ESC
Example searches: “page”, “200”, “createDate”, “instanceId”, “Basic auth”
Search…
Ctrl+K
⌘K
Elastic APIs hub
Elastic Cloud API
Elastic Cloud Billing API
Elastic Cloud Enterprise API
Elastic Cloud Serverless API
Elasticsearch API
Elasticsearch Serverless API
Kibana API
Kibana Serverless API
Logstash API
Observability Intake Serverless API
Back to hub page
Download source
JSON OpenAPI specification
YAML OpenAPI specification
Feedback
Toggle dark mode
main
main
default
v8
v9
Topics
Introduction
Authentication
Kibana spaces
Endpoints
Alerting
Get the alerting framework health
GET
Get the rule types
GET
Get rule details
GET
Update a rule
PUT
Create a rule
POST
Delete a rule
DELETE
Disable a rule
POST
Enable a rule
POST
Mute all alerts
POST
Unmute all alerts
POST
Update the API key for a rule
POST
Schedule a snooze for the rule
POST
Mute an alert
POST
Unmute an alert
POST
Delete a snooze schedule for a rule
DELETE
Get information about rules
GET
APM agent configuration
Get a list of agent configurations
GET
Create or update agent configuration
PUT
Delete agent configuration
DELETE
Get agent name for service
GET
Get environments for service
GET
Lookup single agent configuration
POST
Get single agent configuration
GET
APM agent keys
Create an APM agent key
POST
APM annotations
Create a service annotation
POST
Search for annotations
GET
APM server schema
Save APM server schema
POST
APM sourcemaps
Get source maps
GET
Upload a source map
POST
Delete source map
DELETE
Cases
Create a case
POST
Delete cases
DELETE
Update cases
PATCH
Search cases
GET
Get case information
GET
Get all alerts for a case
GET
Add a case comment or alert
POST
Delete all case comments and alerts
DELETE
Update a case comment or alert
PATCH
Find case comments and alerts
GET
Get a case comment or alert
GET
Delete a case comment or alert
DELETE
Push a case to an external service
POST
Attach a file to a case
POST
Find case activity
GET
Get cases for an alert
GET
Get case settings
GET
Add case settings
POST
Update case settings
PATCH
Get case connectors
GET
Get case creators
GET
Get case tags
GET
CCR Remote synced integrations
Get CCR Remote synced integrations status by outputId
GET
Get CCR Remote synced integrations status
GET
Connectors
Get connector types
GET
Get connector information
GET
Update a connector
PUT
Create a connector
POST
Delete a connector
DELETE
Run a connector
POST
Get all connectors
GET
Data streams
Get data streams
GET
Get data streams
GET
Data views
Get all data views
GET
Create a data view
POST
Get a data view
GET
Update a data view
POST
Delete a data view
DELETE
Update data view fields metadata
POST
Create or update a runtime field
PUT
Create a runtime field
POST
Get a runtime field
GET
Update a runtime field
POST
Delete a runtime field from a data view
DELETE
Get the default data view
GET
Set the default data view
POST
Swap saved object references
POST
Preview a saved object reference swap
POST
Elastic Agent actions
Create an agent action
POST
Reassign an agent
POST
Request agent diagnostics
POST
Unenroll an agent
POST
Upgrade an agent
POST
Get an agent action status
GET
Cancel an agent action
POST
Bulk reassign agents
POST
Bulk request diagnostics from agents
POST
Bulk unenroll agents
POST
Bulk update agent tags
POST
Bulk upgrade agents
POST
Elastic Agent binary download sources
Get agent binary download sources
GET
Create an agent binary download source
POST
Get an agent binary download source
GET
Update an agent binary download source
PUT
Delete an agent binary download source
DELETE
Elastic Agent policies
Get agent policies
GET
Create an agent policy
POST
Bulk get agent policies
POST
Get an agent policy
GET
Update an agent policy
PUT
Get auto upgrade agent status
GET
Copy an agent policy
POST
Download an agent policy
GET
Get a full agent policy
GET
Get outputs for an agent policy
GET
Delete an agent policy
POST
Get outputs for agent policies
POST
Get a full K8s agent manifest
GET
Download an agent manifest
GET
