Elastic APIs hub
  • Elastic Cloud API
  • Elastic Cloud Billing API
  • Elastic Cloud Enterprise API
  • Elastic Cloud Serverless API
  • Elasticsearch API
  • Elasticsearch Serverless API
  • Kibana API
  • Kibana Serverless API
  • Logstash API
  • Observability Intake Serverless API
Back to hub page
API Changelog
Download source
  • JSON OpenAPI specification
  • YAML OpenAPI specification
Feedback
Kibana API logo
main
  • main default
  • v8
  • v9

Topics

  • Introduction
  • Authentication
  • Kibana spaces

Endpoints

  • Alerting
    • Get the alerting framework health GET
    • Get the rule types GET
    • Get rule details GET
    • Update a rule PUT
    • Create a rule POST
    • Delete a rule DELETE
    • Disable a rule POST
    • Enable a rule POST
    • Mute all alerts POST
    • Unmute all alerts POST
    • Update the API key for a rule POST
    • Schedule a snooze for the rule POST
    • Mute an alert POST
    • Unmute an alert POST
    • Delete a snooze schedule for a rule DELETE
    • Get information about rules GET
  • APM agent configuration
    • Get a list of agent configurations GET
    • Create or update agent configuration PUT
    • Delete agent configuration DELETE
    • Get agent name for service GET
    • Get environments for service GET
    • Lookup single agent configuration POST
    • Get single agent configuration GET
  • APM agent keys
    • Create an APM agent key POST
  • APM annotations
    • Create a service annotation POST
    • Search for annotations GET
  • APM server schema
    • Save APM server schema POST
  • APM sourcemaps
    • Get source maps GET
    • Upload a source map POST
    • Delete source map DELETE
  • Cases
    • Create a case POST
    • Delete cases DELETE
    • Update cases PATCH
    • Search cases GET
    • Get case information GET
    • Get all alerts for a case GET
    • Add a case comment or alert POST
    • Delete all case comments and alerts DELETE
    • Update a case comment or alert PATCH
    • Find case comments and alerts GET
    • Get a case comment or alert GET
    • Delete a case comment or alert DELETE
    • Push a case to an external service POST
    • Attach a file to a case POST
    • Find case activity GET
    • Get cases for an alert GET
    • Get case settings GET
    • Add case settings POST
    • Update case settings PATCH
    • Get case connectors GET
    • Get case creators GET
    • Get case tags GET
  • Connectors
    • Get connector types GET
    • Get connector information GET
    • Update a connector PUT
    • Create a connector POST
    • Delete a connector DELETE
    • Run a connector POST
    • Get all connectors GET
  • Dashboards
    • Get a list of dashboards GET
    • Get a dashboard GET
    • Update an existing dashboard PUT
    • Create a dashboard POST
    • Delete a dashboard DELETE
  • Data streams
    • Get data streams GET
    • Get data streams GET
  • Data views
    • Get all data views GET
    • Create a data view POST
    • Get a data view GET
    • Update a data view POST
    • Delete a data view DELETE
    • Update data view fields metadata POST
    • Create or update a runtime field PUT
    • Create a runtime field POST
    • Get a runtime field GET
    • Update a runtime field POST
    • Delete a runtime field from a data view DELETE
    • Get the default data view GET
    • Set the default data view POST
    • Swap saved object references POST
    • Preview a saved object reference swap POST
  • Elastic Agent actions
    • Create an agent action POST
    • Reassign an agent POST
    • Request agent diagnostics POST
    • Unenroll an agent POST
    • Upgrade an agent POST
    • Get an agent action status GET
    • Cancel an agent action POST
    • Bulk reassign agents POST
    • Bulk request diagnostics from agents POST
    • Bulk unenroll agents POST
    • Bulk update agent tags POST
    • Bulk upgrade agents POST
  • Elastic Agent binary download sources
    • Get agent binary download sources GET
    • Create an agent binary download source POST
    • Get an agent binary download source GET
    • Update an agent binary download source PUT
    • Delete an agent binary download source DELETE
  • Elastic Agent policies
    • Get agent policies GET
    • Create an agent policy POST
    • Bulk get agent policies POST
    • Get an agent policy GET
    • Update an agent policy PUT
    • Get auto upgrade agent status GET
    • Copy an agent policy POST
    • Download an agent policy GET
    • Get a full agent policy GET
    • Get outputs for an agent policy GET
