Install a package by upload

POST /api/fleet/epm/packages
Api key auth Basic auth

Spaces method and path for this operation:

post /s/{space_id}/api/fleet/epm/packages

Refer to Spaces for more information.

Install a package by uploading a .zip or .tar.gz archive (max 100MB).

Archives that contain Kibana assets requiring additional privileges are subject to a preflight authorization check before the package is installed. Privileges are checked in every space the package will be installed into.

The following asset types require the corresponding Kibana API privilege:

  • security_rule: rules-all
  • security_rule with type machine_learning: rules-all and ml:canCreateJob
  • security_ai_prompt: elasticAssistant

If any required privilege is missing, the request returns 403 and no assets are written. To learn more, refer to Upload an integration to Kibana.

[Required authorization] Route required privileges: integrations-all AND fleet-agent-policies-all.

Headers

  • kbn-xsrf string Required

    A required header to protect against CSRF attacks

Query parameters

  • ignoreMappingUpdateErrors boolean

    When true, ignore mapping update errors during installation

    Default value is false.

  • skipDataStreamRollover boolean

    When true, skip data stream rollover after installation

    Default value is false.

Body

Body

string(binary) string(binary)

Responses

  • 200

    Successful response

    Hide response attributes Show response attributes object
    • _meta object Required

      Additional properties are NOT allowed.

      Hide _meta attributes Show _meta attributes object
      • install_source string Required
      • name string Required
    • items array[object] Required

      Not more than 10000 elements.

      Any of:
      kibana_asset_reference object es_asset_reference object
  • 400

    Bad Request

    Hide response attributes Show response attributes object
    • attributes Required
    • error string
    • errorType string
    • message string Required
    • statusCode number
  • 403

    Forbidden. The caller lacks a Kibana API privilege required by an asset in the archive. No assets are written.

    Hide response attributes Show response attributes object
    • attributes Required
    • error string
    • errorType string
    • message string Required
    • statusCode number
POST /api/fleet/epm/packages 
curl \
 --request POST 'https://localhost:5601/api/fleet/epm/packages' \
 --header "Authorization: $API_KEY" \
 --header "Content-Type: application/gzip" \
 --header "kbn-xsrf: true"
curl \
 --request POST 'https://localhost:5601/api/fleet/epm/packages' \
 --header "Authorization: $API_KEY" \
 --header "Content-Type: application/gzip; application/zip" \
 --header "kbn-xsrf: true" \
 --data-binary '<binary package archive>'
Request example
Upload a .zip or .tar.gz package archive (max 100MB) 
<binary package archive>
Request example
Upload a .zip or .tar.gz package archive (max 100MB) 
<binary package archive>
Response examples (200)
Package successfully installed from upload 
{"_meta" => {"install_source" => "upload"}, "items" => [{"id" => "my-custom-package-logs-default", "type" => "index_template"}]}
Response examples (200)
Package successfully installed from upload 
{
  "_meta": {
    "install_source": "upload"
  },
  "items": [
    {
      "id": "my-custom-package-logs-default",
      "type": "index_template"
    }
  ]
}
Response examples (400)
Example of a generic error response 
{"error" => "Bad Request", "message" => "An error message describing what went wrong", "statusCode" => 400}
Response examples (400)
Example of a generic error response 
{
  "error": "Bad Request",
  "message": "An error message describing what went wrong",
  "statusCode": 400
}
Response examples (403)
Caller lacks a privilege required by a gated asset type in the archive 
{"error" => "Forbidden", "message" => "Insufficient privileges to upload this package", "statusCode" => 403}
Response examples (403)
Caller lacks a privilege required by a gated asset type in the archive 
{
  "error": "Forbidden",
  "message": "Insufficient privileges to upload this package",
  "statusCode": 403
}