Deprecated: Update a managed integration Experimental; added in 9.5.0

PUT /api/fleet/agentless_policies/{policyId}
Api key auth Basic auth

Spaces method and path for this operation:

put /s/{space_id}/api/fleet/agentless_policies/{policyId}

Refer to Spaces for more information.

Deprecated. Use PUT /api/fleet/managed_integrations/{policyId} instead. Update a managed integration by ID. Uses full-replace semantics: the policy is rebuilt entirely from the request body, so any omitted optional field (for example, description, vars, global_data_tags, cloud_connector) is cleared or reset to its default. The integration package name is immutable and the runtime-managed cluster_id is preserved from the existing policy.

Headers

  • kbn-xsrf string Required

    A required header to protect against CSRF attacks

Path parameters

  • policyId string Required

    The ID of the managed integration to update.

    Maximum length is 256.

application/json

Body

  • additional_datastreams_permissions array[string] | null

    Additional data stream permissions that will be added to the agent policy.

    Not more than 100 elements. Maximum length of each is 256.

  • cloud_connector object | null

    Additional properties are NOT allowed.

    Hide cloud_connector attributes Show cloud_connector attributes object | null
    • cloud_connector_id string

      ID of an existing cloud connector to reuse. If not provided, a new connector is created. Requires enabled: true and cannot be combined with name.

      Maximum length is 256.

    • enabled boolean

      Set to true to attach a cloud connector to this policy. Must be true to set any of cloud_connector_id, name, or target_csp.

      Default value is false.

    • name string

      Name for a new cloud connector. If not provided, a name is generated automatically from the credentials. Requires enabled: true and only applies when creating a new connector (cannot be combined with cloud_connector_id).

      Minimum length is 1, maximum length is 255.

    • target_csp string

      Target cloud service provider. If not provided, the provider is detected automatically from the inputs. Requires enabled: true.

      Values are aws, azure, or gcp.

  • create_dataset_templates boolean

    When true, install dedicated index templates for streams with a custom data_stream.dataset. Defaults to true for input packages, false for integration packages.

  • description string

    Policy description.

    Maximum length is 2048.

  • force boolean

    Force package policy creation even if the package is not verified, or if the agent policy is managed.

  • global_data_tags array[object]

    Not more than 100 elements.

    Hide global_data_tags attributes Show global_data_tags attributes object
    • name string Required

      Name of the custom field. The name cannot contain spaces.

      Maximum length is 1024.

    • value string | number Required

      Value of the custom field.

      Any of:
      string-1 string number-2 number

      Maximum length is 1024.

  • id string

    Policy unique identifier.

    Maximum length is 255.

  • inputs object

    Package policy inputs. Refer to the integration documentation to know which inputs are available.

    Hide inputs attribute Show inputs attribute object
    • * object Additional properties

      Additional properties are NOT allowed.

      Hide * attributes Show * attributes object
      • condition string | null

        Agent condition expression to evaluate whether to apply this input.

        Maximum length is 10000.

      • deprecated object

        Additional properties are NOT allowed.

        Hide deprecated attributes Show deprecated attributes object
        • description string Required

          Maximum length is 4096.

        • replaced_by object
          Hide replaced_by attribute Show replaced_by attribute object
          • * string Additional properties

            Maximum length is 1024.

        • since string

          Maximum length is 50.

      • enabled boolean

        Enable or disable that input. Defaults to true (enabled).

      • streams object

        Input streams. Refer to the integration documentation to know which streams are available.

        Hide streams attribute Show streams attribute object
        • * object Additional properties

          Additional properties are NOT allowed.

          Hide * attributes Show * attributes object
          • condition string | null

            Agent condition expression to evaluate whether to apply this stream.

            Maximum length is 10000.

          • deprecated object

            Additional properties are NOT allowed.

            Hide deprecated attributes Show deprecated attributes object
            • description string Required

              Maximum length is 4096.

            • replaced_by object
              Hide replaced_by attribute Show replaced_by attribute object
              • * string Additional properties

                Maximum length is 1024.

            • since string

              Maximum length is 50.

          • enabled boolean

            Enable or disable that stream. Defaults to true (enabled).

          • var_group_selections object

            Variable group selections. Maps var_group name to the selected option name within that group.

            Hide var_group_selections attribute Show var_group_selections attribute object
            • * string Additional properties

              Maximum length is 1024.

          • vars object

            Input/stream level variable. Refer to the integration documentation for more information.

