found
                    statusCode: 404
          description: Unknown entity resolution rule.
      summary: Enable an entity resolution rule
      tags:
        - Security entity store
      x-state: Generally available; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/security/entity_store/resolution/unlink:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/security/entity_store/resolution/unlink</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Remove one or more entities from their resolution group. Changes become visible on subsequent reads after the next index refresh (typically <1s).<br/><br/>[Required authorization] Route required privileges: securitySolution AND securitySolution-entity-analytics.
      operationId: post-security-entity-store-resolution-unlink
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
      requestBody:
        content:
          application/json:
            examples:
              unlinkEntitiesExample:
                description: Remove entities from their resolution group, restoring them as standalone entities.
                summary: Unlink entities from their resolution group
                value:
                  entity_ids:
                    - user:jdoe@example.com
                    - user:j.doe@example.com
            schema:
              additionalProperties: false
              type: object
              properties:
                entity_ids:
                  description: Entity identifiers to unlink from their resolution group. Minimum 1, maximum 1000.
                  items:
                    type: string
                  maxItems: 1000
                  minItems: 1
                  type: array
              required:
                - entity_ids
      responses:
        '200':
          content:
            application/json:
              examples:
                unlinkSuccessExample:
                  description: The entities were successfully removed from their resolution group.
                  summary: Entities unlinked
                  value:
                    entity_type: user
                    skipped: []
                    unlinked:
                      - user:jdoe@example.com
                      - user:j.doe@example.com
          description: Indicates a successful response.
        '400':
          content:
            application/json:
              examples:
                mixedTypesExample:
                  description: All entities in a resolution group must be of the same type.
                  summary: Mixed entity types
                  value:
                    error: Bad Request
                    message: 'All entities must be of the same type. Found types: [user, host]'
                    statusCode: 400
                notFoundExample:
                  description: One or more of the specified entity identifiers were not found.
                  summary: Entities not found
                  value:
                    error: Bad Request
                    message: 'Entities not found: [user:nonexistent@example.com]'
                    statusCode: 400
          description: Bad request.
      summary: Unlink entities
      tags:
        - Security entity store
      x-codeSamples:
        - lang: curl
          source: |
            curl -X POST -H "kbn-xsrf: true" -H "Authorization: ApiKey ${API_KEY}" \
              -H "Content-Type: application/json" \
              -d '{"entity_ids":["user:jdoe@example.com"]}' \
              "${KIBANA_URL}/api/security/entity_store/resolution/unlink"
        - lang: Console
          source: |
            POST kbn://api/security/entity_store/resolution/unlink
            {
              "entity_ids": ["user:jdoe@example.com"]
            }
      x-state: Generally available; added in 9.4.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/security/entity_store/start:
    put:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb put">put</span>&nbsp;<span class="operation-path">/s/{space_id}/api/security/entity_store/start</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Start previously stopped entity engines, resuming data processing for the specified entity types.<br/><br/>[Required authorization] Route required privileges: securitySolution.
      operationId: put-security-entity-store-start
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
      requestBody:
        content:
          application/json:
            examples:
              startAllExample:
                description: Start all stopped entity engines.
                summary: Start all entity engines
                value:
                  entityTypes:
                    - user
                    - host
                    - service
                    - generic
              startSingleExample:
                description: Start only the host entity engine.
                summary: Start a single entity engine
                value:
                  entityTypes:
                    - host
            schema:
              additionalProperties: false
              type: object
              properties:
                entityTypes:
                  default:
                    - user
                    - host
                    - service
                    - generic
                  description: Entity types to start. Defaults to all installed types.
                  items:
                    enum:
                      - user
                      - host
                      - service
                      - generic
                    type: string
                  type: array
      responses:
        '200':
          content:
            application/json:
              examples:
                startSuccessExample:
                  description: The specified entity engines were successfully started.
                  summary: Engines started
                  value:
                    ok: true
          description: Indicates a successful response.
      summary: Start Entity Store engines
      tags:
        - Security entity store
      x-codeSamples:
        - lang: curl
          source: |
            curl -X PUT -H "kbn-xsrf: true" -H "Authorization: ApiKey ${API_KEY}" \
              -H "Content-Type: application/json" \
              -d '{"entityTypes":["user","host","service","generic"]}' \
              "${KIBANA_URL}/api/security/entity_store/start"
        - lang: Console
          source: |
            PUT kbn://api/security/entity_store/start
            {
              "entityTypes": ["user", "host", "service", "generic"]
            }
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/security/entity_store/status:
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/security/entity_store/status</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Get the overall Entity Store status and per-engine statuses, optionally including component-level health details.<br/><br/>[Required authorization] Route required privileges: securitySolution.
      operationId: get-security-entity-store-status
      parameters:
        - description: If true, returns a detailed status of each engine including all its components.
          in: query
          name: include_components
          required: false
          schema:
            anyOf:
              - enum:
                  - 'true'
                  - 'false'
                type: string
              - type: boolean
            default: false
      responses:
        '200':
          content:
            application/json:
              examples:
                notInstalledExample:
                  description: The Entity Store has not been installed.
                  summary: Entity Store not installed
                  value:
                    engines: []
                    status: not_installed
                runningStatusExample:
                  description: The Entity Store is running with two started engines using default settings.
                  summary: Entity Store running
                  value:
                    engines:
                      - delay: 1m
                        docsPerSecond: -1
                        enrichPolicyExecutionInterval: null
                        fieldHistoryLength: 10
                        filter: ''
                        frequency: 30s
                        indexPattern: ''
                        lastExecutionTimestamp: '2026-04-10T08:30:00.000Z'
                        lookbackPeriod: 3h
                        maxLogsPerPage: 40000
                        maxLogsPerWindow: 500000
                        maxLogsPerWindowCapBehavior: defer
                        maxPageSearchSize: 10000
                        maxTimeWindowSize: 15m
                        status: started
                        timeout: 25s
                        timestampField: '@timestamp'
                        type: host
                      - delay: 1m
                        docsPerSecond: -1
                        enrichPolicyExecutionInterval: null
                        fieldHistoryLength: 10
                        filter: ''
                        frequency: 30s
                        indexPattern: ''
                        lastExecutionTimestamp: '2026-04-10T08:30:00.000Z'
                        lookbackPeriod: 3h
                        maxLogsPerPage: 40000
                        maxLogsPerWindow: 500000
                        maxLogsPerWindowCapBehavior: defer
                        maxPageSearchSize: 10000
                        maxTimeWindowSize: 15m
                        status: started
                        timeout: 25s
                        timestampField: '@timestamp'
                        type: user
                    status: running
          description: Indicates a successful response.
      summary: Get Entity Store status
      tags:
        - Security entity store
      x-codeSamples:
        - lang: curl
          source: |
            curl -X GET -H "Authorization: ApiKey ${API_KEY}" \
              "${KIBANA_URL}/api/security/entity_store/status?include_components=false"
        - lang: Console
          source: |
            GET kbn://api/security/entity_store/status?include_components=false
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/security/entity_store/stop:
    put:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb put">put</span>&nbsp;<span class="operation-path">/s/{space_id}/api/security/entity_store/stop</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Stop running entity engines, pausing data processing for the specified entity types.<br/><br/>[Required authorization] Route required privileges: securitySolution.
      operationId: put-security-entity-store-stop
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
      requestBody:
        content:
          application/json:
            examples:
              stopAllExample:
                description: Stop all running entity engines.
                summary: Stop all entity engines
                value:
                  entityTypes:
                    - user
                    - host
                    - service
                    - generic
            schema:
              additionalProperties: false
              type: object
              properties:
                entityTypes:
                  default:
                    - user
                    - host
                    - service
                    - generic
                  description: Entity types to stop. Defaults to all running types.
                  items:
                    enum:
                      - user
                      - host
                      - service
                      - generic
                    type: string
                  type: array
      responses:
        '200':
          content:
            application/json:
              examples:
                stopSuccessExample:
                  description: The specified entity engines were successfully stopped.
                  summary: Engines stopped
                  value:
                    ok: true
          description: Indicates a successful response.
      summary: Stop Entity Store engines
      tags:
        - Security entity store
      x-codeSamples:
        - lang: curl
          source: |
            curl -X PUT -H "kbn-xsrf: true" -H "Authorization: ApiKey ${API_KEY}" \
              -H "Content-Type: application/json" \
              -d '{"entityTypes":["user","host","service","generic"]}' \
              "${KIBANA_URL}/api/security/entity_store/stop"
        - lang: Console
          source: |
            PUT kbn://api/security/entity_store/stop
            {
              "entityTypes": ["user", "host", "service", "generic"]
            }
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/security/entity_store/uninstall:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/security/entity_store/uninstall</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Uninstall the Entity Store, removing engines and associated resources for the specified entity types.<br/><br/>[Required authorization] Route required privileges: securitySolution.
      operationId: post-security-entity-store-uninstall
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
      requestBody:
        content:
          application/json:
            examples:
              uninstallAllExample:
                description: Uninstall all entity engines from the Entity Store.
                summary: Uninstall all entity types
                value:
                  entityTypes:
                    - user
                    - host
                    - service
                    - generic
              uninstallSingleExample:
                description: Uninstall only the host engine from the Entity Store.
                summary: Uninstall a single entity type
                value:
                  entityTypes:
                    - host
            schema:
              additionalProperties: false
              type: object
              properties:
                entityTypes:
                  default:
                    - user
                    - host
                    - service
                    - generic
                  description: Entity types to uninstall. Defaults to all installed types.
                  items:
                    enum:
                      - user
                      - host
                      - service
                      - generic
                    type: string
                  type: array
      responses:
        '200':
          content:
            application/json:
              examples:
                uninstallSuccessExample:
                  description: The specified entity engines were successfully uninstalled.
                  summary: Entity Store uninstalled
                  value:
                    ok: true
          description: Indicates a successful response.
      summary: Uninstall the Entity Store
      tags:
        - Security entity store
      x-codeSamples:
        - lang: curl
          source: |
            curl -X POST -H "kbn-xsrf: true" -H "Authorization: ApiKey ${API_KEY}" \
              -H "Content-Type: application/json" \
              -d '{"entityTypes":["user","host","service","generic"]}' \
              "${KIBANA_URL}/api/security/entity_store/uninstall"
        - lang: Console
          source: |
            POST kbn://api/security/entity_store/uninstall
            {
              "entityTypes": ["user", "host", "service", "generic"]
            }
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/security/role:
    get:
      description: Retrieve all Kibana roles.
      operationId: get-security-role
      parameters:
        - description: If true, include built-in roles on serverless. By default, serverless returns only custom roles. Other deployments always include built-in roles.
          in: query
          name: includeReservedRoles
          required: false
          schema:
            type: boolean
        - description: If `true` and the response contains any privileges that are associated with deprecated features, they are omitted in favor of details about the appropriate replacement feature privileges.
          in: query
          name: replaceDeprecatedPrivileges
          required: false
          schema:
            type: boolean
      responses:
        '200':
          content:
            application/json:
              examples:
                getAllRolesResponse:
                  value:
                    - _unrecognized_applications: []
                      description: My custom Kibana role.
                      elasticsearch:
                        cluster:
                          - monitor
                        indices:
                          - names:
                              - logs-*
                            privileges:
                              - read
                        run_as: []
                      kibana:
                        - base:
                            - read
                          feature: {}
                          spaces:
                            - default
                      metadata: {}
                      name: my_kibana_role
                      transient_metadata:
                        enabled: true
                getRolesResponse1:
                  $ref: '#/components/examples/get_roles_response1'
              schema:
                items:
                  $ref: '#/components/schemas/Kibana_HTTP_APIs_security_role_response'
                type: array
          description: Indicates a successful call.
      summary: Get all roles
      tags:
        - roles
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/security/role/_query:
    post:
      description: Query Kibana roles with optional filters, paging, and sorting.
      operationId: post-security-role-query
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
      requestBody:
        content:
          application/json:
            examples:
              queryRolesRequest:
                value:
                  from: 0
                  query: kibana
                  size: 25
                  sort:
                    direction: asc
                    field: name
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_security_query_roles_body'
      responses:
        '200':
          content:
            application/json:
              examples:
                queryRolesResponse:
                  value:
                    count: 1
                    roles:
                      - _unrecognized_applications: []
                        description: My custom Kibana role.
                        elasticsearch:
                          cluster:
                            - monitor
                          indices:
                            - names:
                                - logs-*
                              privileges:
                                - read
                          run_as: []
                        kibana:
                          - base:
                              - read
                            feature: {}
                            spaces:
                              - default
                        metadata: {}
                        name: my_kibana_role
                        transient_metadata:
                          enabled: true
                    total: 1
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_security_query_roles_response'
          description: Indicates a successful call.
      summary: Query roles
      tags: []
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/security/role/{name}:
    delete:
      description: Delete a Kibana role by its name.
      operationId: delete-security-role-name
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: The role name.
          in: path
          name: name
          required: true
          schema:
            minLength: 1
            type: string
      responses:
        '204':
          description: Indicates a successful call.
      summary: Delete a role
      tags:
        - roles
      x-metaTags:
        - content: Kibana
          name: product_name
    get:
      description: Retrieve a Kibana role by its name.
      operationId: get-security-role-name
      parameters:
        - description: The role name.
          in: path
          name: name
          required: true
          schema:
            minLength: 1
            type: string
        - description: If `true` and the response contains any privileges that are associated with deprecated features, they are omitted in favor of details about the appropriate replacement feature privileges.
          in: query
          name: replaceDeprecatedPrivileges
          required: false
          schema:
            type: boolean
      responses:
        '200':
          content:
            application/json:
              examples:
                getRoleResponse:
                  value:
                    _unrecognized_applications: []
                    description: My custom Kibana role.
                    elasticsearch:
                      cluster:
                        - monitor
                      indices:
                        - names:
                            - logs-*
                          privileges:
                            - read
                      run_as: []
                    kibana:
                      - base:
                          - read
                        feature: {}
                        spaces:
                          - default
                    metadata: {}
                    name: my_kibana_role
                    transient_metadata:
                      enabled: true
                getRoleResponse1:
                  $ref: '#/components/examples/get_role_response1'
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_security_role_response'
          description: Indicates a successful call.
      summary: Get a role
      tags:
        - roles
      x-metaTags:
        - content: Kibana
          name: product_name
    put:
      description: Create a new Kibana role or update the attributes of an existing role. Kibana roles are stored in the Elasticsearch native realm.
      operationId: put-security-role-name
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: The role name.
          in: path
          name: name
          required: true
          schema:
            maxLength: 1024
            minLength: 1
            type: string
        - description: When true, a role is not overwritten if it already exists.
          in: query
          name: createOnly
          required: false
          schema:
            default: false
            type: boolean
      requestBody:
        content:
          application/json:
            examples:
              createOrUpdateRoleRequest:
                value:
                  description: My custom Kibana role.
                  elasticsearch:
                    cluster:
                      - monitor
                    indices:
                      - names:
                          - logs-*
                        privileges:
                          - read
                  kibana:
                    - base:
                        - read
                      feature: {}
                      spaces:
                        - default
              createRoleRequest1:
                $ref: '#/components/examples/create_role_request1'
              createRoleRequest2:
                $ref: '#/components/examples/create_role_request2'
              createRoleRequest3:
                $ref: '#/components/examples/create_role_request3'
              createRoleRequest4:
                $ref: '#/components/examples/create_role_request4'
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_security_role_put_payload'
      responses:
        '204':
          description: Indicates a successful call.
      summary: Create or update a role
      tags:
        - roles
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/security/roles:
    post:
      description: Create or update multiple Kibana roles in a single request.
      operationId: post-security-roles
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
      requestBody:
        content:
          application/json:
            examples:
              bulkCreateOrUpdateRoles:
                value:
                  roles:
                    my_kibana_role:
                      elasticsearch:
                        cluster:
                          - monitor
                        indices:
                          - names:
                              - logs-*
                            privileges:
                              - read
                      kibana:
                        - base:
                            - read
                          feature: {}
                          spaces:
                            - default
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_security_roles_bulk_create_or_update_payload'
      responses:
        '200':
          content:
            application/json:
              examples:
                bulkCreateOrUpdateRolesResponse:
                  value:
                    created:
                      - my_kibana_role
                    noop: []
                    updated: []
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_security_bulk_create_or_update_roles_response'
          description: Indicates a successful call.
      summary: Create or update roles
      tags:
        - roles
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/security/session/_invalidate:
    post:
      description: |
        Invalidate user sessions that match a query. To use this API, you must be a superuser.
      operationId: post-security-session-invalidate
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
      requestBody:
        content:
          application/json:
            examples:
              invalidateRequestExample1:
                description: Run `POST api/security/session/_invalidate` to invalidate all existing sessions.
                summary: Invalidate all sessions
                value: |-
                  {
                    "match" : "all"
                  }
              invalidateRequestExample2:
                description: Run `POST api/security/session/_invalidate` to invalidate sessions that were created by any SAML authentication provider.
                summary: Invalidate all SAML sessions
                value: |-
                  {
                    "match" : "query",
                    "query": {
                      "provider" : { "type": "saml" }
                    }
                  }
              invalidateRequestExample3:
                description: Run `POST api/security/session/_invalidate` to invalidate sessions that were created by the SAML authentication provider named `saml1`.
                summary: Invalidate sessions for a provider
                value: |-
                  {
                    "match" : "query",
                    "query": {
                      "provider" : { "type": "saml", "name": "saml1" }
                    }
                  }
              invalidateRequestExample4:
                description: Run `POST api/security/session/_invalidate` to invalidate sessions that were created by any OpenID Connect authentication provider for the user with the username `user@my-oidc-sso.com`.
                summary: Invalidate sessions for a user
                value: |-
                  {
                    "match" : "query",
                    "query": {
                      "provider" : { "type": "oidc" },
                      "username": "user@my-oidc-sso.com"
                    }
                  }
            schema:
              type: object
              properties:
                match:
                  description: |
                    The method Kibana uses to determine which sessions to invalidate. If it is `all`, all existing sessions will be invalidated. If it is `query`, only the sessions that match the query will be invalidated.
                  enum:
                    - all
                    - query
                  type: string
                query:
                  description: |
                    The query that Kibana uses to match the sessions to invalidate when the `match` parameter is set to `query`.
                  type: object
                  properties:
                    provider:
                      description: The authentication providers that will have their user sessions invalidated.
                      type: object
                      properties:
                        name:
                          description: The authentication provider name.
                          type: string
                        type:
                          description: |
                            The authentication provide type. For example: `basic`, `token`, `saml`, `oidc`, `kerberos`, or `pki`.
                          type: string
                      required:
                        - type
                    username:
                      description: The username that will have its sessions invalidated.
                      type: string
                  required:
                    - provider
              required:
                - match
      responses:
        '200':
          content:
            application/json:
              schema:
                type: object
                properties:
                  total:
                    description: The number of sessions that were successfully invalidated.
                    type: integer
          description: Indicates a successful call
        '403':
          description: Indicates that the user may not be authorized to invalidate sessions for other users.
      summary: Invalidate user sessions
      tags:
        - user session
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/short_url:
    post:
      description: |
        Kibana URLs may be long and cumbersome, short URLs are much easier to remember and share.
        Short URLs are created by specifying the locator ID and locator parameters. When a short URL is resolved, the locator ID and locator parameters are used to redirect user to the right Kibana page.
      operationId: post-url
      requestBody:
        content:
          application/json:
            examples:
              createShortUrlRequest:
                description: Request a short URL that resolves to a dashboard with a preset time range.
                summary: Create a short URL for a dashboard locator
                value:
                  locatorId: DASHBOARD_APP_LOCATOR
                  params:
                    dashboardId: edf84fe0-e1a0-11e7-b6d5-4dc382ef7f5b
                    timeRange:
                      from: now-7d
                      to: now
                  slug: my-dashboard
            schema:
              type: object
              properties:
                humanReadableSlug:
                  description: |
                    When the `slug` parameter is omitted, the API will generate a random human-readable slug if `humanReadableSlug` is set to true.
                  type: boolean
                locatorId:
                  description: The identifier for the locator.
                  type: string
                params:
                  description: |
                    An object which contains all necessary parameters for the given locator to resolve to a Kibana location.
                    > warn
                    > When you create a short URL, locator params are not validated, which allows you to pass arbitrary and ill-formed data into the API that can break Kibana. Make sure any data that you send to the API is properly formed.
                  type: object
                slug:
                  description: |
                    A custom short URL slug. The slug is the part of the short URL that identifies it. You can provide a custom slug which consists of latin alphabet letters, numbers, and `-._` characters. The slug must be at least 3 characters long, but no longer than 255 characters.
                  type: string
              required:
                - locatorId
                - params
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                createShortUrlResponse:
                  description: The created short URL record.
                  summary: Short URL created
                  value:
                    accessCount: 0
                    accessDate: 1767225600000
                    createDate: 1767225600000
                    id: c54b04f5d4b3aa3c
                    locator:
                      id: DASHBOARD_APP_LOCATOR
                      state:
                        dashboardId: edf84fe0-e1a0-11e7-b6d5-4dc382ef7f5b
                        timeRange:
                          from: now-7d
                          to: now
                      version: 9.4.0
                    slug: my-dashboard
              schema:
                $ref: '#/components/schemas/Short_URL_APIs_urlResponse'
          description: Indicates a successful call.
      summary: Create a short URL
      tags:
        - short url
      x-state: Technical Preview
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/short_url/_slug/{slug}:
    get:
      description: |
        Resolve a Kibana short URL by its slug.
      operationId: resolve-url
      parameters:
        - description: The slug of the short URL.
          in: path
          name: slug
          required: true
          schema:
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                resolveShortUrlResponse:
                  description: The short URL record matching the given slug.
                  summary: Short URL resolved by slug
                  value:
                    accessCount: 12
                    accessDate: 1767744000000
                    createDate: 1767225600000
                    id: c54b04f5d4b3aa3c
                    locator:
                      id: DASHBOARD_APP_LOCATOR
                      state:
                        dashboardId: edf84fe0-e1a0-11e7-b6d5-4dc382ef7f5b
                        timeRange:
                          from: now-7d
                          to: now
                      version: 9.4.0
                    slug: my-dashboard
              schema:
                $ref: '#/components/schemas/Short_URL_APIs_urlResponse'
          description: Indicates a successful call.
      summary: Resolve a short URL
      tags:
        - short url
      x-state: Technical Preview
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/short_url/{id}:
    delete:
      description: |
        Delete a Kibana short URL.
      operationId: delete-url
      parameters:
        - $ref: '#/components/parameters/Short_URL_APIs_idParam'
      responses:
        '200':
          description: Indicates a successful call.
      summary: Delete a short URL
      tags:
        - short url
      x-state: Technical Preview
      x-metaTags:
        - content: Kibana
          name: product_name
    get:
      description: |
        Get a single Kibana short URL.
      operationId: get-url
      parameters:
        - $ref: '#/components/parameters/Short_URL_APIs_idParam'
      responses:
        '200':
          content:
            application/json:
              examples:
                getShortUrlResponse:
                  description: The short URL record matching the given identifier.
                  summary: Short URL retrieved by ID
                  value:
                    accessCount: 12
                    accessDate: 1767744000000
                    createDate: 1767225600000
                    id: c54b04f5d4b3aa3c
                    locator:
                      id: DASHBOARD_APP_LOCATOR
                      state:
                        dashboardId: edf84fe0-e1a0-11e7-b6d5-4dc382ef7f5b
                        timeRange:
                          from: now-7d
                          to: now
                      version: 9.4.0
                    slug: my-dashboard
              schema:
                $ref: '#/components/schemas/Short_URL_APIs_urlResponse'
          description: Indicates a successful call.
      summary: Get a short URL
      tags:
        - short url
      x-state: Technical Preview
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/spaces/_copy_saved_objects:
    post:
      description: 'It also allows you to automatically copy related objects, so when you copy a dashboard, this can automatically copy over the associated visualizations, data views, and saved Discover sessions, as required. You can request to overwrite any objects that already exist in the target space if they share an identifier or you can use the resolve copy saved objects conflicts API to do this on a per-object basis.<br/><br/>[Required authorization] Route required privileges: copySavedObjectsToSpaces.'
      operationId: post-spaces-copy-saved-objects
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
      requestBody:
        content:
          application/json:
            schema:
              additionalProperties: false
              type: object
              properties:
                compatibilityMode:
                  default: false
                  description: Apply various adjustments to the saved objects that are being copied to maintain compatibility between different Kibana versions. Use this option only if you encounter issues with copied saved objects. This option cannot be used with the `createNewCopies` option.
                  type: boolean
                createNewCopies:
                  default: true
                  description: Create new copies of saved objects, regenerate each object identifier, and reset the origin. When used, potential conflict errors are avoided.  This option cannot be used with the `overwrite` and `compatibilityMode` options.
                  type: boolean
                includeReferences:
                  default: false
                  description: When set to true, all saved objects related to the specified saved objects will also be copied into the target spaces.
                  type: boolean
                objects:
                  items:
                    additionalProperties: false
                    type: object
                    properties:
                      id:
                        description: The identifier of the saved object to copy.
                        type: string
                      type:
                        description: The type of the saved object to copy.
                        type: string
                    required:
                      - type
                      - id
                  maxItems: 1000
                  type: array
                overwrite:
                  default: false
                  description: When set to true, all conflicts are automatically overridden. When a saved object with a matching type and identifier exists in the target space, that version is replaced with the version from the source space. This option cannot be used with the `createNewCopies` option.
                  type: boolean
                spaces:
                  items:
                    description: The identifiers of the spaces where you want to copy the specified objects.
                    type: string
                  maxItems: 100
                  type: array
              required:
                - spaces
                - objects
            examples:
              copySavedObjectsRequestExample1:
                $ref: '#/components/examples/copy_saved_objects_request1'
              copySavedObjectsRequestExample2:
                $ref: '#/components/examples/copy_saved_objects_request2'
      responses:
        '200':
          description: 'OK: A successful request.'
          content:
            application/json:
              examples:
                copySavedObjectsResponseExample1:
                  $ref: '#/components/examples/copy_saved_objects_response1'
                copySavedObjectsResponseExample2:
                  $ref: '#/components/examples/copy_saved_objects_response2'
                copySavedObjectsResponseExample3:
                  $ref: '#/components/examples/copy_saved_objects_response3'
                copySavedObjectsResponseExample4:
                  $ref: '#/components/examples/copy_saved_objects_response4'
      summary: Copy saved objects between spaces
      tags:
        - spaces
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/spaces/_disable_legacy_url_aliases:
    post:
      description: Disable one or more legacy URL aliases so that they no longer resolve to their target saved objects.
      operationId: post-spaces-disable-legacy-url-aliases
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
      requestBody:
        content:
          application/json:
            schema:
              additionalProperties: false
              type: object
              properties:
                aliases:
                  items:
                    additionalProperties: false
                    type: object
                    properties:
                      sourceId:
                        description: The alias source object identifier. This is the legacy object identifier.
                        type: string
                      targetSpace:
                        description: The space where the alias target object exists.
                        type: string
                      targetType:
                        description: 'The type of alias target object. '
                        type: string
                    required:
                      - targetSpace
                      - targetType
                      - sourceId
                  maxItems: 1000
                  type: array
              required:
                - aliases
            examples:
              disableLegacyURLRequestExample1:
                $ref: '#/components/examples/disable_legacy_url_request1'
      responses:
        '204':
          description: Indicates a successful call.
      summary: Disable legacy URL aliases
      tags:
        - spaces
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/spaces/_get_shareable_references:
    post:
      description: Collect references and space contexts for saved objects.
      operationId: post-spaces-get-shareable-references
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
      requestBody:
        content:
          application/json:
            schema:
              additionalProperties: false
              type: object
              properties:
                objects:
                  items:
                    additionalProperties: false
                    type: object
                    properties:
                      id:
                        type: string
                      type:
                        type: string
                    required:
                      - type
                      - id
                  maxItems: 1000
                  type: array
              required:
                - objects
            examples:
              getShareableReferencesRequestExample1:
                $ref: '#/components/examples/get_shareable_references_request1'
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              examples:
                getShareableReferencesResponseExample1:
                  $ref: '#/components/examples/get_shareable_references_response1'
      summary: Get shareable references
      tags:
        - spaces
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/spaces/_resolve_copy_saved_objects_errors:
    post:
      description: 'Overwrite saved objects that are returned as errors from the copy saved objects to space API.<br/><br/>[Required authorization] Route required privileges: copySavedObjectsToSpaces.'
      operationId: post-spaces-resolve-copy-saved-objects-errors
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
      requestBody:
        content:
          application/json:
            schema:
              additionalProperties: false
              type: object
              properties:
                compatibilityMode:
                  default: false
                  type: boolean
                createNewCopies:
                  default: true
                  type: boolean
                includeReferences:
                  default: false
                  type: boolean
                objects:
                  items:
                    additionalProperties: false
                    type: object
                    properties:
                      id:
                        type: string
                      type:
                        type: string
                    required:
                      - type
                      - id
                  maxItems: 1000
                  type: array
                retries:
                  additionalProperties:
                    items:
                      additionalProperties: false
                      type: object
                      properties:
                        createNewCopy:
                          description: Creates new copies of the saved objects, regenerates each object ID, and resets the origin.
                          type: boolean
                        destinationId:
                          description: Specifies the destination identifier that the copied object should have, if different from the current identifier.
                          type: string
                        id:
                          description: The saved object identifier.
                          type: string
                        ignoreMissingReferences:
                          description: When set to true, any missing references errors are ignored.
                          type: boolean
                        overwrite:
                          default: false
                          description: When set to true, the saved object from the source space overwrites the conflicting object in the destination space.
                          type: boolean
                        type:
                          description: The saved object type.
                          type: string
                      required:
                        - type
                        - id
                    maxItems: 1000
                    type: array
                  type: object
              required:
                - retries
                - objects
            examples:
              resolveCopySavedObjectsRequestExample1:
                $ref: '#/components/examples/resolve_copy_saved_objects_request1'
              resolveCopySavedObjectsRequestExample2:
                $ref: '#/components/examples/resolve_copy_saved_objects_request2'
      responses:
        '200':
          description: 'OK: A successful request.'
          content:
            application/json:
              examples:
                resolveCopySavedObjectsResponseExample1:
                  $ref: '#/components/examples/copy_saved_objects_response1'
                resolveCopySavedObjectsResponseExample2:
                  $ref: '#/components/examples/copy_saved_objects_response2'
      summary: Resolve conflicts copying saved objects
      tags: []
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/spaces/_update_objects_spaces:
    post:
      description: Update one or more saved objects to add or remove them from some spaces.
      operationId: post-spaces-update-objects-spaces
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
      requestBody:
        content:
          application/json:
            schema:
              additionalProperties: false
              type: object
              properties:
                objects:
                  items:
                    additionalProperties: false
                    type: object
                    properties:
                      id:
                        description: The identifier of the saved object to update.
                        type: string
                      type:
                        description: The type of the saved object to update.
