Create a managed integration Experimental; added in 9.3.0

POST /api/fleet/managed_integrations
Api key auth Basic auth

Spaces method and path for this operation:

post /s/{space_id}/api/fleet/managed_integrations

Refer to Spaces for more information.

Create a managed integration

Headers

  • kbn-xsrf string Required

    A required header to protect against CSRF attacks

application/json

Body

  • additional_datastreams_permissions array[string] | null

    Additional data stream permissions that will be added to the agent policy.

    Not more than 100 elements. Maximum length of each is 256.

  • cloud_connector object | null

    Additional properties are NOT allowed.

    Hide cloud_connector attributes Show cloud_connector attributes object | null
    • cloud_connector_id string

      ID of an existing cloud connector to reuse. If not provided, a new connector is created. Requires enabled: true and cannot be combined with name.

      Maximum length is 256.

    • enabled boolean

      Set to true to attach a cloud connector to this policy. Must be true to set any of cloud_connector_id, name, or target_csp.

      Default value is false.

    • name string

      Name for a new cloud connector. If not provided, a name is generated automatically from the credentials. Requires enabled: true and only applies when creating a new connector (cannot be combined with cloud_connector_id).

      Minimum length is 1, maximum length is 255.

    • target_csp string

      Target cloud service provider. If not provided, the provider is detected automatically from the inputs. Requires enabled: true.

      Values are aws, azure, or gcp.

  • create_dataset_templates boolean

    When true, install dedicated index templates for streams with a custom data_stream.dataset. Defaults to true for input packages, false for integration packages.

  • description string

    Policy description.

    Maximum length is 2048.

  • force boolean

    Force package policy creation even if the package is not verified, or if the agent policy is managed.

  • global_data_tags array[object]

    Not more than 100 elements.

    Hide global_data_tags attributes Show global_data_tags attributes object
    • name string Required

      Name of the custom field. The name cannot contain spaces.

      Maximum length is 1024.

    • value string | number Required

      Value of the custom field.

      Any of:
      string-1 string number-2 number

      Maximum length is 1024.

  • id string

    Policy unique identifier.

    Maximum length is 255.

  • inputs object

    Package policy inputs. Refer to the integration documentation to know which inputs are available.

    Hide inputs attribute Show inputs attribute object
    • * object Additional properties

      Additional properties are NOT allowed.

      Hide * attributes Show * attributes object
      • condition string | null

        Agent condition expression to evaluate whether to apply this input.

        Maximum length is 10000.

      • deprecated object

        Additional properties are NOT allowed.

        Hide deprecated attributes Show deprecated attributes object
        • description string Required

          Maximum length is 4096.

        • replaced_by object
          Hide replaced_by attribute Show replaced_by attribute object
          • * string Additional properties

            Maximum length is 1024.

        • since string

          Maximum length is 50.

      • enabled boolean

        Enable or disable that input. Defaults to true (enabled).

      • streams object

        Input streams. Refer to the integration documentation to know which streams are available.

        Hide streams attribute Show streams attribute object
        • * object Additional properties

          Additional properties are NOT allowed.

          Hide * attributes Show * attributes object
          • condition string | null

            Agent condition expression to evaluate whether to apply this stream.

            Maximum length is 10000.

          • deprecated object

            Additional properties are NOT allowed.

            Hide deprecated attributes Show deprecated attributes object
            • description string Required

              Maximum length is 4096.

            • replaced_by object
              Hide replaced_by attribute Show replaced_by attribute object
              • * string Additional properties

                Maximum length is 1024.

            • since string

              Maximum length is 50.

          • enabled boolean

            Enable or disable that stream. Defaults to true (enabled).

          • var_group_selections object

            Variable group selections. Maps var_group name to the selected option name within that group.

            Hide var_group_selections attribute Show var_group_selections attribute object
            • * string Additional properties

              Maximum length is 1024.

          • vars object

            Input/stream level variable. Refer to the integration documentation for more information.

      • vars object

        Input/stream level variable. Refer to the integration documentation for more information.

  • name string Required

    Unique name for the policy.

    Maximum length is 255.

  • namespace string

    Policy namespace. When not specified, it inherits the agent policy namespace.

    Maximum length is 100.