      • vars object

        Input/stream level variable. Refer to the integration documentation for more information.

  • name string Required

    Unique name for the policy.

    Maximum length is 255.

  • namespace string

    Policy namespace. When not specified, it inherits the agent policy namespace.

    Maximum length is 100.

  • package object Required

    Additional properties are NOT allowed.

    Hide package attributes Show package attributes object
    • experimental_data_stream_features array[object]

      Not more than 100 elements.

      Hide experimental_data_stream_features attributes Show experimental_data_stream_features attributes object
      • data_stream string Required

        Maximum length is 1024.

      • features object Required

        Additional properties are NOT allowed.

        Hide features attributes Show features attributes object
        • doc_value_only_numeric boolean
        • doc_value_only_other boolean
        • synthetic_source boolean
        • tsdb boolean
    • fips_compatible boolean
    • name string Required

      Package name

      Maximum length is 255.

    • requires_root boolean
    • title string

      Maximum length is 255.

    • version string Required

      Package version

      Maximum length is 50.

  • policy_template string

    The policy template to use for the managed integration. If not provided, the default policy template is used.

    Maximum length is 256.

  • var_group_selections object

    Variable group selections. Maps var_group name to the selected option name within that group.

    Hide var_group_selections attribute Show var_group_selections attribute object
    • * string Additional properties

      Maximum length is 1024.

  • vars object

    Input/stream level variable. Refer to the integration documentation for more information.

Responses

  • 200 application/json

    Indicates a successful response

    Hide response attribute Show response attribute object
    • item object Required

      Additional properties are NOT allowed.

      Hide item attributes Show item attributes object
      • additional_datastreams_permissions array[string]

        Additional data stream permissions granted to the managed integration.

        Not more than 1000 elements. Maximum length of each is 256.

      • cloud_connector object

        Additional properties are NOT allowed.

        Hide cloud_connector attributes Show cloud_connector attributes object
        • cloud_connector_id string Required

          The ID of the cloud connector.

          Maximum length is 255.

        • enabled boolean Required

          Whether the cloud connector is active for this policy.

      • created_at string Required

        Creation timestamp (ISO 8601).

        Maximum length is 64.

      • created_by string Required

        User who created the policy.

        Maximum length is 1024.

      • description string

        Managed integration description.

        Maximum length is 2048.

      • global_data_tags array[object]

        Custom data tags applied to all data produced by this policy.

        Not more than 100 elements.

        Hide global_data_tags attributes Show global_data_tags attributes object
        • name string Required

          The name of the custom field.

          Maximum length is 1024.

        • value string | number Required

          The value of the custom field.

          Any of:
          string-1 string number-2 number

          Maximum length is 1024.

      • id string Required

        Managed integration unique identifier.

        Maximum length is 255.

      • inputs object Required

        Package policy inputs. Refer to the integration documentation to know which inputs are available.

        Hide inputs attribute Show inputs attribute object
        • * object Additional properties

          Additional properties are NOT allowed.

          Hide * attributes Show * attributes object
          • condition string | null

            Agent condition expression to evaluate whether to apply this input.

            Maximum length is 10000.

          • deprecated object

            Additional properties are NOT allowed.

            Hide deprecated attributes Show deprecated attributes object
            • description string Required

              Maximum length is 4096.

            • replaced_by object
              Hide replaced_by attribute Show replaced_by attribute object
              • * string Additional properties

                Maximum length is 1024.

            • since string

              Maximum length is 50.

          • enabled boolean

            Enable or disable that input. Defaults to true (enabled).

          • streams object

            Input streams. Refer to the integration documentation to know which streams are available.

            Hide streams attribute Show streams attribute object
            • * object Additional properties

              Additional properties are NOT allowed.

              Hide * attributes Show * attributes object
              • condition string | null

                Agent condition expression to evaluate whether to apply this stream.

                Maximum length is 10000.

              • deprecated object

                Additional properties are NOT allowed.

                Hide deprecated attributes Show deprecated attributes object
                • description string Required

                  Maximum length is 4096.

                • replaced_by object
                  Hide replaced_by attribute Show replaced_by attribute object
                  • * string Additional properties

                    Maximum length is 1024.

                • since string

                  Maximum length is 50.

              • enabled boolean

                Enable or disable that stream. Defaults to true (enabled).

              • var_group_selections object

                Variable group selections. Maps var_group name to the selected option name within that group.

                Hide var_group_selections attribute Show var_group_selections attribute object
                • * string Additional properties

                  Maximum length is 1024.