    • Delete an agent policy POST
    • Get outputs for agent policies POST
    • Get a full K8s agent manifest GET
    • Download an agent manifest GET
  • Elastic Agent status
    • Get an agent status summary GET
  • Elastic Agents
    • Get incoming agent data GET
    • Get agents GET
    • Get agents by action ids POST
    • Get an agent GET
    • Update an agent PUT
    • Delete an agent DELETE
    • Migrate a single agent POST
    • Get agent uploads GET
    • Get available agent versions GET
    • Delete an uploaded file DELETE
    • Get an uploaded file GET
    • Get agent setup info GET
    • Initiate agent setup POST
    • Get agent tags GET
  • Elastic Package Manager (EPM)
    • Bulk get assets POST
    • Get package categories GET
    • Create a custom integration POST
    • Update a custom integration PUT
    • Get packages GET
    • Install a package by upload POST
    • Bulk install packages POST
    • Get a package GET
    • Update package settings PUT
    • Install a package from the registry POST
    • Delete a package DELETE
    • Get a package file GET
    • Delete assets for an input package DELETE
    • Install Kibana assets for a package POST
    • Delete Kibana assets for a package DELETE
    • Authorize transforms POST
    • Get package stats GET
    • Get installed packages GET
    • Get a limited package list GET
    • Get an inputs template GET
    • Get a package signature verification key ID GET
  • Fleet enrollment API keys
    • Get enrollment API keys GET
    • Create an enrollment API key POST
    • Get an enrollment API key GET
    • Revoke an enrollment API key DELETE
  • Fleet internals
    • Check permissions GET
    • Check Fleet Server health POST
    • Get settings GET
    • Update settings PUT
    • Initiate Fleet setup POST
  • Fleet outputs
    • Generate a Logstash API key POST
    • Get outputs GET
    • Create output POST
    • Get output GET
    • Update output PUT
    • Delete output DELETE
    • Get the latest output health GET
  • Fleet package policies
    • Get package policies GET
    • Create a package policy POST
    • Bulk get package policies POST
    • Get a package policy GET
    • Update a package policy PUT
    • Delete a package policy DELETE
    • Bulk delete package policies POST
    • Upgrade a package policy POST
    • Dry run a package policy upgrade POST
  • Fleet proxies
    • Get proxies GET
    • Create a proxy POST
    • Get a proxy GET
    • Update a proxy PUT
    • Delete a proxy DELETE
  • Fleet Server hosts
    • Get Fleet Server hosts GET
    • Create a Fleet Server host POST
    • Get a Fleet Server host GET
    • Update a Fleet Server host PUT
    • Delete a Fleet Server host DELETE
  • Fleet service tokens
    • Create a service token POST
  • Fleet uninstall tokens
    • Get metadata for latest uninstall tokens GET
    • Get a decrypted uninstall token GET
  • Logstash configuration management
    • Get a Logstash pipeline GET
    • Create or update a Logstash pipeline PUT
    • Delete a Logstash pipeline DELETE
    • Get all Logstash pipelines GET
  • Maintenance windows
    • Create a maintenance window. POST
    • Get maintenance window details. GET
    • Delete a maintenance window. DELETE
    • Update a maintenance window. PATCH
    • Archive a maintenance window. POST
    • Unarchive a maintenance window. POST
  • Message Signing Service
    • Rotate a Fleet message signing key pair POST
  • Machine learning
    • Sync saved objects in the default space GET
  • Roles
    • Get all roles GET
    • Get a role GET
    • Create or update a role PUT
    • Delete a role DELETE
    • Create or update roles POST
  • Saved objects
    • Rotate a key for encrypted saved objects POST
    • Create saved objects POST
    • Delete saved objects POST
    • Get saved objects POST
    • Resolve saved objects POST
    • Update saved objects POST
    • Export saved objects POST
    • Search for saved objects GET
    • Import saved objects POST
    • Resolve import errors POST
    • Create a saved object POST
    • Get a saved object GET
    • Update a saved object PUT
    • Create a saved object POST
    • Resolve a saved object GET
  • Security AI assistant
    • Apply a bulk action to anonymization fields POST
    • Get anonymization fields GET
    • Create a model response POST
    • Create a conversation POST
    • Get conversations GET
    • Get a conversation GET
    • Update a conversation PUT
    • Delete a conversation DELETE
    • Read a KnowledgeBase GET
    • Create a KnowledgeBase POST
    • Create a Knowledge Base Entry POST