Elastic Agent status
Get an agent status summary
GET
Elastic Agents
Get incoming agent data
GET
Get agents
GET
Get agents by action ids
POST
Get an agent
GET
Update an agent by ID
PUT
Delete an agent
DELETE
Get agent uploads
GET
Get available agent versions
GET
Delete an uploaded file
DELETE
Get an uploaded file
GET
Get agent setup info
GET
Initiate agent setup
POST
Get agent tags
GET
Elastic Package Manager (EPM)
Bulk get assets
POST
Get package categories
GET
Create a custom integration
POST
Update a custom integration
PUT
Get packages
GET
Install a package by upload
POST
Bulk install packages
POST
Bulk uninstall packages
POST
Get Bulk uninstall packages details
GET
Bulk upgrade packages
POST
Get Bulk upgrade packages details
GET
Get a package
GET
Update package settings
PUT
Install a package from the registry
POST
Delete a package
DELETE
Get a package file
GET
Delete assets for an input package
DELETE
Install Kibana assets for a package
POST
Delete Kibana assets for a package
DELETE
Authorize transforms
POST
Get package stats
GET
Get installed packages
GET
Get a limited package list
GET
Get an inputs template
GET
Get a package signature verification key ID
GET
Fleet enrollment API keys
Get enrollment API keys
GET
Create an enrollment API key
POST
Get an enrollment API key
GET
Revoke an enrollment API key
DELETE
Fleet internals
Check permissions
GET
Check Fleet Server health
POST
Get settings
GET
Update settings
PUT
Initiate Fleet setup
POST
Fleet outputs
Generate a Logstash API key
POST
Get outputs
GET
Create output
POST
Get output
GET
Update output
PUT
Delete output
DELETE
Get the latest output health
GET
Fleet package policies
Get package policies
GET
Create a package policy
POST
Bulk get package policies
POST
Get a package policy
GET
Update a package policy
PUT
Delete a package policy
DELETE
Bulk delete package policies
POST
Upgrade a package policy
POST
Dry run a package policy upgrade
POST
Fleet proxies
Get proxies
GET
Create a proxy
POST
Get a proxy
GET
Update a proxy
PUT
Delete a proxy
DELETE
Fleet Server hosts
Get Fleet Server hosts
GET
Create a Fleet Server host
POST
Get a Fleet Server host
GET
Update a Fleet Server host
PUT
Delete a Fleet Server host
DELETE
Fleet service tokens
Create a service token
POST
Fleet uninstall tokens
Get metadata for latest uninstall tokens
GET
Get a decrypted uninstall token
GET
Logstash configuration management
Get a Logstash pipeline
GET
Create or update a Logstash pipeline
PUT
Delete a Logstash pipeline
DELETE
Get all Logstash pipelines
GET
Maintenance windows
Create a maintenance window.
POST
Get maintenance window details.
GET
Delete a maintenance window.
DELETE
Update a maintenance window.
PATCH
Archive a maintenance window.
POST
Unarchive a maintenance window.
POST
Message Signing Service
Rotate a Fleet message signing key pair
POST
Machine learning
Sync saved objects in the default space
GET
Observability AI Assistant
Generate a chat completion
POST
Roles
Get all roles
GET
Get a role
GET
Create or update a role
PUT
Delete a role
DELETE
Create or update roles
POST
Saved objects
Rotate a key for encrypted saved objects
POST
Create saved objects
POST
Delete saved objects
POST
Get saved objects
POST
Resolve saved objects
POST
Update saved objects
POST
Export saved objects
POST
Search for saved objects
GET
Import saved objects
POST
Resolve import errors
POST
Create a saved object
POST
Get a saved object
GET
Update a saved object
PUT
Create a saved object
POST
Resolve a saved object
GET
Security AI assistant
Apply a bulk action to anonymization fields
POST
Get anonymization fields
GET
Create a model response
POST
Create a conversation
POST
Delete conversations
DELETE
Get conversations
GET
Get a conversation
GET
Update a conversation
PUT
Delete a conversation
DELETE
Read a KnowledgeBase
GET
Create a KnowledgeBase
POST
Create a Knowledge Base Entry
POST
Applies a bulk action to multiple Knowledge Base Entries
POST
Finds Knowledge Base Entries that match the given query.