              • vars object

                Input/stream level variable. Refer to the integration documentation for more information.

          • vars object

            Input/stream level variable. Refer to the integration documentation for more information.

      • name string Required

        Managed integration name.

        Maximum length is 255.

      • namespace string

        Policy namespace. Defaults to the agent policy namespace.

        Maximum length is 100.

      • package object Required

        Additional properties are NOT allowed.

        Hide package attributes Show package attributes object
        • name string Required

          Integration package name.

          Maximum length is 255.

        • title string Required

          Integration package display title.

          Maximum length is 255.

        • version string Required

          Integration package version.

          Maximum length is 50.

      • updated_at string Required

        Last update timestamp (ISO 8601).

        Maximum length is 64.

      • updated_by string Required

        User who last updated the policy.

        Maximum length is 1024.

      • var_group_selections object

        Variable group selections. Maps var_group name to the selected option name within that group.

        Hide var_group_selections attribute Show var_group_selections attribute object
        • * string Additional properties

          Maximum length is 1024.

      • vars object

        Input/stream level variable. Refer to the integration documentation for more information.
  • 400 application/json

    Bad Request

    Hide response attributes Show response attributes object
    • attributes Required
    • error string
    • errorType string
    • message string Required
    • statusCode number
  • 404 application/json

    Not Found

    Hide response attribute Show response attribute object
    • message string Required
  • 409 application/json

    Conflict — for example, the requested name is already used by another integration policy.