  • package object Required

    Additional properties are NOT allowed.

    Hide package attributes Show package attributes object
    • experimental_data_stream_features array[object]

      Not more than 100 elements.

      Hide experimental_data_stream_features attributes Show experimental_data_stream_features attributes object
      • data_stream string Required

        Maximum length is 1024.

      • features object Required

        Additional properties are NOT allowed.

        Hide features attributes Show features attributes object
        • doc_value_only_numeric boolean
        • doc_value_only_other boolean
        • synthetic_source boolean
        • tsdb boolean
    • fips_compatible boolean
    • name string Required

      Package name

      Maximum length is 255.

    • requires_root boolean
    • title string

      Maximum length is 255.

    • version string Required

      Package version

      Maximum length is 50.

  • policy_template string

    The policy template to use for the managed integration. If not provided, the default policy template is used.

    Maximum length is 256.

  • var_group_selections object

    Variable group selections. Maps var_group name to the selected option name within that group.

    Hide var_group_selections attribute Show var_group_selections attribute object
    • * string Additional properties

      Maximum length is 1024.

  • vars object

    Input/stream level variable. Refer to the integration documentation for more information.

Responses

  • 200 application/json

    Indicates a successful response

    Hide response attribute Show response attribute object
    • item object Required

      Additional properties are NOT allowed.

      Hide item attributes Show item attributes object
      • additional_datastreams_permissions array[string]

        Additional data stream permissions granted to the managed integration.

        Not more than 1000 elements. Maximum length of each is 256.

      • cloud_connector object

        Additional properties are NOT allowed.

        Hide cloud_connector attributes Show cloud_connector attributes object
        • cloud_connector_id string Required

          The ID of the cloud connector.

          Maximum length is 255.

        • enabled boolean Required

          Whether the cloud connector is active for this policy.

      • created_at string Required

        Creation timestamp (ISO 8601).

        Maximum length is 64.

      • created_by string Required

        User who created the policy.

        Maximum length is 1024.

      • description string

        Managed integration description.

        Maximum length is 2048.

      • global_data_tags array[object]

        Custom data tags applied to all data produced by this policy.

        Not more than 100 elements.

        Hide global_data_tags attributes Show global_data_tags attributes object
        • name string Required

          The name of the custom field.

          Maximum length is 1024.

        • value string | number Required

          The value of the custom field.

          Any of:
          string-1 string number-2 number

          Maximum length is 1024.

      • id string Required

        Managed integration unique identifier.

        Maximum length is 255.

      • inputs object Required

        Package policy inputs. Refer to the integration documentation to know which inputs are available.

        Hide inputs attribute Show inputs attribute object
        • * object Additional properties

          Additional properties are NOT allowed.

          Hide * attributes Show * attributes object
          • condition string | null

            Agent condition expression to evaluate whether to apply this input.

            Maximum length is 10000.

          • deprecated object

            Additional properties are NOT allowed.

            Hide deprecated attributes Show deprecated attributes object
            • description string Required

              Maximum length is 4096.

            • replaced_by object
              Hide replaced_by attribute Show replaced_by attribute object
              • * string Additional properties

                Maximum length is 1024.

            • since string

              Maximum length is 50.

          • enabled boolean

            Enable or disable that input. Defaults to true (enabled).

          • streams object

            Input streams. Refer to the integration documentation to know which streams are available.

            Hide streams attribute Show streams attribute object
            • * object Additional properties

              Additional properties are NOT allowed.

              Hide * attributes Show * attributes object
              • condition string | null

                Agent condition expression to evaluate whether to apply this stream.

                Maximum length is 10000.

              • deprecated object

                Additional properties are NOT allowed.

                Hide deprecated attributes Show deprecated attributes object
                • description string Required

                  Maximum length is 4096.

                • replaced_by object
                  Hide replaced_by attribute Show replaced_by attribute object
                  • * string Additional properties

                    Maximum length is 1024.

                • since string

                  Maximum length is 50.

              • enabled boolean

                Enable or disable that stream. Defaults to true (enabled).

              • var_group_selections object

                Variable group selections. Maps var_group name to the selected option name within that group.

                Hide var_group_selections attribute Show var_group_selections attribute object
                • * string Additional properties

                  Maximum length is 1024.