                        type: string
                    required:
                      - type
                      - id
                  maxItems: 1000
                  type: array
                spacesToAdd:
                  items:
                    description: The identifiers of the spaces the saved objects should be added to or removed from.
                    type: string
                  maxItems: 1000
                  type: array
                spacesToRemove:
                  items:
                    description: The identifiers of the spaces the saved objects should be added to or removed from.
                    type: string
                  maxItems: 1000
                  type: array
              required:
                - objects
                - spacesToAdd
                - spacesToRemove
            examples:
              updateObjectSpacesRequestExample1:
                $ref: '#/components/examples/update_saved_objects_spaces_request1'
      responses:
        '200':
          description: 'OK: A successful request.'
          content:
            application/json:
              examples:
                updateObjectSpacesResponseExample1:
                  $ref: '#/components/examples/update_saved_objects_spaces_response1'
      summary: Update saved objects in spaces
      tags:
        - spaces
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/spaces/space:
    get:
      description: Retrieve all available Kibana spaces. The list includes only the spaces that the user is authorized to access.
      operationId: get-spaces-space
      parameters:
        - description: Specifies which authorization checks are applied to the API call. The default value is `any`.
          in: query
          name: purpose
          required: false
          schema:
            enum:
              - any
              - copySavedObjectsIntoSpace
              - shareSavedObjectsIntoSpace
            type: string
        - description: When enabled, the API returns any spaces the user is authorized to access in any capacity, each including the purposes for which the user is authorized. This is useful for identifying spaces the user can read but is not authorized for a given purpose. Without the security plugin, this parameter has no effect, because no authorization checks are performed. This parameter cannot be used together with the `purpose` parameter.
          in: query
          name: include_authorized_purposes
          required: false
          schema:
            type: boolean
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              examples:
                getSpacesResponseExample1:
                  $ref: '#/components/examples/get_spaces_response1'
                getSpacesResponseExample2:
                  $ref: '#/components/examples/get_spaces_response2'
      summary: Get all spaces
      tags:
        - spaces
      x-metaTags:
        - content: Kibana
          name: product_name
    post:
      description: Create a new Kibana space.
      operationId: post-spaces-space
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
      requestBody:
        content:
          application/json:
            schema:
              additionalProperties: false
              type: object
              properties:
                _reserved:
                  type: boolean
                color:
                  description: The hexadecimal color code used in the space avatar. By default, the color is automatically generated from the space name.
                  type: string
                description:
                  description: A description for the space.
                  type: string
                disabledFeatures:
                  default: []
                  items:
                    description: The list of features that are turned off in the space.
                    type: string
                  maxItems: 100
                  type: array
                id:
                  description: The space ID that is part of the Kibana URL when inside the space. Space IDs are limited to lowercase alphanumeric, underscore, and hyphen characters (a-z, 0-9, _, and -). You are cannot change the ID with the update operation.
                  type: string
                imageUrl:
                  description: The data-URL encoded image to display in the space avatar. If specified, initials will not be displayed and the color will be visible as the background color for transparent images. For best results, your image should be 64x64. Images will not be optimized by this API call, so care should be taken when using custom images.
                  type: string
                initials:
                  description: One or two characters that are shown in the space avatar. By default, the initials are automatically generated from the space name.
                  maxLength: 2
                  type: string
                name:
                  description: 'The display name for the space. '
                  minLength: 1
                  type: string
                projectRouting:
                  description: Cross-project search default routing configuration for this space. Controls whether searches are scoped to a single project or span multiple projects in serverless environments.
                  type: string
                solution:
                  enum:
                    - security
                    - oblt
                    - es
                    - classic
                  type: string
              required:
                - id
                - name
            examples:
              createSpaceRequest:
                $ref: '#/components/examples/create_space_request'
      responses:
        '200':
          content:
            application/json:
              schema:
                additionalProperties: false
                type: object
                properties:
                  _reserved:
                    type: boolean
                  color:
                    description: The hexadecimal color code used in the space avatar. By default, the color is automatically generated from the space name.
                    type: string
                  description:
                    description: A description for the space.
                    type: string
                  disabledFeatures:
                    default: []
                    items:
                      description: The list of features that are turned off in the space.
                      type: string
                    maxItems: 100
                    type: array
                  id:
                    description: The space ID that is part of the Kibana URL when inside the space. Space IDs are limited to lowercase alphanumeric, underscore, and hyphen characters (a-z, 0-9, _, and -). You are cannot change the ID with the update operation.
                    type: string
                  imageUrl:
                    description: The data-URL encoded image to display in the space avatar. If specified, initials will not be displayed and the color will be visible as the background color for transparent images. For best results, your image should be 64x64. Images will not be optimized by this API call, so care should be taken when using custom images.
                    type: string
                  initials:
                    description: One or two characters that are shown in the space avatar. By default, the initials are automatically generated from the space name.
                    maxLength: 2
                    type: string
                  name:
                    description: 'The display name for the space. '
                    minLength: 1
                    type: string
                  projectRouting:
                    description: Cross-project search default routing configuration for this space. Controls whether searches are scoped to a single project or span multiple projects in serverless environments.
                    type: string
                  solution:
                    enum:
                      - security
                      - oblt
                      - es
                      - classic
                    type: string
                required:
                  - id
                  - name
              examples:
                createSpaceResponseExample:
                  $ref: '#/components/examples/get_space_response'
          description: Indicates a successful call.
      summary: Create a space
      tags:
        - spaces
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/spaces/space/{id}:
    delete:
      description: When you delete a space, all saved objects that belong to the space are automatically deleted, which is permanent and cannot be undone.
      operationId: delete-spaces-space-id
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: The space identifier.
          in: path
          name: id
          required: true
          schema:
            type: string
      responses:
        '204':
          description: Indicates a successful call.
        '404':
          description: Indicates that the request failed.
      summary: Delete a space
      tags:
        - spaces
      x-metaTags:
        - content: Kibana
          name: product_name
    get:
      description: Retrieve a single Kibana space by its identifier.
      operationId: get-spaces-space-id
      parameters:
        - description: The space identifier.
          in: path
          name: id
          required: true
          schema:
            type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                getSpaceResponse:
                  description: A response that contains the full configuration for a single Kibana space.
                  summary: Get details about a marketing space
                  value:
                    color: '#aabbcc'
                    description: This is the Marketing Space
                    disabledFeatures: []
                    id: marketing
                    imageUrl: ''
                    initials: MK
                    name: Marketing
                    solution: es
              schema:
                additionalProperties: false
                type: object
                properties:
                  _reserved:
                    type: boolean
                  color:
                    description: The hexadecimal color code used in the space avatar. By default, the color is automatically generated from the space name.
                    type: string
                  description:
                    description: A description for the space.
                    type: string
                  disabledFeatures:
                    default: []
                    items:
                      description: The list of features that are turned off in the space.
                      type: string
                    maxItems: 100
                    type: array
                  id:
                    description: The space ID that is part of the Kibana URL when inside the space. Space IDs are limited to lowercase alphanumeric, underscore, and hyphen characters (a-z, 0-9, _, and -). You are cannot change the ID with the update operation.
                    type: string
                  imageUrl:
                    description: The data-URL encoded image to display in the space avatar. If specified, initials will not be displayed and the color will be visible as the background color for transparent images. For best results, your image should be 64x64. Images will not be optimized by this API call, so care should be taken when using custom images.
                    type: string
                  initials:
                    description: One or two characters that are shown in the space avatar. By default, the initials are automatically generated from the space name.
                    maxLength: 2
                    type: string
                  name:
                    description: 'The display name for the space. '
                    minLength: 1
                    type: string
                  projectRouting:
                    description: Cross-project search default routing configuration for this space. Controls whether searches are scoped to a single project or span multiple projects in serverless environments.
                    type: string
                  solution:
                    enum:
                      - security
                      - oblt
                      - es
                      - classic
                    type: string
                required:
                  - id
                  - name
          description: Indicates a successful call.
      summary: Get a space
      tags:
        - spaces
      x-metaTags:
        - content: Kibana
          name: product_name
    put:
      description: Update an existing Kibana space.
      operationId: put-spaces-space-id
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: The space identifier. You are unable to change the ID with the update operation.
          in: path
          name: id
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              additionalProperties: false
              type: object
              properties:
                _reserved:
                  type: boolean
                color:
                  description: The hexadecimal color code used in the space avatar. By default, the color is automatically generated from the space name.
                  type: string
                description:
                  description: A description for the space.
                  type: string
                disabledFeatures:
                  default: []
                  items:
                    description: The list of features that are turned off in the space.
                    type: string
                  maxItems: 100
                  type: array
                id:
                  description: The space ID that is part of the Kibana URL when inside the space. Space IDs are limited to lowercase alphanumeric, underscore, and hyphen characters (a-z, 0-9, _, and -). You are cannot change the ID with the update operation.
                  type: string
                imageUrl:
                  description: The data-URL encoded image to display in the space avatar. If specified, initials will not be displayed and the color will be visible as the background color for transparent images. For best results, your image should be 64x64. Images will not be optimized by this API call, so care should be taken when using custom images.
                  type: string
                initials:
                  description: One or two characters that are shown in the space avatar. By default, the initials are automatically generated from the space name.
                  maxLength: 2
                  type: string
                name:
                  description: 'The display name for the space. '
                  minLength: 1
                  type: string
                projectRouting:
                  description: Cross-project search default routing configuration for this space. Controls whether searches are scoped to a single project or span multiple projects in serverless environments.
                  type: string
                solution:
                  enum:
                    - security
                    - oblt
                    - es
                    - classic
                  type: string
              required:
                - id
                - name
            examples:
              updateSpaceRequest:
                $ref: '#/components/examples/update_space_request'
      responses:
        '200':
          content:
            application/json:
              examples:
                updateSpaceResponse:
                  description: A response that contains the updated configuration of the Kibana space.
                  summary: Update the marketing space
                  value:
                    color: '#aabbcc'
                    description: An updated description for the Marketing Space
                    disabledFeatures: []
                    id: marketing
                    imageUrl: ''
                    initials: MK
                    name: Marketing
                    solution: es
              schema:
                additionalProperties: false
                type: object
                properties:
                  _reserved:
                    type: boolean
                  color:
                    description: The hexadecimal color code used in the space avatar. By default, the color is automatically generated from the space name.
                    type: string
                  description:
                    description: A description for the space.
                    type: string
                  disabledFeatures:
                    default: []
                    items:
                      description: The list of features that are turned off in the space.
                      type: string
                    maxItems: 100
                    type: array
                  id:
                    description: The space ID that is part of the Kibana URL when inside the space. Space IDs are limited to lowercase alphanumeric, underscore, and hyphen characters (a-z, 0-9, _, and -). You are cannot change the ID with the update operation.
                    type: string
                  imageUrl:
                    description: The data-URL encoded image to display in the space avatar. If specified, initials will not be displayed and the color will be visible as the background color for transparent images. For best results, your image should be 64x64. Images will not be optimized by this API call, so care should be taken when using custom images.
                    type: string
                  initials:
                    description: One or two characters that are shown in the space avatar. By default, the initials are automatically generated from the space name.
                    maxLength: 2
                    type: string
                  name:
                    description: 'The display name for the space. '
                    minLength: 1
                    type: string
                  projectRouting:
                    description: Cross-project search default routing configuration for this space. Controls whether searches are scoped to a single project or span multiple projects in serverless environments.
                    type: string
                  solution:
                    enum:
                      - security
                      - oblt
                      - es
                      - classic
                    type: string
                required:
                  - id
                  - name
          description: Indicates a successful call.
      summary: Update a space
      tags:
        - spaces
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/status:
    get:
      description: Returns Kibana's overall operational status and a per-service breakdown for Elasticsearch, Saved Objects, and registered plugins. The endpoint is intended for liveness and readiness checks (for example, by Kubernetes probes) and for operators monitoring a Kibana deployment. Unauthenticated callers receive a redacted response that exposes only the overall status level.
      operationId: get-status
      parameters:
        - description: Set to "true" to get the response in v7 format.
          in: query
          name: v7format
          required: false
          schema:
            type: boolean
        - description: Set to "true" to get the response in v8 format.
          in: query
          name: v8format
          required: false
          schema:
            type: boolean
      responses:
        '200':
          content:
            application/json:
              examples:
                statusAvailableResponse:
                  description: A successful response when Kibana and its core services are operating normally.
                  summary: Kibana is available
                  value:
                    metrics:
                      collection_interval_in_millis: 5000
                      elasticsearch_client:
                        totalActiveSockets: 4
                        totalIdleSockets: 2
                        totalQueuedRequests: 0
                      last_updated: '2026-04-30T12:00:05.000Z'
                    name: kibana
                    status:
                      core:
                        elasticsearch:
                          level: available
                          summary: Elasticsearch is available
                        savedObjects:
                          level: available
                          summary: SavedObjects service has completed migrations and is available
                      overall:
                        level: available
                        summary: All services are available
                      plugins: {}
                    uuid: 5b2de169-2785-441b-ae8c-186a1936b17d
                    version:
                      build_date: '2026-04-30T12:00:00.000Z'
                      build_flavor: traditional
                      build_hash: ad8f0fa4d5022f56bbe2c4d51e9d0fcfa1ee67fc
                      build_number: 100200
                      build_snapshot: false
                      number: 9.3.0
                statusRedactedResponse:
                  description: A redacted response returned when the caller is unauthenticated or lacks the `monitor` cluster privilege.
                  summary: Kibana is available (redacted)
                  value:
                    status:
                      overall:
                        level: available
              schema:
                anyOf:
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_core_status_response'
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_core_status_redactedResponse'
                description: Kibana's operational status. A minimal response is sent for unauthorized users.
          description: Overall status is OK and Kibana should be functioning normally.
        '503':
          content:
            application/json:
              examples:
                statusUnavailableResponse:
                  description: A response when one or more core services are unavailable.
                  summary: Kibana is unavailable
                  value:
                    metrics:
                      collection_interval_in_millis: 5000
                      elasticsearch_client:
                        totalActiveSockets: 0
                        totalIdleSockets: 0
                        totalQueuedRequests: 0
                      last_updated: '2026-04-30T12:00:05.000Z'
                    name: kibana
                    status:
                      core:
                        elasticsearch:
                          level: unavailable
                          summary: Unable to connect to Elasticsearch
                        savedObjects:
                          level: unavailable
                          summary: SavedObjects service depends on Elasticsearch
                      overall:
                        level: unavailable
                        summary: Some services are unavailable
                      plugins: {}
                    uuid: 5b2de169-2785-441b-ae8c-186a1936b17d
                    version:
                      build_date: '2026-04-30T12:00:00.000Z'
                      build_flavor: traditional
                      build_hash: ad8f0fa4d5022f56bbe2c4d51e9d0fcfa1ee67fc
                      build_number: 100200
                      build_snapshot: false
                      number: 9.3.0
              schema:
                anyOf:
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_core_status_response'
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_core_status_redactedResponse'
                description: Kibana's operational status. A minimal response is sent for unauthorized users.
          description: Kibana or some of its essential services are unavailable. Kibana may be degraded or unavailable.
      summary: Get Kibana's current status
      tags:
        - system
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/streams:
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/streams</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Fetches list of all streams<br/><br/>[Required authorization] Route required privileges: read_stream.
      operationId: get-streams
      parameters: []
      requestBody:
        content:
          application/json:
            examples: {}
            schema:
              anyOf:
                - additionalProperties: false
                  type: object
                  properties: {}
                - {}
              nullable: true
      responses:
        '200':
          content:
            application/json:
              examples:
                listStreams:
                  value:
                    streams:
                      - description: Root logs stream
                        ingest:
                          failure_store:
                            inherit: {}
                          lifecycle:
                            inherit: {}
                          processing:
                            steps: []
                            updated_at: '2025-01-10T08:00:00.000Z'
                          settings: {}
                          wired:
                            fields:
                              '@timestamp':
                                type: date
                              log.level:
                                type: keyword
                              message:
                                type: match_only_text
                            routing:
                              - destination: logs.nginx
                                status: enabled
                                where:
                                  eq: nginx
                                  field: host.name
                        name: logs
                        type: wired
                        updated_at: '2025-01-10T08:00:00.000Z'
                      - description: Web server access logs, routed by severity
                        ingest:
                          failure_store:
                            inherit: {}
                          lifecycle:
                            inherit: {}
                          processing:
                            steps: []
                            updated_at: '2025-01-15T10:30:00.000Z'
                          settings: {}
                          wired:
                            fields:
                              host.name:
                                type: keyword
                              http.response.status_code:
                                type: long
                              message:
                                type: match_only_text
                            routing:
                              - destination: logs.nginx.errors
                                status: enabled
                                where:
                                  field: http.response.status_code
                                  gte: 500
                        name: logs.nginx
                        type: wired
                        updated_at: '2025-01-15T10:30:00.000Z'
                      - description: Legacy application logs
                        ingest:
                          classic: {}
                          failure_store:
                            disabled: {}
                          lifecycle:
                            dsl:
                              data_retention: 30d
                          processing:
                            steps:
                              - action: grok
                                from: message
                                ignore_missing: true
                                patterns:
                                  - '%{TIMESTAMP_ISO8601:timestamp} %{LOGLEVEL:log.level} %{GREEDYDATA:message}'
                            updated_at: '2024-12-01T09:00:00.000Z'
                          settings: {}
                        name: logs-myapp-default
                        type: classic
                        updated_at: '2024-12-01T09:00:00.000Z'
                      - description: All error-level logs across every stream
                        name: logs.errors
                        query:
                          esql: FROM logs* | WHERE log.level == "error"
                          view: logs.errors-view
                        type: query
                        updated_at: '2025-01-20T14:00:00.000Z'
          description: A list of all streams.
      summary: Get stream list
      tags:
        - streams
      x-state: Experimental; added in 9.1.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/streams/_disable:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/streams/_disable</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Disables wired streams and deletes all existing stream definitions. The data of wired streams is deleted, but the data of classic streams is preserved.<br/><br/>[Required authorization] Route required privileges: manage_stream.
      operationId: post-streams-disable
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
      requestBody:
        content:
          application/json:
            examples: {}
            schema:
              anyOf:
                - additionalProperties: false
                  type: object
                  properties: {}
                - {}
              nullable: true
      responses:
        '200':
          description: Streams were disabled successfully.
      summary: Disable streams
      tags:
        - streams
      x-state: Experimental; added in 9.1.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/streams/_enable:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/streams/_enable</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Enables wired streams<br/><br/>[Required authorization] Route required privileges: manage_stream.
      operationId: post-streams-enable
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
      requestBody:
        content:
          application/json:
            examples: {}
            schema:
              anyOf:
                - additionalProperties: false
                  type: object
                  properties: {}
                - {}
              nullable: true
      responses:
        '200':
          description: Streams were enabled successfully.
      summary: Enable streams
      tags:
        - streams
      x-state: Experimental; added in 9.1.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/streams/_resync:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/streams/_resync</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Resyncs all streams, making sure that Elasticsearch assets are up to date<br/><br/>[Required authorization] Route required privileges: manage_stream.
      operationId: post-streams-resync
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
      requestBody:
        content:
          application/json:
            examples: {}
            schema:
              anyOf:
                - additionalProperties: false
                  type: object
                  properties: {}
                - {}
              nullable: true
      responses:
        '200':
          description: Streams were resynced successfully.
      summary: Resync streams
      tags:
        - streams
      x-state: Experimental; added in 9.1.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/streams/{name}:
    delete:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb delete">delete</span>&nbsp;<span class="operation-path">/s/{space_id}/api/streams/{name}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Deletes a stream definition and the underlying data stream<br/><br/>[Required authorization] Route required privileges: manage_stream.
      operationId: delete-streams-name
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: The name of the stream.
          in: path
          name: name
          required: true
          schema:
            maxLength: 200
            type: string
      requestBody:
        content:
          application/json:
            examples: {}
            schema:
              anyOf:
                - additionalProperties: false
                  type: object
                  properties: {}
                - {}
              nullable: true
      responses:
        '200':
          description: The stream was deleted successfully.
      summary: Delete a stream
      tags:
        - streams
      x-state: Experimental; added in 9.1.0
      x-metaTags:
        - content: Kibana
          name: product_name
    get:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/streams/{name}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Fetches a stream definition and associated dashboards<br/><br/>[Required authorization] Route required privileges: read_stream.
      operationId: get-streams-name
      parameters:
        - description: The name of the stream.
          in: path
          name: name
          required: true
          schema:
            maxLength: 200
            type: string
      requestBody:
        content:
          application/json:
            examples: {}
            schema:
              anyOf:
                - additionalProperties: false
                  type: object
                  properties: {}
                - {}
              nullable: true
      responses:
        '200':
          content:
            application/json:
              examples:
                getWiredStream:
                  value:
                    dashboards: []
                    data_stream_exists: true
                    effective_failure_store:
                      disabled: {}
                      from: logs
                    effective_lifecycle:
                      dsl:
                        data_retention: 7d
                      from: logs
                    effective_settings: {}
                    inherited_fields:
                      '@timestamp':
                        from: logs
                        type: date
                      log.level:
                        from: logs
                        type: keyword
                    privileges:
                      create_snapshot_repository: false
                      lifecycle: true
                      manage: true
                      manage_failure_store: true
                      monitor: true
                      read_failure_store: true
                      simulate: true
                      text_structure: true
                      view_index_metadata: true
                    rules: []
                    stream:
                      description: Web server access logs, routed by severity
                      ingest:
                        failure_store:
                          inherit: {}
                        lifecycle:
                          inherit: {}
                        processing:
                          steps: []
                          updated_at: '2025-01-15T10:30:00.000Z'
                        settings: {}
                        wired:
                          fields:
                            host.name:
                              type: keyword
                            http.response.status_code:
                              type: long
                            message:
                              type: match_only_text
                          routing:
                            - destination: logs.nginx.errors
                              status: enabled
                              where:
                                field: http.response.status_code
                                gte: 500
                      name: logs.nginx
                      type: wired
                      updated_at: '2025-01-15T10:30:00.000Z'
          description: Stream definition and associated metadata.
      summary: Get a stream
      tags:
        - streams
      x-state: Experimental; added in 9.1.0
      x-metaTags:
        - content: Kibana
          name: product_name
    put:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb put">put</span>&nbsp;<span class="operation-path">/s/{space_id}/api/streams/{name}</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Creates or updates a stream definition. Classic streams can not be created through this API, only updated<br/><br/>[Required authorization] Route required privileges: manage_stream.
      operationId: put-streams-name
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: The name of the stream.
          in: path
          name: name
          required: true
          schema:
            maxLength: 200
            type: string
      requestBody:
        content:
          application/json:
            examples:
              createQueryStream:
                value:
                  dashboards: []
                  rules: []
                  stream:
                    description: All error-level logs across every stream
                    query:
                      esql: FROM logs* | WHERE log.level == "error"
                      view: logs.errors-view
                    type: query
              createWiredStream:
                value:
                  dashboards: []
                  rules: []
                  stream:
                    description: Web server access logs, routed by severity
                    ingest:
                      failure_store:
                        inherit: {}
                      lifecycle:
                        inherit: {}
                      processing:
                        steps: []
                      settings: {}
                      wired:
                        fields:
                          host.name:
                            type: keyword
                          http.response.status_code:
                            type: long
                          message:
                            type: match_only_text
                        routing:
                          - destination: logs.nginx.errors
                            status: enabled
                            where:
                              field: http.response.status_code
                              gte: 500
                    type: wired
              updateClassicStream:
                value:
                  dashboards: []
                  rules: []
                  stream:
                    description: Legacy application logs managed as a classic data stream
                    ingest:
                      classic: {}
                      failure_store:
                        disabled: {}
                      lifecycle:
                        dsl:
                          data_retention: 30d
                      processing:
                        steps:
                          - action: grok
                            from: message
                            ignore_missing: true
                            patterns:
                              - '%{TIMESTAMP_ISO8601:timestamp} %{LOGLEVEL:log.level} %{GREEDYDATA:message}'
                      settings: {}
                    type: classic
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_StreamUpsertRequest'
      responses:
        '200':
          description: The stream was created or updated successfully.
      summary: Create or update a stream
      tags:
        - streams
      x-state: Experimental; added in 9.1.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/streams/{name}/_fork:
    post:
      description: |-
        **Spaces method and path for this operation:**

        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/streams/{name}/_fork</span></div>

        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

        Forks a wired stream and creates a child stream<br/><br/>[Required authorization] Route required privileges: manage_stream.
      operationId: post-streams-name-fork
      parameters:
        - description: A required header to protect against CSRF attacks
          in: header
          name: kbn-xsrf
          required: true
          schema:
            example: 'true'
            type: string
        - description: The name of the parent stream to fork from.