GET
Read a Knowledge Base Entry
GET
Update a Knowledge Base Entry
PUT
Deletes a single Knowledge Base Entry using the `id` field
DELETE
Apply a bulk action to prompts
POST
Get prompts
GET
Security detections
Reads the alert index name if it exists
GET
Create an alerts index
POST
Delete an alerts index
DELETE
Returns user privileges for the Kibana space
GET
Retrieve a detection rule
GET
Update a detection rule
PUT
Create a detection rule
POST
Delete a detection rule
DELETE
Patch a detection rule
PATCH
Apply a bulk action to detection rules
POST
Export detection rules
POST
List all detection rules
GET
Import detection rules
POST
Install prebuilt detection rules and Timelines
PUT
Retrieve the status of prebuilt detection rules and Timelines
GET
Preview rule alerts generated on specified time range
POST
Assign and unassign users from detection alerts
POST
Finalize detection alert migrations
POST
Initiate a detection alert migration
POST
Clean up detection alert migrations
DELETE
Retrieve the status of detection alert migrations
GET
Find and/or aggregate detection alerts
POST
Set a detection alert status
POST
Add and remove detection alert tags
POST
List all detection rule tags
GET
Security endpoint exceptions
Create an endpoint exception list
POST
Get an endpoint exception list item
GET
Update an endpoint exception list item
PUT
Create an endpoint exception list item
POST
Delete an endpoint exception list item
DELETE
Get endpoint exception list items
GET
Security endpoint management
Get response actions
GET
Get response actions status
GET
Get action details
GET
Get file information
GET
Download a file
GET
Run a command
POST
Get a file
POST
Isolate an endpoint
POST
Terminate a process
POST
Get running processes
POST
Run a script
POST
Scan a file or directory
POST
Get actions state
GET
Suspend a process
POST
Release an isolated endpoint
POST
Upload a file
POST
Get a metadata list
GET
Get metadata
GET
Get a policy response
GET
Get a protection updates note
GET
Create or update a protection updates note
POST
Security entity analytics
Get an asset criticality record
GET
Upsert an asset criticality record
POST
Delete an asset criticality record
DELETE
Bulk upsert asset criticality records
POST
List asset criticality records
GET
Initialize the Privilege Monitoring Engine
POST
Health check on Privilege Monitoring
GET
Create a new monitored user
POST
Upsert multiple monitored users via CSV upload
POST
Update a monitored user
PUT
Delete a monitored user
DELETE
List all monitored users
GET
Installs the privileged access detection package for the Entity Analytics privileged user monitoring experience
POST
Gets the status of the privileged access detection package for the Entity Analytics privileged user monitoring experience
GET
Initialize the Entity Store
POST
List the Entity Engines
GET
Get an Entity Engine
GET
Delete the Entity Engine
DELETE
Initialize an Entity Engine
POST
Start an Entity Engine
POST
Stop an Entity Engine
POST
Apply DataView indices to all installed engines
POST
List Entity Store Entities
GET
Get the status of the Entity Store
GET
Cleanup the Risk Engine
DELETE
Configure the Risk Engine Saved Object
PATCH
Run the risk scoring engine
POST
Security exceptions
Create rule exception items
POST
Get exception list details
GET
Update an exception list
PUT
Create an exception list
POST
Delete an exception list
DELETE
Duplicate an exception list
POST
Export an exception list
POST
Get exception lists
GET
Import an exception list
POST
Get an exception list item
GET
Update an exception list item
PUT
Create an exception list item
POST
Delete an exception list item
DELETE
Get exception list items
GET
Get an exception list summary
GET
Create a shared exception list
POST
Security lists
Get value list details
GET
Update a value list
PUT
Create a value list
POST
Delete a value list
DELETE
Patch a value list
PATCH