    • Applies a bulk action to multiple Knowledge Base Entries POST
    • Finds Knowledge Base Entries that match the given query. GET
    • Read a Knowledge Base Entry GET
    • Update a Knowledge Base Entry PUT
    • Deletes a single Knowledge Base Entry using the `id` field DELETE
    • Apply a bulk action to prompts POST
    • Get prompts GET
  • Security detections
    • Reads the alert index name if it exists GET
    • Create an alerts index POST
    • Delete an alerts index DELETE
    • Returns user privileges for the Kibana space GET
    • Retrieve a detection rule GET
    • Update a detection rule PUT
    • Create a detection rule POST
    • Delete a detection rule DELETE
    • Patch a detection rule PATCH
    • Apply a bulk action to detection rules POST
    • Export detection rules POST
    • List all detection rules GET
    • Import detection rules POST
    • Install prebuilt detection rules and Timelines PUT
    • Retrieve the status of prebuilt detection rules and Timelines GET
    • Preview rule alerts generated on specified time range POST
    • Assign and unassign users from detection alerts POST
    • Finalize detection alert migrations POST
    • Initiate a detection alert migration POST
    • Clean up detection alert migrations DELETE
    • Retrieve the status of detection alert migrations GET
    • Find and/or aggregate detection alerts POST
    • Set a detection alert status POST
    • Add and remove detection alert tags POST
    • List all detection rule tags GET
  • Security endpoint exceptions
    • Create an endpoint exception list POST
    • Get an endpoint exception list item GET
    • Update an endpoint exception list item PUT
    • Create an endpoint exception list item POST
    • Delete an endpoint exception list item DELETE
    • Get endpoint exception list items GET
  • Security endpoint management
    • Get response actions GET
    • Get response actions status GET
    • Get action details GET
    • Get file information GET
    • Download a file GET
    • Run a command POST
    • Get a file POST
    • Isolate an endpoint POST
    • Terminate a process POST
    • Get running processes POST
    • Run a script POST
    • Scan a file or directory POST
    • Get actions state GET
    • Suspend a process POST
    • Release an isolated endpoint POST
    • Upload a file POST
    • Get a metadata list GET
    • Get metadata GET
    • Get a policy response GET
    • Get a protection updates note GET
    • Create or update a protection updates note POST
  • Security entity analytics
    • Get an asset criticality record GET
    • Upsert an asset criticality record POST
    • Delete an asset criticality record DELETE
    • Bulk upsert asset criticality records POST
    • List asset criticality records GET
    • Initialize the Privilege Monitoring Engine POST
    • Health check on Privilege Monitoring GET
    • Create a new monitored user POST
    • Upsert multiple monitored users via CSV upload POST
    • Upsert multiple monitored users via JSON upload POST
    • Retrieve a monitored user by ID GET
    • Update a monitored user PUT
    • Delete a monitored user DELETE
    • List all monitored users GET
    • Initialize the Entity Store POST
    • List the Entity Engines GET
    • Get an Entity Engine GET
    • Delete the Entity Engine DELETE
    • Initialize an Entity Engine POST
    • Start an Entity Engine POST
    • Stop an Entity Engine POST
    • Apply DataView indices to all installed engines POST
    • List Entity Store Entities GET
    • Get the status of the Entity Store GET
    • Cleanup the Risk Engine DELETE
    • Configure the Risk Engine Saved Object PATCH
    • Run the risk scoring engine POST
  • Security exceptions
    • Create rule exception items POST
    • Get exception list details GET
    • Update an exception list PUT
    • Create an exception list POST
    • Delete an exception list DELETE
    • Duplicate an exception list POST
    • Export an exception list POST
    • Get exception lists GET
    • Import an exception list POST
    • Get an exception list item GET
    • Update an exception list item PUT
    • Create an exception list item POST
    • Delete an exception list item DELETE
    • Get exception list items GET
    • Get an exception list summary GET
    • Create a shared exception list POST
  • Security lists
    • Get value list details GET
    • Update a value list PUT
    • Create a value list POST
    • Delete a value list DELETE
    • Patch a value list PATCH
    • Get value lists GET