          in: path
          name: name
          required: true
          schema:
            maxLength: 200
            type: string
      requestBody:
        content:
          application/json:
            examples:
              forkStream:
                value:
                  status: enabled
                  stream:
                    name: logs.nginx.errors
                  where:
                    eq: '500'
                    field: http.response.status_code
            schema:
              additionalProperties: false
              type: object
              properties:
                draft:
                  type: boolean
                status:
                  enum:
                    - enabled
                    - disabled
                  type: string
                stream:
                  additionalProperties: false
                  type: object
                  properties:
                    name:
                      maxLength: 200
                      type: string
                  required:
                    - name
                where:
                  anyOf:
                    - anyOf:
                        - additionalProperties: false
                          type: object
                          properties:
                            contains:
                              anyOf:
                                - maxLength: 65535
                                  type: string
                                - type: number
                                - type: boolean
                            endsWith:
                              anyOf:
                                - maxLength: 65535
                                  type: string
                                - type: number
                                - type: boolean
                            eq:
                              anyOf:
                                - maxLength: 65535
                                  type: string
                                - type: number
                                - type: boolean
                            field:
                              maxLength: 256
                              minLength: 1
                              type: string
                            gt:
                              anyOf:
                                - maxLength: 65535
                                  type: string
                                - type: number
                                - type: boolean
                            gte:
                              anyOf:
                                - maxLength: 65535
                                  type: string
                                - type: number
                                - type: boolean
                            includes:
                              anyOf:
                                - maxLength: 65535
                                  type: string
                                - type: number
                                - type: boolean
                            lt:
                              anyOf:
                                - maxLength: 65535
                                  type: string
                                - type: number
                                - type: boolean
                            lte:
                              anyOf:
                                - maxLength: 65535
                                  type: string
                                - type: number
                                - type: boolean
                            neq:
                              anyOf:
                                - maxLength: 65535
                                  type: string
                                - type: number
                                - type: boolean
                            range:
                              additionalProperties: false
                              type: object
                              properties:
                                gt:
                                  anyOf:
                                    - maxLength: 65535
                                      type: string
                                    - type: number
                                    - type: boolean
                                gte:
                                  anyOf:
                                    - maxLength: 65535
                                      type: string
                                    - type: number
                                    - type: boolean
                                lt:
                                  anyOf:
                                    - maxLength: 65535
                                      type: string
                                    - type: number
                                    - type: boolean
                                lte:
                                  anyOf:
                                    - maxLength: 65535
                                      type: string
                                    - type: number
                                    - type: boolean
                            startsWith:
                              anyOf:
                                - maxLength: 65535
                                  type: string
                                - type: number
                                - type: boolean
                          required:
                            - field
                        - additionalProperties: false
                          type: object
                          properties:
                            exists:
                              type: boolean
                            field:
                              maxLength: 256
                              minLength: 1
                              type: string
                          required:
                            - field
                    - additionalProperties: false
                      type: object
                      properties:
                        and:
                          items:
                            anyOf:
                              - anyOf:
                                  - additionalProperties: false
                                    type: object
                                    properties:
                                      contains:
                                        anyOf:
                                          - maxLength: 65535
                                            type: string
                                          - type: number
                                          - type: boolean
                                      endsWith:
                                        anyOf:
                                          - maxLength: 65535
                                            type: string
                                          - type: number
                                          - type: boolean
                                      eq:
                                        anyOf:
                                          - maxLength: 65535
                                            type: string
                                          - type: number
                                          - type: boolean
                                      field:
                                        maxLength: 256
                                        minLength: 1
                                        type: string
                                      gt:
                                        anyOf:
                                          - maxLength: 65535
                                            type: string
                                          - type: number
                                          - type: boolean
                                      gte:
                                        anyOf:
                                          - maxLength: 65535
                                            type: string
                                          - type: number
                                          - type: boolean
                                      includes:
                                        anyOf:
                                          - maxLength: 65535
                                            type: string
                                          - type: number
                                          - type: boolean
                                      lt:
                                        anyOf:
                                          - maxLength: 65535
                                            type: string
                                          - type: number
                                          - type: boolean
                                      lte:
                                        anyOf:
                                          - maxLength: 65535
                                            type: string
                                          - type: number
                                          - type: boolean
                                      neq:
                                        anyOf:
                                          - maxLength: 65535
                                            type: string
                                          - type: number
                                          - type: boolean
                                      range:
                                        additionalProperties: false
                                        type: object
                                        properties:
                                          gt:
                                            anyOf:
                                              - maxLength: 65535
                                                type: string
                                              - type: number
                                              - type: boolean
                                          gte:
                                            anyOf:
                                              - maxLength: 65535
                                                type: string
                                              - type: number
                                              - type: boolean
                                          lt:
                                            anyOf:
                                              - maxLength: 65535
                                                type: string
                                              - type: number
                                              - type: boolean
                                          lte:
                                            anyOf:
                                              - maxLength: 65535
                                                type: string
                                              - type: number
                                              - type: boolean
                                      startsWith:
                                        anyOf:
                                          - maxLength: 65535
                                            type: string
                                          - type: number
                                          - type: boolean
                                    required:
                                      - field
                                  - additionalProperties: false
                                    type: object
                                    properties:
                                      exists:
                                        type: boolean
                                      field:
                                        maxLength: 256
                                        minLength: 1
                                        type: string
                                    required:
                                      - field
                              - additionalProperties: false
                                type: object
                                properties:
                                  and:
                                    items:
                                      anyOf:
                                        - anyOf:
                                            - additionalProperties: false
                                              type: object
                                              properties:
                                                contains:
                                                  anyOf:
                                                    - maxLength: 65535
                                                      type: string
                                                    - type: number
                                                    - type: boolean
                                                endsWith:
                                                  anyOf:
                                                    - maxLength: 65535
                                                      type: string
                                                    - type: number
                                                    - type: boolean
                                                eq:
                                                  anyOf:
                                                    - maxLength: 65535
                                                      type: string
                                                    - type: number
                                                    - type: boolean
                                                field:
                                                  maxLength: 256
                                                  minLength: 1
                                                  type: string
                                                gt:
                                                  anyOf:
                                                    - maxLength: 65535
                                                      type: string
                                                    - type: number
                                                    - type: boolean
                                                gte:
                                                  anyOf:
                                                    - maxLength: 65535
                                                      type: string
                                                    - type: number
                                                    - type: boolean
                                                includes:
                                                  anyOf:
                                                    - maxLength: 65535
                                                      type: string
                                                    - type: number
                                                    - type: boolean
                                                lt:
                                                  anyOf:
                                                    - maxLength: 65535
                                                      type: string
                                                    - type: number
                                                    - type: boolean
                                                lte:
                                                  anyOf:
                                                    - maxLength: 65535
                                                      type: string
                                                    - type: number
                                                    - type: boolean
                                                neq:
                                                  anyOf:
                                                    - maxLength: 65535
                                                      type: string
                                                    - type: number
                                                    - type: boolean
                                                range:
                                                  additionalProperties: false
                                                  type: object
                                                  properties:
                                                    gt:
                                                      anyOf:
                                                        - maxLength: 65535
                                                          type: string
                                                        - type: number
                                                        - type: boolean
                                                    gte:
                                                      anyOf:
                                                        - maxLength: 65535
                                                          type: string
                                                        - type: number
                                                        - type: boolean
                                                    lt:
                                                      anyOf:
                                                        - maxLength: 65535
                                                          type: string
                                                        - type: number
                                                        - type: boolean
                                                    lte:
                                                      anyOf:
                                                        - maxLength: 65535
                                                          type: string
                                                        - type: number
                                                        - type: boolean
                                                startsWith:
                                                  anyOf:
                                                    - maxLength: 65535
                                                      type: string
                                                    - type: number
                                                    - type: boolean
                                              required:
                                                - field
                                            - additionalProperties: false
                                              type: object
                                              properties:
                                                exists:
                                                  type: boolean
                                                field:
                                                  maxLength: 256
                                                  minLength: 1
                                                  type: string
                                              required:
                                                - field
                                        - additionalProperties: false
                                          type: object
                                          properties:
                                            and:
                                              items:
                                                anyOf:
                                                  - anyOf:
                                                      - additionalProperties: false
                                                        type: object
                                                        properties:
                                                          contains:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          endsWith:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          eq:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          field:
                                                            maxLength: 256
                                                            minLength: 1
                                                            type: string
                                                          gt:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          gte:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          includes:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          lt:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          lte:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          neq:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          range:
                                                            additionalProperties: false
                                                            type: object
                                                            properties:
                                                              gt:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              gte:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              lt:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              lte:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                          startsWith:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                        required:
                                                          - field
                                                      - additionalProperties: false
                                                        type: object
                                                        properties:
                                                          exists:
                                                            type: boolean
                                                          field:
                                                            maxLength: 256
                                                            minLength: 1
                                                            type: string
                                                        required:
                                                          - field
                                                  - additionalProperties: false
                                                    type: object
                                                    properties:
                                                      and:
                                                        items:
                                                          anyOf:
                                                            - anyOf:
                                                                - additionalProperties: false
                                                                  type: object
                                                                  properties:
                                                                    contains:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    endsWith:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    eq:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    field:
                                                                      maxLength: 256
                                                                      minLength: 1
                                                                      type: string
                                                                    gt:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    gte:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    includes:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    lt:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    lte:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    neq:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    range:
                                                                      additionalProperties: false
                                                                      type: object
                                                                      properties:
                                                                        gt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        gte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                    startsWith:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                  required:
                                                                    - field
                                                                - additionalProperties: false
                                                                  type: object
                                                                  properties:
                                                                    exists:
                                                                      type: boolean
                                                                    field:
                                                                      maxLength: 256
                                                                      minLength: 1
                                                                      type: string
                                                                  required:
                                                                    - field
                                                            - additionalProperties: false
                                                              type: object
                                                              properties:
                                                                and:
                                                                  items:
                                                                    anyOf:
                                                                      - anyOf:
                                                                          - additionalProperties: false
                                                                            type: object
                                                                            properties:
                                                                              contains:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              endsWith:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              eq:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              field:
                                                                                maxLength: 256
                                                                                minLength: 1
                                                                                type: string
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              includes:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              neq:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              range:
                                                                                additionalProperties: false
                                                                                type: object
                                                                                properties:
                                                                                  gt:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  gte:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  lt:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  lte:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                              startsWith:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            required:
                                                                              - field
                                                                          - additionalProperties: false
                                                                            type: object
                                                                            properties:
                                                                              exists:
                                                                                type: boolean
                                                                              field:
                                                                                maxLength: 256
                                                                                minLength: 1
                                                                                type: string
                                                                            required:
                                                                              - field
                                                                      - additionalProperties: false
                                                                        type: object
                                                                        properties:
                                                                          always:
                                                                            additionalProperties: false
                                                                            type: object
                                                                            properties: {}
                                                                        required:
                                                                          - always
                                                                      - additionalProperties: false
                                                                        type: object
                                                                        properties:
                                                                          never:
                                                                            additionalProperties: false
                                                                            type: object
                                                                            properties: {}
                                                                        required:
                                                                          - never
                                                                  maxItems: 50
                                                                  type: array
                                                              required:
                                                                - and
                                                            - additionalProperties: false
                                                              type: object
                                                              properties:
                                                                or:
                                                                  items:
                                                                    anyOf:
                                                                      - anyOf:
                                                                          - additionalProperties: false
                                                                            type: object
                                                                            properties:
                                                                              contains:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              endsWith:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              eq:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              field:
                                                                                maxLength: 256
                                                                                minLength: 1
                                                                                type: string
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              includes:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              neq:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              range:
                                                                                additionalProperties: false
                                                                                type: object
                                                                                properties:
                                                                                  gt:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  gte:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  lt:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  lte:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                              startsWith:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            required:
                                                                              - field
                                                                          - additionalProperties: false
                                                                            type: object
                                                                            properties:
                                                                              exists:
                                                                                type: boolean
                                                                              field:
                                                                                maxLength: 256
                                                                                minLength: 1
                                                                                type: string
                                                                            required:
                                                                              - field
                                                                      - additionalProperties: false
                                                                        type: object
                                                                        properties:
                                                                          always:
                                                                            additionalProperties: false
                                                                            type: object
                                                                            properties: {}
                                                                        required:
                                                                          - always
                                                                      - additionalProperties: false
                                                                        type: object
                                                                        properties:
                                                                          never:
                                                                            additionalProperties: false
                                                                            type: object
                                                                            properties: {}
                                                                        required:
                                                                          - never
                                                                  maxItems: 50
                                                                  type: array
                                                              required:
                                                                - or
                                                            - additionalProperties: false
                                                              type: object
                                                              properties:
                                                                not:
                                                                  anyOf:
                                                                    - anyOf:
                                                                        - additionalProperties: false
                                                                          type: object
                                                                          properties:
                                                                            contains:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            endsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            eq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            includes:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            neq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            range:
                                                                              additionalProperties: false
                                                                              type: object
                                                                              properties:
                                                                                gt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                gte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                            startsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          required:
                                                                            - field
                                                                        - additionalProperties: false
                                                                          type: object
                                                                          properties:
                                                                            exists:
                                                                              type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                          required:
                                                                            - field
                                                                    - additionalProperties: false
                                                                      type: object
                                                                      properties:
                                                                        always:
                                                                          additionalProperties: false
                                                                          type: object
                                                                          properties: {}
                                                                      required:
                                                                        - always
                                                                    - additionalProperties: false
                                                                      type: object
                                                                      properties:
                                                                        never:
                                                                          additionalProperties: false
                                                                          type: object
                                                                          properties: {}
                                                                      required:
                                                                        - never
                                                              required:
                                                                - not
                                                            - additionalProperties: false
                                                              type: object
                                                              properties:
                                                                always:
                                                                  additionalProperties: false
                                                                  type: object
                                                                  properties: {}
                                                              required:
                                                                - always
                                                            - additionalProperties: false
                                                              type: object
                                                              properties:
                                                                never:
                                                                  additionalProperties: false
                                                                  type: object
                                                                  properties: {}
                                                              required:
                                                                - never
                                                        maxItems: 50
                                                        type: array
                                                    required:
                                                      - and
                                                  - additionalProperties: false
                                                    type: object
                                                    properties:
                                                      or:
                                                        items:
                                                          anyOf:
                                                            - anyOf:
                                                                - additionalProperties: false
                                                                  type: object
                                                                  properties:
                                                                    contains:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    endsWith:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    eq:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    field:
                                                                      maxLength: 256
                                                                      minLength: 1
                                                                      type: string
                                                                    gt:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    gte:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    includes:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    lt:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    lte:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    neq:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    range:
                                                                      additionalProperties: false
                                                                      type: object
                                                                      properties:
                                                                        gt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        gte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                    startsWith:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                  required:
                                                                    - field
                                                                - additionalProperties: false
                                                                  type: object
                                                                  properties:
                                                                    exists:
                                                                      type: boolean
                                                                    field:
                                                                      maxLength: 256
                                                                      minLength: 1
                                                                      type: string
                                                                  required:
                                                                    - field
                                                            - additionalProperties: false
                                                              type: object
                                                              properties:
                                                                and:
                                                                  items:
                                                                    anyOf:
                                                                      - anyOf:
                                                                          - additionalProperties: false
                                                                            type: object
                                                                            properties:
                                                                              contains:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              endsWith:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              eq:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              field:
                                                                                maxLength: 256
                                                                                minLength: 1
                                                                                type: string
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              includes:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              neq:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              range:
                                                                                additionalProperties: false
                                                                                type: object
                                                                                properties:
                                                                                  gt:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  gte:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  lt:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  lte:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                              startsWith:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            required:
                                                                              - field
                                                                          - additionalProperties: false
                                                                            type: object
                                                                            properties:
                                                                              exists:
                                                                                type: boolean
                                                                              field:
                                                                                maxLength: 256
                                                                                minLength: 1
                                                                                type: string
                                                                            required:
                                                                              - field
                                                                      - additionalProperties: false
                                                                        type: object
                                                                        properties:
                                                                          always:
                                                                            additionalProperties: false
                                                                            type: object
                                                                            properties: {}
                                                                        required:
                                                                          - always
                                                                      - additionalProperties: false
                                                                        type: object
                                                                        properties:
                                                                          never:
                                                                            additionalProperties: false
                                                                            type: object
                                                                            properties: {}
                                                                        required:
                                                                          - never
                                                                  maxItems: 50
                                                                  type: array
                                                              required:
                                                                - and
                                                            - additionalProperties: false
                                                              type: object
                                                              properties:
                                                                or:
                                                                  items:
                                                                    anyOf:
                                                                      - anyOf:
                                                                          - additionalProperties: false
                                                                            type: object
                                                                            properties:
                                                                              contains:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              endsWith:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              eq:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              field:
                                                                                maxLength: 256
                                                                                minLength: 1
                                                                                type: string
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              includes:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              neq:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              range:
                                                                                additionalProperties: false
                                                                                type: object
                                                                                properties:
                                                                                  gt:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  gte:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  lt:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  lte:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                              startsWith:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            required:
                                                                              - field
                                                                          - additionalProperties: false
                                                                            type: object
                                                                            properties:
                                                                              exists:
                                                                                type: boolean
                                                                              field:
                                                                                maxLength: 256
                                                                                minLength: 1
                                                                                type: string
                                                                            required:
                                                                              - field
                                                                      - additionalProperties: false
                                                                        type: object
                                                                        properties:
                                                                          always:
                                                                            additionalProperties: false
                                                                            type: object
                                                                            properties: {}
                                                                        required:
                                                                          - always
                                                                      - additionalProperties: false
                                                                        type: object
                                                                        properties:
                                                                          never:
                                                                            additionalProperties: false
                                                                            type: object
                                                                            properties: {}
                                                                        required:
                                                                          - never
                                                                  maxItems: 50
                                                                  type: array
                                                              required:
                                                                - or
                                                            - additionalProperties: false
                                                              type: object
                                                              properties:
                                                                not:
                                                                  anyOf:
                                                                    - anyOf:
                                                                        - additionalProperties: false
                                                                          type: object
                                                                          properties:
                                                                            contains:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            endsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            eq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            includes:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            neq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            range:
                                                                              additionalProperties: false
                                                                              type: object
                                                                              properties:
                                                                                gt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                gte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                            startsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          required:
                                                                            - field
                                                                        - additionalProperties: false
                                                                          type: object
                                                                          properties:
                                                                            exists:
                                                                              type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                          required:
                                                                            - field
                                                                    - additionalProperties: false
                                                                      type: object
                                                                      properties:
                                                                        always:
                                                                          additionalProperties: false
                                                                          type: object
                                                                          properties: {}
                                                                      required:
                                                                        - always
                                                                    - additionalProperties: false
                                                                      type: object
                                                                      properties:
                                                                        never:
                                                                          additionalProperties: false
                                                                          type: object
                                                                          properties: {}
                                                                      required:
                                                                        - never
                                                              required:
                                                                - not
                                                            - additionalProperties: false
                                                              type: object
                                                              properties:
                                                                always:
                                                                  additionalProperties: false
                                                                  type: object
                                                                  properties: {}
                                                              required:
                                                                - always
                                                            - additionalProperties: false
                                                              type: object
                                                              properties:
                                                                never:
                                                                  additionalProperties: false
                                                                  type: object
                                                                  properties: {}
                                                              required:
                                                                - never
                                                        maxItems: 50
                                                        type: array
                                                    required:
                                                      - or
                                                  - additionalProperties: false
                                                    type: object
                                                    properties:
                                                      not:
                                                        anyOf:
                                                          - anyOf:
                                                              - additionalProperties: false
                                                                type: object
                                                                properties:
                                                                  contains:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  endsWith:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  eq:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  field:
                                                                    maxLength: 256
                                                                    minLength: 1
                                                                    type: string
                                                                  gt:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  gte:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  includes:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  lt:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  lte:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  neq:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  range:
                                                                    additionalProperties: false
                                                                    type: object
                                                                    properties:
                                                                      gt:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      gte:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      lt:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      lte:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                  startsWith:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                required:
                                                                  - field
                                                              - additionalProperties: false
                                                                type: object
                                                                properties:
                                                                  exists:
                                                                    type: boolean
                                                                  field:
                                                                    maxLength: 256
                                                                    minLength: 1
                                                                    type: string
                                                                required:
                                                                  - field
                                                          - additionalProperties: false
                                                            type: object
                                                            properties:
                                                              and:
                                                                items:
                                                                  anyOf:
                                                                    - anyOf:
                                                                        - additionalProperties: false
                                                                          type: object
                                                                          properties:
                                                                            contains:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            endsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            eq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            includes:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            neq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            range:
                                                                              additionalProperties: false
                                                                              type: object
                                                                              properties:
                                                                                gt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                gte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                            startsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          required:
                                                                            - field
                                                                        - additionalProperties: false
                                                                          type: object
                                                                          properties:
                                                                            exists:
                                                                              type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                          required:
                                                                            - field
                                                                    - additionalProperties: false
                                                                      type: object
                                                                      properties:
                                                                        always:
                                                                          additionalProperties: false
                                                                          type: object
                                                                          properties: {}
                                                                      required:
                                                                        - always
                                                                    - additionalProperties: false
                                                                      type: object
                                                                      properties:
                                                                        never:
                                                                          additionalProperties: false
                                                                          type: object
                                                                          properties: {}
                                                                      required:
                                                                        - never
                                                                maxItems: 50
                                                                type: array
                                                            required:
                                                              - and
                                                          - additionalProperties: false
                                                            type: object
                                                            properties:
                                                              or:
                                                                items:
                                                                  anyOf:
                                                                    - anyOf:
                                                                        - additionalProperties: false
                                                                          type: object
                                                                          properties:
                                                                            contains:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            endsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            eq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            includes:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            neq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            range:
                                                                              additionalProperties: false
                                                                              type: object
                                                                              properties:
                                                                                gt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                gte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                            startsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          required:
                                                                            - field
                                                                        - additionalProperties: false
                                                                          type: object
                                                                          properties:
                                                                            exists:
                                                                              type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                          required:
                                                                            - field
                                                                    - additionalProperties: false
                                                                      type: object
                                                                      properties:
                                                                        always:
                                                                          additionalProperties: false
                                                                          type: object
                                                                          properties: {}
                                                                      required:
                                                                        - always
                                                                    - additionalProperties: false
                                                                      type: object
                                                                      properties:
                                                                        never:
                                                                          additionalProperties: false
                                                                          type: object
                                                                          properties: {}
                                                                      required:
                                                                        - never
                                                                maxItems: 50
                                                                type: array
                                                            required:
                                                              - or
                                                          - additionalProperties: false
                                                            type: object
                                                            properties:
                                                              not:
                                                                anyOf:
                                                                  - anyOf:
                                                                      - additionalProperties: false
                                                                        type: object
                                                                        properties:
                                                                          contains:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          endsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          eq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                          gt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          gte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          includes:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          neq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          range:
                                                                            additionalProperties: false
                                                                            type: object
                                                                            properties:
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                          startsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                        required:
                                                                          - field
                                                                      - additionalProperties: false
                                                                        type: object
                                                                        properties:
                                                                          exists:
                                                                            type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                        required:
                                                                          - field
                                                                  - additionalProperties: false
                                                                    type: object
                                                                    properties:
                                                                      always:
                                                                        additionalProperties: false
                                                                        type: object
                                                                        properties: {}
                                                                    required:
                                                                      - always
                                                                  - additionalProperties: false
                                                                    type: object
                                                                    properties:
                                                                      never:
                                                                        additionalProperties: false
                                                                        type: object
                                                                        properties: {}
                                                                    required:
                                                                      - never
                                                            required:
                                                              - not
                                                          - additionalProperties: false
                                                            type: object
                                                            properties:
                                                              always:
                                                                additionalProperties: false
                                                                type: object
                                                                properties: {}
                                                            required:
                                                              - always
                                                          - additionalProperties: false
                                                            type: object
                                                            properties:
                                                              never:
                                                                additionalProperties: false
                                                                type: object
                                                                properties: {}
                                                            required:
                                                              - never
                                                    required:
                                                      - not
                                                  - additionalProperties: false
                                                    type: object
                                                    properties:
                                                      always:
                                                        additionalProperties: false
                                                        type: object
                                                        properties: {}
                                                    required:
                                                      - always
                                                  - additionalProperties: false
                                                    type: object
                                                    properties:
                                                      never:
                                                        additionalProperties: false
                                                        type: object
                                                        properties: {}
                                                    required:
                                                      - never
                                              maxItems: 50
                                              type: array
                                          required:
                                            - and
                                        - additionalProperties: false
                                          type: object
                                          properties:
                                            or:
                                              items:
                                                anyOf:
                                                  - anyOf:
                                                      - additionalProperties: false
                                                        type: object
                                                        properties:
                                                          contains:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          endsWith:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          eq:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          field:
                                                            maxLength: 256
                                                            minLength: 1
                                                            type: string
                                                          gt:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          gte:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          includes:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          lt:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          lte:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          neq:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          range:
                                                            additionalProperties: false
                                                            type: object
                                                            properties:
                                                              gt:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              gte:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              lt:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              lte:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                          startsWith:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                        required:
                                                          - field
                                                      - additionalProperties: false
                                                        type: object
                                                        properties:
                                                          exists:
                                                            type: boolean
                                                          field:
                                                            maxLength: 256
                                                            minLength: 1
                                                            type: string
                                                        required:
                                                          - field
                                                  - additionalProperties: false
                                                    type: object
                                                    properties:
                                                      and:
                                                        items:
                                                          anyOf:
                                                            - anyOf:
                                                                - additionalProperties: false
                                                                  type: object
                                                                  properties:
                                                                    contains:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    endsWith:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    eq:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    field:
                                                                      maxLength: 256
                                                                      minLength: 1
                                                                      type: string
                                                                    gt:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    gte:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    includes:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    lt:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    lte:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    neq:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    range:
                                                                      additionalProperties: false
                                                                      type: object
                                                                      properties:
                                                                        gt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        gte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                    startsWith:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                  required:
                                                                    - field
                                                                - additionalProperties: false
                                                                  type: object
                                                                  properties:
                                                                    exists:
                                                                      type: boolean
                                                                    field:
                                                                      maxLength: 256
                                                                      minLength: 1
                                                                      type: string
                                                                  required:
                                                                    - field
                                                            - additionalProperties: false
                                                              type: object
                                                              properties:
                                                                and:
                                                                  items:
                                                                    anyOf:
                                                                      - anyOf:
                                                                          - additionalProperties: false
                                                                            type: object
                                                                            properties:
                                                                              contains:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              endsWith:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              eq:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              field:
                                                                                maxLength: 256
                                                                                minLength: 1
                                                                                type: string
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              includes:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              neq:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              range:
                                                                                additionalProperties: false
                                                                                type: object
                                                                                properties:
                                                                                  gt:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  gte:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  lt:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  lte:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                              startsWith:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            required:
                                                                              - field
                                                                          - additionalProperties: false
                                                                            type: object
                                                                            properties:
                                                                              exists:
                                                                                type: boolean
                                                                              field:
                                                                                maxLength: 256
                                                                                minLength: 1
                                                                                type: string
                                                                            required:
                                                                              - field
                                                                      - additionalProperties: false
                                                                        type: object
                                                                        properties:
                                                                          always:
                                                                            additionalProperties: false
                                                                            type: object
                                                                            properties: {}
                                                                        required:
                                                                          - always
                                                                      - additionalProperties: false
                                                                        type: object
                                                                        properties:
                                                                          never:
                                                                            additionalProperties: false
                                                                            type: object
                                                                            properties: {}
                                                                        required:
                                                                          - never
                                                                  maxItems: 50
                                                                  type: array
                                                              required:
                                                                - and
                                                            - additionalProperties: false
                                                              type: object
                                                              properties:
                                                                or:
                                                                  items:
                                                                    anyOf:
                                                                      - anyOf:
                                                                          - additionalProperties: false
                                                                            type: object
                                                                            properties:
                                                                              contains:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              endsWith:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              eq:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              field:
                                                                                maxLength: 256
                                                                                minLength: 1
                                                                                type: string
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              includes:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              neq:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              range:
                                                                                additionalProperties: false
                                                                                type: object
                                                                                properties:
                                                                                  gt:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  gte:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  lt:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  lte:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                              startsWith:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            required:
                                                                              - field
                                                                          - additionalProperties: false
                                                                            type: object
                                                                            properties:
                                                                              exists:
                                                                                type: boolean
                                                                              field:
                                                                                maxLength: 256
                                                                                minLength: 1
                                                                                type: string
                                                                            required:
                                                                              - field
                                                                      - additionalProperties: false
                                                                        type: object
                                                                        properties:
                                                                          always:
                                                                            additionalProperties: false
                                                                            type: object
                                                                            properties: {}
                                                                        required:
                                                                          - always
                                                                      - additionalProperties: false
                                                                        type: object
                                                                        properties:
                                                                          never:
                                                                            additionalProperties: false
                                                                            type: object
                                                                            properties: {}
                                                                        required:
                                                                          - never
                                                                  maxItems: 50
                                                                  type: array
                                                              required:
                                                                - or
                                                            - additionalProperties: false
                                                              type: object
                                                              properties:
                                                                not:
                                                                  anyOf:
                                                                    - anyOf:
                                                                        - additionalProperties: false
                                                                          type: object
                                                                          properties:
                                                                            contains:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            endsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            eq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            includes:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            neq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            range:
                                                                              additionalProperties: false
                                                                              type: object
                                                                              properties:
                                                                                gt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                gte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                            startsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          required:
                                                                            - field
                                                                        - additionalProperties: false
                                                                          type: object
                                                                          properties:
                                                                            exists:
                                                                              type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                          required:
                                                                            - field
                                                                    - additionalProperties: false
                                                                      type: object
                                                                      properties:
                                                                        always:
                                                                          additionalProperties: false
                                                                          type: object
                                                                          properties: {}
                                                                      required:
                                                                        - always
                                                                    - additionalProperties: false
                                                                      type: object
                                                                      properties:
                                                                        never:
                                                                          additionalProperties: false
                                                                          type: object
                                                                          properties: {}
                                                                      required:
                                                                        - never
                                                              required:
                                                                - not
                                                            - additionalProperties: false
                                                              type: object
                                                              properties:
                                                                always:
                                                                  additionalProperties: false
                                                                  type: object
                                                                  properties: {}
                                                              required:
                                                                - always
                                                            - additionalProperties: false
                                                              type: object
                                                              properties:
                                                                never:
                                                                  additionalProperties: false
                                                                  type: object
                                                                  properties: {}
                                                              required:
                                                                - never
                                                        maxItems: 50
                                                        type: array
                                                    required:
                                                      - and
                                                  - additionalProperties: false
                                                    type: object
                                                    properties:
                                                      or:
                                                        items:
                                                          anyOf:
                                                            - anyOf:
                                                                - additionalProperties: false
                                                                  type: object
                                                                  properties:
                                                                    contains:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    endsWith:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    eq:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    field:
                                                                      maxLength: 256
                                                                      minLength: 1
                                                                      type: string
                                                                    gt:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    gte:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    includes:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    lt:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    lte:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    neq:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    range:
                                                                      additionalProperties: false
                                                                      type: object
                                                                      properties:
                                                                        gt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        gte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                    startsWith:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                  required:
                                                                    - field
                                                                - additionalProperties: false
                                                                  type: object
                                                                  properties:
                                                                    exists:
                                                                      type: boolean
                                                                    field:
                                                                      maxLength: 256
                                                                      minLength: 1
                                                                      type: string
                                                                  required:
                                                                    - field
                                                            - additionalProperties: false
                                                              type: object
                                                              properties:
                                                                and:
                                                                  items:
                                                                    anyOf:
                                                                      - anyOf:
                                                                          - additionalProperties: false
                                                                            type: object
                                                                            properties:
                                                                              contains:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              endsWith:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              eq:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              field:
                                                                                maxLength: 256
                                                                                minLength: 1
                                                                                type: string
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              includes:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              neq:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              range:
                                                                                additionalProperties: false
                                                                                type: object
                                                                                properties:
                                                                                  gt:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  gte:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  lt:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  lte:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                              startsWith:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            required:
                                                                              - field
                                                                          - additionalProperties: false
                                                                            type: object
                                                                            properties:
                                                                              exists:
                                                                                type: boolean
                                                                              field:
                                                                                maxLength: 256
                                                                                minLength: 1
                                                                                type: string
                                                                            required:
                                                                              - field
                                                                      - additionalProperties: false
                                                                        type: object
                                                                        properties:
                                                                          always:
                                                                            additionalProperties: false
                                                                            type: object
                                                                            properties: {}
                                                                        required:
                                                                          - always
                                                                      - additionalProperties: false
                                                                        type: object
                                                                        properties:
                                                                          never:
                                                                            additionalProperties: false
                                                                            type: object
                                                                            properties: {}
                                                                        required:
                                                                          - never
                                                                  maxItems: 50
                                                                  type: array
                                                              required:
                                                                - and
                                                            - additionalProperties: false
                                                              type: object
                                                              properties:
                                                                or:
                                                                  items:
                                                                    anyOf:
                                                                      - anyOf:
                                                                          - additionalProperties: false
                                                                            type: object
                                                                            properties:
                                                                              contains:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              endsWith:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              eq:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              field:
                                                                                maxLength: 256
                                                                                minLength: 1
                                                                                type: string
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              includes:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              neq:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              range:
                                                                                additionalProperties: false
                                                                                type: object
                                                                                properties:
                                                                                  gt:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  gte:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  lt:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  lte:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                              startsWith:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            required:
                                                                              - field
                                                                          - additionalProperties: false
                                                                            type: object
                                                                            properties:
                                                                              exists:
                                                                                type: boolean
                                                                              field:
                                                                                maxLength: 256
                                                                                minLength: 1
                                                                                type: string
                                                                            required:
                                                                              - field
                                                                      - additionalProperties: false
                                                                        type: object
                                                                        properties:
                                                                          always:
                                                                            additionalProperties: false
                                                                            type: object
                                                                            properties: {}
                                                                        required:
                                                                          - always
                                                                      - additionalProperties: false
                                                                        type: object
                                                                        properties:
                                                                          never:
                                                                            additionalProperties: false
                                                                            type: object
                                                                            properties: {}
                                                                        required:
                                                                          - never
                                                                  maxItems: 50
                                                                  type: array
                                                              required:
                                                                - or
                                                            - additionalProperties: false
                                                              type: object
                                                              properties:
                                                                not:
                                                                  anyOf:
                                                                    - anyOf:
                                                                        - additionalProperties: false
                                                                          type: object
                                                                          properties:
                                                                            contains:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            endsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            eq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            includes:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            neq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            range:
                                                                              additionalProperties: false
                                                                              type: object
