Create a Knowledge Base Entry

POST /api/security_ai_assistant/knowledge_base/entries

Api key auth Basic auth

Spaces method and path for this operation:

post /s/{space_id}/api/security_ai_assistant/knowledge_base/entries

Refer to Spaces for more information.

Create a Knowledge Base Entry

application/json

Body object Required

global boolean

Whether this Knowledge Base Entry is global, defaults to false.
name string Required

Name of the Knowledge Base Entry.
namespace string

Kibana Space, defaults to 'default' space.
users array[object]

Users who have access to the Knowledge Base Entry, defaults to current user. Empty array provides access to all users.
Hide users attributes Show users attributes object
Could be any string, not necessarily a UUID.
- id string
  
  User id.
- name string
  
  User name.
kbResource string Required

Knowledge Base resource name for grouping entries, e.g. 'security_labs', 'user', etc.

Values are security_labs, defend_insights, or user.
source string Required

Source document name or filepath.
text string Required

Knowledge Base Entry content.
type string Required Discriminator

Entry type.

Value is document.
required boolean

Whether this resource should always be included, defaults to false.
vector object

Object containing Knowledge Base Entry text embeddings and modelId used to create the embeddings.
Hide vector attributes Show vector attributes object
- modelId string Required
  
  ID of the model used to create the embeddings.
- tokens object Required
  
  Tokens with their corresponding values.
  Hide tokens attribute Show tokens attribute object
  
  * number Additional properties

global boolean

Whether this Knowledge Base Entry is global, defaults to false.
name string Required

Name of the Knowledge Base Entry.
namespace string

Kibana Space, defaults to 'default' space.
users array[object]

Users who have access to the Knowledge Base Entry, defaults to current user. Empty array provides access to all users.
Hide users attributes Show users attributes object
Could be any string, not necessarily a UUID.
- id string
  
  User id.
- name string
  
  User name.
description string Required

Description for when this index or data stream should be queried for Knowledge Base content. Passed to the LLM as a tool description.
field string Required

Field to query for Knowledge Base content.
index string Required

Index or Data Stream to query for Knowledge Base content.
queryDescription string Required

Description of query field used to fetch Knowledge Base content. Passed to the LLM as part of the tool input schema.
type string Required Discriminator

Entry type.

Value is index.
inputSchema array[object]

Array of objects defining the input schema, allowing the LLM to extract structured data to be used in retrieval.
Hide inputSchema attributes Show inputSchema attributes object
- description string Required
  
  Description of the field.
- fieldName string Required
  
  Name of the field.
- fieldType string Required
  
  Type of the field.
outputFields array[string]

Fields to extract from the query result, defaults to all fields if not provided or empty.

Responses

200 application/json

Successful request returning Knowledge Base Entries
Any of:
document object index object
Hide attributes Show attributes

global boolean Required

Whether this Knowledge Base Entry is global, defaults to false.

name string Required

Name of the Knowledge Base Entry.

namespace string Required

Kibana Space, defaults to 'default' space.

users array[object] Required

Users who have access to the Knowledge Base Entry, defaults to current user. Empty array provides access to all users.

Hide users attributes Show users attributes object

Could be any string, not necessarily a UUID.

id string

User id.

name string

User name.

createdAt string Required

Time the Knowledge Base Entry was created.

createdBy string Required

User who created the Knowledge Base Entry.

id string(nonempty) Required

A string that does not contain only whitespace characters.

Minimum length is 1.

updatedAt string Required

Time the Knowledge Base Entry was last updated.

updatedBy string Required

User who last updated the Knowledge Base Entry.

kbResource string Required

Knowledge Base resource name for grouping entries, e.g. 'security_labs', 'user', etc.

Values are security_labs, defend_insights, or user.

source string Required

Source document name or filepath.

text string Required

Knowledge Base Entry content.

type string Required Discriminator

Entry type.

Value is document.

required boolean

Whether this resource should always be included, defaults to false.

vector object

Object containing Knowledge Base Entry text embeddings and modelId used to create the embeddings.

Hide vector attributes Show vector attributes object

modelId string Required

ID of the model used to create the embeddings.

tokens object Required

Tokens with their corresponding values.

Hide tokens attribute Show tokens attribute object

* number Additional properties
Hide attributes Show attributes

global boolean Required

Whether this Knowledge Base Entry is global, defaults to false.

name string Required

Name of the Knowledge Base Entry.

namespace string Required

Kibana Space, defaults to 'default' space.

users array[object] Required

Users who have access to the Knowledge Base Entry, defaults to current user. Empty array provides access to all users.

Hide users attributes Show users attributes object

Could be any string, not necessarily a UUID.

id string

User id.

name string

User name.

createdAt string Required

Time the Knowledge Base Entry was created.

createdBy string Required

User who created the Knowledge Base Entry.

id string(nonempty) Required

A string that does not contain only whitespace characters.

Minimum length is 1.

updatedAt string Required

Time the Knowledge Base Entry was last updated.

updatedBy string Required

User who last updated the Knowledge Base Entry.

description string Required

Description for when this index or data stream should be queried for Knowledge Base content. Passed to the LLM as a tool description.

field string Required

Field to query for Knowledge Base content.

index string Required

Index or Data Stream to query for Knowledge Base content.

queryDescription string Required

Description of query field used to fetch Knowledge Base content. Passed to the LLM as part of the tool input schema.

type string Required Discriminator

Entry type.

Value is index.

inputSchema array[object]

Array of objects defining the input schema, allowing the LLM to extract structured data to be used in retrieval.

Hide inputSchema attributes Show inputSchema attributes object

description string Required

Description of the field.

fieldName string Required

Name of the field.

fieldType string Required

Type of the field.

outputFields array[string]

Fields to extract from the query result, defaults to all fields if not provided or empty.
400 application/json

A generic error occurred, such as invalid input or missing required fields.
Hide response attributes Show response attributes object
- error string Required
  
  Error type or category.
- message string Required
  
  Detailed error message.
- statusCode number Required
  
  HTTP status code of the error.

POST /api/security_ai_assistant/knowledge_base/entries

curl \
 --request POST 'https://localhost:5601/api/security_ai_assistant/knowledge_base/entries' \
 --header "Authorization: $API_KEY" \
 --header "Content-Type: application/json" \
 --data '"{\n  \"content\": \"To reset your password, go to the settings page and click 'Reset Password'.\",\n  \"tags\": [\n    \"password\",\n    \"reset\",\n    \"help\"\n  ],\n  \"title\": \"How to reset a password\"\n}"'

Request example

{
  "content": "To reset your password, go to the settings page and click 'Reset Password'.",
  "tags": [
    "password",
    "reset",
    "help"
  ],
  "title": "How to reset a password"
}

Response examples (200)

{
  "content": "To reset your password, go to the settings page and click 'Reset Password'.",
  "id": "12345",
  "tags": [
    "password",
    "reset",
    "help"
  ],
  "title": "How to reset a password"
}

Response examples (400)

{
  "error": "Invalid input",
  "message": "The 'title' field is required."
}