Get value lists
GET
Get status of value list data streams
GET
Create list data streams
POST
Delete value list data streams
DELETE
Get a value list item
GET
Update a value list item
PUT
Create a value list item
POST
Delete a value list item
DELETE
Patch a value list item
PATCH
Export value list items
POST
Get value list items
GET
Import value list items
POST
Get value list privileges
GET
Security Osquery
Get live queries
GET
Create a live query
POST
Get live query details
GET
Get live query results
GET
Get packs
GET
Create a pack
POST
Get pack details
GET
Update a pack
PUT
Delete a pack
DELETE
Get saved queries
GET
Create a saved query
POST
Get saved query details
GET
Update a saved query
PUT
Delete a saved query
DELETE
Security timeline
Get notes
GET
Delete a note
DELETE
Add or update a note
PATCH
Pin/unpin an event
PATCH
Get Timeline or Timeline template details
GET
Create a Timeline or Timeline template
POST
Delete Timelines or Timeline templates
DELETE
Update a Timeline
PATCH
Copies timeline or timeline template
GET
Get draft Timeline or Timeline template details
GET
Create a clean draft Timeline or Timeline template
POST
Export Timelines
POST
Favorite a Timeline or Timeline template
PATCH
Import Timelines
POST
Install prepackaged Timelines
POST
Get an existing saved Timeline or Timeline template
GET
Get Timelines or Timeline templates
GET
Short URLs
Create a short URL
POST
Resolve a short URL
GET
Get a short URL
GET
Delete a short URL
DELETE
Service level objectives
Get a paginated list of SLOs
GET
Create an SLO
POST
Bulk delete SLO definitions and their associated summary and rollup data.
POST
Retrieve the status of the bulk deletion
GET
Batch delete rollup and summary data
POST
Batch delete rollup and summary data
POST
Get an SLO
GET
Update an SLO
PUT
Delete an SLO
DELETE
Reset an SLO
POST
Disable an SLO
POST
Enable an SLO
POST
Get the SLO definitions
GET
Spaces
Copy saved objects between spaces
POST
Disable legacy URL aliases
POST
Get shareable references
POST
Update saved objects in spaces
POST
Get all spaces
GET
Create a space
POST
Get a space
GET
Update a space
PUT
Delete a space
DELETE
Streams
Get stream list
GET
Disable streams
POST
Enable streams
POST
Resync streams
POST
Get a stream
GET
Create or update a stream
PUT
Delete a stream
DELETE
Fork a stream
POST
Get group stream settings
GET
Upsert group stream settings
PUT
Get ingest stream settings
GET
Update ingest stream settings
PUT
Export stream content
POST
Import content into a stream
POST
Get stream dashboards
GET
Bulk update dashboards
POST
Link a dashboard to a stream
PUT
Unlink a dashboard from a stream
DELETE
Get stream queries
GET
Bulk update queries
POST
Upsert a query to a stream
PUT
Remove a query from a stream
DELETE
Read the significant events
GET
Synthetics
Get monitors
GET
Create a monitor
POST
Delete monitors
POST
Get a monitor
GET
Update a monitor
PUT
Delete a monitor
DELETE
Get parameters
GET
Add parameters
POST
Delete parameters
DELETE
Get a parameter
GET
Update a parameter
PUT
Delete a parameter
DELETE
Get private locations
GET
Create a private location
POST
Get a private location
GET
Update a private location
PUT
Delete a private location
DELETE
System
Get features
GET
Get Kibana's current status
GET
Task manager
Get the task manager health
GET
Upgrade assistant
Get the upgrade readiness status
GET
Uptime
Get uptime settings
GET
Update uptime settings
PUT
User session management
Invalidate user sessions
POST
Search…
Ctrl+K
⌘K
Elastic APIs hub
Elastic Cloud API
Elastic Cloud Billing API
Elastic Cloud Enterprise API
Elastic Cloud Serverless API
Elasticsearch API
Elasticsearch Serverless API
Kibana API
Kibana Serverless API
Logstash API
Observability Intake Serverless API
Back to hub page
Download source
JSON OpenAPI specification
YAML OpenAPI specification
Feedback
Toggle dark mode
Dismiss highlight
Show more
Message Signing Service