                                                                              properties:
                                                                                gt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                gte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                            startsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          required:
                                                                            - field
                                                                        - additionalProperties: false
                                                                          type: object
                                                                          properties:
                                                                            exists:
                                                                              type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                          required:
                                                                            - field
                                                                    - additionalProperties: false
                                                                      type: object
                                                                      properties:
                                                                        always:
                                                                          additionalProperties: false
                                                                          type: object
                                                                          properties: {}
                                                                      required:
                                                                        - always
                                                                    - additionalProperties: false
                                                                      type: object
                                                                      properties:
                                                                        never:
                                                                          additionalProperties: false
                                                                          type: object
                                                                          properties: {}
                                                                      required:
                                                                        - never
                                                              required:
                                                                - not
                                                            - additionalProperties: false
                                                              type: object
                                                              properties:
                                                                always:
                                                                  additionalProperties: false
                                                                  type: object
                                                                  properties: {}
                                                              required:
                                                                - always
                                                            - additionalProperties: false
                                                              type: object
                                                              properties:
                                                                never:
                                                                  additionalProperties: false
                                                                  type: object
                                                                  properties: {}
                                                              required:
                                                                - never
                                                        maxItems: 50
                                                        type: array
                                                    required:
                                                      - or
                                                  - additionalProperties: false
                                                    type: object
                                                    properties:
                                                      not:
                                                        anyOf:
                                                          - anyOf:
                                                              - additionalProperties: false
                                                                type: object
                                                                properties:
                                                                  contains:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  endsWith:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  eq:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  field:
                                                                    maxLength: 256
                                                                    minLength: 1
                                                                    type: string
                                                                  gt:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  gte:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  includes:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  lt:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  lte:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  neq:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  range:
                                                                    additionalProperties: false
                                                                    type: object
                                                                    properties:
                                                                      gt:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      gte:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      lt:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      lte:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                  startsWith:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                required:
                                                                  - field
                                                              - additionalProperties: false
                                                                type: object
                                                                properties:
                                                                  exists:
                                                                    type: boolean
                                                                  field:
                                                                    maxLength: 256
                                                                    minLength: 1
                                                                    type: string
                                                                required:
                                                                  - field
                                                          - additionalProperties: false
                                                            type: object
                                                            properties:
                                                              and:
                                                                items:
                                                                  anyOf:
                                                                    - anyOf:
                                                                        - additionalProperties: false
                                                                          type: object
                                                                          properties:
                                                                            contains:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            endsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            eq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            includes:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            neq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            range:
                                                                              additionalProperties: false
                                                                              type: object
                                                                              properties:
                                                                                gt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                gte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                            startsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          required:
                                                                            - field
                                                                        - additionalProperties: false
                                                                          type: object
                                                                          properties:
                                                                            exists:
                                                                              type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                          required:
                                                                            - field
                                                                    - additionalProperties: false
                                                                      type: object
                                                                      properties:
                                                                        always:
                                                                          additionalProperties: false
                                                                          type: object
                                                                          properties: {}
                                                                      required:
                                                                        - always
                                                                    - additionalProperties: false
                                                                      type: object
                                                                      properties:
                                                                        never:
                                                                          additionalProperties: false
                                                                          type: object
                                                                          properties: {}
                                                                      required:
                                                                        - never
                                                                maxItems: 50
                                                                type: array
                                                            required:
                                                              - and
                                                          - additionalProperties: false
                                                            type: object
                                                            properties:
                                                              or:
                                                                items:
                                                                  anyOf:
                                                                    - anyOf:
                                                                        - additionalProperties: false
                                                                          type: object
                                                                          properties:
                                                                            contains:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            endsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            eq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            includes:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            neq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            range:
                                                                              additionalProperties: false
                                                                              type: object
                                                                              properties:
                                                                                gt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                gte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                            startsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          required:
                                                                            - field
                                                                        - additionalProperties: false
                                                                          type: object
                                                                          properties:
                                                                            exists:
                                                                              type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                          required:
                                                                            - field
                                                                    - additionalProperties: false
                                                                      type: object
                                                                      properties:
                                                                        always:
                                                                          additionalProperties: false
                                                                          type: object
                                                                          properties: {}
                                                                      required:
                                                                        - always
                                                                    - additionalProperties: false
                                                                      type: object
                                                                      properties:
                                                                        never:
                                                                          additionalProperties: false
                                                                          type: object
                                                                          properties: {}
                                                                      required:
                                                                        - never
                                                                maxItems: 50
                                                                type: array
                                                            required:
                                                              - or
                                                          - additionalProperties: false
                                                            type: object
                                                            properties:
                                                              not:
                                                                anyOf:
                                                                  - anyOf:
                                                                      - additionalProperties: false
                                                                        type: object
                                                                        properties:
                                                                          contains:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          endsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          eq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                          gt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          gte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          includes:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          neq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          range:
                                                                            additionalProperties: false
                                                                            type: object
                                                                            properties:
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                          startsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                        required:
                                                                          - field
                                                                      - additionalProperties: false
                                                                        type: object
                                                                        properties:
                                                                          exists:
                                                                            type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                        required:
                                                                          - field
                                                                  - additionalProperties: false
                                                                    type: object
                                                                    properties:
                                                                      always:
                                                                        additionalProperties: false
                                                                        type: object
                                                                        properties: {}
                                                                    required:
                                                                      - always
                                                                  - additionalProperties: false
                                                                    type: object
                                                                    properties:
                                                                      never:
                                                                        additionalProperties: false
                                                                        type: object
                                                                        properties: {}
                                                                    required:
                                                                      - never
                                                            required:
                                                              - not
                                                          - additionalProperties: false
                                                            type: object
                                                            properties:
                                                              always:
                                                                additionalProperties: false
                                                                type: object
                                                                properties: {}
                                                            required:
                                                              - always
                                                          - additionalProperties: false
                                                            type: object
                                                            properties:
                                                              never:
                                                                additionalProperties: false
                                                                type: object
                                                                properties: {}
                                                            required:
                                                              - never
                                                    required:
                                                      - not
                                                  - additionalProperties: false
                                                    type: object
                                                    properties:
                                                      always:
                                                        additionalProperties: false
                                                        type: object
                                                        properties: {}
                                                    required:
                                                      - always
                                                  - additionalProperties: false
                                                    type: object
                                                    properties:
                                                      never:
                                                        additionalProperties: false
                                                        type: object
                                                        properties: {}
                                                    required:
                                                      - never
                                              maxItems: 50
                                              type: array
                                          required:
                                            - or
                                        - additionalProperties: false
                                          type: object
                                          properties:
                                            not:
                                              anyOf:
                                                - anyOf:
                                                    - additionalProperties: false
                                                      type: object
                                                      properties:
                                                        contains:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        endsWith:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        eq:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        field:
                                                          maxLength: 256
                                                          minLength: 1
                                                          type: string
                                                        gt:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        gte:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        includes:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        lt:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        lte:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        neq:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        range:
                                                          additionalProperties: false
                                                          type: object
                                                          properties:
                                                            gt:
                                                              anyOf:
                                                                - maxLength: 65535
                                                                  type: string
                                                                - type: number
                                                                - type: boolean
                                                            gte:
                                                              anyOf:
                                                                - maxLength: 65535
                                                                  type: string
                                                                - type: number
                                                                - type: boolean
                                                            lt:
                                                              anyOf:
                                                                - maxLength: 65535
                                                                  type: string
                                                                - type: number
                                                                - type: boolean
                                                            lte:
                                                              anyOf:
                                                                - maxLength: 65535
                                                                  type: string
                                                                - type: number
                                                                - type: boolean
                                                        startsWith:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                      required:
                                                        - field
                                                    - additionalProperties: false
                                                      type: object
                                                      properties:
                                                        exists:
                                                          type: boolean
                                                        field:
                                                          maxLength: 256
                                                          minLength: 1
                                                          type: string
                                                      required:
                                                        - field
                                                - additionalProperties: false
                                                  type: object
                                                  properties:
                                                    and:
                                                      items:
                                                        anyOf:
                                                          - anyOf:
                                                              - additionalProperties: false
                                                                type: object
                                                                properties:
                                                                  contains:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  endsWith:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  eq:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  field:
                                                                    maxLength: 256
                                                                    minLength: 1
                                                                    type: string
                                                                  gt:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  gte:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  includes:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  lt:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  lte:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  neq:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  range:
                                                                    additionalProperties: false
                                                                    type: object
                                                                    properties:
                                                                      gt:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      gte:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      lt:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      lte:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                  startsWith:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                required:
                                                                  - field
                                                              - additionalProperties: false
                                                                type: object
                                                                properties:
                                                                  exists:
                                                                    type: boolean
                                                                  field:
                                                                    maxLength: 256
                                                                    minLength: 1
                                                                    type: string
                                                                required:
                                                                  - field
                                                          - additionalProperties: false
                                                            type: object
                                                            properties:
                                                              and:
                                                                items:
                                                                  anyOf:
                                                                    - anyOf:
                                                                        - additionalProperties: false
                                                                          type: object
                                                                          properties:
                                                                            contains:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            endsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            eq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            includes:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            neq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            range:
                                                                              additionalProperties: false
                                                                              type: object
                                                                              properties:
                                                                                gt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                gte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                            startsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          required:
                                                                            - field
                                                                        - additionalProperties: false
                                                                          type: object
                                                                          properties:
                                                                            exists:
                                                                              type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                          required:
                                                                            - field
                                                                    - additionalProperties: false
                                                                      type: object
                                                                      properties:
                                                                        always:
                                                                          additionalProperties: false
                                                                          type: object
                                                                          properties: {}
                                                                      required:
                                                                        - always
                                                                    - additionalProperties: false
                                                                      type: object
                                                                      properties:
                                                                        never:
                                                                          additionalProperties: false
                                                                          type: object
                                                                          properties: {}
                                                                      required:
                                                                        - never
                                                                maxItems: 50
                                                                type: array
                                                            required:
                                                              - and
                                                          - additionalProperties: false
                                                            type: object
                                                            properties:
                                                              or:
                                                                items:
                                                                  anyOf:
                                                                    - anyOf:
                                                                        - additionalProperties: false
                                                                          type: object
                                                                          properties:
                                                                            contains:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            endsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            eq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            includes:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            neq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            range:
                                                                              additionalProperties: false
                                                                              type: object
                                                                              properties:
                                                                                gt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                gte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                            startsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          required:
                                                                            - field
                                                                        - additionalProperties: false
                                                                          type: object
                                                                          properties:
                                                                            exists:
                                                                              type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                          required:
                                                                            - field
                                                                    - additionalProperties: false
                                                                      type: object
                                                                      properties:
                                                                        always:
                                                                          additionalProperties: false
                                                                          type: object
                                                                          properties: {}
                                                                      required:
                                                                        - always
                                                                    - additionalProperties: false
                                                                      type: object
                                                                      properties:
                                                                        never:
                                                                          additionalProperties: false
                                                                          type: object
                                                                          properties: {}
                                                                      required:
                                                                        - never
                                                                maxItems: 50
                                                                type: array
                                                            required:
                                                              - or
                                                          - additionalProperties: false
                                                            type: object
                                                            properties:
                                                              not:
                                                                anyOf:
                                                                  - anyOf:
                                                                      - additionalProperties: false
                                                                        type: object
                                                                        properties:
                                                                          contains:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          endsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          eq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                          gt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          gte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          includes:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          neq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          range:
                                                                            additionalProperties: false
                                                                            type: object
                                                                            properties:
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                          startsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                        required:
                                                                          - field
                                                                      - additionalProperties: false
                                                                        type: object
                                                                        properties:
                                                                          exists:
                                                                            type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                        required:
                                                                          - field
                                                                  - additionalProperties: false
                                                                    type: object
                                                                    properties:
                                                                      always:
                                                                        additionalProperties: false
                                                                        type: object
                                                                        properties: {}
                                                                    required:
                                                                      - always
                                                                  - additionalProperties: false
                                                                    type: object
                                                                    properties:
                                                                      never:
                                                                        additionalProperties: false
                                                                        type: object
                                                                        properties: {}
                                                                    required:
                                                                      - never
                                                            required:
                                                              - not
                                                          - additionalProperties: false
                                                            type: object
                                                            properties:
                                                              always:
                                                                additionalProperties: false
                                                                type: object
                                                                properties: {}
                                                            required:
                                                              - always
                                                          - additionalProperties: false
                                                            type: object
                                                            properties:
                                                              never:
                                                                additionalProperties: false
                                                                type: object
                                                                properties: {}
                                                            required:
                                                              - never
                                                      maxItems: 50
                                                      type: array
                                                  required:
                                                    - and
                                                - additionalProperties: false
                                                  type: object
                                                  properties:
                                                    or:
                                                      items:
                                                        anyOf:
                                                          - anyOf:
                                                              - additionalProperties: false
                                                                type: object
                                                                properties:
                                                                  contains:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  endsWith:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  eq:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  field:
                                                                    maxLength: 256
                                                                    minLength: 1
                                                                    type: string
                                                                  gt:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  gte:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  includes:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  lt:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  lte:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  neq:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  range:
                                                                    additionalProperties: false
                                                                    type: object
                                                                    properties:
                                                                      gt:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      gte:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      lt:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      lte:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                  startsWith:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                required:
                                                                  - field
                                                              - additionalProperties: false
                                                                type: object
                                                                properties:
                                                                  exists:
                                                                    type: boolean
                                                                  field:
                                                                    maxLength: 256
                                                                    minLength: 1
                                                                    type: string
                                                                required:
                                                                  - field
                                                          - additionalProperties: false
                                                            type: object
                                                            properties:
                                                              and:
                                                                items:
                                                                  anyOf:
                                                                    - anyOf:
                                                                        - additionalProperties: false
                                                                          type: object
                                                                          properties:
                                                                            contains:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            endsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            eq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            includes:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            neq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            range:
                                                                              additionalProperties: false
                                                                              type: object
                                                                              properties:
                                                                                gt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                gte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                            startsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          required:
                                                                            - field
                                                                        - additionalProperties: false
                                                                          type: object
                                                                          properties:
                                                                            exists:
                                                                              type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                          required:
                                                                            - field
                                                                    - additionalProperties: false
                                                                      type: object
                                                                      properties:
                                                                        always:
                                                                          additionalProperties: false
                                                                          type: object
                                                                          properties: {}
                                                                      required:
                                                                        - always
                                                                    - additionalProperties: false
                                                                      type: object
                                                                      properties:
                                                                        never:
                                                                          additionalProperties: false
                                                                          type: object
                                                                          properties: {}
                                                                      required:
                                                                        - never
                                                                maxItems: 50
                                                                type: array
                                                            required:
                                                              - and
                                                          - additionalProperties: false
                                                            type: object
                                                            properties:
                                                              or:
                                                                items:
                                                                  anyOf:
                                                                    - anyOf:
                                                                        - additionalProperties: false
                                                                          type: object
                                                                          properties:
                                                                            contains:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            endsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            eq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            includes:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            neq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            range:
                                                                              additionalProperties: false
                                                                              type: object
                                                                              properties:
                                                                                gt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                gte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                            startsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          required:
                                                                            - field
                                                                        - additionalProperties: false
                                                                          type: object
                                                                          properties:
                                                                            exists:
                                                                              type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                          required:
                                                                            - field
                                                                    - additionalProperties: false
                                                                      type: object
                                                                      properties:
                                                                        always:
                                                                          additionalProperties: false
                                                                          type: object
                                                                          properties: {}
                                                                      required:
                                                                        - always
                                                                    - additionalProperties: false
                                                                      type: object
                                                                      properties:
                                                                        never:
                                                                          additionalProperties: false
                                                                          type: object
                                                                          properties: {}
                                                                      required:
                                                                        - never
                                                                maxItems: 50
                                                                type: array
                                                            required:
                                                              - or
                                                          - additionalProperties: false
                                                            type: object
                                                            properties:
                                                              not:
                                                                anyOf:
                                                                  - anyOf:
                                                                      - additionalProperties: false
                                                                        type: object
                                                                        properties:
                                                                          contains:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          endsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          eq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                          gt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          gte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          includes:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          neq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          range:
                                                                            additionalProperties: false
                                                                            type: object
                                                                            properties:
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                          startsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                        required:
                                                                          - field
                                                                      - additionalProperties: false
                                                                        type: object
                                                                        properties:
                                                                          exists:
                                                                            type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                        required:
                                                                          - field
                                                                  - additionalProperties: false
                                                                    type: object
                                                                    properties:
                                                                      always:
                                                                        additionalProperties: false
                                                                        type: object
                                                                        properties: {}
                                                                    required:
                                                                      - always
                                                                  - additionalProperties: false
                                                                    type: object
                                                                    properties:
                                                                      never:
                                                                        additionalProperties: false
                                                                        type: object
                                                                        properties: {}
                                                                    required:
                                                                      - never
                                                            required:
                                                              - not
                                                          - additionalProperties: false
                                                            type: object
                                                            properties:
                                                              always:
                                                                additionalProperties: false
                                                                type: object
                                                                properties: {}
                                                            required:
                                                              - always
                                                          - additionalProperties: false
                                                            type: object
                                                            properties:
                                                              never:
                                                                additionalProperties: false
                                                                type: object
                                                                properties: {}
                                                            required:
                                                              - never
                                                      maxItems: 50
                                                      type: array
                                                  required:
                                                    - or
                                                - additionalProperties: false
                                                  type: object
                                                  properties:
                                                    not:
                                                      anyOf:
                                                        - anyOf:
                                                            - additionalProperties: false
                                                              type: object
                                                              properties:
                                                                contains:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                endsWith:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                eq:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                field:
                                                                  maxLength: 256
                                                                  minLength: 1
                                                                  type: string
                                                                gt:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                gte:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                includes:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                lt:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                lte:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                neq:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                range:
                                                                  additionalProperties: false
                                                                  type: object
                                                                  properties:
                                                                    gt:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    gte:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    lt:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    lte:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                startsWith:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                              required:
                                                                - field
                                                            - additionalProperties: false
                                                              type: object
                                                              properties:
                                                                exists:
                                                                  type: boolean
                                                                field:
                                                                  maxLength: 256
                                                                  minLength: 1
                                                                  type: string
                                                              required:
                                                                - field
                                                        - additionalProperties: false
                                                          type: object
                                                          properties:
                                                            and:
                                                              items:
                                                                anyOf:
                                                                  - anyOf:
                                                                      - additionalProperties: false
                                                                        type: object
                                                                        properties:
                                                                          contains:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          endsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          eq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                          gt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          gte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          includes:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          neq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          range:
                                                                            additionalProperties: false
                                                                            type: object
                                                                            properties:
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                          startsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                        required:
                                                                          - field
                                                                      - additionalProperties: false
                                                                        type: object
                                                                        properties:
                                                                          exists:
                                                                            type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                        required:
                                                                          - field
                                                                  - additionalProperties: false
                                                                    type: object
                                                                    properties:
                                                                      always:
                                                                        additionalProperties: false
                                                                        type: object
                                                                        properties: {}
                                                                    required:
                                                                      - always
                                                                  - additionalProperties: false
                                                                    type: object
                                                                    properties:
                                                                      never:
                                                                        additionalProperties: false
                                                                        type: object
                                                                        properties: {}
                                                                    required:
                                                                      - never
                                                              maxItems: 50
                                                              type: array
                                                          required:
                                                            - and
                                                        - additionalProperties: false
                                                          type: object
                                                          properties:
                                                            or:
                                                              items:
                                                                anyOf:
                                                                  - anyOf:
                                                                      - additionalProperties: false
                                                                        type: object
                                                                        properties:
                                                                          contains:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          endsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          eq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                          gt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          gte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          includes:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          neq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          range:
                                                                            additionalProperties: false
                                                                            type: object
                                                                            properties:
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                          startsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                        required:
                                                                          - field
                                                                      - additionalProperties: false
                                                                        type: object
                                                                        properties:
                                                                          exists:
                                                                            type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                        required:
                                                                          - field
                                                                  - additionalProperties: false
                                                                    type: object
                                                                    properties:
                                                                      always:
                                                                        additionalProperties: false
                                                                        type: object
                                                                        properties: {}
                                                                    required:
                                                                      - always
                                                                  - additionalProperties: false
                                                                    type: object
                                                                    properties:
                                                                      never:
                                                                        additionalProperties: false
                                                                        type: object
                                                                        properties: {}
                                                                    required:
                                                                      - never
                                                              maxItems: 50
                                                              type: array
                                                          required:
                                                            - or
                                                        - additionalProperties: false
                                                          type: object
                                                          properties:
                                                            not:
                                                              anyOf:
                                                                - anyOf:
                                                                    - additionalProperties: false
                                                                      type: object
                                                                      properties:
                                                                        contains:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        endsWith:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        eq:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        field:
                                                                          maxLength: 256
                                                                          minLength: 1
                                                                          type: string
                                                                        gt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        gte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        includes:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        neq:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        range:
                                                                          additionalProperties: false
                                                                          type: object
                                                                          properties:
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                        startsWith:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                      required:
                                                                        - field
                                                                    - additionalProperties: false
                                                                      type: object
                                                                      properties:
                                                                        exists:
                                                                          type: boolean
                                                                        field:
                                                                          maxLength: 256
                                                                          minLength: 1
                                                                          type: string
                                                                      required:
                                                                        - field
                                                                - additionalProperties: false
                                                                  type: object
                                                                  properties:
                                                                    always:
                                                                      additionalProperties: false
                                                                      type: object
                                                                      properties: {}
                                                                  required:
                                                                    - always
                                                                - additionalProperties: false
                                                                  type: object
                                                                  properties:
                                                                    never:
                                                                      additionalProperties: false
                                                                      type: object
                                                                      properties: {}
                                                                  required:
                                                                    - never
                                                          required:
                                                            - not
                                                        - additionalProperties: false
                                                          type: object
                                                          properties:
                                                            always:
                                                              additionalProperties: false
                                                              type: object
                                                              properties: {}
                                                          required:
                                                            - always
                                                        - additionalProperties: false
                                                          type: object
                                                          properties:
                                                            never:
                                                              additionalProperties: false
                                                              type: object
                                                              properties: {}
                                                          required:
                                                            - never
                                                  required:
                                                    - not
                                                - additionalProperties: false
                                                  type: object
                                                  properties:
                                                    always:
                                                      additionalProperties: false
                                                      type: object
                                                      properties: {}
                                                  required:
                                                    - always
                                                - additionalProperties: false
                                                  type: object
                                                  properties:
                                                    never:
                                                      additionalProperties: false
                                                      type: object
                                                      properties: {}
                                                  required:
                                                    - never
                                          required:
                                            - not
                                        - additionalProperties: false
                                          type: object
                                          properties:
                                            always:
                                              additionalProperties: false
                                              type: object
                                              properties: {}
                                          required:
                                            - always
                                        - additionalProperties: false
                                          type: object
                                          properties:
                                            never:
                                              additionalProperties: false
                                              type: object
                                              properties: {}
                                          required:
                                            - never
                                    maxItems: 50
                                    type: array
                                required:
                                  - and
                              - additionalProperties: false
                                type: object
                                properties:
                                  or:
                                    items:
                                      anyOf:
                                        - anyOf:
                                            - additionalProperties: false
                                              type: object
                                              properties:
                                                contains:
                                                  anyOf:
                                                    - maxLength: 65535
                                                      type: string
                                                    - type: number
                                                    - type: boolean
                                                endsWith:
                                                  anyOf:
                                                    - maxLength: 65535
                                                      type: string
                                                    - type: number
                                                    - type: boolean
                                                eq:
                                                  anyOf:
                                                    - maxLength: 65535
                                                      type: string
                                                    - type: number
                                                    - type: boolean
                                                field:
                                                  maxLength: 256
                                                  minLength: 1
                                                  type: string
                                                gt:
                                                  anyOf:
                                                    - maxLength: 65535
                                                      type: string
                                                    - type: number
                                                    - type: boolean
                                                gte:
                                                  anyOf:
                                                    - maxLength: 65535
                                                      type: string
                                                    - type: number
                                                    - type: boolean
                                                includes:
                                                  anyOf:
                                                    - maxLength: 65535
                                                      type: string
                                                    - type: number
                                                    - type: boolean
                                                lt:
                                                  anyOf:
                                                    - maxLength: 65535
                                                      type: string
                                                    - type: number
                                                    - type: boolean
                                                lte:
                                                  anyOf:
                                                    - maxLength: 65535
                                                      type: string
                                                    - type: number
                                                    - type: boolean
                                                neq:
                                                  anyOf:
                                                    - maxLength: 65535
                                                      type: string
                                                    - type: number
                                                    - type: boolean
                                                range:
                                                  additionalProperties: false
                                                  type: object
                                                  properties:
                                                    gt:
                                                      anyOf:
                                                        - maxLength: 65535
                                                          type: string
                                                        - type: number
                                                        - type: boolean
                                                    gte:
                                                      anyOf:
                                                        - maxLength: 65535
                                                          type: string
                                                        - type: number
                                                        - type: boolean
                                                    lt:
                                                      anyOf:
                                                        - maxLength: 65535
                                                          type: string
                                                        - type: number
                                                        - type: boolean
                                                    lte:
                                                      anyOf:
                                                        - maxLength: 65535
                                                          type: string
                                                        - type: number
                                                        - type: boolean
                                                startsWith:
                                                  anyOf:
                                                    - maxLength: 65535
                                                      type: string
                                                    - type: number
                                                    - type: boolean
                                              required:
                                                - field
                                            - additionalProperties: false
                                              type: object
                                              properties:
                                                exists:
                                                  type: boolean
                                                field:
                                                  maxLength: 256
                                                  minLength: 1
                                                  type: string
                                              required:
                                                - field
                                        - additionalProperties: false
                                          type: object
                                          properties:
                                            and:
                                              items:
                                                anyOf:
                                                  - anyOf:
                                                      - additionalProperties: false
                                                        type: object
                                                        properties:
                                                          contains:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          endsWith:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          eq:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          field:
                                                            maxLength: 256
                                                            minLength: 1
                                                            type: string
                                                          gt:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          gte:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          includes:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          lt:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          lte:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          neq:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          range:
                                                            additionalProperties: false
                                                            type: object
                                                            properties:
                                                              gt:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              gte:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              lt:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              lte:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                          startsWith:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                        required:
                                                          - field
                                                      - additionalProperties: false
                                                        type: object
                                                        properties:
                                                          exists:
                                                            type: boolean
                                                          field:
                                                            maxLength: 256
                                                            minLength: 1
                                                            type: string
                                                        required:
                                                          - field
                                                  - additionalProperties: false
                                                    type: object
                                                    properties:
                                                      and:
                                                        items:
                                                          anyOf:
                                                            - anyOf:
                                                                - additionalProperties: false
                                                                  type: object
                                                                  properties:
                                                                    contains:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    endsWith:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    eq:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    field:
                                                                      maxLength: 256
                                                                      minLength: 1
                                                                      type: string
                                                                    gt:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    gte:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    includes:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    lt:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    lte:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    neq:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    range:
                                                                      additionalProperties: false
                                                                      type: object
                                                                      properties:
                                                                        gt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        gte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                    startsWith:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                  required:
                                                                    - field
                                                                - additionalProperties: false
                                                                  type: object
                                                                  properties:
                                                                    exists:
                                                                      type: boolean
                                                                    field:
                                                                      maxLength: 256
                                                                      minLength: 1
                                                                      type: string
                                                                  required:
                                                                    - field
                                                            - additionalProperties: false
                                                              type: object
                                                              properties:
                                                                and:
                                                                  items:
                                                                    anyOf:
                                                                      - anyOf:
                                                                          - additionalProperties: false
                                                                            type: object
                                                                            properties:
                                                                              contains:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              endsWith:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              eq:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              field:
                                                                                maxLength: 256
                                                                                minLength: 1
                                                                                type: string
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              includes:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              neq:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              range:
                                                                                additionalProperties: false
                                                                                type: object
                                                                                properties:
                                                                                  gt:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  gte:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  lt:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  lte:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                              startsWith:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            required:
                                                                              - field
                                                                          - additionalProperties: false
                                                                            type: object
                                                                            properties:
                                                                              exists:
                                                                                type: boolean
                                                                              field:
                                                                                maxLength: 256
                                                                                minLength: 1
                                                                                type: string
                                                                            required:
                                                                              - field
                                                                      - additionalProperties: false
                                                                        type: object
                                                                        properties:
                                                                          always:
                                                                            additionalProperties: false
                                                                            type: object
                                                                            properties: {}
                                                                        required:
                                                                          - always
                                                                      - additionalProperties: false
                                                                        type: object
                                                                        properties:
                                                                          never:
                                                                            additionalProperties: false
                                                                            type: object
                                                                            properties: {}
                                                                        required:
                                                                          - never
                                                                  maxItems: 50
                                                                  type: array
                                                              required:
                                                                - and
                                                            - additionalProperties: false
                                                              type: object
                                                              properties:
                                                                or:
                                                                  items:
                                                                    anyOf:
                                                                      - anyOf:
                                                                          - additionalProperties: false
                                                                            type: object
                                                                            properties:
                                                                              contains:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              endsWith:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              eq:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              field:
                                                                                maxLength: 256
                                                                                minLength: 1
                                                                                type: string
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              includes:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              neq:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              range:
                                                                                additionalProperties: false
                                                                                type: object
                                                                                properties:
                                                                                  gt:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  gte:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  lt:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  lte:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                              startsWith:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            required:
                                                                              - field
                                                                          - additionalProperties: false
                                                                            type: object
                                                                            properties:
                                                                              exists:
                                                                                type: boolean
                                                                              field:
                                                                                maxLength: 256
                                                                                minLength: 1
                                                                                type: string
                                                                            required:
                                                                              - field
                                                                      - additionalProperties: false
                                                                        type: object
                                                                        properties:
                                                                          always:
                                                                            additionalProperties: false
                                                                            type: object
                                                                            properties: {}
                                                                        required:
                                                                          - always
                                                                      - additionalProperties: false
                                                                        type: object
                                                                        properties:
                                                                          never:
                                                                            additionalProperties: false
                                                                            type: object
                                                                            properties: {}
                                                                        required:
                                                                          - never
                                                                  maxItems: 50
                                                                  type: array
                                                              required:
                                                                - or
                                                            - additionalProperties: false
                                                              type: object
                                                              properties:
                                                                not:
                                                                  anyOf:
                                                                    - anyOf:
                                                                        - additionalProperties: false
                                                                          type: object
                                                                          properties:
                                                                            contains:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            endsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            eq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            includes:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            neq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            range:
                                                                              additionalProperties: false
                                                                              type: object
                                                                              properties:
                                                                                gt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                gte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                            startsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          required:
                                                                            - field
                                                                        - additionalProperties: false
                                                                          type: object
                                                                          properties:
                                                                            exists:
                                                                              type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                          required:
                                                                            - field
                                                                    - additionalProperties: false
                                                                      type: object
                                                                      properties:
                                                                        always:
                                                                          additionalProperties: false
                                                                          type: object
                                                                          properties: {}
                                                                      required:
                                                                        - always
                                                                    - additionalProperties: false
                                                                      type: object
                                                                      properties:
                                                                        never:
                                                                          additionalProperties: false
                                                                          type: object
                                                                          properties: {}
                                                                      required:
                                                                        - never
                                                              required:
                                                                - not
                                                            - additionalProperties: false
                                                              type: object
                                                              properties:
                                                                always:
                                                                  additionalProperties: false
                                                                  type: object
                                                                  properties: {}
                                                              required:
                                                                - always
                                                            - additionalProperties: false
                                                              type: object
                                                              properties:
                                                                never:
                                                                  additionalProperties: false
                                                                  type: object
                                                                  properties: {}
                                                              required:
                                                                - never
                                                        maxItems: 50
                                                        type: array
                                                    required:
                                                      - and
                                                  - additionalProperties: false
                                                    type: object
                                                    properties:
                                                      or:
                                                        items:
                                                          anyOf:
                                                            - anyOf:
                                                                - additionalProperties: false
                                                                  type: object
                                                                  properties:
                                                                    contains:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    endsWith:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    eq:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    field:
                                                                      maxLength: 256
                                                                      minLength: 1
                                                                      type: string
                                                                    gt:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    gte:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    includes:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    lt:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    lte:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    neq:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    range:
                                                                      additionalProperties: false
                                                                      type: object
                                                                      properties:
                                                                        gt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        gte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                    startsWith:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                  required:
                                                                    - field
                                                                - additionalProperties: false
                                                                  type: object
                                                                  properties:
                                                                    exists:
                                                                      type: boolean
                                                                    field:
                                                                      maxLength: 256
                                                                      minLength: 1
                                                                      type: string
                                                                  required:
                                                                    - field
                                                            - additionalProperties: false
                                                              type: object
                                                              properties:
                                                                and:
                                                                  items:
                                                                    anyOf:
                                                                      - anyOf:
                                                                          - additionalProperties: false
                                                                            type: object
                                                                            properties:
                                                                              contains:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              endsWith:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              eq:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              field:
                                                                                maxLength: 256
                                                                                minLength: 1
                                                                                type: string
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              includes:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              neq:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              range:
                                                                                additionalProperties: false
                                                                                type: object
                                                                                properties:
                                                                                  gt:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  gte:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  lt:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  lte:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                              startsWith:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            required:
                                                                              - field
                                                                          - additionalProperties: false
                                                                            type: object
                                                                            properties:
                                                                              exists:
                                                                                type: boolean
                                                                              field:
                                                                                maxLength: 256
                                                                                minLength: 1
                                                                                type: string
                                                                            required:
                                                                              - field
                                                                      - additionalProperties: false
                                                                        type: object
                                                                        properties:
                                                                          always:
                                                                            additionalProperties: false
                                                                            type: object
                                                                            properties: {}
                                                                        required:
                                                                          - always
                                                                      - additionalProperties: false
                                                                        type: object
                                                                        properties:
                                                                          never:
                                                                            additionalProperties: false
                                                                            type: object
                                                                            properties: {}
                                                                        required:
                                                                          - never
                                                                  maxItems: 50
                                                                  type: array
                                                              required:
                                                                - and
                                                            - additionalProperties: false
                                                              type: object
                                                              properties:
                                                                or:
                                                                  items:
                                                                    anyOf:
                                                                      - anyOf:
                                                                          - additionalProperties: false
                                                                            type: object
                                                                            properties:
                                                                              contains:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              endsWith:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              eq:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              field:
                                                                                maxLength: 256
                                                                                minLength: 1
                                                                                type: string
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              includes:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              neq:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              range:
                                                                                additionalProperties: false
                                                                                type: object
                                                                                properties:
                                                                                  gt:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  gte:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  lt:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  lte:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                              startsWith:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            required:
                                                                              - field
                                                                          - additionalProperties: false
                                                                            type: object
                                                                            properties:
                                                                              exists:
                                                                                type: boolean
                                                                              field:
                                                                                maxLength: 256
                                                                                minLength: 1
                                                                                type: string
                                                                            required:
                                                                              - field
                                                                      - additionalProperties: false
                                                                        type: object
                                                                        properties:
                                                                          always:
                                                                            additionalProperties: false
                                                                            type: object
                                                                            properties: {}
                                                                        required:
                                                                          - always
                                                                      - additionalProperties: false
                                                                        type: object
                                                                        properties:
                                                                          never:
                                                                            additionalProperties: false
                                                                            type: object
                                                                            properties: {}
                                                                        required:
                                                                          - never
                                                                  maxItems: 50
                                                                  type: array
                                                              required:
                                                                - or
                                                            - additionalProperties: false
                                                              type: object
                                                              properties:
                                                                not:
                                                                  anyOf:
                                                                    - anyOf:
                                                                        - additionalProperties: false
                                                                          type: object
                                                                          properties:
                                                                            contains:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            endsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            eq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            includes:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            neq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            range:
                                                                              additionalProperties: false
                                                                              type: object
                                                                              properties:
                                                                                gt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                gte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                            startsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          required:
                                                                            - field
                                                                        - additionalProperties: false
                                                                          type: object
                                                                          properties:
                                                                            exists:
                                                                              type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                          required:
                                                                            - field
                                                                    - additionalProperties: false
                                                                      type: object
                                                                      properties:
                                                                        always:
                                                                          additionalProperties: false
                                                                          type: object
                                                                          properties: {}
                                                                      required:
                                                                        - always
                                                                    - additionalProperties: false
                                                                      type: object
                                                                      properties:
                                                                        never:
                                                                          additionalProperties: false
                                                                          type: object
                                                                          properties: {}
                                                                      required:
                                                                        - never
                                                              required:
                                                                - not
                                                            - additionalProperties: false
                                                              type: object
                                                              properties:
                                                                always:
                                                                  additionalProperties: false
                                                                  type: object
                                                                  properties: {}
                                                              required:
                                                                - always
                                                            - additionalProperties: false
                                                              type: object
                                                              properties:
                                                                never:
                                                                  additionalProperties: false
                                                                  type: object
                                                                  properties: {}
                                                              required:
                                                                - never
                                                        maxItems: 50
                                                        type: array
                                                    required:
                                                      - or
                                                  - additionalProperties: false
                                                    type: object
                                                    properties:
                                                      not:
                                                        anyOf:
                                                          - anyOf:
                                                              - additionalProperties: false
                                                                type: object
                                                                properties:
                                                                  contains:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  endsWith:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  eq:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  field:
                                                                    maxLength: 256
                                                                    minLength: 1
                                                                    type: string
                                                                  gt:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  gte:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  includes:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  lt:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  lte:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  neq:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  range:
                                                                    additionalProperties: false
                                                                    type: object
                                                                    properties:
                                                                      gt:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      gte:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      lt:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      lte:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                  startsWith:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                required:
                                                                  - field
                                                              - additionalProperties: false
                                                                type: object
                                                                properties:
                                                                  exists:
                                                                    type: boolean
                                                                  field:
                                                                    maxLength: 256
                                                                    minLength: 1
                                                                    type: string
                                                                required:
                                                                  - field
                                                          - additionalProperties: false
                                                            type: object
                                                            properties:
                                                              and:
                                                                items:
                                                                  anyOf:
                                                                    - anyOf:
                                                                        - additionalProperties: false
                                                                          type: object
                                                                          properties:
                                                                            contains:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            endsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            eq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            includes:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            neq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            range:
                                                                              additionalProperties: false
                                                                              type: object
                                                                              properties:
                                                                                gt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                gte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                            startsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          required:
                                                                            - field
                                                                        - additionalProperties: false
                                                                          type: object
                                                                          properties:
                                                                            exists:
                                                                              type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                          required:
                                                                            - field
                                                                    - additionalProperties: false
                                                                      type: object
                                                                      properties:
                                                                        always:
                                                                          additionalProperties: false
                                                                          type: object
                                                                          properties: {}
                                                                      required:
                                                                        - always
                                                                    - additionalProperties: false
                                                                      type: object
                                                                      properties:
                                                                        never:
                                                                          additionalProperties: false
                                                                          type: object
                                                                          properties: {}
                                                                      required:
                                                                        - never
                                                                maxItems: 50
                                                                type: array
                                                            required:
                                                              - and
                                                          - additionalProperties: false
                                                            type: object
                                                            properties:
                                                              or:
                                                                items:
                                                                  anyOf:
                                                                    - anyOf:
                                                                        - additionalProperties: false
                                                                          type: object
                                                                          properties:
                                                                            contains:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            endsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            eq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            includes:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            neq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            range:
                                                                              additionalProperties: false
                                                                              type: object
                                                                              properties:
                                                                                gt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                gte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                            startsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          required:
                                                                            - field
                                                                        - additionalProperties: false
                                                                          type: object
                                                                          properties:
                                                                            exists:
                                                                              type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                          required:
                                                                            - field
                                                                    - additionalProperties: false
                                                                      type: object
                                                                      properties:
                                                                        always:
                                                                          additionalProperties: false
                                                                          type: object
                                                                          properties: {}
                                                                      required:
                                                                        - always
                                                                    - additionalProperties: false
                                                                      type: object
                                                                      properties:
                                                                        never:
                                                                          additionalProperties: false
                                                                          type: object
                                                                          properties: {}
                                                                      required:
                                                                        - never
                                                                maxItems: 50
                                                                type: array
                                                            required:
                                                              - or
                                                          - additionalProperties: false
                                                            type: object
                                                            properties:
                                                              not:
                                                                anyOf:
                                                                  - anyOf:
                                                                      - additionalProperties: false
                                                                        type: object
                                                                        properties:
                                                                          contains:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          endsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          eq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                          gt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          gte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          includes:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          neq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          range:
                                                                            additionalProperties: false
                                                                            type: object
                                                                            properties:
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                          startsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                        required:
                                                                          - field
                                                                      - additionalProperties: false
                                                                        type: object
                                                                        properties:
                                                                          exists:
                                                                            type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                        required:
                                                                          - field
                                                                  - additionalProperties: false
                                                                    type: object
                                                                    properties:
                                                                      always:
                                                                        additionalProperties: false
                                                                        type: object
                                                                        properties: {}
                                                                    required:
                                                                      - always
                                                                  - additionalProperties: false
                                                                    type: object
                                                                    properties:
                                                                      never:
                                                                        additionalProperties: false
                                                                        type: object
                                                                        properties: {}
                                                                    required:
                                                                      - never
                                                            required:
                                                              - not
                                                          - additionalProperties: false
                                                            type: object
                                                            properties:
                                                              always:
                                                                additionalProperties: false
                                                                type: object
                                                                properties: {}
                                                            required:
                                                              - always
                                                          - additionalProperties: false
                                                            type: object
                                                            properties:
                                                              never:
                                                                additionalProperties: false
                                                                type: object
                                                                properties: {}
                                                            required:
                                                              - never
                                                    required:
                                                      - not
                                                  - additionalProperties: false
                                                    type: object
                                                    properties:
                                                      always:
                                                        additionalProperties: false
                                                        type: object
                                                        properties: {}
                                                    required:
                                                      - always
                                                  - additionalProperties: false
                                                    type: object
                                                    properties:
                                                      never:
                                                        additionalProperties: false
                                                        type: object
                                                        properties: {}
                                                    required:
                                                      - never
                                              maxItems: 50
                                              type: array
                                          required:
                                            - and
                                        - additionalProperties: false
                                          type: object
                                          properties:
                                            or:
                                              items:
                                                anyOf:
                                                  - anyOf:
                                                      - additionalProperties: false
                                                        type: object
                                                        properties:
                                                          contains:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          endsWith:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          eq:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          field:
                                                            maxLength: 256
                                                            minLength: 1
                                                            type: string
                                                          gt:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          gte:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          includes:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          lt:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          lte:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          neq:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          range:
                                                            additionalProperties: false
                                                            type: object
                                                            properties:
                                                              gt:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              gte:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              lt:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              lte:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                          startsWith:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                        required:
                                                          - field
                                                      - additionalProperties: false
                                                        type: object
                                                        properties:
                                                          exists:
                                                            type: boolean
                                                          field:
                                                            maxLength: 256
                                                            minLength: 1
                                                            type: string
                                                        required:
                                                          - field
                                                  - additionalProperties: false
                                                    type: object
                                                    properties:
                                                      and:
                                                        items:
                                                          anyOf:
                                                            - anyOf:
                                                                - additionalProperties: false
                                                                  type: object
                                                                  properties:
                                                                    contains:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    endsWith:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    eq:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    field:
                                                                      maxLength: 256
                                                                      minLength: 1
                                                                      type: string
                                                                    gt:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    gte:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    includes:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    lt:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    lte:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    neq:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    range:
                                                                      additionalProperties: false
                                                                      type: object
                                                                      properties:
                                                                        gt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        gte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                    startsWith:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                  required:
                                                                    - field
                                                                - additionalProperties: false
                                                                  type: object
                                                                  properties:
                                                                    exists:
                                                                      type: boolean
                                                                    field:
                                                                      maxLength: 256
                                                                      minLength: 1
                                                                      type: string
                                                                  required:
                                                                    - field
                                                            - additionalProperties: false
                                                              type: object
                                                              properties:
                                                                and:
                                                                  items:
                                                                    anyOf:
                                                                      - anyOf:
                                                                          - additionalProperties: false
                                                                            type: object
                                                                            properties:
                                                                              contains:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              endsWith:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              eq:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              field:
                                                                                maxLength: 256
                                                                                minLength: 1
                                                                                type: string
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              includes:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              neq:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              range:
                                                                                additionalProperties: false
                                                                                type: object
                                                                                properties:
                                                                                  gt:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  gte:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  lt:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  lte:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                              startsWith:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            required:
                                                                              - field
                                                                          - additionalProperties: false
                                                                            type: object
                                                                            properties:
                                                                              exists:
                                                                                type: boolean
                                                                              field:
                                                                                maxLength: 256
                                                                                minLength: 1
                                                                                type: string
                                                                            required:
                                                                              - field
                                                                      - additionalProperties: false
                                                                        type: object
                                                                        properties:
                                                                          always:
                                                                            additionalProperties: false
                                                                            type: object
                                                                            properties: {}
                                                                        required:
                                                                          - always
                                                                      - additionalProperties: false
                                                                        type: object
                                                                        properties:
                                                                          never:
                                                                            additionalProperties: false
                                                                            type: object
                                                                            properties: {}
                                                                        required:
                                                                          - never
                                                                  maxItems: 50
                                                                  type: array
                                                              required:
                                                                - and
                                                            - additionalProperties: false
                                                              type: object
                                                              properties:
                                                                or:
                                                                  items:
                                                                    anyOf:
                                                                      - anyOf:
                                                                          - additionalProperties: false
                                                                            type: object
                                                                            properties:
                                                                              contains:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              endsWith:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              eq:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              field:
                                                                                maxLength: 256
                                                                                minLength: 1
                                                                                type: string
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              includes:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              neq:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              range:
                                                                                additionalProperties: false
                                                                                type: object
                                                                                properties:
                                                                                  gt:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  gte:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  lt:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  lte:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                              startsWith:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            required:
                                                                              - field
                                                                          - additionalProperties: false
                                                                            type: object
                                                                            properties:
                                                                              exists:
                                                                                type: boolean
                                                                              field:
                                                                                maxLength: 256
                                                                                minLength: 1
                                                                                type: string
                                                                            required:
                                                                              - field
                                                                      - additionalProperties: false
                                                                        type: object
                                                                        properties:
                                                                          always:
                                                                            additionalProperties: false
                                                                            type: object
                                                                            properties: {}
                                                                        required:
                                                                          - always
                                                                      - additionalProperties: false
                                                                        type: object
                                                                        properties:
                                                                          never:
                                                                            additionalProperties: false
                                                                            type: object
                                                                            properties: {}
                                                                        required:
                                                                          - never
                                                                  maxItems: 50
                                                                  type: array
                                                              required:
                                                                - or
                                                            - additionalProperties: false
                                                              type: object
                                                              properties:
                                                                not:
                                                                  anyOf:
                                                                    - anyOf:
                                                                        - additionalProperties: false
                                                                          type: object
                                                                          properties:
                                                                            contains:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            endsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            eq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            includes:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            neq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            range:
                                                                              additionalProperties: false
                                                                              type: object
                                                                              properties:
                                                                                gt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                gte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                            startsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          required:
                                                                            - field
                                                                        - additionalProperties: false
                                                                          type: object
                                                                          properties:
                                                                            exists:
                                                                              type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                          required:
                                                                            - field
                                                                    - additionalProperties: false
                                                                      type: object
                                                                      properties:
                                                                        always:
                                                                          additionalProperties: false
                                                                          type: object
                                                                          properties: {}
                                                                      required:
                                                                        - always
                                                                    - additionalProperties: false
                                                                      type: object
                                                                      properties:
                                                                        never:
                                                                          additionalProperties: false
                                                                          type: object
                                                                          properties: {}
                                                                      required:
                                                                        - never
                                                              required:
                                                                - not
                                                            - additionalProperties: false
                                                              type: object
                                                              properties:
                                                                always:
                                                                  additionalProperties: false
                                                                  type: object
                                                                  properties: {}
                                                              required:
                                                                - always
                                                            - additionalProperties: false
                                                              type: object
                                                              properties:
                                                                never:
                                                                  additionalProperties: false
                                                                  type: object
                                                                  properties: {}
                                                              required:
                                                                - never
                                                        maxItems: 50
                                                        type: array
                                                    required:
                                                      - and
                                                  - additionalProperties: false
                                                    type: object
                                                    properties:
                                                      or:
                                                        items:
                                                          anyOf:
                                                            - anyOf:
                                                                - additionalProperties: false
                                                                  type: object
                                                                  properties:
                                                                    contains:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    endsWith:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    eq:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    field:
                                                                      maxLength: 256
                                                                      minLength: 1
                                                                      type: string
                                                                    gt:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    gte:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    includes:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    lt:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    lte:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    neq:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    range:
                                                                      additionalProperties: false
                                                                      type: object
                                                                      properties:
                                                                        gt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        gte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                    startsWith:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                  required:
                                                                    - field
                                                                - additionalProperties: false
                                                                  type: object
                                                                  properties:
                                                                    exists:
                                                                      type: boolean
                                                                    field:
                                                                      maxLength: 256
                                                                      minLength: 1
                                                                      type: string
                                                                  required:
                                                                    - field
                                                            - additionalProperties: false
                                                              type: object
                                                              properties:
                                                                and:
                                                                  items:
                                                                    anyOf:
                                                                      - anyOf:
                                                                          - additionalProperties: false
                                                                            type: object
                                                                            properties:
                                                                              contains:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              endsWith:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              eq:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              field:
                                                                                maxLength: 256
                                                                                minLength: 1
                                                                                type: string
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              includes:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              neq:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              range:
                                                                                additionalProperties: false
                                                                                type: object
                                                                                properties:
                                                                                  gt:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  gte:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  lt:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  lte:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                              startsWith:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            required:
                                                                              - field
                                                                          - additionalProperties: false
                                                                            type: object
                                                                            properties:
                                                                              exists:
                                                                                type: boolean
                                                                              field:
                                                                                maxLength: 256
                                                                                minLength: 1
                                                                                type: string
                                                                            required:
                                                                              - field
                                                                      - additionalProperties: false
                                                                        type: object
                                                                        properties:
                                                                          always:
                                                                            additionalProperties: false
                                                                            type: object
                                                                            properties: {}
                                                                        required:
                                                                          - always
                                                                      - additionalProperties: false
                                                                        type: object
                                                                        properties:
                                                                          never:
                                                                            additionalProperties: false
                                                                            type: object
                                                                            properties: {}
                                                                        required:
                                                                          - never
                                                                  maxItems: 50
                                                                  type: array
                                                              required:
                                                                - and
                                                            - additionalProperties: false
                                                              type: object
                                                              properties:
                                                                or:
                                                                  items:
                                                                    anyOf:
                                                                      - anyOf:
                                                                          - additionalProperties: false
                                                                            type: object
                                                                            properties:
                                                                              contains:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              endsWith:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              eq:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              field:
                                                                                maxLength: 256
                                                                                minLength: 1
                                                                                type: string
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              includes:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              neq:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              range:
                                                                                additionalProperties: false
                                                                                type: object
                                                                                properties:
                                                                                  gt:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  gte:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  lt:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  lte:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                              startsWith:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            required:
                                                                              - field
                                                                          - additionalProperties: false
                                                                            type: object
                                                                            properties:
                                                                              exists:
                                                                                type: boolean
                                                                              field:
                                                                                maxLength: 256
                                                                                minLength: 1
                                                                                type: string
                                                                            required:
                                                                              - field
                                                                      - additionalProperties: false
                                                                        type: object
                                                                        properties:
                                                                          always:
                                                                            additionalProperties: false
                                                                            type: object
                                                                            properties: {}
                                                                        required:
                                                                          - always
                                                                      - additionalProperties: false
                                                                        type: object
                                                                        properties:
                                                                          never:
                                                                            additionalProperties: false
                                                                            type: object
                                                                            properties: {}
                                                                        required:
                                                                          - never
                                                                  maxItems: 50
                                                                  type: array
                                                              required:
                                                                - or
                                                            - additionalProperties: false
                                                              type: object
                                                              properties:
                                                                not:
                                                                  anyOf:
                                                                    - anyOf:
                                                                        - additionalProperties: false
                                                                          type: object
                                                                          properties:
                                                                            contains:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            endsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            eq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            includes:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            neq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            range:
                                                                              additionalProperties: false
                                                                              type: object
                                                                              properties:
                                                                                gt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                gte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                            startsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          required:
                                                                            - field
                                                                        - additionalProperties: false
                                                                          type: object
                                                                          properties:
                                                                            exists:
                                                                              type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                          required:
                                                                            - field
                                                                    - additionalProperties: false
                                                                      type: object
                                                                      properties:
                                                                        always:
                                                                          additionalProperties: false
                                                                          type: object
                                                                          properties: {}
                                                                      required:
                                                                        - always
                                                                    - additionalProperties: false
                                                                      type: object
                                                                      properties:
                                                                        never:
                                                                          additionalProperties: false
                                                                          type: object
                                                                          properties: {}
                                                                      required:
                                                                        - never
                                                              required:
                                                                - not
                                                            - additionalProperties: false
                                                              type: object
                                                              properties:
                                                                always:
                                                                  additionalProperties: false
                                                                  type: object
                                                                  properties: {}
                                                              required:
                                                                - always
                                                            - additionalProperties: false
                                                              type: object
                                                              properties:
                                                                never:
                                                                  additionalProperties: false
                                                                  type: object
                                                                  properties: {}
                                                              required:
                                                                - never
                                                        maxItems: 50
                                                        type: array
                                                    required:
                                                      - or
                                                  - additionalProperties: false
                                                    type: object
                                                    properties:
                                                      not:
                                                        anyOf:
                                                          - anyOf:
                                                              - additionalProperties: false
                                                                type: object
                                                                properties:
                                                                  contains:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  endsWith:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  eq:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  field:
                                                                    maxLength: 256
                                                                    minLength: 1
                                                                    type: string
                                                                  gt:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  gte:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  includes:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  lt:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  lte:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  neq:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  range:
                                                                    additionalProperties: false
                                                                    type: object
                                                                    properties:
                                                                      gt:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      gte:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      lt:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      lte:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                  startsWith:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                required:
                                                                  - field
                                                              - additionalProperties: false
                                                                type: object
                                                                properties:
                                                                  exists:
                                                                    type: boolean
                                                                  field:
                                                                    maxLength: 256
                                                                    minLength: 1
                                                                    type: string
                                                                required:
                                                                  - field
                                                          - additionalProperties: false
                                                            type: object
                                                            properties:
                                                              and:
                                                                items:
                                                                  anyOf:
                                                                    - anyOf:
                                                                        - additionalProperties: false
                                                                          type: object
                                                                          properties:
                                                                            contains:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            endsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            eq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            includes:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            neq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            range:
                                                                              additionalProperties: false
                                                                              type: object
                                                                              properties:
                                                                                gt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                gte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                            startsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          required:
                                                                            - field
                                                                        - additionalProperties: false
                                                                          type: object
                                                                          properties:
                                                                            exists:
                                                                              type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                          required:
                                                                            - field
                                                                    - additionalProperties: false
                                                                      type: object
                                                                      properties:
                                                                        always:
                                                                          additionalProperties: false
                                                                          type: object
                                                                          properties: {}
                                                                      required:
                                                                        - always
                                                                    - additionalProperties: false
                                                                      type: object
                                                                      properties:
                                                                        never:
                                                                          additionalProperties: false
                                                                          type: object
                                                                          properties: {}
                                                                      required:
                                                                        - never
                                                                maxItems: 50
                                                                type: array
                                                            required:
                                                              - and
                                                          - additionalProperties: false
                                                            type: object
                                                            properties:
                                                              or:
                                                                items:
                                                                  anyOf:
                                                                    - anyOf:
                                                                        - additionalProperties: false
                                                                          type: object
                                                                          properties:
                                                                            contains:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            endsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            eq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            includes:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            neq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            range:
                                                                              additionalProperties: false
                                                                              type: object
                                                                              properties:
                                                                                gt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                gte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                            startsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          required:
                                                                            - field
                                                                        - additionalProperties: false
                                                                          type: object
                                                                          properties:
                                                                            exists:
                                                                              type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                          required:
                                                                            - field
                                                                    - additionalProperties: false
                                                                      type: object
                                                                      properties:
                                                                        always:
                                                                          additionalProperties: false
                                                                          type: object
                                                                          properties: {}
                                                                      required:
                                                                        - always
                                                                    - additionalProperties: false
                                                                      type: object
                                                                      properties:
                                                                        never:
                                                                          additionalProperties: false
                                                                          type: object
                                                                          properties: {}
                                                                      required:
                                                                        - never
                                                                maxItems: 50
                                                                type: array
                                                            required:
                                                              - or
                                                          - additionalProperties: false
                                                            type: object
                                                            properties:
                                                              not:
                                                                anyOf:
                                                                  - anyOf:
                                                                      - additionalProperties: false
                                                                        type: object
                                                                        properties:
                                                                          contains:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          endsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          eq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                          gt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          gte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          includes:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          neq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          range:
                                                                            additionalProperties: false
                                                                            type: object
                                                                            properties:
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                          startsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                        required:
                                                                          - field
                                                                      - additionalProperties: false
                                                                        type: object
                                                                        properties:
                                                                          exists:
                                                                            type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                        required:
                                                                          - field
                                                                  - additionalProperties: false
                                                                    type: object
                                                                    properties:
                                                                      always:
                                                                        additionalProperties: false
                                                                        type: object
                                                                        properties: {}
                                                                    required:
                                                                      - always
                                                                  - additionalProperties: false
                                                                    type: object
                                                                    properties:
                                                                      never:
                                                                        additionalProperties: false
                                                                        type: object
                                                                        properties: {}
                                                                    required:
                                                                      - never
                                                            required:
                                                              - not
                                                          - additionalProperties: false
                                                            type: object
                                                            properties:
                                                              always:
                                                                additionalProperties: false
                                                                type: object
                                                                properties: {}
                                                            required:
                                                              - always
                                                          - additionalProperties: false
                                                            type: object
                                                            properties:
                                                              never:
                                                                additionalProperties: false
                                                                type: object
                                                                properties: {}
                                                            required:
                                                              - never
                                                    required:
                                                      - not
                                                  - additionalProperties: false
                                                    type: object
                                                    properties:
                                                      always:
                                                        additionalProperties: false
                                                        type: object
                                                        properties: {}
                                                    required:
                                                      - always
                                                  - additionalProperties: false
                                                    type: object
                                                    properties:
                                                      never:
                                                        additionalProperties: false
                                                        type: object
                                                        properties: {}
                                                    required:
                                                      - never
                                              maxItems: 50
                                              type: array
                                          required:
                                            - or
                                        - additionalProperties: false
                                          type: object
                                          properties:
                                            not:
                                              anyOf:
                                                - anyOf:
                                                    - additionalProperties: false
                                                      type: object
                                                      properties:
                                                        contains:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        endsWith:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        eq:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        field:
                                                          maxLength: 256
                                                          minLength: 1
                                                          type: string
                                                        gt:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        gte:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        includes:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        lt:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        lte:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        neq:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        range:
                                                          additionalProperties: false
                                                          type: object
                                                          properties:
                                                            gt:
                                                              anyOf:
                                                                - maxLength: 65535
                                                                  type: string
                                                                - type: number
                                                                - type: boolean
                                                            gte:
                                                              anyOf:
                                                                - maxLength: 65535
                                                                  type: string
                                                                - type: number
                                                                - type: boolean
                                                            lt:
                                                              anyOf:
                                                                - maxLength: 65535
                                                                  type: string
                                                                - type: number
                                                                - type: boolean
                                                            lte:
                                                              anyOf:
                                                                - maxLength: 65535
                                                                  type: string
                                                                - type: number
                                                                - type: boolean
                                                        startsWith:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                      required:
                                                        - field
                                                    - additionalProperties: false
                                                      type: object
                                                      properties:
                                                        exists:
                                                          type: boolean
                                                        field:
                                                          maxLength: 256
                                                          minLength: 1
                                                          type: string
                                                      required:
                                                        - field
                                                - additionalProperties: false
                                                  type: object
                                                  properties:
                                                    and:
                                                      items:
                                                        anyOf:
                                                          - anyOf:
                                                              - additionalProperties: false
                                                                type: object
                                                                properties:
                                                                  contains:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  endsWith:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  eq:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  field:
                                                                    maxLength: 256
                                                                    minLength: 1
                                                                    type: string
                                                                  gt:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  gte:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  includes:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  lt:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  lte:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  neq:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  range:
                                                                    additionalProperties: false
                                                                    type: object
                                                                    properties:
                                                                      gt:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      gte:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      lt:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      lte:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                  startsWith:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                required:
                                                                  - field
                                                              - additionalProperties: false
                                                                type: object
                                                                properties:
                                                                  exists:
                                                                    type: boolean
                                                                  field:
                                                                    maxLength: 256
                                                                    minLength: 1
                                                                    type: string
                                                                required:
                                                                  - field
                                                          - additionalProperties: false
                                                            type: object
                                                            properties:
                                                              and:
                                                                items:
                                                                  anyOf:
                                                                    - anyOf:
                                                                        - additionalProperties: false
                                                                          type: object
                                                                          properties:
                                                                            contains:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            endsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            eq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            includes:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            neq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            range:
                                                                              additionalProperties: false
                                                                              type: object
                                                                              properties:
                                                                                gt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                gte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                            startsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          required:
                                                                            - field
                                                                        - additionalProperties: false
                                                                          type: object
                                                                          properties:
                                                                            exists:
                                                                              type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                          required:
                                                                            - field
                                                                    - additionalProperties: false
                                                                      type: object
                                                                      properties:
                                                                        always:
                                                                          additionalProperties: false
                                                                          type: object
                                                                          properties: {}
                                                                      required:
                                                                        - always
                                                                    - additionalProperties: false
                                                                      type: object
                                                                      properties:
                                                                        never:
                                                                          additionalProperties: false
                                                                          type: object
                                                                          properties: {}
                                                                      required:
                                                                        - never
                                                                maxItems: 50
                                                                type: array
                                                            required:
                                                              - and
                                                          - additionalProperties: false
                                                            type: object
                                                            properties:
                                                              or:
                                                                items:
                                                                  anyOf:
                                                                    - anyOf:
                                                                        - additionalProperties: false
                                                                          type: object
                                                                          properties:
                                                                            contains:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            endsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            eq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            includes:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            neq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            range:
                                                                              additionalProperties: false
                                                                              type: object
                                                                              properties:
                                                                                gt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                gte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                            startsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          required:
                                                                            - field
                                                                        - additionalProperties: false
                                                                          type: object
                                                                          properties:
                                                                            exists:
                                                                              type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                          required:
                                                                            - field
                                                                    - additionalProperties: false
                                                                      type: object
                                                                      properties:
                                                                        always:
                                                                          additionalProperties: false
                                                                          type: object
                                                                          properties: {}
                                                                      required:
                                                                        - always
                                                                    - additionalProperties: false
                                                                      type: object
                                                                      properties:
                                                                        never:
                                                                          additionalProperties: false
                                                                          type: object
                                                                          properties: {}
                                                                      required:
                                                                        - never
                                                                maxItems: 50
                                                                type: array
                                                            required:
                                                              - or
                                                          - additionalProperties: false
                                                            type: object
                                                            properties:
                                                              not:
                                                                anyOf:
                                                                  - anyOf:
                                                                      - additionalProperties: false
                                                                        type: object
                                                                        properties:
                                                                          contains:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          endsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          eq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                          gt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          gte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          includes:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          neq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          range:
                                                                            additionalProperties: false
                                                                            type: object
                                                                            properties:
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                          startsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                        required:
                                                                          - field
                                                                      - additionalProperties: false
                                                                        type: object
                                                                        properties:
                                                                          exists:
                                                                            type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                        required:
                                                                          - field
                                                                  - additionalProperties: false
                                                                    type: object
                                                                    properties:
                                                                      always:
                                                                        additionalProperties: false
                                                                        type: object
                                                                        properties: {}
                                                                    required:
                                                                      - always
                                                                  - additionalProperties: false
                                                                    type: object
                                                                    properties:
                                                                      never:
                                                                        additionalProperties: false
                                                                        type: object
                                                                        properties: {}
                                                                    required:
                                                                      - never
                                                            required:
                                                              - not
                                                          - additionalProperties: false
                                                            type: object
                                                            properties:
                                                              always:
                                                                additionalProperties: false
                                                                type: object
                                                                properties: {}
                                                            required:
                                                              - always
                                                          - additionalProperties: false
                                                            type: object
                                                            properties:
                                                              never:
                                                                additionalProperties: false
                                                                type: object
                                                                properties: {}
                                                            required:
                                                              - never
                                                      maxItems: 50
                                                      type: array
                                                  required:
                                                    - and
                                                - additionalProperties: false
                                                  type: object
                                                  properties:
                                                    or:
                                                      items:
                                                        anyOf:
                                                          - anyOf:
                                                              - additionalProperties: false
                                                                type: object
                                                                properties:
                                                                  contains:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  endsWith:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  eq:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  field:
                                                                    maxLength: 256
                                                                    minLength: 1
                                                                    type: string
