Applies a bulk action to multiple Knowledge Base Entries

POST /api/security_ai_assistant/knowledge_base/entries/_bulk_action

The bulk action is applied to all Knowledge Base Entries that match the filter or to the list of Knowledge Base Entries by their IDs

application/json

Body

create array[object]
Any of:
Security_AI_Assistant_API_DocumentEntryCreateFields object Security_AI_Assistant_API_IndexEntryCreateFields object
Hide attributes Show attributes

global boolean

Whether this Knowledge Base Entry is global, defaults to false

name string Required

Name of the Knowledge Base Entry

namespace string

Kibana Space, defaults to 'default' space

users array[object]

Users who have access to the Knowledge Base Entry, defaults to current user. Empty array provides access to all users.

Could be any string, not necessarily a UUID

Hide users attributes Show users attributes object

id string

User id

name string

User name

kbResource string Required

Knowledge Base resource name for grouping entries, e.g. 'security_labs', 'user', etc

Values are security_labs or user.

source string Required

Source document name or filepath

text string Required

Knowledge Base Entry content

type string Required Discriminator

Entry type

Value is document.

required boolean

Whether this resource should always be included, defaults to false

vector object

Object containing Knowledge Base Entry text embeddings and modelId used to create the embeddings

Hide vector attributes Show vector attributes object

modelId string Required

ID of the model used to create the embeddings

tokens object Required

Tokens with their corresponding values

Hide tokens attribute Show tokens attribute object

* number Additional properties
Hide attributes Show attributes

global boolean

Whether this Knowledge Base Entry is global, defaults to false

name string Required

Name of the Knowledge Base Entry

namespace string

Kibana Space, defaults to 'default' space

users array[object]

Users who have access to the Knowledge Base Entry, defaults to current user. Empty array provides access to all users.

Could be any string, not necessarily a UUID

Hide users attributes Show users attributes object

id string

User id

name string

User name

description string Required

Description for when this index or data stream should be queried for Knowledge Base content. Passed to the LLM as a tool description

field string Required

Field to query for Knowledge Base content

index string Required

Index or Data Stream to query for Knowledge Base content

queryDescription string Required

Description of query field used to fetch Knowledge Base content. Passed to the LLM as part of the tool input schema

type string Required Discriminator

Entry type

Value is index.

inputSchema array[object]

Array of objects defining the input schema, allowing the LLM to extract structured data to be used in retrieval

Hide inputSchema attributes Show inputSchema attributes object

description string Required

Description of the field

fieldName string Required

Name of the field

fieldType string Required

Type of the field

outputFields array[string]

Fields to extract from the query result, defaults to all fields if not provided or empty
delete object
Hide delete attributes Show delete attributes object
- ids array[string]
  
  Array of Knowledge base Entry IDs
  
  At least 1 element.
- query string
  
  Query to filter Knowledge Base Entries
update array[object]
Any of:
Security_AI_Assistant_API_DocumentEntryCreateFields object Security_AI_Assistant_API_IndexEntryCreateFields object
Hide attributes Show attributes

global boolean

Whether this Knowledge Base Entry is global, defaults to false

id string(nonempty) Required

A string that does not contain only whitespace characters

Minimum length is 1.

name string Required

Name of the Knowledge Base Entry

namespace string

Kibana Space, defaults to 'default' space

users array[object]

Users who have access to the Knowledge Base Entry, defaults to current user. Empty array provides access to all users.

Could be any string, not necessarily a UUID

Hide users attributes Show users attributes object

id string

User id

name string

User name

kbResource string Required

Knowledge Base resource name for grouping entries, e.g. 'security_labs', 'user', etc

Values are security_labs or user.

source string Required

Source document name or filepath

text string Required

Knowledge Base Entry content

type string Required Discriminator

Entry type

Value is document.

required boolean

Whether this resource should always be included, defaults to false

vector object

Object containing Knowledge Base Entry text embeddings and modelId used to create the embeddings

Hide vector attributes Show vector attributes object

modelId string Required

ID of the model used to create the embeddings

tokens object Required

Tokens with their corresponding values

Hide tokens attribute Show tokens attribute object

* number Additional properties
Hide attributes Show attributes

global boolean

Whether this Knowledge Base Entry is global, defaults to false

id string(nonempty) Required

A string that does not contain only whitespace characters

Minimum length is 1.

name string Required

Name of the Knowledge Base Entry

namespace string

Kibana Space, defaults to 'default' space

users array[object]

Users who have access to the Knowledge Base Entry, defaults to current user. Empty array provides access to all users.