    Hide response attributes Show response attributes object
    • attributes Required
    • error string
    • errorType string
    • message string Required
    • statusCode number
PUT /api/fleet/agentless_policies/{policyId} 
curl \
 --request PUT 'https://localhost:5601/api/fleet/agentless_policies/{policyId}' \
 --header "Authorization: $API_KEY" \
 --header "Content-Type: application/json" \
 --header "kbn-xsrf: true" \
 --data '"{\n  \"cloud_connector\": {\n    \"enabled\": true,\n    \"target_csp\": \"aws\"\n  },\n  \"description\": \"CSPM integration for AWS with cloud connector\",\n  \"inputs\": {\n    \"cspm-cloudbeat/cis_aws\": {\n      \"enabled\": true,\n      \"streams\": {\n        \"cloud_security_posture.findings\": {\n          \"enabled\": true,\n          \"vars\": {\n            \"aws.account_type\": \"organization-account\",\n            \"aws.credentials.type\": \"cloud_connector\",\n            \"aws.supports_cloud_connectors\": true,\n            \"external_id\": {\n              \"id\": \"ABCDEFGHIJKLMNOPQRST\",\n              \"isSecretRef\": true\n            },\n            \"role_arn\": \"arn:aws:iam::123456789012:role/TestRole\"\n          }\n        }\n      },\n      \"vars\": {\n        \"cloud_formation_template\": \"https://console.aws.amazon.com/cloudformation/home#/stacks/quickcreate?templateURL=https://elastic-cspm-cft.s3.eu-central-1.amazonaws.com/cloudformation-cspm-ACCOUNT_TYPE-9.2.0.yml\"\n      }\n    },\n    \"cspm-cloudbeat/cis_azure\": {\n      \"enabled\": false\n    },\n    \"cspm-cloudbeat/cis_gcp\": {\n      \"enabled\": false\n    }\n  },\n  \"name\": \"cspm-aws-policy\",\n  \"namespace\": \"default\",\n  \"package\": {\n    \"name\": \"cloud_security_posture\",\n    \"version\": \"3.1.1\"\n  },\n  \"vars\": {\n    \"deployment\": \"aws\",\n    \"posture\": \"cspm\"\n  }\n}"'
Request examples
Example request to attach an AWS cloud connector to a managed integration on update. Because `PUT` is full-replace, the `cloud_connector` block must be present on every subsequent update or the connector is detached. 
{
  "cloud_connector": {
    "enabled": true,
    "target_csp": "aws"
  },
  "description": "CSPM integration for AWS with cloud connector",
  "inputs": {
    "cspm-cloudbeat/cis_aws": {
      "enabled": true,
      "streams": {
        "cloud_security_posture.findings": {
          "enabled": true,
          "vars": {
            "aws.account_type": "organization-account",
            "aws.credentials.type": "cloud_connector",
            "aws.supports_cloud_connectors": true,
            "external_id": {
              "id": "ABCDEFGHIJKLMNOPQRST",
              "isSecretRef": true
            },
            "role_arn": "arn:aws:iam::123456789012:role/TestRole"
          }
        }
      },
      "vars": {
        "cloud_formation_template": "https://console.aws.amazon.com/cloudformation/home#/stacks/quickcreate?templateURL=https://elastic-cspm-cft.s3.eu-central-1.amazonaws.com/cloudformation-cspm-ACCOUNT_TYPE-9.2.0.yml"
      }
    },
    "cspm-cloudbeat/cis_azure": {
      "enabled": false
    },
    "cspm-cloudbeat/cis_gcp": {
      "enabled": false
    }
  },
  "name": "cspm-aws-policy",
  "namespace": "default",
  "package": {
    "name": "cloud_security_posture",
    "version": "3.1.1"
  },
  "vars": {
    "deployment": "aws",
    "posture": "cspm"
  }
}
Example showing full-replace clearing semantics. Compared to the prior state, this request omits `description` (clearing it) and provides only the minimal required fields. Any optional field not present in the body (for example, `description`, `vars`, `global_data_tags`, `cloud_connector`) is dropped from the resulting policy. 
{
  "inputs": {
    "ESS Billing-cel": {
      "enabled": true,
      "streams": {
        "ess_billing.billing": {
          "enabled": true
        },
        "ess_billing.credits": {
          "enabled": true
        }
      },
      "vars": {
        "api_key": "<REPLACE_WITH_YOUR_API_KEY>",
        "organization_id": "1234"
      }
    }
  },
  "name": "ess_billing-1",
  "namespace": "default",
  "package": {
    "name": "ess_billing",
    "version": "1.6.0"
  }
}
Example request to update a managed integration. `PUT` uses full-replace semantics: the policy is rebuilt entirely from this body, so any omitted optional field is cleared or reset to its default rather than preserved. For example, omitting `description` clears it, omitting `vars` or `global_data_tags` removes them, and omitting `cloud_connector` detaches any previously attached connector. Detaching or swapping a cloud connector only removes the reference; the connector itself is not deleted, as connectors have an independent, shareable lifecycle and are managed through the cloud connector API. Two fields are exceptions that cannot be changed using `PUT`: the integration `package.name` is immutable, and the runtime-managed `cluster_id` is preserved from the existing agent policy. 
{
  "description": "updated description",
  "inputs": {
    "ESS Billing-cel": {
      "enabled": true,
      "streams": {
        "ess_billing.billing": {
          "enabled": true,
          "vars": {
            "hide_sensitive": true,
            "http_client_timeout": "30s",
            "lookbehind": 180,
            "tags": [
              "forwarded",
              "billing"
            ]
          }
        },
        "ess_billing.credits": {
          "enabled": true
        }
      },
      "vars": {
        "api_key": "<REPLACE_WITH_YOUR_API_KEY>",
        "organization_id": "1234"
      }
    }
  },
  "name": "ess_billing-1",
  "namespace": "default",
  "package": {
    "name": "ess_billing",
    "version": "1.6.0"
  }
}
Example request to update a managed integration reusing an existing AWS cloud connector by ID instead of creating a new one. 