              • vars object

                Input/stream level variable. Refer to the integration documentation for more information.

          • vars object

            Input/stream level variable. Refer to the integration documentation for more information.

      • name string Required

        Managed integration name.

        Maximum length is 255.

      • namespace string

        Policy namespace. Defaults to the agent policy namespace.

        Maximum length is 100.

      • package object Required

        Additional properties are NOT allowed.

        Hide package attributes Show package attributes object
        • name string Required

          Integration package name.

          Maximum length is 255.

        • title string Required

          Integration package display title.

          Maximum length is 255.

        • version string Required

          Integration package version.

          Maximum length is 50.

      • updated_at string Required

        Last update timestamp (ISO 8601).

        Maximum length is 64.

      • updated_by string Required

        User who last updated the policy.

        Maximum length is 1024.

      • var_group_selections object

        Variable group selections. Maps var_group name to the selected option name within that group.

        Hide var_group_selections attribute Show var_group_selections attribute object
        • * string Additional properties

          Maximum length is 1024.

      • vars object

        Input/stream level variable. Refer to the integration documentation for more information.
  • 400 application/json

    Bad Request

    Hide response attributes Show response attributes object
    • attributes Required
    • error string
    • errorType string
    • message string Required
    • statusCode number
  • 409 application/json

    Conflict

    Hide response attributes Show response attributes object
    • attributes Required
    • error string
    • errorType string
    • message string Required
    • statusCode number
POST /api/fleet/managed_integrations 
curl \
 --request POST 'https://localhost:5601/api/fleet/managed_integrations' \
 --header "Authorization: $API_KEY" \
 --header "Content-Type: application/json" \
 --header "kbn-xsrf: true" \
 --data '"{\n  \"description\": \"test\",\n  \"inputs\": {\n    \"ESS Billing-cel\": {\n      \"enabled\": true,\n      \"streams\": {\n        \"ess_billing.billing\": {\n          \"enabled\": true,\n          \"vars\": {\n            \"hide_sensitive\": true,\n            \"http_client_timeout\": \"30s\",\n            \"lookbehind\": 365,\n            \"tags\": [\n              \"forwarded\",\n              \"billing\"\n            ]\n          }\n        },\n        \"ess_billing.credits\": {\n          \"enabled\": false\n        }\n      },\n      \"vars\": {\n        \"api_key\": \"\u003cREPLACE_WITH_YOUR_API_KEY\u003e\",\n        \"organization_id\": \"1234\"\n      }\n    }\n  },\n  \"name\": \"ess_billing-1\",\n  \"namespace\": \"default\",\n  \"package\": {\n    \"name\": \"ess_billing\",\n    \"version\": \"1.6.0\"\n  }\n}"'
Request examples
Example request to create a managed integration 
{
  "description": "test",
  "inputs": {
    "ESS Billing-cel": {
      "enabled": true,
      "streams": {
        "ess_billing.billing": {
          "enabled": true,
          "vars": {
            "hide_sensitive": true,
            "http_client_timeout": "30s",
            "lookbehind": 365,
            "tags": [
              "forwarded",
              "billing"
            ]
          }
        },
        "ess_billing.credits": {
          "enabled": false
        }
      },
      "vars": {
        "api_key": "<REPLACE_WITH_YOUR_API_KEY>",
        "organization_id": "1234"
      }
    }
  },
  "name": "ess_billing-1",
  "namespace": "default",
  "package": {
    "name": "ess_billing",
    "version": "1.6.0"
  }
}
Example request to create a managed integration reusing an existing AWS cloud connector 
{
  "cloud_connector": {
    "cloud_connector_id": "existing-aws-connector-id",
    "enabled": true,
    "target_csp": "aws"
  },
  "description": "CSPM integration for AWS reusing existing cloud connector",
  "inputs": {
    "cspm-cloudbeat/cis_aws": {