Could be any string, not necessarily a UUID

Hide users attributes Show users attributes object

id string

User id

name string

User name

description string Required

Description for when this index or data stream should be queried for Knowledge Base content. Passed to the LLM as a tool description

field string Required

Field to query for Knowledge Base content

index string Required

Index or Data Stream to query for Knowledge Base content

queryDescription string Required

Description of query field used to fetch Knowledge Base content. Passed to the LLM as part of the tool input schema

type string Required Discriminator

Entry type

Value is index.

inputSchema array[object]

Array of objects defining the input schema, allowing the LLM to extract structured data to be used in retrieval

Hide inputSchema attributes Show inputSchema attributes object

description string Required

Description of the field

fieldName string Required

Name of the field

fieldType string Required

Type of the field

outputFields array[string]

Fields to extract from the query result, defaults to all fields if not provided or empty

Responses

200 application/json

Successful bulk operation request
Hide response attributes Show response attributes object
- attributes object Required
  
  Hide attributes attributes Show attributes attributes object
  
  errors array[object]
  
  Hide errors attributes Show errors attributes object
  
  err_code string
  
  knowledgeBaseEntries array[object] Required
  
  Hide knowledgeBaseEntries attributes Show knowledgeBaseEntries attributes object
  
  id string Required
  
  name string
  
  message string Required
  
  statusCode integer Required
  
  results object Required
  
  Hide results attributes Show results attributes object
  
  created array[object] Required
  
  Any of:
  Security_AI_Assistant_API_DocumentEntryResponseFields object Security_AI_Assistant_API_IndexEntryResponseFields object
  
  Hide attributes Show attributes
  
  global boolean Required
  
  Whether this Knowledge Base Entry is global, defaults to false
  
  name string Required
  
  Name of the Knowledge Base Entry
  
  namespace string Required
  
  Kibana Space, defaults to 'default' space
  
  users array[object] Required
  
  Users who have access to the Knowledge Base Entry, defaults to current user. Empty array provides access to all users.
  
  Could be any string, not necessarily a UUID
  
  Hide users attributes Show users attributes object
  
  id string
  
  User id
  
  name string
  
  User name
  
  createdAt string Required
  
  Time the Knowledge Base Entry was created
  
  createdBy string Required
  
  User who created the Knowledge Base Entry
  
  id string(nonempty) Required
  
  A string that does not contain only whitespace characters
  
  Minimum length is 1.
  
  updatedAt string Required
  
  Time the Knowledge Base Entry was last updated
  
  updatedBy string Required
  
  User who last updated the Knowledge Base Entry
  
  kbResource string Required
  
  Knowledge Base resource name for grouping entries, e.g. 'security_labs', 'user', etc
  
  Values are security_labs or user.
  
  source string Required
  
  Source document name or filepath
  
  text string Required
  
  Knowledge Base Entry content
  
  type string Required Discriminator
  
  Entry type
  
  Value is document.
  
  required boolean
  
  Whether this resource should always be included, defaults to false
  
  vector object
  
  Object containing Knowledge Base Entry text embeddings and modelId used to create the embeddings
  
  Hide vector attributes Show vector attributes object
  
  modelId string Required
  
  ID of the model used to create the embeddings
  
  tokens object Required
  
  Tokens with their corresponding values
  
  Hide tokens attribute Show tokens attribute object
  
  * number Additional properties
  
  Hide attributes Show attributes
  
  global boolean Required
  
  Whether this Knowledge Base Entry is global, defaults to false
  
  name string Required
  
  Name of the Knowledge Base Entry
  
  namespace string Required
  
  Kibana Space, defaults to 'default' space
  
  users array[object] Required
  
  Users who have access to the Knowledge Base Entry, defaults to current user. Empty array provides access to all users.
  
  Could be any string, not necessarily a UUID
  
  Hide users attributes Show users attributes object
  
  id string
  
  User id
  
  name string
  
  User name
  
  createdAt string Required
  
  Time the Knowledge Base Entry was created
  
  createdBy string Required
  
  User who created the Knowledge Base Entry
  
  id string(nonempty) Required
  
  A string that does not contain only whitespace characters
  
  Minimum length is 1.
  
  updatedAt string Required
  
  Time the Knowledge Base Entry was last updated
  
  updatedBy string Required
  
  User who last updated the Knowledge Base Entry
  
  description string Required
  
  Description for when this index or data stream should be queried for Knowledge Base content. Passed to the LLM as a tool description
  
  field string Required
  
  Field to query for Knowledge Base content
  
  index string Required
  
  Index or Data Stream to query for Knowledge Base content
  
  queryDescription string Required
  
  Description of query field used to fetch Knowledge Base content. Passed to the LLM as part of the tool input schema
  
  type string Required Discriminator
  
  Entry type
  
  Value is index.
  
  inputSchema array[object]
  
  Array of objects defining the input schema, allowing the LLM to extract structured data to be used in retrieval
  
  Hide inputSchema attributes Show inputSchema attributes object
  
  description string Required
  
  Description of the field
  
  fieldName string Required
  
  Name of the field
  
  fieldType string Required
  
  Type of the field
  
  outputFields array[string]
  
  Fields to extract from the query result, defaults to all fields if not provided or empty
  
  deleted array[string] Required
  
  skipped array[object] Required
  
  Hide skipped attributes Show skipped attributes object
  
  id string Required
  
  name string
  
  skip_reason string Required
  
  Value is KNOWLEDGE_BASE_ENTRY_NOT_MODIFIED.
  
  updated array[object] Required
  
  Any of:
  Security_AI_Assistant_API_DocumentEntryResponseFields object Security_AI_Assistant_API_IndexEntryResponseFields object
  
  Hide attributes Show attributes
  
  global boolean Required
  
  Whether this Knowledge Base Entry is global, defaults to false
  
  name string Required
  
  Name of the Knowledge Base Entry
  
  namespace string Required
  
  Kibana Space, defaults to 'default' space
  
  users array[object] Required
  
  Users who have access to the Knowledge Base Entry, defaults to current user. Empty array provides access to all users.
  