{
  "cloud_connector": {
    "cloud_connector_id": "existing-aws-connector-id",
    "enabled": true,
    "target_csp": "aws"
  },
  "description": "CSPM integration for AWS reusing existing cloud connector",
  "inputs": {
    "cspm-cloudbeat/cis_aws": {
      "enabled": true,
      "streams": {
        "cloud_security_posture.findings": {
          "enabled": true,
          "vars": {
            "aws.account_type": "organization-account",
            "aws.credentials.type": "cloud_connector",
            "aws.supports_cloud_connectors": true,
            "external_id": {
              "id": "ABCDEFGHIJKLMNOPQRST",
              "isSecretRef": true
            },
            "role_arn": "arn:aws:iam::123456789012:role/TestRole"
          }
        }
      },
      "vars": {
        "cloud_formation_template": "https://console.aws.amazon.com/cloudformation/home#/stacks/quickcreate?templateURL=https://elastic-cspm-cft.s3.eu-central-1.amazonaws.com/cloudformation-cspm-ACCOUNT_TYPE-9.2.0.yml"
      }
    },
    "cspm-cloudbeat/cis_azure": {
      "enabled": false
    },
    "cspm-cloudbeat/cis_gcp": {
      "enabled": false
    }
  },
  "name": "cspm-aws-policy",
  "namespace": "default",
  "package": {
    "name": "cloud_security_posture",
    "version": "3.1.1"
  },
  "vars": {
    "deployment": "aws",
    "posture": "cspm"
  }
}
Example request to update a managed integration to a different package version. The package name is immutable, but the version may change. 
{
  "description": "bumped to a newer package version",
  "inputs": {
    "ESS Billing-cel": {
      "enabled": true,
      "streams": {
        "ess_billing.billing": {
          "enabled": true
        },
        "ess_billing.credits": {
          "enabled": false
        }
      },
      "vars": {
        "api_key": "<REPLACE_WITH_YOUR_API_KEY>",
        "organization_id": "1234"
      }
    }
  },
  "name": "ess_billing-1",
  "namespace": "default",
  "package": {
    "name": "ess_billing",
    "version": "1.7.0"
  }
}
Response examples (200)
Example response for updating a managed integration 
{
  "item": {
    "created_at": "2025-11-06T18:27:43.541Z",
    "created_by": "test_user",
    "description": "updated description",
    "id": "d52a7812-5736-4fdc-aed8-72152afa1ffa",
    "inputs": {
      "ESS Billing-cel": {
        "enabled": true,
        "streams": {
          "ess_billing.billing": {
            "enabled": true,
            "vars": {
              "hide_sensitive": true,
              "http_client_timeout": "30s",
              "lookbehind": 180,
              "tags": [
                "forwarded",
                "billing"
              ]
            }
          },
          "ess_billing.credits": {
            "enabled": true
          }
        },
        "vars": {
          "api_key": {
            "id": "QY1sWpoBbWcMW-edr0Ee",
            "isSecretRef": true
          },
          "organization_id": "1234",
          "url": "https://billing.elastic-cloud.com"
        }
      }
    },
    "name": "ess_billing-1",
    "namespace": "default",
    "package": {
      "name": "ess_billing",
      "title": "Elasticsearch Service Billing",
      "version": "1.6.0"
    },
    "updated_at": "2025-11-07T09:14:02.118Z",
    "updated_by": "test_user"
  }
}
Example response after attaching an AWS cloud connector on update 
{
  "item": {
    "cloud_connector": {
      "cloud_connector_id": "aws-connector-67890",
      "enabled": true
    },
    "created_at": "2025-11-06T18:27:43.541Z",
    "created_by": "test_user",
    "description": "CSPM integration for AWS with cloud connector",
    "id": "aws-policy-12345",
    "inputs": {
      "cspm-cloudbeat/cis_aws": {
        "enabled": true,
        "streams": {
          "cloud_security_posture.findings": {
            "enabled": true,
            "vars": {
              "aws.account_type": "organization-account",
              "aws.credentials.type": "cloud_connector",
              "external_id": {
                "id": "secret-external-id-123",
                "isSecretRef": true
              },
              "role_arn": "arn:aws:iam::123456789012:role/TestRole"
            }
          }
        },
        "vars": {
          "cloud_formation_template": "https://console.aws.amazon.com/cloudformation/home#/stacks/quickcreate?templateURL=https://elastic-cspm-cft.s3.eu-central-1.amazonaws.com/cloudformation-cspm-ACCOUNT_TYPE-9.2.0.yml"
        }
      },
      "cspm-cloudbeat/cis_azure": {
        "enabled": false
      },
      "cspm-cloudbeat/cis_gcp": {
        "enabled": false
      }
    },
    "name": "cspm-aws-policy",
    "namespace": "default",
    "package": {
      "name": "cloud_security_posture",
      "title": "Cloud Security Posture Management",
      "version": "3.1.1"
    },
    "updated_at": "2025-11-07T09:14:02.118Z",
    "updated_by": "test_user",
    "vars": {
      "deployment": "aws",
      "posture": "cspm"
    }
  }
}
Response examples (400)
Example of a generic error response 
{
  "error": "Bad Request",
  "message": "An error message describing what went wrong",
  "statusCode": 400
}
The integration package name cannot be changed on update 
{
  "error": "Bad Request",
  "message": "Cannot change the integration package of an agentless policy (from \"ess_billing\" to \"cloud_security_posture\").",
  "statusCode": 400
}
Response examples (404)
Example of a not found error response 
{
  "message": "Agentless policy d52a7812-5736-4fdc-aed8-72152afa1ffa not found"
}
Response examples (409)
Example of a name-conflict error response 
{
  "error": "Conflict",
  "message": "An integration policy with the name my-agentless-policy already exists. Please rename it or choose a different name.",
  "statusCode": 409
}