    • Get status of value list data streams GET
    • Create list data streams POST
    • Delete value list data streams DELETE
    • Get a value list item GET
    • Update a value list item PUT
    • Create a value list item POST
    • Delete a value list item DELETE
    • Patch a value list item PATCH
    • Export value list items POST
    • Get value list items GET
    • Import value list items POST
    • Get value list privileges GET
  • Security Osquery
    • Get live queries GET
    • Create a live query POST
    • Get live query details GET
    • Get live query results GET
    • Get packs GET
    • Create a pack POST
    • Get pack details GET
    • Update a pack PUT
    • Delete a pack DELETE
    • Get saved queries GET
    • Create a saved query POST
    • Get saved query details GET
    • Update a saved query PUT
    • Delete a saved query DELETE
  • Security timeline
    • Get notes GET
    • Delete a note DELETE
    • Add or update a note PATCH
    • Pin/unpin an event PATCH
    • Get Timeline or Timeline template details GET
    • Create a Timeline or Timeline template POST
    • Delete Timelines or Timeline templates DELETE
    • Update a Timeline PATCH
    • Copies timeline or timeline template GET
    • Get draft Timeline or Timeline template details GET
    • Create a clean draft Timeline or Timeline template POST
    • Export Timelines POST
    • Favorite a Timeline or Timeline template PATCH
    • Import Timelines POST
    • Install prepackaged Timelines POST
    • Get an existing saved Timeline or Timeline template GET
    • Get Timelines or Timeline templates GET
  • Short URLs
    • Create a short URL POST
    • Resolve a short URL GET
    • Get a short URL GET
    • Delete a short URL DELETE
  • Service level objectives
    • Get a paginated list of SLOs GET
    • Create an SLO POST
    • Bulk delete SLO definitions and their associated summary and rollup data. POST
    • Retrieve the status of the bulk deletion GET
    • Batch delete rollup and summary data POST
    • Batch delete rollup and summary data POST
    • Get an SLO GET
    • Update an SLO PUT
    • Delete an SLO DELETE
    • Reset an SLO POST
    • Disable an SLO POST
    • Enable an SLO POST
    • Get the SLO definitions GET
  • Spaces
    • Copy saved objects between spaces POST
    • Disable legacy URL aliases POST
    • Get shareable references POST
    • Update saved objects in spaces POST
    • Get all spaces GET
    • Create a space POST
    • Get a space GET
    • Update a space PUT
    • Delete a space DELETE
  • Streams
    • Get stream list GET
    • Disable streams POST
    • Enable streams POST
    • Resync streams POST
    • Get a stream GET
    • Create or update a stream PUT
    • Delete a stream DELETE
    • Fork a stream POST
    • Get group stream settings GET
    • Upsert group stream settings PUT
    • Get ingest stream settings GET
    • Update ingest stream settings PUT
    • Export stream content POST
    • Import content into a stream POST
    • Get stream dashboards GET
    • Bulk update dashboards POST
    • Link a dashboard to a stream PUT
    • Unlink a dashboard from a stream DELETE
    • Get stream queries GET
    • Bulk update queries POST
    • Upsert a query to a stream PUT
    • Remove a query from a stream DELETE
    • Read the significant events GET
  • Synthetics
    • Get monitors GET
    • Create a monitor POST
    • Delete monitors POST
    • Get a monitor GET
    • Update a monitor PUT
    • Delete a monitor DELETE
    • Get parameters GET
    • Add parameters POST
    • Delete parameters DELETE
    • Get a parameter GET
    • Update a parameter PUT
    • Delete a parameter DELETE
    • Get private locations GET
    • Create a private location POST
    • Get a private location GET
    • Delete a private location DELETE
  • System
    • Get features GET
    • Get Kibana's current status GET
  • Task manager
    • Get the task manager health GET
  • Upgrade assistant
    • Get the upgrade readiness status GET
  • Uptime
    • Get uptime settings GET
    • Update uptime settings PUT
  • User session management
    • Invalidate user sessions POST
Powered by Bump.sh
Elastic APIs hub
  • Elastic Cloud API
  • Elastic Cloud Billing API
  • Elastic Cloud Enterprise API
  • Elastic Cloud Serverless API
  • Elasticsearch API
  • Elasticsearch Serverless API
  • Kibana API
  • Kibana Serverless API
  • Logstash API
  • Observability Intake Serverless API
Back to hub page
API Changelog
Download source
  • JSON OpenAPI specification
  • YAML OpenAPI specification
Feedback
Kibana API logo