  Could be any string, not necessarily a UUID
  
  Hide users attributes Show users attributes object
  
  id string
  
  User id
  
  name string
  
  User name
  
  createdAt string Required
  
  Time the Knowledge Base Entry was created
  
  createdBy string Required
  
  User who created the Knowledge Base Entry
  
  id string(nonempty) Required
  
  A string that does not contain only whitespace characters
  
  Minimum length is 1.
  
  updatedAt string Required
  
  Time the Knowledge Base Entry was last updated
  
  updatedBy string Required
  
  User who last updated the Knowledge Base Entry
  
  kbResource string Required
  
  Knowledge Base resource name for grouping entries, e.g. 'security_labs', 'user', etc
  
  Values are security_labs or user.
  
  source string Required
  
  Source document name or filepath
  
  text string Required
  
  Knowledge Base Entry content
  
  type string Required Discriminator
  
  Entry type
  
  Value is document.
  
  required boolean
  
  Whether this resource should always be included, defaults to false
  
  vector object
  
  Object containing Knowledge Base Entry text embeddings and modelId used to create the embeddings
  
  Hide vector attributes Show vector attributes object
  
  modelId string Required
  
  ID of the model used to create the embeddings
  
  tokens object Required
  
  Tokens with their corresponding values
  
  Hide tokens attribute Show tokens attribute object
  
  * number Additional properties
  
  Hide attributes Show attributes
  
  global boolean Required
  
  Whether this Knowledge Base Entry is global, defaults to false
  
  name string Required
  
  Name of the Knowledge Base Entry
  
  namespace string Required
  
  Kibana Space, defaults to 'default' space
  
  users array[object] Required
  
  Users who have access to the Knowledge Base Entry, defaults to current user. Empty array provides access to all users.
  
  Could be any string, not necessarily a UUID
  
  Hide users attributes Show users attributes object
  
  id string
  
  User id
  
  name string
  
  User name
  
  createdAt string Required
  
  Time the Knowledge Base Entry was created
  
  createdBy string Required
  
  User who created the Knowledge Base Entry
  
  id string(nonempty) Required
  
  A string that does not contain only whitespace characters
  
  Minimum length is 1.
  
  updatedAt string Required
  
  Time the Knowledge Base Entry was last updated
  
  updatedBy string Required
  
  User who last updated the Knowledge Base Entry
  
  description string Required
  
  Description for when this index or data stream should be queried for Knowledge Base content. Passed to the LLM as a tool description
  
  field string Required
  
  Field to query for Knowledge Base content
  
  index string Required
  
  Index or Data Stream to query for Knowledge Base content
  
  queryDescription string Required
  
  Description of query field used to fetch Knowledge Base content. Passed to the LLM as part of the tool input schema
  
  type string Required Discriminator
  
  Entry type
  
  Value is index.
  
  inputSchema array[object]
  
  Array of objects defining the input schema, allowing the LLM to extract structured data to be used in retrieval
  
  Hide inputSchema attributes Show inputSchema attributes object
  
  description string Required
  
  Description of the field
  
  fieldName string Required
  
  Name of the field
  
  fieldType string Required
  
  Type of the field
  
  outputFields array[string]
  
  Fields to extract from the query result, defaults to all fields if not provided or empty
  
  summary object Required
  
  Hide summary attributes Show summary attributes object
  
  failed integer Required
  
  skipped integer Required
  
  succeeded integer Required
  
  total integer Required
- knowledgeBaseEntriesCount integer
- message string
- statusCode integer
- success boolean
400 application/json

Generic Error
Hide response attributes Show response attributes object
- error string Required
- message string Required
- statusCode number Required

POST /api/security_ai_assistant/knowledge_base/entries/_bulk_action

curl \
 --request POST 'https://localhost:5601/api/security_ai_assistant/knowledge_base/entries/_bulk_action' \
 --header "Authorization: $API_KEY" \
 --header "Content-Type: application/json" \
 --data '{"create":[{"global":true,"name":"string","namespace":"string","users":[{"id":"string","name":"string"}],"kbResource":"security_labs","source":"string","text":"string","type":"document","required":true,"vector":{"modelId":"string","tokens":{"additionalProperty1":42.0,"additionalProperty2":42.0}}}],"delete":{"ids":["string"],"query":"string"},"update":[{"global":true,"id":"string","name":"string","namespace":"string","users":[{"id":"string","name":"string"}],"kbResource":"security_labs","source":"string","text":"string","type":"document","required":true,"vector":{"modelId":"string","tokens":{"additionalProperty1":42.0,"additionalProperty2":42.0}}}]}'