                                                                  gt:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  gte:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  includes:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  lt:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  lte:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  neq:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  range:
                                                                    additionalProperties: false
                                                                    type: object
                                                                    properties:
                                                                      gt:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      gte:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      lt:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      lte:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                  startsWith:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                required:
                                                                  - field
                                                              - additionalProperties: false
                                                                type: object
                                                                properties:
                                                                  exists:
                                                                    type: boolean
                                                                  field:
                                                                    maxLength: 256
                                                                    minLength: 1
                                                                    type: string
                                                                required:
                                                                  - field
                                                          - additionalProperties: false
                                                            type: object
                                                            properties:
                                                              and:
                                                                items:
                                                                  anyOf:
                                                                    - anyOf:
                                                                        - additionalProperties: false
                                                                          type: object
                                                                          properties:
                                                                            contains:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            endsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            eq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            includes:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            neq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            range:
                                                                              additionalProperties: false
                                                                              type: object
                                                                              properties:
                                                                                gt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                gte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                            startsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          required:
                                                                            - field
                                                                        - additionalProperties: false
                                                                          type: object
                                                                          properties:
                                                                            exists:
                                                                              type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                          required:
                                                                            - field
                                                                    - additionalProperties: false
                                                                      type: object
                                                                      properties:
                                                                        always:
                                                                          additionalProperties: false
                                                                          type: object
                                                                          properties: {}
                                                                      required:
                                                                        - always
                                                                    - additionalProperties: false
                                                                      type: object
                                                                      properties:
                                                                        never:
                                                                          additionalProperties: false
                                                                          type: object
                                                                          properties: {}
                                                                      required:
                                                                        - never
                                                                maxItems: 50
                                                                type: array
                                                            required:
                                                              - and
                                                          - additionalProperties: false
                                                            type: object
                                                            properties:
                                                              or:
                                                                items:
                                                                  anyOf:
                                                                    - anyOf:
                                                                        - additionalProperties: false
                                                                          type: object
                                                                          properties:
                                                                            contains:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            endsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            eq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            includes:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            neq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            range:
                                                                              additionalProperties: false
                                                                              type: object
                                                                              properties:
                                                                                gt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                gte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                            startsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          required:
                                                                            - field
                                                                        - additionalProperties: false
                                                                          type: object
                                                                          properties:
                                                                            exists:
                                                                              type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                          required:
                                                                            - field
                                                                    - additionalProperties: false
                                                                      type: object
                                                                      properties:
                                                                        always:
                                                                          additionalProperties: false
                                                                          type: object
                                                                          properties: {}
                                                                      required:
                                                                        - always
                                                                    - additionalProperties: false
                                                                      type: object
                                                                      properties:
                                                                        never:
                                                                          additionalProperties: false
                                                                          type: object
                                                                          properties: {}
                                                                      required:
                                                                        - never
                                                                maxItems: 50
                                                                type: array
                                                            required:
                                                              - or
                                                          - additionalProperties: false
                                                            type: object
                                                            properties:
                                                              not:
                                                                anyOf:
                                                                  - anyOf:
                                                                      - additionalProperties: false
                                                                        type: object
                                                                        properties:
                                                                          contains:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          endsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          eq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                          gt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          gte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          includes:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          neq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          range:
                                                                            additionalProperties: false
                                                                            type: object
                                                                            properties:
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                          startsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                        required:
                                                                          - field
                                                                      - additionalProperties: false
                                                                        type: object
                                                                        properties:
                                                                          exists:
                                                                            type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                        required:
                                                                          - field
                                                                  - additionalProperties: false
                                                                    type: object
                                                                    properties:
                                                                      always:
                                                                        additionalProperties: false
                                                                        type: object
                                                                        properties: {}
                                                                    required:
                                                                      - always
                                                                  - additionalProperties: false
                                                                    type: object
                                                                    properties:
                                                                      never:
                                                                        additionalProperties: false
                                                                        type: object
                                                                        properties: {}
                                                                    required:
                                                                      - never
                                                            required:
                                                              - not
                                                          - additionalProperties: false
                                                            type: object
                                                            properties:
                                                              always:
                                                                additionalProperties: false
                                                                type: object
                                                                properties: {}
                                                            required:
                                                              - always
                                                          - additionalProperties: false
                                                            type: object
                                                            properties:
                                                              never:
                                                                additionalProperties: false
                                                                type: object
                                                                properties: {}
                                                            required:
                                                              - never
                                                      maxItems: 50
                                                      type: array
                                                  required:
                                                    - or
                                                - additionalProperties: false
                                                  type: object
                                                  properties:
                                                    not:
                                                      anyOf:
                                                        - anyOf:
                                                            - additionalProperties: false
                                                              type: object
                                                              properties:
                                                                contains:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                endsWith:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                eq:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                field:
                                                                  maxLength: 256
                                                                  minLength: 1
                                                                  type: string
                                                                gt:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                gte:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                includes:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                lt:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                lte:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                neq:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                range:
                                                                  additionalProperties: false
                                                                  type: object
                                                                  properties:
                                                                    gt:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    gte:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    lt:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    lte:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                startsWith:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                              required:
                                                                - field
                                                            - additionalProperties: false
                                                              type: object
                                                              properties:
                                                                exists:
                                                                  type: boolean
                                                                field:
                                                                  maxLength: 256
                                                                  minLength: 1
                                                                  type: string
                                                              required:
                                                                - field
                                                        - additionalProperties: false
                                                          type: object
                                                          properties:
                                                            and:
                                                              items:
                                                                anyOf:
                                                                  - anyOf:
                                                                      - additionalProperties: false
                                                                        type: object
                                                                        properties:
                                                                          contains:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          endsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          eq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                          gt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          gte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          includes:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          neq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          range:
                                                                            additionalProperties: false
                                                                            type: object
                                                                            properties:
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                          startsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                        required:
                                                                          - field
                                                                      - additionalProperties: false
                                                                        type: object
                                                                        properties:
                                                                          exists:
                                                                            type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                        required:
                                                                          - field
                                                                  - additionalProperties: false
                                                                    type: object
                                                                    properties:
                                                                      always:
                                                                        additionalProperties: false
                                                                        type: object
                                                                        properties: {}
                                                                    required:
                                                                      - always
                                                                  - additionalProperties: false
                                                                    type: object
                                                                    properties:
                                                                      never:
                                                                        additionalProperties: false
                                                                        type: object
                                                                        properties: {}
                                                                    required:
                                                                      - never
                                                              maxItems: 50
                                                              type: array
                                                          required:
                                                            - and
                                                        - additionalProperties: false
                                                          type: object
                                                          properties:
                                                            or:
                                                              items:
                                                                anyOf:
                                                                  - anyOf:
                                                                      - additionalProperties: false
                                                                        type: object
                                                                        properties:
                                                                          contains:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          endsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          eq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                          gt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          gte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          includes:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          neq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          range:
                                                                            additionalProperties: false
                                                                            type: object
                                                                            properties:
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                          startsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                        required:
                                                                          - field
                                                                      - additionalProperties: false
                                                                        type: object
                                                                        properties:
                                                                          exists:
                                                                            type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                        required:
                                                                          - field
                                                                  - additionalProperties: false
                                                                    type: object
                                                                    properties:
                                                                      always:
                                                                        additionalProperties: false
                                                                        type: object
                                                                        properties: {}
                                                                    required:
                                                                      - always
                                                                  - additionalProperties: false
                                                                    type: object
                                                                    properties:
                                                                      never:
                                                                        additionalProperties: false
                                                                        type: object
                                                                        properties: {}
                                                                    required:
                                                                      - never
                                                              maxItems: 50
                                                              type: array
                                                          required:
                                                            - or
                                                        - additionalProperties: false
                                                          type: object
                                                          properties:
                                                            not:
                                                              anyOf:
                                                                - anyOf:
                                                                    - additionalProperties: false
                                                                      type: object
                                                                      properties:
                                                                        contains:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        endsWith:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        eq:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        field:
                                                                          maxLength: 256
                                                                          minLength: 1
                                                                          type: string
                                                                        gt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        gte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        includes:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        neq:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        range:
                                                                          additionalProperties: false
                                                                          type: object
                                                                          properties:
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                        startsWith:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                      required:
                                                                        - field
                                                                    - additionalProperties: false
                                                                      type: object
                                                                      properties:
                                                                        exists:
                                                                          type: boolean
                                                                        field:
                                                                          maxLength: 256
                                                                          minLength: 1
                                                                          type: string
                                                                      required:
                                                                        - field
                                                                - additionalProperties: false
                                                                  type: object
                                                                  properties:
                                                                    always:
                                                                      additionalProperties: false
                                                                      type: object
                                                                      properties: {}
                                                                  required:
                                                                    - always
                                                                - additionalProperties: false
                                                                  type: object
                                                                  properties:
                                                                    never:
                                                                      additionalProperties: false
                                                                      type: object
                                                                      properties: {}
                                                                  required:
                                                                    - never
                                                          required:
                                                            - not
                                                        - additionalProperties: false
                                                          type: object
                                                          properties:
                                                            always:
                                                              additionalProperties: false
                                                              type: object
                                                              properties: {}
                                                          required:
                                                            - always
                                                        - additionalProperties: false
                                                          type: object
                                                          properties:
                                                            never:
                                                              additionalProperties: false
                                                              type: object
                                                              properties: {}
                                                          required:
                                                            - never
                                                  required:
                                                    - not
                                                - additionalProperties: false
                                                  type: object
                                                  properties:
                                                    always:
                                                      additionalProperties: false
                                                      type: object
                                                      properties: {}
                                                  required:
                                                    - always
                                                - additionalProperties: false
                                                  type: object
                                                  properties:
                                                    never:
                                                      additionalProperties: false
                                                      type: object
                                                      properties: {}
                                                  required:
                                                    - never
                                          required:
                                            - not
                                        - additionalProperties: false
                                          type: object
                                          properties:
                                            always:
                                              additionalProperties: false
                                              type: object
                                              properties: {}
                                          required:
                                            - always
                                        - additionalProperties: false
                                          type: object
                                          properties:
                                            never:
                                              additionalProperties: false
                                              type: object
                                              properties: {}
                                          required:
                                            - never
                                    maxItems: 50
                                    type: array
                                required:
                                  - or
                              - additionalProperties: false
                                type: object
                                properties:
                                  not:
                                    anyOf:
                                      - anyOf:
                                          - additionalProperties: false
                                            type: object
                                            properties:
                                              contains:
                                                anyOf:
                                                  - maxLength: 65535
                                                    type: string
                                                  - type: number
                                                  - type: boolean
                                              endsWith:
                                                anyOf:
                                                  - maxLength: 65535
                                                    type: string
                                                  - type: number
                                                  - type: boolean
                                              eq:
                                                anyOf:
                                                  - maxLength: 65535
                                                    type: string
                                                  - type: number
                                                  - type: boolean
                                              field:
                                                maxLength: 256
                                                minLength: 1
                                                type: string
                                              gt:
                                                anyOf:
                                                  - maxLength: 65535
                                                    type: string
                                                  - type: number
                                                  - type: boolean
                                              gte:
                                                anyOf:
                                                  - maxLength: 65535
                                                    type: string
                                                  - type: number
                                                  - type: boolean
                                              includes:
                                                anyOf:
                                                  - maxLength: 65535
                                                    type: string
                                                  - type: number
                                                  - type: boolean
                                              lt:
                                                anyOf:
                                                  - maxLength: 65535
                                                    type: string
                                                  - type: number
                                                  - type: boolean
                                              lte:
                                                anyOf:
                                                  - maxLength: 65535
                                                    type: string
                                                  - type: number
                                                  - type: boolean
                                              neq:
                                                anyOf:
                                                  - maxLength: 65535
                                                    type: string
                                                  - type: number
                                                  - type: boolean
                                              range:
                                                additionalProperties: false
                                                type: object
                                                properties:
                                                  gt:
                                                    anyOf:
                                                      - maxLength: 65535
                                                        type: string
                                                      - type: number
                                                      - type: boolean
                                                  gte:
                                                    anyOf:
                                                      - maxLength: 65535
                                                        type: string
                                                      - type: number
                                                      - type: boolean
                                                  lt:
                                                    anyOf:
                                                      - maxLength: 65535
                                                        type: string
                                                      - type: number
                                                      - type: boolean
                                                  lte:
                                                    anyOf:
                                                      - maxLength: 65535
                                                        type: string
                                                      - type: number
                                                      - type: boolean
                                              startsWith:
                                                anyOf:
                                                  - maxLength: 65535
                                                    type: string
                                                  - type: number
                                                  - type: boolean
                                            required:
                                              - field
                                          - additionalProperties: false
                                            type: object
                                            properties:
                                              exists:
                                                type: boolean
                                              field:
                                                maxLength: 256
                                                minLength: 1
                                                type: string
                                            required:
                                              - field
                                      - additionalProperties: false
                                        type: object
                                        properties:
                                          and:
                                            items:
                                              anyOf:
                                                - anyOf:
                                                    - additionalProperties: false
                                                      type: object
                                                      properties:
                                                        contains:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        endsWith:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        eq:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        field:
                                                          maxLength: 256
                                                          minLength: 1
                                                          type: string
                                                        gt:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        gte:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        includes:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        lt:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        lte:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        neq:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        range:
                                                          additionalProperties: false
                                                          type: object
                                                          properties:
                                                            gt:
                                                              anyOf:
                                                                - maxLength: 65535
                                                                  type: string
                                                                - type: number
                                                                - type: boolean
                                                            gte:
                                                              anyOf:
                                                                - maxLength: 65535
                                                                  type: string
                                                                - type: number
                                                                - type: boolean
                                                            lt:
                                                              anyOf:
                                                                - maxLength: 65535
                                                                  type: string
                                                                - type: number
                                                                - type: boolean
                                                            lte:
                                                              anyOf:
                                                                - maxLength: 65535
                                                                  type: string
                                                                - type: number
                                                                - type: boolean
                                                        startsWith:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                      required:
                                                        - field
                                                    - additionalProperties: false
                                                      type: object
                                                      properties:
                                                        exists:
                                                          type: boolean
                                                        field:
                                                          maxLength: 256
                                                          minLength: 1
                                                          type: string
                                                      required:
                                                        - field
                                                - additionalProperties: false
                                                  type: object
                                                  properties:
                                                    and:
                                                      items:
                                                        anyOf:
                                                          - anyOf:
                                                              - additionalProperties: false
                                                                type: object
                                                                properties:
                                                                  contains:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  endsWith:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  eq:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  field:
                                                                    maxLength: 256
                                                                    minLength: 1
                                                                    type: string
                                                                  gt:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  gte:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  includes:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  lt:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  lte:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  neq:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  range:
                                                                    additionalProperties: false
                                                                    type: object
                                                                    properties:
                                                                      gt:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      gte:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      lt:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      lte:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                  startsWith:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                required:
                                                                  - field
                                                              - additionalProperties: false
                                                                type: object
                                                                properties:
                                                                  exists:
                                                                    type: boolean
                                                                  field:
                                                                    maxLength: 256
                                                                    minLength: 1
                                                                    type: string
                                                                required:
                                                                  - field
                                                          - additionalProperties: false
                                                            type: object
                                                            properties:
                                                              and:
                                                                items:
                                                                  anyOf:
                                                                    - anyOf:
                                                                        - additionalProperties: false
                                                                          type: object
                                                                          properties:
                                                                            contains:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            endsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            eq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            includes:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            neq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            range:
                                                                              additionalProperties: false
                                                                              type: object
                                                                              properties:
                                                                                gt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                gte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                            startsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          required:
                                                                            - field
                                                                        - additionalProperties: false
                                                                          type: object
                                                                          properties:
                                                                            exists:
                                                                              type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                          required:
                                                                            - field
                                                                    - additionalProperties: false
                                                                      type: object
                                                                      properties:
                                                                        always:
                                                                          additionalProperties: false
                                                                          type: object
                                                                          properties: {}
                                                                      required:
                                                                        - always
                                                                    - additionalProperties: false
                                                                      type: object
                                                                      properties:
                                                                        never:
                                                                          additionalProperties: false
                                                                          type: object
                                                                          properties: {}
                                                                      required:
                                                                        - never
                                                                maxItems: 50
                                                                type: array
                                                            required:
                                                              - and
                                                          - additionalProperties: false
                                                            type: object
                                                            properties:
                                                              or:
                                                                items:
                                                                  anyOf:
                                                                    - anyOf:
                                                                        - additionalProperties: false
                                                                          type: object
                                                                          properties:
                                                                            contains:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            endsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            eq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            includes:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            neq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            range:
                                                                              additionalProperties: false
                                                                              type: object
                                                                              properties:
                                                                                gt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                gte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                            startsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          required:
                                                                            - field
                                                                        - additionalProperties: false
                                                                          type: object
                                                                          properties:
                                                                            exists:
                                                                              type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                          required:
                                                                            - field
                                                                    - additionalProperties: false
                                                                      type: object
                                                                      properties:
                                                                        always:
                                                                          additionalProperties: false
                                                                          type: object
                                                                          properties: {}
                                                                      required:
                                                                        - always
                                                                    - additionalProperties: false
                                                                      type: object
                                                                      properties:
                                                                        never:
                                                                          additionalProperties: false
                                                                          type: object
                                                                          properties: {}
                                                                      required:
                                                                        - never
                                                                maxItems: 50
                                                                type: array
                                                            required:
                                                              - or
                                                          - additionalProperties: false
                                                            type: object
                                                            properties:
                                                              not:
                                                                anyOf:
                                                                  - anyOf:
                                                                      - additionalProperties: false
                                                                        type: object
                                                                        properties:
                                                                          contains:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          endsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          eq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                          gt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          gte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          includes:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          neq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          range:
                                                                            additionalProperties: false
                                                                            type: object
                                                                            properties:
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                          startsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                        required:
                                                                          - field
                                                                      - additionalProperties: false
                                                                        type: object
                                                                        properties:
                                                                          exists:
                                                                            type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                        required:
                                                                          - field
                                                                  - additionalProperties: false
                                                                    type: object
                                                                    properties:
                                                                      always:
                                                                        additionalProperties: false
                                                                        type: object
                                                                        properties: {}
                                                                    required:
                                                                      - always
                                                                  - additionalProperties: false
                                                                    type: object
                                                                    properties:
                                                                      never:
                                                                        additionalProperties: false
                                                                        type: object
                                                                        properties: {}
                                                                    required:
                                                                      - never
                                                            required:
                                                              - not
                                                          - additionalProperties: false
                                                            type: object
                                                            properties:
                                                              always:
                                                                additionalProperties: false
                                                                type: object
                                                                properties: {}
                                                            required:
                                                              - always
                                                          - additionalProperties: false
                                                            type: object
                                                            properties:
                                                              never:
                                                                additionalProperties: false
                                                                type: object
                                                                properties: {}
                                                            required:
                                                              - never
                                                      maxItems: 50
                                                      type: array
                                                  required:
                                                    - and
                                                - additionalProperties: false
                                                  type: object
                                                  properties:
                                                    or:
                                                      items:
                                                        anyOf:
                                                          - anyOf:
                                                              - additionalProperties: false
                                                                type: object
                                                                properties:
                                                                  contains:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  endsWith:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  eq:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  field:
                                                                    maxLength: 256
                                                                    minLength: 1
                                                                    type: string
                                                                  gt:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  gte:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  includes:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  lt:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  lte:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  neq:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  range:
                                                                    additionalProperties: false
                                                                    type: object
                                                                    properties:
                                                                      gt:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      gte:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      lt:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      lte:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                  startsWith:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                required:
                                                                  - field
                                                              - additionalProperties: false
                                                                type: object
                                                                properties:
                                                                  exists:
                                                                    type: boolean
                                                                  field:
                                                                    maxLength: 256
                                                                    minLength: 1
                                                                    type: string
                                                                required:
                                                                  - field
                                                          - additionalProperties: false
                                                            type: object
                                                            properties:
                                                              and:
                                                                items:
                                                                  anyOf:
                                                                    - anyOf:
                                                                        - additionalProperties: false
                                                                          type: object
                                                                          properties:
                                                                            contains:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            endsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            eq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            includes:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            neq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            range:
                                                                              additionalProperties: false
                                                                              type: object
                                                                              properties:
                                                                                gt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                gte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                            startsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          required:
                                                                            - field
                                                                        - additionalProperties: false
                                                                          type: object
                                                                          properties:
                                                                            exists:
                                                                              type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                          required:
                                                                            - field
                                                                    - additionalProperties: false
                                                                      type: object
                                                                      properties:
                                                                        always:
                                                                          additionalProperties: false
                                                                          type: object
                                                                          properties: {}
                                                                      required:
                                                                        - always
                                                                    - additionalProperties: false
                                                                      type: object
                                                                      properties:
                                                                        never:
                                                                          additionalProperties: false
                                                                          type: object
                                                                          properties: {}
                                                                      required:
                                                                        - never
                                                                maxItems: 50
                                                                type: array
                                                            required:
                                                              - and
                                                          - additionalProperties: false
                                                            type: object
                                                            properties:
                                                              or:
                                                                items:
                                                                  anyOf:
                                                                    - anyOf:
                                                                        - additionalProperties: false
                                                                          type: object
                                                                          properties:
                                                                            contains:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            endsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            eq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            includes:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            neq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            range:
                                                                              additionalProperties: false
                                                                              type: object
                                                                              properties:
                                                                                gt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                gte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                            startsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          required:
                                                                            - field
                                                                        - additionalProperties: false
                                                                          type: object
                                                                          properties:
                                                                            exists:
                                                                              type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                          required:
                                                                            - field
                                                                    - additionalProperties: false
                                                                      type: object
                                                                      properties:
                                                                        always:
                                                                          additionalProperties: false
                                                                          type: object
                                                                          properties: {}
                                                                      required:
                                                                        - always
                                                                    - additionalProperties: false
                                                                      type: object
                                                                      properties:
                                                                        never:
                                                                          additionalProperties: false
                                                                          type: object
                                                                          properties: {}
                                                                      required:
                                                                        - never
                                                                maxItems: 50
                                                                type: array
                                                            required:
                                                              - or
                                                          - additionalProperties: false
                                                            type: object
                                                            properties:
                                                              not:
                                                                anyOf:
                                                                  - anyOf:
                                                                      - additionalProperties: false
                                                                        type: object
                                                                        properties:
                                                                          contains:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          endsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          eq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                          gt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          gte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          includes:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          neq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          range:
                                                                            additionalProperties: false
                                                                            type: object
                                                                            properties:
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                          startsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                        required:
                                                                          - field
                                                                      - additionalProperties: false
                                                                        type: object
                                                                        properties:
                                                                          exists:
                                                                            type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                        required:
                                                                          - field
                                                                  - additionalProperties: false
                                                                    type: object
                                                                    properties:
                                                                      always:
                                                                        additionalProperties: false
                                                                        type: object
                                                                        properties: {}
                                                                    required:
                                                                      - always
                                                                  - additionalProperties: false
                                                                    type: object
                                                                    properties:
                                                                      never:
                                                                        additionalProperties: false
                                                                        type: object
                                                                        properties: {}
                                                                    required:
                                                                      - never
                                                            required:
                                                              - not
                                                          - additionalProperties: false
                                                            type: object
                                                            properties:
                                                              always:
                                                                additionalProperties: false
                                                                type: object
                                                                properties: {}
                                                            required:
                                                              - always
                                                          - additionalProperties: false
                                                            type: object
                                                            properties:
                                                              never:
                                                                additionalProperties: false
                                                                type: object
                                                                properties: {}
                                                            required:
                                                              - never
                                                      maxItems: 50
                                                      type: array
                                                  required:
                                                    - or
                                                - additionalProperties: false
                                                  type: object
                                                  properties:
                                                    not:
                                                      anyOf:
                                                        - anyOf:
                                                            - additionalProperties: false
                                                              type: object
                                                              properties:
                                                                contains:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                endsWith:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                eq:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                field:
                                                                  maxLength: 256
                                                                  minLength: 1
                                                                  type: string
                                                                gt:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                gte:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                includes:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                lt:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                lte:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                neq:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                range:
                                                                  additionalProperties: false
                                                                  type: object
                                                                  properties:
                                                                    gt:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    gte:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    lt:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    lte:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                startsWith:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                              required:
                                                                - field
                                                            - additionalProperties: false
                                                              type: object
                                                              properties:
                                                                exists:
                                                                  type: boolean
                                                                field:
                                                                  maxLength: 256
                                                                  minLength: 1
                                                                  type: string
                                                              required:
                                                                - field
                                                        - additionalProperties: false
                                                          type: object
                                                          properties:
                                                            and:
                                                              items:
                                                                anyOf:
                                                                  - anyOf:
                                                                      - additionalProperties: false
                                                                        type: object
                                                                        properties:
                                                                          contains:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          endsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          eq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                          gt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          gte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          includes:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          neq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          range:
                                                                            additionalProperties: false
                                                                            type: object
                                                                            properties:
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                          startsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                        required:
                                                                          - field
                                                                      - additionalProperties: false
                                                                        type: object
                                                                        properties:
                                                                          exists:
                                                                            type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                        required:
                                                                          - field
                                                                  - additionalProperties: false
                                                                    type: object
                                                                    properties:
                                                                      always:
                                                                        additionalProperties: false
                                                                        type: object
                                                                        properties: {}
                                                                    required:
                                                                      - always
                                                                  - additionalProperties: false
                                                                    type: object
                                                                    properties:
                                                                      never:
                                                                        additionalProperties: false
                                                                        type: object
                                                                        properties: {}
                                                                    required:
                                                                      - never
                                                              maxItems: 50
                                                              type: array
                                                          required:
                                                            - and
                                                        - additionalProperties: false
                                                          type: object
                                                          properties:
                                                            or:
                                                              items:
                                                                anyOf:
                                                                  - anyOf:
                                                                      - additionalProperties: false
                                                                        type: object
                                                                        properties:
                                                                          contains:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          endsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          eq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                          gt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          gte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          includes:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          neq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          range:
                                                                            additionalProperties: false
                                                                            type: object
                                                                            properties:
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                          startsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                        required:
                                                                          - field
                                                                      - additionalProperties: false
                                                                        type: object
                                                                        properties:
                                                                          exists:
                                                                            type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                        required:
                                                                          - field
                                                                  - additionalProperties: false
                                                                    type: object
                                                                    properties:
                                                                      always:
                                                                        additionalProperties: false
                                                                        type: object
                                                                        properties: {}
                                                                    required:
                                                                      - always
                                                                  - additionalProperties: false
                                                                    type: object
                                                                    properties:
                                                                      never:
                                                                        additionalProperties: false
                                                                        type: object
                                                                        properties: {}
                                                                    required:
                                                                      - never
                                                              maxItems: 50
                                                              type: array
                                                          required:
                                                            - or
                                                        - additionalProperties: false
                                                          type: object
                                                          properties:
                                                            not:
                                                              anyOf:
                                                                - anyOf:
                                                                    - additionalProperties: false
                                                                      type: object
                                                                      properties:
                                                                        contains:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        endsWith:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        eq:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        field:
                                                                          maxLength: 256
                                                                          minLength: 1
                                                                          type: string
                                                                        gt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        gte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        includes:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        neq:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        range:
                                                                          additionalProperties: false
                                                                          type: object
                                                                          properties:
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                        startsWith:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                      required:
                                                                        - field
                                                                    - additionalProperties: false
                                                                      type: object
                                                                      properties:
                                                                        exists:
                                                                          type: boolean
                                                                        field:
                                                                          maxLength: 256
                                                                          minLength: 1
                                                                          type: string
                                                                      required:
                                                                        - field
                                                                - additionalProperties: false
                                                                  type: object
                                                                  properties:
                                                                    always:
                                                                      additionalProperties: false
                                                                      type: object
                                                                      properties: {}
                                                                  required:
                                                                    - always
                                                                - additionalProperties: false
                                                                  type: object
                                                                  properties:
                                                                    never:
                                                                      additionalProperties: false
                                                                      type: object
                                                                      properties: {}
                                                                  required:
                                                                    - never
                                                          required:
                                                            - not
                                                        - additionalProperties: false
                                                          type: object
                                                          properties:
                                                            always:
                                                              additionalProperties: false
                                                              type: object
                                                              properties: {}
                                                          required:
                                                            - always
                                                        - additionalProperties: false
                                                          type: object
                                                          properties:
                                                            never:
                                                              additionalProperties: false
                                                              type: object
                                                              properties: {}
                                                          required:
                                                            - never
                                                  required:
                                                    - not
                                                - additionalProperties: false
                                                  type: object
                                                  properties:
                                                    always:
                                                      additionalProperties: false
                                                      type: object
                                                      properties: {}
                                                  required:
                                                    - always
                                                - additionalProperties: false
                                                  type: object
                                                  properties:
                                                    never:
                                                      additionalProperties: false
                                                      type: object
                                                      properties: {}
                                                  required:
                                                    - never
                                            maxItems: 50
                                            type: array
                                        required:
                                          - and
                                      - additionalProperties: false
                                        type: object
                                        properties:
                                          or:
                                            items:
                                              anyOf:
                                                - anyOf:
                                                    - additionalProperties: false
                                                      type: object
                                                      properties:
                                                        contains:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        endsWith:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        eq:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        field:
                                                          maxLength: 256
                                                          minLength: 1
                                                          type: string
                                                        gt:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        gte:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        includes:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        lt:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        lte:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        neq:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        range:
                                                          additionalProperties: false
                                                          type: object
                                                          properties:
                                                            gt:
                                                              anyOf:
                                                                - maxLength: 65535
                                                                  type: string
                                                                - type: number
                                                                - type: boolean
                                                            gte:
                                                              anyOf:
                                                                - maxLength: 65535
                                                                  type: string
                                                                - type: number
                                                                - type: boolean
                                                            lt:
                                                              anyOf:
                                                                - maxLength: 65535
                                                                  type: string
                                                                - type: number
                                                                - type: boolean
                                                            lte:
                                                              anyOf:
                                                                - maxLength: 65535
                                                                  type: string
                                                                - type: number
                                                                - type: boolean
                                                        startsWith:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                      required:
                                                        - field
                                                    - additionalProperties: false
                                                      type: object
                                                      properties:
                                                        exists:
                                                          type: boolean
                                                        field:
                                                          maxLength: 256
                                                          minLength: 1
                                                          type: string
                                                      required:
                                                        - field
                                                - additionalProperties: false
                                                  type: object
                                                  properties:
                                                    and:
                                                      items:
                                                        anyOf:
                                                          - anyOf:
                                                              - additionalProperties: false
                                                                type: object
                                                                properties:
                                                                  contains:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  endsWith:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  eq:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  field:
                                                                    maxLength: 256
                                                                    minLength: 1
                                                                    type: string
                                                                  gt:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  gte:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  includes:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  lt:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  lte:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  neq:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  range:
                                                                    additionalProperties: false
                                                                    type: object
                                                                    properties:
                                                                      gt:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      gte:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      lt:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      lte:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                  startsWith:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                required:
                                                                  - field
                                                              - additionalProperties: false
                                                                type: object
                                                                properties:
                                                                  exists:
                                                                    type: boolean
                                                                  field:
                                                                    maxLength: 256
                                                                    minLength: 1
                                                                    type: string
                                                                required:
                                                                  - field
                                                          - additionalProperties: false
                                                            type: object
                                                            properties:
                                                              and:
                                                                items:
                                                                  anyOf:
                                                                    - anyOf:
                                                                        - additionalProperties: false
                                                                          type: object
                                                                          properties:
                                                                            contains:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            endsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            eq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            includes:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            neq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            range:
                                                                              additionalProperties: false
                                                                              type: object
                                                                              properties:
                                                                                gt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                gte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                            startsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          required:
                                                                            - field
                                                                        - additionalProperties: false
                                                                          type: object
                                                                          properties:
                                                                            exists:
                                                                              type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                          required:
                                                                            - field
                                                                    - additionalProperties: false
                                                                      type: object
                                                                      properties:
                                                                        always:
                                                                          additionalProperties: false
                                                                          type: object
                                                                          properties: {}
                                                                      required:
                                                                        - always
                                                                    - additionalProperties: false
                                                                      type: object
                                                                      properties:
                                                                        never:
                                                                          additionalProperties: false
                                                                          type: object
                                                                          properties: {}
                                                                      required:
                                                                        - never
                                                                maxItems: 50
                                                                type: array
                                                            required:
                                                              - and
                                                          - additionalProperties: false
                                                            type: object
                                                            properties:
                                                              or:
                                                                items:
                                                                  anyOf:
                                                                    - anyOf:
                                                                        - additionalProperties: false
                                                                          type: object
                                                                          properties:
                                                                            contains:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            endsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            eq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            includes:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            neq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            range:
                                                                              additionalProperties: false
                                                                              type: object
                                                                              properties:
                                                                                gt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                gte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                            startsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          required:
                                                                            - field
                                                                        - additionalProperties: false
                                                                          type: object
                                                                          properties:
                                                                            exists:
                                                                              type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                          required:
                                                                            - field
                                                                    - additionalProperties: false
                                                                      type: object
                                                                      properties:
                                                                        always:
                                                                          additionalProperties: false
                                                                          type: object
                                                                          properties: {}
                                                                      required:
                                                                        - always
                                                                    - additionalProperties: false
                                                                      type: object
                                                                      properties:
                                                                        never:
                                                                          additionalProperties: false
                                                                          type: object
                                                                          properties: {}
                                                                      required:
                                                                        - never
                                                                maxItems: 50
                                                                type: array
                                                            required:
                                                              - or
                                                          - additionalProperties: false
                                                            type: object
                                                            properties:
                                                              not:
                                                                anyOf:
                                                                  - anyOf:
                                                                      - additionalProperties: false
                                                                        type: object
                                                                        properties:
                                                                          contains:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          endsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          eq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                          gt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          gte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          includes:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          neq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          range:
                                                                            additionalProperties: false
                                                                            type: object
                                                                            properties:
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                          startsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                        required:
                                                                          - field
                                                                      - additionalProperties: false
                                                                        type: object
                                                                        properties:
                                                                          exists:
                                                                            type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                        required:
                                                                          - field
                                                                  - additionalProperties: false
                                                                    type: object
                                                                    properties:
                                                                      always:
                                                                        additionalProperties: false
                                                                        type: object
                                                                        properties: {}
                                                                    required:
                                                                      - always
                                                                  - additionalProperties: false
                                                                    type: object
                                                                    properties:
                                                                      never:
                                                                        additionalProperties: false
                                                                        type: object
                                                                        properties: {}
                                                                    required:
                                                                      - never
                                                            required:
                                                              - not
                                                          - additionalProperties: false
                                                            type: object
                                                            properties:
                                                              always:
                                                                additionalProperties: false
                                                                type: object
                                                                properties: {}
                                                            required:
                                                              - always
                                                          - additionalProperties: false
                                                            type: object
                                                            properties:
                                                              never:
                                                                additionalProperties: false
                                                                type: object
                                                                properties: {}
                                                            required:
                                                              - never
                                                      maxItems: 50
                                                      type: array
                                                  required:
                                                    - and
                                                - additionalProperties: false
                                                  type: object
                                                  properties:
                                                    or:
                                                      items:
                                                        anyOf:
                                                          - anyOf:
                                                              - additionalProperties: false
                                                                type: object
                                                                properties:
                                                                  contains:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  endsWith:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  eq:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  field:
                                                                    maxLength: 256
                                                                    minLength: 1
                                                                    type: string
                                                                  gt:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  gte:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  includes:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  lt:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  lte:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  neq:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  range:
                                                                    additionalProperties: false
                                                                    type: object
                                                                    properties:
                                                                      gt:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      gte:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      lt:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      lte:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                  startsWith:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                required:
                                                                  - field
                                                              - additionalProperties: false
                                                                type: object
                                                                properties:
                                                                  exists:
                                                                    type: boolean
                                                                  field:
                                                                    maxLength: 256
                                                                    minLength: 1
                                                                    type: string
                                                                required:
                                                                  - field
                                                          - additionalProperties: false
                                                            type: object
                                                            properties:
                                                              and:
                                                                items:
                                                                  anyOf:
                                                                    - anyOf:
                                                                        - additionalProperties: false
                                                                          type: object
                                                                          properties:
                                                                            contains:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            endsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            eq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            includes:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            neq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            range:
                                                                              additionalProperties: false
                                                                              type: object
                                                                              properties:
                                                                                gt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                gte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                            startsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          required:
                                                                            - field
                                                                        - additionalProperties: false
                                                                          type: object
                                                                          properties:
                                                                            exists:
                                                                              type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                          required:
                                                                            - field
                                                                    - additionalProperties: false
                                                                      type: object
                                                                      properties:
                                                                        always:
                                                                          additionalProperties: false
                                                                          type: object
                                                                          properties: {}
                                                                      required:
                                                                        - always
                                                                    - additionalProperties: false
                                                                      type: object
                                                                      properties:
                                                                        never:
                                                                          additionalProperties: false
                                                                          type: object
                                                                          properties: {}
                                                                      required:
                                                                        - never
                                                                maxItems: 50
                                                                type: array
                                                            required:
                                                              - and
                                                          - additionalProperties: false
                                                            type: object
                                                            properties:
                                                              or:
                                                                items:
                                                                  anyOf:
                                                                    - anyOf:
                                                                        - additionalProperties: false
                                                                          type: object
                                                                          properties:
                                                                            contains:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            endsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            eq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            includes:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            neq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            range:
                                                                              additionalProperties: false
                                                                              type: object
                                                                              properties:
                                                                                gt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                gte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                            startsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          required:
                                                                            - field
                                                                        - additionalProperties: false
                                                                          type: object
                                                                          properties:
                                                                            exists:
                                                                              type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                          required:
                                                                            - field
                                                                    - additionalProperties: false
                                                                      type: object
                                                                      properties:
                                                                        always:
                                                                          additionalProperties: false
                                                                          type: object
                                                                          properties: {}
                                                                      required:
                                                                        - always
                                                                    - additionalProperties: false
                                                                      type: object
                                                                      properties:
                                                                        never:
                                                                          additionalProperties: false
                                                                          type: object
                                                                          properties: {}
                                                                      required:
                                                                        - never
                                                                maxItems: 50
                                                                type: array
                                                            required:
                                                              - or
                                                          - additionalProperties: false
                                                            type: object
                                                            properties:
                                                              not:
                                                                anyOf:
                                                                  - anyOf:
                                                                      - additionalProperties: false
                                                                        type: object
                                                                        properties:
                                                                          contains:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          endsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          eq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                          gt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          gte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          includes:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          neq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          range:
                                                                            additionalProperties: false
                                                                            type: object
                                                                            properties:
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                          startsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                        required:
                                                                          - field
                                                                      - additionalProperties: false
                                                                        type: object
                                                                        properties:
                                                                          exists:
                                                                            type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                        required:
                                                                          - field
                                                                  - additionalProperties: false
                                                                    type: object
                                                                    properties:
                                                                      always:
                                                                        additionalProperties: false
                                                                        type: object
                                                                        properties: {}
                                                                    required:
                                                                      - always
                                                                  - additionalProperties: false
                                                                    type: object
                                                                    properties:
                                                                      never:
                                                                        additionalProperties: false
                                                                        type: object
                                                                        properties: {}
                                                                    required:
                                                                      - never
                                                            required:
                                                              - not
                                                          - additionalProperties: false
                                                            type: object
                                                            properties:
                                                              always:
                                                                additionalProperties: false
                                                                type: object
                                                                properties: {}
                                                            required:
                                                              - always
                                                          - additionalProperties: false
                                                            type: object
                                                            properties:
                                                              never:
                                                                additionalProperties: false
                                                                type: object
                                                                properties: {}
                                                            required:
                                                              - never
                                                      maxItems: 50
                                                      type: array
                                                  required:
                                                    - or
                                                - additionalProperties: false
                                                  type: object
                                                  properties:
                                                    not:
                                                      anyOf:
                                                        - anyOf:
                                                            - additionalProperties: false
                                                              type: object
                                                              properties:
                                                                contains:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                endsWith:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                eq:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                field:
                                                                  maxLength: 256
                                                                  minLength: 1
                                                                  type: string
                                                                gt:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                gte:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                includes:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                lt:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                lte:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                neq:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                range:
                                                                  additionalProperties: false
                                                                  type: object
                                                                  properties:
                                                                    gt:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    gte:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    lt:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    lte:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                startsWith:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                              required:
                                                                - field
                                                            - additionalProperties: false
                                                              type: object
                                                              properties:
                                                                exists:
                                                                  type: boolean
                                                                field:
                                                                  maxLength: 256
                                                                  minLength: 1
                                                                  type: string
                                                              required:
                                                                - field
                                                        - additionalProperties: false
                                                          type: object
                                                          properties:
                                                            and:
                                                              items:
                                                                anyOf:
                                                                  - anyOf:
                                                                      - additionalProperties: false
                                                                        type: object
                                                                        properties:
                                                                          contains:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          endsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          eq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                          gt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          gte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          includes:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          neq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          range:
                                                                            additionalProperties: false
                                                                            type: object
                                                                            properties:
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                          startsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                        required:
                                                                          - field
                                                                      - additionalProperties: false
                                                                        type: object
                                                                        properties:
                                                                          exists:
                                                                            type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                        required:
                                                                          - field
                                                                  - additionalProperties: false
                                                                    type: object
                                                                    properties:
                                                                      always:
                                                                        additionalProperties: false
                                                                        type: object
                                                                        properties: {}
                                                                    required:
                                                                      - always
                                                                  - additionalProperties: false
                                                                    type: object
                                                                    properties:
                                                                      never:
                                                                        additionalProperties: false
                                                                        type: object
                                                                        properties: {}
                                                                    required:
                                                                      - never
                                                              maxItems: 50
                                                              type: array
                                                          required:
                                                            - and
                                                        - additionalProperties: false
                                                          type: object
                                                          properties:
                                                            or:
                                                              items:
                                                                anyOf:
                                                                  - anyOf:
                                                                      - additionalProperties: false
                                                                        type: object
                                                                        properties:
                                                                          contains:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          endsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          eq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                          gt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          gte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          includes:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          neq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          range:
                                                                            additionalProperties: false
                                                                            type: object
                                                                            properties:
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                          startsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                        required:
                                                                          - field
                                                                      - additionalProperties: false
                                                                        type: object
                                                                        properties:
                                                                          exists:
                                                                            type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                        required:
                                                                          - field
                                                                  - additionalProperties: false
                                                                    type: object
                                                                    properties:
                                                                      always:
                                                                        additionalProperties: false
                                                                        type: object
                                                                        properties: {}
                                                                    required:
                                                                      - always
                                                                  - additionalProperties: false
                                                                    type: object
                                                                    properties:
                                                                      never:
                                                                        additionalProperties: false
                                                                        type: object
                                                                        properties: {}
                                                                    required:
                                                                      - never
                                                              maxItems: 50
                                                              type: array
                                                          required:
                                                            - or
                                                        - additionalProperties: false
                                                          type: object
                                                          properties:
                                                            not:
                                                              anyOf:
                                                                - anyOf:
                                                                    - additionalProperties: false
                                                                      type: object
                                                                      properties:
                                                                        contains:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        endsWith:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        eq:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        field:
                                                                          maxLength: 256
                                                                          minLength: 1
                                                                          type: string
                                                                        gt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        gte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        includes:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        neq:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        range:
                                                                          additionalProperties: false
                                                                          type: object
                                                                          properties:
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                        startsWith:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                      required:
                                                                        - field
                                                                    - additionalProperties: false
                                                                      type: object
                                                                      properties:
                                                                        exists:
                                                                          type: boolean
                                                                        field:
                                                                          maxLength: 256
                                                                          minLength: 1
                                                                          type: string
                                                                      required:
                                                                        - field
                                                                - additionalProperties: false
                                                                  type: object
                                                                  properties:
                                                                    always:
                                                                      additionalProperties: false
                                                                      type: object
                                                                      properties: {}
                                                                  required:
                                                                    - always
                                                                - additionalProperties: false
                                                                  type: object
                                                                  properties:
                                                                    never:
                                                                      additionalProperties: false
                                                                      type: object
                                                                      properties: {}
                                                                  required:
                                                                    - never
                                                          required:
                                                            - not
                                                        - additionalProperties: false
                                                          type: object
                                                          properties:
                                                            always:
                                                              additionalProperties: false
                                                              type: object
                                                              properties: {}
                                                          required:
                                                            - always
                                                        - additionalProperties: false
                                                          type: object
                                                          properties:
                                                            never:
                                                              additionalProperties: false
                                                              type: object
                                                              properties: {}
                                                          required:
                                                            - never
                                                  required:
                                                    - not
                                                - additionalProperties: false
                                                  type: object
                                                  properties:
                                                    always:
                                                      additionalProperties: false
                                                      type: object
                                                      properties: {}
                                                  required:
                                                    - always
                                                - additionalProperties: false
                                                  type: object
                                                  properties:
                                                    never:
                                                      additionalProperties: false
                                                      type: object
                                                      properties: {}
                                                  required:
                                                    - never
                                            maxItems: 50
                                            type: array
                                        required:
                                          - or
                                      - additionalProperties: false
                                        type: object
                                        properties:
                                          not:
                                            anyOf:
                                              - anyOf:
                                                  - additionalProperties: false
                                                    type: object
                                                    properties:
                                                      contains:
                                                        anyOf:
                                                          - maxLength: 65535
                                                            type: string
                                                          - type: number
                                                          - type: boolean
                                                      endsWith:
                                                        anyOf:
                                                          - maxLength: 65535
                                                            type: string
                                                          - type: number
                                                          - type: boolean
                                                      eq:
                                                        anyOf:
                                                          - maxLength: 65535
                                                            type: string
                                                          - type: number
                                                          - type: boolean
                                                      field:
                                                        maxLength: 256
                                                        minLength: 1
                                                        type: string
                                                      gt:
                                                        anyOf:
                                                          - maxLength: 65535
                                                            type: string
                                                          - type: number
                                                          - type: boolean
                                                      gte:
                                                        anyOf:
                                                          - maxLength: 65535
                                                            type: string
                                                          - type: number
                                                          - type: boolean
                                                      includes:
                                                        anyOf:
                                                          - maxLength: 65535
                                                            type: string
                                                          - type: number
                                                          - type: boolean
                                                      lt:
                                                        anyOf:
                                                          - maxLength: 65535
                                                            type: string
                                                          - type: number
                                                          - type: boolean
                                                      lte:
                                                        anyOf:
                                                          - maxLength: 65535
                                                            type: string
                                                          - type: number
                                                          - type: boolean
                                                      neq:
                                                        anyOf:
                                                          - maxLength: 65535
                                                            type: string
                                                          - type: number
                                                          - type: boolean
                                                      range:
                                                        additionalProperties: false
                                                        type: object
                                                        properties:
                                                          gt:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          gte:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          lt:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          lte:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                      startsWith:
                                                        anyOf:
                                                          - maxLength: 65535
                                                            type: string
                                                          - type: number
                                                          - type: boolean
                                                    required:
                                                      - field
                                                  - additionalProperties: false
                                                    type: object
                                                    properties:
                                                      exists:
                                                        type: boolean
                                                      field:
                                                        maxLength: 256
                                                        minLength: 1
                                                        type: string
                                                    required:
                                                      - field
                                              - additionalProperties: false
                                                type: object
                                                properties:
                                                  and:
                                                    items:
                                                      anyOf:
                                                        - anyOf:
                                                            - additionalProperties: false
                                                              type: object
                                                              properties:
                                                                contains:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                endsWith:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                eq:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                field:
                                                                  maxLength: 256
                                                                  minLength: 1
                                                                  type: string
                                                                gt:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                gte:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                includes:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                lt:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                lte:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                neq:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                range:
                                                                  additionalProperties: false
                                                                  type: object
                                                                  properties:
                                                                    gt:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    gte:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    lt:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    lte:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                startsWith:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                              required:
                                                                - field
                                                            - additionalProperties: false
                                                              type: object
                                                              properties:
                                                                exists:
                                                                  type: boolean
                                                                field:
                                                                  maxLength: 256
                                                                  minLength: 1
                                                                  type: string
                                                              required:
                                                                - field
                                                        - additionalProperties: false
                                                          type: object
                                                          properties:
                                                            and:
                                                              items:
                                                                anyOf:
                                                                  - anyOf:
                                                                      - additionalProperties: false
                                                                        type: object
                                                                        properties:
                                                                          contains:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          endsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          eq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                          gt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          gte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          includes:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          neq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          range:
                                                                            additionalProperties: false
                                                                            type: object
                                                                            properties:
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                          startsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                        required:
                                                                          - field
                                                                      - additionalProperties: false
                                                                        type: object
                                                                        properties:
                                                                          exists:
                                                                            type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                        required:
                                                                          - field
                                                                  - additionalProperties: false
                                                                    type: object
                                                                    properties:
                                                                      always:
                                                                        additionalProperties: false
                                                                        type: object
                                                                        properties: {}
                                                                    required:
                                                                      - always
                                                                  - additionalProperties: false
                                                                    type: object
                                                                    properties:
                                                                      never:
                                                                        additionalProperties: false
                                                                        type: object
                                                                        properties: {}
                                                                    required:
                                                                      - never
                                                              maxItems: 50
                                                              type: array
                                                          required:
                                                            - and
                                                        - additionalProperties: false
                                                          type: object
                                                          properties:
                                                            or:
                                                              items:
                                                                anyOf:
                                                                  - anyOf:
                                                                      - additionalProperties: false
                                                                        type: object
                                                                        properties:
                                                                          contains:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          endsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          eq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                          gt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          gte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          includes:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          neq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          range:
                                                                            additionalProperties: false
                                                                            type: object
                                                                            properties:
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                          startsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                        required:
                                                                          - field
                                                                      - additionalProperties: false
                                                                        type: object
                                                                        properties:
                                                                          exists:
                                                                            type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                        required:
                                                                          - field
                                                                  - additionalProperties: false
                                                                    type: object
                                                                    properties:
                                                                      always:
                                                                        additionalProperties: false
                                                                        type: object
                                                                        properties: {}
                                                                    required:
                                                                      - always
                                                                  - additionalProperties: false
                                                                    type: object
                                                                    properties:
                                                                      never:
                                                                        additionalProperties: false
                                                                        type: object
                                                                        properties: {}
                                                                    required:
                                                                      - never
                                                              maxItems: 50
                                                              type: array
                                                          required:
                                                            - or
                                                        - additionalProperties: false
                                                          type: object
                                                          properties:
                                                            not:
                                                              anyOf:
                                                                - anyOf:
                                                                    - additionalProperties: false
                                                                      type: object
                                                                      properties:
                                                                        contains:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        endsWith:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        eq:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        field:
                                                                          maxLength: 256
                                                                          minLength: 1
                                                                          type: string
                                                                        gt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        gte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        includes:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        neq:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        range:
                                                                          additionalProperties: false
                                                                          type: object
                                                                          properties:
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                        startsWith:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                      required:
                                                                        - field
                                                                    - additionalProperties: false
                                                                      type: object
                                                                      properties:
                                                                        exists:
                                                                          type: boolean
                                                                        field:
                                                                          maxLength: 256
                                                                          minLength: 1
                                                                          type: string
                                                                      required:
                                                                        - field
                                                                - additionalProperties: false
                                                                  type: object
                                                                  properties:
                                                                    always:
                                                                      additionalProperties: false
                                                                      type: object
                                                                      properties: {}
                                                                  required:
                                                                    - always
                                                                - additionalProperties: false
                                                                  type: object
                                                                  properties:
                                                                    never:
                                                                      additionalProperties: false
                                                                      type: object
                                                                      properties: {}
                                                                  required:
                                                                    - never
                                                          required:
                                                            - not
                                                        - additionalProperties: false
                                                          type: object
                                                          properties:
                                                            always:
                                                              additionalProperties: false
                                                              type: object
                                                              properties: {}
                                                          required:
                                                            - always
                                                        - additionalProperties: false
                                                          type: object
                                                          properties:
                                                            never:
                                                              additionalProperties: false
                                                              type: object
                                                              properties: {}
                                                          required:
                                                            - never
                                                    maxItems: 50
                                                    type: array
                                                required:
                                                  - and
                                              - additionalProperties: false
                                                type: object
                                                properties:
                                                  or:
                                                    items:
                                                      anyOf:
                                                        - anyOf:
                                                            - additionalProperties: false
                                                              type: object
                                                              properties:
                                                                contains:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                endsWith:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                eq:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                field:
                                                                  maxLength: 256
                                                                  minLength: 1
                                                                  type: string
                                                                gt:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                gte:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                includes:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                lt:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                lte:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                neq:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                range:
                                                                  additionalProperties: false
                                                                  type: object
                                                                  properties:
                                                                    gt:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    gte:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    lt:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    lte:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                startsWith:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                              required:
                                                                - field
                                                            - additionalProperties: false
                                                              type: object
                                                              properties:
                                                                exists:
                                                                  type: boolean
                                                                field:
                                                                  maxLength: 256
                                                                  minLength: 1
                                                                  type: string
                                                              required:
                                                                - field
                                                        - additionalProperties: false
                                                          type: object
                                                          properties:
                                                            and:
                                                              items:
                                                                anyOf:
                                                                  - anyOf:
                                                                      - additionalProperties: false
                                                                        type: object
                                                                        properties:
                                                                          contains:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          endsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          eq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                          gt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          gte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          includes:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          neq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          range:
                                                                            additionalProperties: false
                                                                            type: object
                                                                            properties:
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                          startsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                        required:
                                                                          - field
                                                                      - additionalProperties: false
                                                                        type: object
                                                                        properties:
                                                                          exists:
                                                                            type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                        required:
                                                                          - field
                                                                  - additionalProperties: false
                                                                    type: object
                                                                    properties:
                                                                      always:
                                                                        additionalProperties: false
                                                                        type: object
                                                                        properties: {}
                                                                    required:
                                                                      - always
                                                                  - additionalProperties: false
                                                                    type: object
                                                                    properties:
                                                                      never:
                                                                        additionalProperties: false
                                                                        type: object
                                                                        properties: {}
                                                                    required:
                                                                      - never
                                                              maxItems: 50
                                                              type: array
                                                          required:
                                                            - and
                                                        - additionalProperties: false
                                                          type: object
                                                          properties:
                                                            or:
                                                              items:
                                                                anyOf:
                                                                  - anyOf:
                                                                      - additionalProperties: false
                                                                        type: object
                                                                        properties:
                                                                          contains:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          endsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          eq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                          gt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          gte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          includes:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          neq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          range:
                                                                            additionalProperties: false
                                                                            type: object
                                                                            properties:
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                          startsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                        required:
                                                                          - field
                                                                      - additionalProperties: false
                                                                        type: object
                                                                        properties:
                                                                          exists:
                                                                            type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                        required:
                                                                          - field
                                                                  - additionalProperties: false
                                                                    type: object
                                                                    properties:
                                                                      always:
                                                                        additionalProperties: false
                                                                        type: object
                                                                        properties: {}
                                                                    required:
                                                                      - always
                                                                  - additionalProperties: false
                                                                    type: object
                                                                    properties:
                                                                      never:
                                                                        additionalProperties: false
                                                                        type: object
                                                                        properties: {}
                                                                    required:
                                                                      - never
                                                              maxItems: 50
                                                              type: array
                                                          required:
                                                            - or
                                                        - additionalProperties: false
                                                          type: object
                                                          properties:
                                                            not:
                                                              anyOf:
                                                                - anyOf:
                                                                    - additionalProperties: false
                                                                      type: object
                                                                      properties:
                                                                        contains:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        endsWith:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        eq:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        field:
                                                                          maxLength: 256
                                                                          minLength: 1
                                                                          type: string
                                                                        gt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        gte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        includes:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        neq:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        range:
                                                                          additionalProperties: false
                                                                          type: object
                                                                          properties:
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                        startsWith:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                      required:
                                                                        - field
                                                                    - additionalProperties: false
                                                                      type: object
                                                                      properties:
                                                                        exists:
                                                                          type: boolean
                                                                        field:
                                                                          maxLength: 256
                                                                          minLength: 1
                                                                          type: string
                                                                      required:
                                                                        - field
                                                                - additionalProperties: false
                                                                  type: object
                                                                  properties:
                                                                    always:
                                                                      additionalProperties: false
                                                                      type: object
                                                                      properties: {}
                                                                  required:
                                                                    - always
                                                                - additionalProperties: false
                                                                  type: object
                                                                  properties:
                                                                    never:
                                                                      additionalProperties: false
                                                                      type: object
                                                                      properties: {}
                                                                  required:
                                                                    - never
                                                          required:
                                                            - not
                                                        - additionalProperties: false
                                                          type: object
                                                          properties:
                                                            always:
                                                              additionalProperties: false
                                                              type: object
                                                              properties: {}
                                                          required:
                                                            - always
                                                        - additionalProperties: false
                                                          type: object
                                                          properties:
                                                            never:
                                                              additionalProperties: false
                                                              type: object
                                                              properties: {}
                                                          required:
                                                            - never
                                                    maxItems: 50
                                                    type: array
                                                required:
                                                  - or
                                              - additionalProperties: false
                                                type: object
                                                properties:
                                                  not:
                                                    anyOf:
                                                      - anyOf:
                                                          - additionalProperties: false
                                                            type: object
                                                            properties:
                                                              contains:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              endsWith:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              eq:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              field:
                                                                maxLength: 256
                                                                minLength: 1
                                                                type: string
                                                              gt:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              gte:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              includes:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              lt:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              lte:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              neq:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              range:
                                                                additionalProperties: false
                                                                type: object
                                                                properties:
                                                                  gt:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  gte:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  lt:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  lte:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                              startsWith:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                            required:
                                                              - field
                                                          - additionalProperties: false
                                                            type: object
                                                            properties:
                                                              exists:
                                                                type: boolean
                                                              field:
                                                                maxLength: 256
                                                                minLength: 1
                                                                type: string
                                                            required:
                                                              - field
                                                      - additionalProperties: false
                                                        type: object
                                                        properties:
                                                          and:
                                                            items:
                                                              anyOf:
                                                                - anyOf:
                                                                    - additionalProperties: false
                                                                      type: object
                                                                      properties:
                                                                        contains:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        endsWith:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        eq:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        field:
                                                                          maxLength: 256
                                                                          minLength: 1
                                                                          type: string
                                                                        gt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        gte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        includes:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        neq:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        range:
                                                                          additionalProperties: false
                                                                          type: object
                                                                          properties:
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                        startsWith:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                      required:
                                                                        - field
                                                                    - additionalProperties: false
                                                                      type: object
                                                                      properties:
                                                                        exists:
                                                                          type: boolean
                                                                        field:
                                                                          maxLength: 256
                                                                          minLength: 1
                                                                          type: string
                                                                      required:
                                                                        - field
                                                                - additionalProperties: false
                                                                  type: object
                                                                  properties:
                                                                    always:
                                                                      additionalProperties: false
                                                                      type: object
                                                                      properties: {}
                                                                  required:
                                                                    - always
                                                                - additionalProperties: false
                                                                  type: object
                                                                  properties:
                                                                    never:
                                                                      additionalProperties: false
                                                                      type: object
                                                                      properties: {}
                                                                  required:
                                                                    - never
                                                            maxItems: 50
                                                            type: array
                                                        required:
                                                          - and
                                                      - additionalProperties: false
                                                        type: object
                                                        properties:
                                                          or:
                                                            items:
                                                              anyOf:
                                                                - anyOf:
                                                                    - additionalProperties: false
                                                                      type: object
                                                                      properties:
                                                                        contains:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        endsWith:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        eq:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        field:
                                                                          maxLength: 256
                                                                          minLength: 1
                                                                          type: string
                                                                        gt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        gte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        includes:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        neq:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        range:
                                                                          additionalProperties: false
                                                                          type: object
                                                                          properties:
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                        startsWith:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                      required:
                                                                        - field
                                                                    - additionalProperties: false
                                                                      type: object
                                                                      properties:
                                                                        exists:
                                                                          type: boolean
                                                                        field:
                                                                          maxLength: 256
                                                                          minLength: 1
                                                                          type: string
                                                                      required:
                                                                        - field
                                                                - additionalProperties: false
                                                                  type: object
                                                                  properties:
                                                                    always:
                                                                      additionalProperties: false
                                                                      type: object
                                                                      properties: {}
                                                                  required:
                                                                    - always
                                                                - additionalProperties: false
                                                                  type: object
                                                                  properties:
                                                                    never:
                                                                      additionalProperties: false
                                                                      type: object
                                                                      properties: {}
                                                                  required:
                                                                    - never
                                                            maxItems: 50
                                                            type: array
                                                        required:
                                                          - or
                                                      - additionalProperties: false
                                                        type: object
                                                        properties:
                                                          not:
                                                            anyOf:
                                                              - anyOf:
                                                                  - additionalProperties: false
                                                                    type: object
                                                                    properties:
                                                                      contains:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      endsWith:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      eq:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      field:
                                                                        maxLength: 256
                                                                        minLength: 1
                                                                        type: string
                                                                      gt:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      gte:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      includes:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      lt:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      lte:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      neq:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      range:
                                                                        additionalProperties: false
                                                                        type: object
                                                                        properties:
                                                                          gt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          gte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                      startsWith:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                    required:
                                                                      - field
                                                                  - additionalProperties: false
                                                                    type: object
                                                                    properties:
                                                                      exists:
                                                                        type: boolean
                                                                      field:
                                                                        maxLength: 256
                                                                        minLength: 1
                                                                        type: string
                                                                    required:
                                                                      - field
                                                              - additionalProperties: false
                                                                type: object
                                                                properties:
                                                                  always:
                                                                    additionalProperties: false
                                                                    type: object
                                                                    properties: {}
                                                                required:
                                                                  - always
                                                              - additionalProperties: false
                                                                type: object
                                                                properties:
                                                                  never:
                                                                    additionalProperties: false
                                                                    type: object
                                                                    properties: {}
                                                                required:
                                                                  - never
                                                        required:
                                                          - not
                                                      - additionalProperties: false
                                                        type: object
                                                        properties:
                                                          always:
                                                            additionalProperties: false
                                                            type: object
                                                            properties: {}
                                                        required:
                                                          - always
                                                      - additionalProperties: false
                                                        type: object
                                                        properties:
                                                          never:
                                                            additionalProperties: false
                                                            type: object
                                                            properties: {}
                                                        required:
                                                          - never
                                                required:
                                                  - not
                                              - additionalProperties: false
                                                type: object
                                                properties:
                                                  always:
                                                    additionalProperties: false
                                                    type: object
                                                    properties: {}
                                                required:
                                                  - always
                                              - additionalProperties: false
                                                type: object
                                                properties:
                                                  never:
                                                    additionalProperties: false
                                                    type: object
                                                    properties: {}
                                                required:
                                                  - never
                                        required:
                                          - not
                                      - additionalProperties: false
                                        type: object
                                        properties:
                                          always:
                                            additionalProperties: false
                                            type: object
                                            properties: {}
                                        required:
                                          - always
                                      - additionalProperties: false
                                        type: object
                                        properties:
                                          never:
                                            additionalProperties: false
                                            type: object
                                            properties: {}
                                        required:
                                          - never
                                required:
                                  - not
                              - additionalProperties: false
                                type: object
                                properties:
                                  always:
                                    additionalProperties: false
                                    type: object
                                    properties: {}
                                required:
                                  - always
                              - additionalProperties: false
                                type: object
                                properties:
                                  never:
                                    additionalProperties: false
                                    type: object
                                    properties: {}
                                required:
                                  - never
                          maxItems: 50
                          type: array
                      required:
                        - and
                    - additionalProperties: false
                      type: object
                      properties:
                        or:
                          items:
                            anyOf:
                              - anyOf:
                                  - additionalProperties: false
                                    type: object
                                    properties:
                                      contains:
                                        anyOf:
                                          - maxLength: 65535
                                            type: string
                                          - type: number
                                          - type: boolean
                                      endsWith:
                                        anyOf:
                                          - maxLength: 65535
                                            type: string
                                          - type: number
                                          - type: boolean
                                      eq:
                                        anyOf:
                                          - maxLength: 65535
                                            type: string
                                          - type: number
                                          - type: boolean
                                      field:
                                        maxLength: 256
                                        minLength: 1
                                        type: string
                                      gt:
                                        anyOf:
                                          - maxLength: 65535
                                            type: string
                                          - type: number
                                          - type: boolean
                                      gte:
                                        anyOf:
                                          - maxLength: 65535
                                            type: string
                                          - type: number
                                          - type: boolean
                                      includes:
                                        anyOf:
                                          - maxLength: 65535
                                            type: string
                                          - type: number
                                          - type: boolean
                                      lt:
                                        anyOf:
                                          - maxLength: 65535
                                            type: string
                                          - type: number
                                          - type: boolean
                                      lte:
                                        anyOf:
                                          - maxLength: 65535
                                            type: string
                                          - type: number
                                          - type: boolean
                                      neq:
                                        anyOf:
                                          - maxLength: 65535
                                            type: string
                                          - type: number
                                          - type: boolean
                                      range:
                                        additionalProperties: false
                                        type: object
                                        properties:
                                          gt:
                                            anyOf:
                                              - maxLength: 65535
                                                type: string
                                              - type: number
                                              - type: boolean
                                          gte:
                                            anyOf:
                                              - maxLength: 65535
                                                type: string
                                              - type: number
                                              - type: boolean
                                          lt:
                                            anyOf:
                                              - maxLength: 65535
                                                type: string
                                              - type: number
                                              - type: boolean
                                          lte:
                                            anyOf:
                                              - maxLength: 65535
                                                type: string
                                              - type: number
                                              - type: boolean
                                      startsWith:
                                        anyOf:
                                          - maxLength: 65535
                                            type: string
                                          - type: number
                                          - type: boolean
                                    required:
                                      - field
                                  - additionalProperties: false
                                    type: object
                                    properties:
                                      exists:
                                        type: boolean
                                      field:
                                        maxLength: 256
                                        minLength: 1
                                        type: string
                                    required:
                                      - field
                              - additionalProperties: false
                                type: object
                                properties:
                                  and:
                                    items:
                                      anyOf:
                                        - anyOf:
                                            - additionalProperties: false
                                              type: object
                                              properties:
                                                contains:
                                                  anyOf:
                                                    - maxLength: 65535
                                                      type: string
                                                    - type: number
                                                    - type: boolean
                                                endsWith:
                                                  anyOf:
                                                    - maxLength: 65535
                                                      type: string
                                                    - type: number
                                                    - type: boolean
                                                eq:
                                                  anyOf:
                                                    - maxLength: 65535
                                                      type: string
                                                    - type: number
                                                    - type: boolean
                                                field:
                                                  maxLength: 256
                                                  minLength: 1
                                                  type: string
                                                gt:
                                                  anyOf:
                                                    - maxLength: 65535
                                                      type: string
                                                    - type: number
                                                    - type: boolean
                                                gte:
                                                  anyOf:
                                                    - maxLength: 65535
                                                      type: string
                                                    - type: number
                                                    - type: boolean
                                                includes:
                                                  anyOf:
                                                    - maxLength: 65535
                                                      type: string
                                                    - type: number
                                                    - type: boolean
                                                lt:
                                                  anyOf:
                                                    - maxLength: 65535
                                                      type: string
                                                    - type: number
                                                    - type: boolean
                                                lte:
                                                  anyOf:
                                                    - maxLength: 65535
                                                      type: string
                                                    - type: number
                                                    - type: boolean
                                                neq:
                                                  anyOf:
                                                    - maxLength: 65535
                                                      type: string
                                                    - type: number
                                                    - type: boolean
                                                range:
                                                  additionalProperties: false
                                                  type: object
                                                  properties:
                                                    gt:
                                                      anyOf:
                                                        - maxLength: 65535
                                                          type: string
                                                        - type: number
                                                        - type: boolean
                                                    gte:
                                                      anyOf:
                                                        - maxLength: 65535
                                                          type: string
                                                        - type: number
                                                        - type: boolean
                                                    lt:
                                                      anyOf:
                                                        - maxLength: 65535
                                                          type: string
                                                        - type: number
                                                        - type: boolean
                                                    lte:
                                                      anyOf:
                                                        - maxLength: 65535
                                                          type: string
                                                        - type: number
                                                        - type: boolean
                                                startsWith:
                                                  anyOf:
                                                    - maxLength: 65535
                                                      type: string
                                                    - type: number
                                                    - type: boolean
                                              required:
                                                - field
                                            - additionalProperties: false
                                              type: object
                                              properties:
                                                exists:
                                                  type: boolean
                                                field:
                                                  maxLength: 256
                                                  minLength: 1
                                                  type: string
                                              required:
                                                - field
                                        - additionalProperties: false
                                          type: object
                                          properties:
                                            and:
                                              items:
                                                anyOf:
                                                  - anyOf:
                                                      - additionalProperties: false
                                                        type: object
                                                        properties:
                                                          contains:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          endsWith:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          eq:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          field:
                                                            maxLength: 256
                                                            minLength: 1
                                                            type: string
                                                          gt:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          gte:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          includes:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          lt:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          lte:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          neq:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          range:
                                                            additionalProperties: false
                                                            type: object
                                                            properties:
                                                              gt:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              gte:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              lt:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              lte:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                          startsWith:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                        required:
                                                          - field
                                                      - additionalProperties: false
                                                        type: object
                                                        properties:
                                                          exists:
                                                            type: boolean
                                                          field:
                                                            maxLength: 256
                                                            minLength: 1
                                                            type: string
                                                        required:
                                                          - field
                                                  - additionalProperties: false
                                                    type: object
                                                    properties:
                                                      and:
                                                        items:
                                                          anyOf:
                                                            - anyOf:
                                                                - additionalProperties: false
                                                                  type: object
                                                                  properties:
                                                                    contains:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    endsWith:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    eq:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    field:
                                                                      maxLength: 256
                                                                      minLength: 1
                                                                      type: string
                                                                    gt:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    gte:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    includes:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    lt:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    lte:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    neq:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    range:
                                                                      additionalProperties: false
                                                                      type: object
                                                                      properties:
                                                                        gt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        gte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                    startsWith:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                  required:
                                                                    - field
                                                                - additionalProperties: false
                                                                  type: object
                                                                  properties:
                                                                    exists:
                                                                      type: boolean
                                                                    field:
                                                                      maxLength: 256
                                                                      minLength: 1
                                                                      type: string
                                                                  required:
                                                                    - field
                                                            - additionalProperties: false
                                                              type: object
                                                              properties:
                                                                and:
                                                                  items:
                                                                    anyOf:
                                                                      - anyOf:
                                                                          - additionalProperties: false
                                                                            type: object
                                                                            properties:
                                                                              contains:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              endsWith:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              eq:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              field:
                                                                                maxLength: 256
                                                                                minLength: 1
                                                                                type: string
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              includes:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              neq:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              range:
                                                                                additionalProperties: false
                                                                                type: object
                                                                                properties:
                                                                                  gt:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  gte:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  lt:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  lte:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                              startsWith:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            required:
                                                                              - field
                                                                          - additionalProperties: false
                                                                            type: object
                                                                            properties:
                                                                              exists:
                                                                                type: boolean
                                                                              field:
                                                                                maxLength: 256
                                                                                minLength: 1
                                                                                type: string
                                                                            required:
                                                                              - field
                                                                      - additionalProperties: false
                                                                        type: object
                                                                        properties:
                                                                          always:
                                                                            additionalProperties: false
                                                                            type: object
                                                                            properties: {}
                                                                        required:
                                                                          - always
                                                                      - additionalProperties: false
                                                                        type: object
                                                                        properties:
                                                                          never:
                                                                            additionalProperties: false
                                                                            type: object
                                                                            properties: {}
                                                                        required:
                                                                          - never
                                                                  maxItems: 50
                                                                  type: array
                                                              required:
                                                                - and
                                                            - additionalProperties: false
                                                              type: object
                                                              properties:
                                                                or:
                                                                  items:
                                                                    anyOf:
                                                                      - anyOf:
                                                                          - additionalProperties: false
                                                                            type: object
                                                                            properties:
                                                                              contains:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              endsWith:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              eq:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              field:
                                                                                maxLength: 256
                                                                                minLength: 1
                                                                                type: string
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              includes:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              neq:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              range:
                                                                                additionalProperties: false
                                                                                type: object
                                                                                properties:
                                                                                  gt:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  gte:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  lt:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  lte:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                              startsWith:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            required:
                                                                              - field
                                                                          - additionalProperties: false
                                                                            type: object
                                                                            properties:
                                                                              exists:
                                                                                type: boolean
                                                                              field:
                                                                                maxLength: 256
                                                                                minLength: 1
                                                                                type: string
                                                                            required:
                                                                              - field
                                                                      - additionalProperties: false
                                                                        type: object
                                                                        properties:
                                                                          always:
                                                                            additionalProperties: false
                                                                            type: object
                                                                            properties: {}
                                                                        required:
                                                                          - always
                                                                      - additionalProperties: false
                                                                        type: object
                                                                        properties:
                                                                          never:
                                                                            additionalProperties: false
                                                                            type: object
                                                                            properties: {}
                                                                        required:
                                                                          - never
                                                                  maxItems: 50
                                                                  type: array
                                                              required:
                                                                - or
                                                            - additionalProperties: false
                                                              type: object
                                                              properties:
                                                                not:
                                                                  anyOf:
                                                                    - anyOf:
                                                                        - additionalProperties: false
                                                                          type: object
                                                                          properties:
                                                                            contains:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            endsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            eq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            includes:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            neq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            range:
                                                                              additionalProperties: false
                                                                              type: object
                                                                              properties:
                                                                                gt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                gte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                            startsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          required:
                                                                            - field
                                                                        - additionalProperties: false
                                                                          type: object
                                                                          properties:
                                                                            exists:
                                                                              type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                          required:
                                                                            - field
                                                                    - additionalProperties: false
                                                                      type: object
                                                                      properties:
                                                                        always:
                                                                          additionalProperties: false
                                                                          type: object
                                                                          properties: {}
                                                                      required:
                                                                        - always
                                                                    - additionalProperties: false
                                                                      type: object
                                                                      properties:
                                                                        never:
                                                                          additionalProperties: false
                                                                          type: object
                                                                          properties: {}
                                                                      required:
                                                                        - never
                                                              required:
                                                                - not
                                                            - additionalProperties: false
                                                              type: object
                                                              properties:
                                                                always:
                                                                  additionalProperties: false
                                                                  type: object
                                                                  properties: {}
                                                              required:
                                                                - always
                                                            - additionalProperties: false
                                                              type: object
                                                              properties:
                                                                never:
                                                                  additionalProperties: false
                                                                  type: object
                                                                  properties: {}
                                                              required:
                                                                - never
                                                        maxItems: 50
                                                        type: array
                                                    required:
                                                      - and
                                                  - additionalProperties: false
                                                    type: object
                                                    properties:
                                                      or:
                                                        items:
                                                          anyOf:
                                                            - anyOf:
                                                                - additionalProperties: false
                                                                  type: object
                                                                  properties:
                                                                    contains:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    endsWith:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    eq:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    field:
                                                                      maxLength: 256
                                                                      minLength: 1
                                                                      type: string
                                                                    gt:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    gte:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    includes:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    lt:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    lte:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    neq:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    range:
                                                                      additionalProperties: false
                                                                      type: object
                                                                      properties:
                                                                        gt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        gte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                    startsWith:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                  required:
                                                                    - field
                                                                - additionalProperties: false
                                                                  type: object
                                                                  properties:
                                                                    exists:
                                                                      type: boolean
                                                                    field:
                                                                      maxLength: 256
                                                                      minLength: 1
                                                                      type: string
                                                                  required:
                                                                    - field
                                                            - additionalProperties: false
                                                              type: object
                                                              properties:
                                                                and:
                                                                  items:
                                                                    anyOf:
                                                                      - anyOf:
                                                                          - additionalProperties: false
                                                                            type: object
                                                                            properties:
                                                                              contains:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              endsWith:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              eq:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              field:
                                                                                maxLength: 256
                                                                                minLength: 1
                                                                                type: string
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              includes:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              neq:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              range:
                                                                                additionalProperties: false
                                                                                type: object
                                                                                properties:
                                                                                  gt:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  gte:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  lt:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  lte:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                              startsWith:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            required:
                                                                              - field
                                                                          - additionalProperties: false
                                                                            type: object
                                                                            properties:
                                                                              exists:
                                                                                type: boolean
                                                                              field:
                                                                                maxLength: 256
                                                                                minLength: 1
                                                                                type: string
                                                                            required:
                                                                              - field
                                                                      - additionalProperties: false
                                                                        type: object
                                                                        properties:
                                                                          always:
                                                                            additionalProperties: false
                                                                            type: object
                                                                            properties: {}
                                                                        required:
                                                                          - always
                                                                      - additionalProperties: false
                                                                        type: object
                                                                        properties:
                                                                          never:
                                                                            additionalProperties: false
                                                                            type: object
                                                                            properties: {}
                                                                        required:
                                                                          - never
                                                                  maxItems: 50
                                                                  type: array
                                                              required:
                                                                - and
                                                            - additionalProperties: false
                                                              type: object
                                                              properties:
                                                                or:
                                                                  items:
                                                                    anyOf:
                                                                      - anyOf:
                                                                          - additionalProperties: false
                                                                            type: object
                                                                            properties:
                                                                              contains:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              endsWith:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              eq:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              field:
                                                                                maxLength: 256
                                                                                minLength: 1
                                                                                type: string
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              includes:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              neq:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              range:
                                                                                additionalProperties: false
                                                                                type: object
                                                                                properties:
                                                                                  gt:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  gte:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  lt:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  lte:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                              startsWith:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            required:
                                                                              - field
                                                                          - additionalProperties: false
                                                                            type: object
                                                                            properties:
                                                                              exists:
                                                                                type: boolean
                                                                              field:
                                                                                maxLength: 256
                                                                                minLength: 1
                                                                                type: string
                                                                            required:
                                                                              - field
                                                                      - additionalProperties: false
                                                                        type: object
                                                                        properties:
                                                                          always:
                                                                            additionalProperties: false
                                                                            type: object
                                                                            properties: {}
                                                                        required:
                                                                          - always
                                                                      - additionalProperties: false
                                                                        type: object
                                                                        properties:
                                                                          never:
                                                                            additionalProperties: false
                                                                            type: object
                                                                            properties: {}
                                                                        required:
                                                                          - never
                                                                  maxItems: 50
                                                                  type: array
                                                              required:
                                                                - or
                                                            - additionalProperties: false
                                                              type: object
                                                              properties:
                                                                not:
                                                                  anyOf:
                                                                    - anyOf:
                                                                        - additionalProperties: false
                                                                          type: object
                                                                          properties:
                                                                            contains:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            endsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            eq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            includes:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            neq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            range:
                                                                              additionalProperties: false
                                                                              type: object
                                                                              properties:
                                                                                gt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                gte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                            startsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          required:
                                                                            - field
                                                                        - additionalProperties: false
                                                                          type: object
                                                                          properties:
                                                                            exists:
                                                                              type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                          required:
                                                                            - field
                                                                    - additionalProperties: false
                                                                      type: object
                                                                      properties:
                                                                        always:
                                                                          additionalProperties: false
                                                                          type: object
                                                                          properties: {}
                                                                      required:
                                                                        - always
                                                                    - additionalProperties: false
                                                                      type: object
                                                                      properties:
                                                                        never:
                                                                          additionalProperties: false
                                                                          type: object
                                                                          properties: {}
                                                                      required:
                                                                        - never
                                                              required:
                                                                - not
                                                            - additionalProperties: false
                                                              type: object
                                                              properties:
                                                                always:
                                                                  additionalProperties: false
                                                                  type: object
                                                                  properties: {}
                                                              required:
                                                                - always
                                                            - additionalProperties: false
                                                              type: object
                                                              properties:
                                                                never:
                                                                  additionalProperties: false
                                                                  type: object
                                                                  properties: {}
                                                              required:
                                                                - never
                                                        maxItems: 50
                                                        type: array
                                                    required:
                                                      - or
                                                  - additionalProperties: false
                                                    type: object
                                                    properties:
                                                      not:
                                                        anyOf:
                                                          - anyOf:
                                                              - additionalProperties: false
                                                                type: object
                                                                properties:
                                                                  contains:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  endsWith:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  eq:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  field:
                                                                    maxLength: 256
                                                                    minLength: 1
                                                                    type: string
                                                                  gt:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  gte:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  includes:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  lt:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  lte:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  neq:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  range:
                                                                    additionalProperties: false
                                                                    type: object
                                                                    properties:
                                                                      gt:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      gte:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      lt:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      lte:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                  startsWith:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                required:
                                                                  - field
                                                              - additionalProperties: false
                                                                type: object
                                                                properties:
                                                                  exists:
                                                                    type: boolean
                                                                  field:
                                                                    maxLength: 256
                                                                    minLength: 1
                                                                    type: string
                                                                required:
                                                                  - field
                                                          - additionalProperties: false
                                                            type: object
                                                            properties:
                                                              and:
                                                                items:
                                                                  anyOf:
                                                                    - anyOf:
                                                                        - additionalProperties: false
                                                                          type: object
                                                                          properties:
                                                                            contains:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            endsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            eq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            includes:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            neq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            range:
                                                                              additionalProperties: false
                                                                              type: object
                                                                              properties:
                                                                                gt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                gte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                            startsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          required:
                                                                            - field
                                                                        - additionalProperties: false
                                                                          type: object
                                                                          properties:
                                                                            exists:
                                                                              type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                          required:
                                                                            - field
                                                                    - additionalProperties: false
                                                                      type: object
                                                                      properties:
                                                                        always:
                                                                          additionalProperties: false
                                                                          type: object
                                                                          properties: {}
                                                                      required:
                                                                        - always
                                                                    - additionalProperties: false
                                                                      type: object
                                                                      properties:
                                                                        never:
                                                                          additionalProperties: false
                                                                          type: object
                                                                          properties: {}
                                                                      required:
                                                                        - never
                                                                maxItems: 50
                                                                type: array
                                                            required:
                                                              - and
                                                          - additionalProperties: false
                                                            type: object
                                                            properties:
                                                              or:
                                                                items:
                                                                  anyOf:
                                                                    - anyOf:
                                                                        - additionalProperties: false
                                                                          type: object
                                                                          properties:
                                                                            contains:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            endsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            eq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            includes:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            neq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            range:
                                                                              additionalProperties: false
                                                                              type: object
                                                                              properties:
                                                                                gt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                gte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                            startsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          required:
                                                                            - field
                                                                        - additionalProperties: false
                                                                          type: object
                                                                          properties:
                                                                            exists:
                                                                              type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                          required:
                                                                            - field
                                                                    - additionalProperties: false
                                                                      type: object
                                                                      properties:
                                                                        always:
                                                                          additionalProperties: false
                                                                          type: object
                                                                          properties: {}
                                                                      required:
                                                                        - always
                                                                    - additionalProperties: false
                                                                      type: object
                                                                      properties:
                                                                        never:
                                                                          additionalProperties: false
                                                                          type: object
                                                                          properties: {}
                                                                      required:
                                                                        - never
                                                                maxItems: 50
                                                                type: array
                                                            required:
                                                              - or
                                                          - additionalProperties: false
                                                            type: object
                                                            properties:
                                                              not:
                                                                anyOf:
                                                                  - anyOf:
                                                                      - additionalProperties: false
                                                                        type: object
                                                                        properties:
                                                                          contains:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          endsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          eq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                          gt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          gte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          includes:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          neq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          range:
                                                                            additionalProperties: false
                                                                            type: object
                                                                            properties:
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                          startsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                        required:
                                                                          - field
                                                                      - additionalProperties: false
                                                                        type: object
                                                                        properties:
                                                                          exists:
                                                                            type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                        required:
                                                                          - field
                                                                  - additionalProperties: false
                                                                    type: object
                                                                    properties:
                                                                      always:
                                                                        additionalProperties: false
                                                                        type: object
                                                                        properties: {}
                                                                    required:
                                                                      - always
                                                                  - additionalProperties: false
                                                                    type: object
                                                                    properties:
                                                                      never:
                                                                        additionalProperties: false
                                                                        type: object
                                                                        properties: {}
                                                                    required:
                                                                      - never
                                                            required:
                                                              - not
                                                          - additionalProperties: false
                                                            type: object
                                                            properties:
                                                              always:
                                                                additionalProperties: false
                                                                type: object
                                                                properties: {}
                                                            required:
                                                              - always
                                                          - additionalProperties: false
                                                            type: object
                                                            properties:
                                                              never:
                                                                additionalProperties: false
                                                                type: object
                                                                properties: {}
                                                            required:
                                                              - never
                                                    required:
                                                      - not
                                                  - additionalProperties: false
                                                    type: object
                                                    properties:
                                                      always:
                                                        additionalProperties: false
                                                        type: object
                                                        properties: {}
                                                    required:
                                                      - always
                                                  - additionalProperties: false
                                                    type: object
                                                    properties:
                                                      never:
                                                        additionalProperties: false
                                                        type: object
                                                        properties: {}
                                                    required:
                                                      - never
                                              maxItems: 50
                                              type: array
                                          required:
                                            - and
                                        - additionalProperties: false
                                          type: object
                                          properties:
                                            or:
                                              items:
                                                anyOf:
                                                  - anyOf:
                                                      - additionalProperties: false
                                                        type: object
                                                        properties:
                                                          contains:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          endsWith:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          eq:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          field:
                                                            maxLength: 256
                                                            minLength: 1
                                                            type: string
                                                          gt:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          gte:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          includes:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          lt:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          lte:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          neq:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          range:
                                                            additionalProperties: false
                                                            type: object
                                                            properties:
                                                              gt:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              gte:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              lt:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              lte:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                          startsWith:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                        required:
                                                          - field
                                                      - additionalProperties: false
                                                        type: object
                                                        properties:
                                                          exists:
                                                            type: boolean
                                                          field:
                                                            maxLength: 256
                                                            minLength: 1
                                                            type: string
                                                        required:
                                                          - field
                                                  - additionalProperties: false
                                                    type: object
                                                    properties:
                                                      and:
                                                        items:
                                                          anyOf:
                                                            - anyOf:
                                                                - additionalProperties: false
                                                                  type: object
                                                                  properties:
                                                                    contains:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    endsWith:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    eq:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    field:
                                                                      maxLength: 256
                                                                      minLength: 1
                                                                      type: string
                                                                    gt:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    gte:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    includes:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    lt:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    lte:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    neq:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    range:
                                                                      additionalProperties: false
                                                                      type: object
                                                                      properties:
                                                                        gt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        gte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                    startsWith:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                  required:
                                                                    - field
                                                                - additionalProperties: false
                                                                  type: object
                                                                  properties:
                                                                    exists:
                                                                      type: boolean
                                                                    field:
                                                                      maxLength: 256
                                                                      minLength: 1
                                                                      type: string
                                                                  required:
                                                                    - field
                                                            - additionalProperties: false
                                                              type: object
                                                              properties:
                                                                and:
                                                                  items:
                                                                    anyOf:
                                                                      - anyOf:
                                                                          - additionalProperties: false
                                                                            type: object
                                                                            properties:
                                                                              contains:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              endsWith:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              eq:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              field:
                                                                                maxLength: 256
                                                                                minLength: 1
                                                                                type: string
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              includes:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              neq:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              range:
                                                                                additionalProperties: false
                                                                                type: object
                                                                                properties:
                                                                                  gt:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  gte:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  lt:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  lte:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                              startsWith:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            required:
                                                                              - field
                                                                          - additionalProperties: false
                                                                            type: object
                                                                            properties:
                                                                              exists:
                                                                                type: boolean
                                                                              field:
                                                                                maxLength: 256
                                                                                minLength: 1
                                                                                type: string
                                                                            required:
                                                                              - field
                                                                      - additionalProperties: false
                                                                        type: object
                                                                        properties:
                                                                          always:
                                                                            additionalProperties: false
                                                                            type: object
                                                                            properties: {}
                                                                        required:
                                                                          - always
                                                                      - additionalProperties: false
                                                                        type: object
                                                                        properties:
                                                                          never:
                                                                            additionalProperties: false
                                                                            type: object
                                                                            properties: {}
                                                                        required:
                                                                          - never
                                                                  maxItems: 50
                                                                  type: array
                                                              required:
                                                                - and
                                                            - additionalProperties: false
                                                              type: object
                                                              properties:
                                                                or:
                                                                  items:
                                                                    anyOf:
                                                                      - anyOf:
                                                                          - additionalProperties: false
                                                                            type: object
                                                                            properties:
                                                                              contains:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              endsWith:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              eq:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              field:
                                                                                maxLength: 256
                                                                                minLength: 1
                                                                                type: string
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              includes:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              neq:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              range:
                                                                                additionalProperties: false
                                                                                type: object
                                                                                properties:
                                                                                  gt:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  gte:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  lt:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  lte:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                              startsWith:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            required:
                                                                              - field
                                                                          - additionalProperties: false
                                                                            type: object
                                                                            properties:
                                                                              exists:
                                                                                type: boolean
                                                                              field:
                                                                                maxLength: 256
                                                                                minLength: 1
                                                                                type: string
                                                                            required:
                                                                              - field
                                                                      - additionalProperties: false
                                                                        type: object
                                                                        properties:
                                                                          always:
                                                                            additionalProperties: false
                                                                            type: object
                                                                            properties: {}
                                                                        required:
                                                                          - always
                                                                      - additionalProperties: false
                                                                        type: object
                                                                        properties:
                                                                          never:
                                                                            additionalProperties: false
                                                                            type: object
                                                                            properties: {}
                                                                        required:
                                                                          - never
                                                                  maxItems: 50
                                                                  type: array
                                                              required:
                                                                - or
                                                            - additionalProperties: false
                                                              type: object
                                                              properties:
                                                                not:
                                                                  anyOf:
                                                                    - anyOf:
                                                                        - additionalProperties: false
                                                                          type: object
                                                                          properties:
                                                                            contains:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            endsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            eq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            includes:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            neq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            range:
                                                                              additionalProperties: false
                                                                              type: object
                                                                              properties:
                                                                                gt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                gte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                            startsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          required:
                                                                            - field
                                                                        - additionalProperties: false
                                                                          type: object
                                                                          properties:
                                                                            exists:
                                                                              type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                          required:
                                                                            - field
                                                                    - additionalProperties: false
                                                                      type: object
                                                                      properties:
                                                                        always:
                                                                          additionalProperties: false
                                                                          type: object
                                                                          properties: {}
                                                                      required:
                                                                        - always
                                                                    - additionalProperties: false
                                                                      type: object
                                                                      properties:
                                                                        never:
                                                                          additionalProperties: false
                                                                          type: object
                                                                          properties: {}
                                                                      required:
                                                                        - never
                                                              required:
                                                                - not
                                                            - additionalProperties: false
                                                              type: object
                                                              properties:
                                                                always:
                                                                  additionalProperties: false
                                                                  type: object
                                                                  properties: {}
                                                              required:
                                                                - always
                                                            - additionalProperties: false
                                                              type: object
                                                              properties:
                                                                never:
                                                                  additionalProperties: false
                                                                  type: object
                                                                  properties: {}
                                                              required:
                                                                - never
                                                        maxItems: 50
                                                        type: array
                                                    required:
                                                      - and
                                                  - additionalProperties: false
                                                    type: object
                                                    properties:
                                                      or:
                                                        items:
                                                          anyOf:
                                                            - anyOf:
                                                                - additionalProperties: false
                                                                  type: object
                                                                  properties:
                                                                    contains:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    endsWith:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    eq:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    field:
                                                                      maxLength: 256
                                                                      minLength: 1
                                                                      type: string
                                                                    gt:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    gte:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    includes:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    lt:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    lte:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    neq:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    range:
                                                                      additionalProperties: false
                                                                      type: object
                                                                      properties:
                                                                        gt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        gte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                    startsWith:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                  required:
                                                                    - field
                                                                - additionalProperties: false
                                                                  type: object
                                                                  properties:
                                                                    exists:
                                                                      type: boolean
                                                                    field:
                                                                      maxLength: 256
                                                                      minLength: 1
                                                                      type: string
                                                                  required:
                                                                    - field
                                                            - additionalProperties: false
                                                              type: object
                                                              properties:
                                                                and:
                                                                  items:
                                                                    anyOf:
                                                                      - anyOf:
                                                                          - additionalProperties: false
                                                                            type: object
                                                                            properties:
                                                                              contains:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              endsWith:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              eq:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              field:
                                                                                maxLength: 256
                                                                                minLength: 1
                                                                                type: string
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              includes:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              neq:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              range:
                                                                                additionalProperties: false
                                                                                type: object
                                                                                properties:
                                                                                  gt:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  gte:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  lt:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  lte:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                              startsWith:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            required:
                                                                              - field
                                                                          - additionalProperties: false
                                                                            type: object
                                                                            properties:
                                                                              exists:
                                                                                type: boolean
                                                                              field:
                                                                                maxLength: 256
                                                                                minLength: 1
                                                                                type: string
                                                                            required:
                                                                              - field
                                                                      - additionalProperties: false
                                                                        type: object
                                                                        properties:
                                                                          always:
                                                                            additionalProperties: false
                                                                            type: object
                                                                            properties: {}
                                                                        required:
                                                                          - always
                                                                      - additionalProperties: false
                                                                        type: object
                                                                        properties:
                                                                          never:
                                                                            additionalProperties: false
                                                                            type: object
                                                                            properties: {}
                                                                        required:
                                                                          - never
                                                                  maxItems: 50
                                                                  type: array
                                                              required:
                                                                - and
                                                            - additionalProperties: false
                                                              type: object
                                                              properties:
                                                                or:
                                                                  items:
                                                                    anyOf:
                                                                      - anyOf:
                                                                          - additionalProperties: false
                                                                            type: object
                                                                            properties:
                                                                              contains:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              endsWith:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              eq:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              field:
                                                                                maxLength: 256
                                                                                minLength: 1
                                                                                type: string
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              includes:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              neq:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              range:
                                                                                additionalProperties: false
                                                                                type: object
                                                                                properties:
                                                                                  gt:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  gte:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  lt:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  lte:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                              startsWith:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            required:
                                                                              - field
                                                                          - additionalProperties: false
                                                                            type: object
                                                                            properties:
                                                                              exists:
                                                                                type: boolean
                                                                              field:
                                                                                maxLength: 256
                                                                                minLength: 1
                                                                                type: string
                                                                            required:
                                                                              - field
                                                                      - additionalProperties: false
                                                                        type: object
                                                                        properties:
                                                                          always:
                                                                            additionalProperties: false
                                                                            type: object
                                                                            properties: {}
                                                                        required:
                                                                          - always
                                                                      - additionalProperties: false
                                                                        type: object
                                                                        properties:
                                                                          never:
                                                                            additionalProperties: false
                                                                            type: object
                                                                            properties: {}
                                                                        required:
                                                                          - never
                                                                  maxItems: 50
                                                                  type: array
                                                              required:
                                                                - or
                                                            - additionalProperties: false
                                                              type: object
                                                              properties:
                                                                not:
                                                                  anyOf:
                                                                    - anyOf:
                                                                        - additionalProperties: false
                                                                          type: object
                                                                          properties:
                                                                            contains:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            endsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            eq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            includes:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            neq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            range:
                                                                              additionalProperties: false
                                                                              type: object
                                                                              properties:
                                                                                gt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                gte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                            startsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          required:
                                                                            - field
                                                                        - additionalProperties: false
                                                                          type: object
                                                                          properties:
                                                                            exists:
                                                                              type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                          required:
                                                                            - field
                                                                    - additionalProperties: false
                                                                      type: object
                                                                      properties:
                                                                        always:
                                                                          additionalProperties: false
                                                                          type: object
                                                                          properties: {}
                                                                      required:
                                                                        - always
                                                                    - additionalProperties: false
                                                                      type: object
                                                                      properties:
                                                                        never:
                                                                          additionalProperties: false
                                                                          type: object
                                                                          properties: {}
                                                                      required:
                                                                        - never
                                                              required:
                                                                - not
                                                            - additionalProperties: false
                                                              type: object
                                                              properties:
                                                                always:
                                                                  additionalProperties: false
                                                                  type: object
                                                                  properties: {}
                                                              required:
                                                                - always
                                                            - additionalProperties: false
                                                              type: object
                                                              properties:
                                                                never:
                                                                  additionalProperties: false
                                                                  type: object
                                                                  properties: {}
                                                              required:
                                                                - never
                                                        maxItems: 50
                                                        type: array
                                                    required:
                                                      - or
                                                  - additionalProperties: false
                                                    type: object
                                                    properties:
                                                      not:
                                                        anyOf:
                                                          - anyOf:
                                                              - additionalProperties: false
                                                                type: object
                                                                properties:
                                                                  contains:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  endsWith:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  eq:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  field:
                                                                    maxLength: 256
                                                                    minLength: 1
                                                                    type: string
                                                                  gt:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  gte:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  includes:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  lt:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  lte:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  neq:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  range:
                                                                    additionalProperties: false
                                                                    type: object
                                                                    properties:
                                                                      gt:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      gte:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      lt:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      lte:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                  startsWith:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                required:
                                                                  - field
                                                              - additionalProperties: false
                                                                type: object
                                                                properties:
                                                                  exists:
                                                                    type: boolean
                                                                  field:
                                                                    maxLength: 256
                                                                    minLength: 1
                                                                    type: string
                                                                required:
                                                                  - field
                                                          - additionalProperties: false
                                                            type: object
                                                            properties:
                                                              and:
                                                                items:
                                                                  anyOf:
                                                                    - anyOf:
                                                                        - additionalProperties: false
                                                                          type: object
                                                                          properties:
                                                                            contains:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            endsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            eq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            includes:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            neq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            range:
                                                                              additionalProperties: false
                                                                              type: object
                                                                              properties:
                                                                                gt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                gte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                            startsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          required:
                                                                            - field
                                                                        - additionalProperties: false
                                                                          type: object
                                                                          properties:
                                                                            exists:
                                                                              type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                          required:
                                                                            - field
                                                                    - additionalProperties: false
                                                                      type: object
                                                                      properties:
                                                                        always:
                                                                          additionalProperties: false
                                                                          type: object
                                                                          properties: {}
                                                                      required:
                                                                        - always
                                                                    - additionalProperties: false
                                                                      type: object
                                                                      properties:
                                                                        never:
                                                                          additionalProperties: false
                                                                          type: object
                                                                          properties: {}
                                                                      required:
                                                                        - never
                                                                maxItems: 50
                                                                type: array
                                                            required:
                                                              - and
                                                          - additionalProperties: false
                                                            type: object
                                                            properties:
                                                              or:
                                                                items:
                                                                  anyOf:
                                                                    - anyOf:
                                                                        - additionalProperties: false
                                                                          type: object
                                                                          properties:
                                                                            contains:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            endsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            eq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            includes:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            neq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            range:
                                                                              additionalProperties: false
                                                                              type: object
                                                                              properties:
                                                                                gt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                gte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                            startsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          required:
                                                                            - field
                                                                        - additionalProperties: false
                                                                          type: object
                                                                          properties:
                                                                            exists:
                                                                              type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                          required:
                                                                            - field
                                                                    - additionalProperties: false
                                                                      type: object
                                                                      properties:
                                                                        always:
                                                                          additionalProperties: false
                                                                          type: object
                                                                          properties: {}
                                                                      required:
                                                                        - always
                                                                    - additionalProperties: false
                                                                      type: object