      "enabled": true,
      "streams": {
        "cloud_security_posture.findings": {
          "enabled": true,
          "vars": {
            "aws.account_type": "organization-account",
            "aws.credentials.type": "cloud_connector",
            "aws.supports_cloud_connectors": true,
            "external_id": {
              "id": "ABCDEFGHIJKLMNOPQRST",
              "isSecretRef": true
            },
            "role_arn": "arn:aws:iam::123456789012:role/TestRole"
          }
        }
      },
      "vars": {
        "cloud_formation_template": "https://console.aws.amazon.com/cloudformation/home#/stacks/quickcreate?templateURL=https://elastic-cspm-cft.s3.eu-central-1.amazonaws.com/cloudformation-cspm-ACCOUNT_TYPE-9.2.0.yml"
      }
    },
    "cspm-cloudbeat/cis_azure": {
      "enabled": false
    },
    "cspm-cloudbeat/cis_gcp": {
      "enabled": false
    }
  },
  "name": "cspm-aws-reuse-policy",
  "namespace": "default",
  "package": {
    "name": "cloud_security_posture",
    "version": "3.1.1"
  },
  "vars": {
    "deployment": "aws",
    "posture": "cspm"
  }
}
Example request to create a managed integration with AWS cloud connector 
{
  "cloud_connector": {
    "enabled": true,
    "target_csp": "aws"
  },
  "description": "CSPM integration for AWS with cloud connector",
  "inputs": {
    "cspm-cloudbeat/cis_aws": {
      "enabled": true,
      "streams": {
        "cloud_security_posture.findings": {
          "enabled": true,
          "vars": {
            "aws.account_type": "organization-account",
            "aws.credentials.type": "cloud_connector",
            "aws.supports_cloud_connectors": true,
            "external_id": {
              "id": "ABCDEFGHIJKLMNOPQRST",
              "isSecretRef": true
            },
            "role_arn": "arn:aws:iam::123456789012:role/TestRole"
          }
        }
      },
      "vars": {
        "cloud_formation_template": "https://console.aws.amazon.com/cloudformation/home#/stacks/quickcreate?templateURL=https://elastic-cspm-cft.s3.eu-central-1.amazonaws.com/cloudformation-cspm-ACCOUNT_TYPE-9.2.0.yml"
      }
    },
    "cspm-cloudbeat/cis_azure": {
      "enabled": false
    },
    "cspm-cloudbeat/cis_gcp": {
      "enabled": false
    }
  },
  "name": "cspm-aws-policy",
  "namespace": "default",
  "package": {
    "name": "cloud_security_posture",
    "version": "3.1.1"
  },
  "vars": {
    "deployment": "aws",
    "posture": "cspm"
  }
}
Example request to create a managed integration with Azure cloud connector 
{
  "cloud_connector": {
    "enabled": true,
    "target_csp": "azure"
  },
  "description": "CSPM integration for Azure with cloud connector",
  "inputs": {
    "cspm-cloudbeat/cis_aws": {
      "enabled": false
    },
    "cspm-cloudbeat/cis_azure": {
      "enabled": true,
      "streams": {
        "cloud_security_posture.findings": {
          "enabled": true,
          "vars": {
            "azure_credentials_cloud_connector_id": {
              "type": "text",
              "value": "existing-azure-credentials-connector-id"
            },
            "azure.account_type": "organization-account",
            "client_id": {
              "id": "client-secret-id",
              "isSecretRef": true
            },
            "tenant_id": {
              "id": "tenant-secret-id",
              "isSecretRef": true
            }
          }
        }
      }
    },
    "cspm-cloudbeat/cis_gcp": {
      "enabled": false
    }
  },
  "name": "cspm-azure-policy",
  "namespace": "default",
  "package": {
    "name": "cloud_security_posture",
    "version": "3.1.1"
  },
  "vars": {
    "deployment": "azure",
    "posture": "cspm"
  }
}
Response examples (200)
Example response for creating a managed integration 
{
  "item": {
    "created_at": "2025-11-06T18:27:43.541Z",
    "created_by": "test_user",
    "description": "test",
    "id": "d52a7812-5736-4fdc-aed8-72152afa1ffa",
    "inputs": {
      "ESS Billing-cel": {
        "enabled": true,
        "streams": {
          "ess_billing.billing": {
            "enabled": true,
            "vars": {
              "hide_sensitive": true,
              "http_client_timeout": "30s",
              "lookbehind": 365,
              "tags": [
                "forwarded",
                "billing"
              ]
            }
          },
          "ess_billing.credits": {
            "enabled": false
          }
        },
        "vars": {
          "api_key": {
            "id": "QY1sWpoBbWcMW-edr0Ee",
            "isSecretRef": true
          },
          "organization_id": "1234",
          "url": "https://billing.elastic-cloud.com"
        }
      }
    },
    "name": "ess_billing-1",
    "namespace": "default",
    "package": {
      "name": "ess_billing",
      "title": "Elasticsearch Service Billing",
      "version": "1.6.0"
    },
    "updated_at": "2025-11-06T18:27:43.541Z",
    "updated_by": "test_user"
  }
}
Example response for AWS cloud connector integration 
{
  "item": {
    "cloud_connector": {
      "cloud_connector_id": "aws-connector-67890",
      "enabled": true
    },
    "created_at": "2025-11-06T18:27:43.541Z",
    "created_by": "test_user",
    "description": "CSPM integration for AWS with cloud connector",
    "id": "aws-policy-12345",
    "inputs": {
      "cspm-cloudbeat/cis_aws": {
        "enabled": true,
        "streams": {
          "cloud_security_posture.findings": {
            "enabled": true,
            "vars": {
              "aws.account_type": "organization-account",
              "aws.credentials.type": "cloud_connector",
              "external_id": {
                "id": "secret-external-id-123",
                "isSecretRef": true
              },
              "role_arn": "arn:aws:iam::123456789012:role/TestRole"
            }
          }
        },
        "vars": {
          "cloud_formation_template": "https://console.aws.amazon.com/cloudformation/home#/stacks/quickcreate?templateURL=https://elastic-cspm-cft.s3.eu-central-1.amazonaws.com/cloudformation-cspm-ACCOUNT_TYPE-9.2.0.yml"
        }
      },
      "cspm-cloudbeat/cis_azure": {
        "enabled": false
      },
      "cspm-cloudbeat/cis_gcp": {
        "enabled": false
      }
    },
    "name": "cspm-aws-policy",
    "namespace": "default",
    "package": {
      "name": "cloud_security_posture",
      "title": "Cloud Security Posture Management",
      "version": "3.1.1"
    },
    "updated_at": "2025-11-06T18:27:43.541Z",
    "updated_by": "test_user",
    "vars": {
      "deployment": "aws",
      "posture": "cspm"
    }
  }
}
Example response for Azure cloud connector integration 
{
  "item": {
    "cloud_connector": {
      "cloud_connector_id": "azure-connector-67890",
      "enabled": true
    },
    "created_at": "2025-11-06T18:27:43.541Z",
    "created_by": "test_user",
    "description": "CSPM integration for Azure with cloud connector",
    "id": "azure-policy-12345",
    "inputs": {
      "cspm-cloudbeat/cis_aws": {
        "enabled": false
      },
      "cspm-cloudbeat/cis_azure": {
        "enabled": true,
        "streams": {
          "cloud_security_posture.findings": {
            "enabled": true,
            "vars": {
              "azure_credentials_cloud_connector_id": {
                "type": "text",
                "value": "existing-azure-credentials-connector-id"
              },
              "azure.account_type": "organization-account",
              "client_id": {
                "id": "client-secret-id-456",
                "isSecretRef": true
              },
              "tenant_id": {
                "id": "tenant-secret-id-123",
                "isSecretRef": true
              }
            }
          }
        }
      },
      "cspm-cloudbeat/cis_gcp": {
        "enabled": false
      }
    },
    "name": "cspm-azure-policy",
    "namespace": "default",
    "package": {
      "name": "cloud_security_posture",
      "title": "Cloud Security Posture Management",
      "version": "3.1.1"
    },
    "updated_at": "2025-11-06T18:27:43.541Z",
    "updated_by": "test_user",
    "vars": {
      "deployment": "azure",
      "posture": "cspm"
    }
  }
}
Response examples (400)
Example of a generic error response 
{
  "error": "Bad Request",
  "message": "An error message describing what went wrong",
  "statusCode": 400
}
Response examples (409)
Example of a conflict error response 
{
  "error": "Conflict",
  "message": "An error message describing what went wrong",
  "statusCode": 409
}