Query parameters

• fields array[string]

  A list of fields to include in the response. If not provided, all fields will be included.

• filter string

  Search query to filter Knowledge Base Entries by specific criteria.

• sort_field string

  Field to sort the Knowledge Base Entries by.

  Values are created_at, is_default, title, or updated_at.

• sort_order string

  Sort order for the results, either asc or desc.

  Values are asc or desc.

• page integer

  Page number for paginated results. Defaults to 1.

  Minimum value is 1. Default value is 1.

• per_page integer

  Number of Knowledge Base Entries to return per page. Defaults to 20.

  Minimum value is 0. Default value is 20.

Responses

• 200 application/json

  Successful response containing the paginated Knowledge Base Entries.

  Hide response attributes Show response attributes object

  • data array[object] Required

    The list of Knowledge Base Entries for the current page.

    Any of:

    document object index object

    Hide attributes Show attributes

    • global boolean Required

      Whether this Knowledge Base Entry is global, defaults to false.

    • name string Required

      Name of the Knowledge Base Entry.

    • namespace string Required

      Kibana Space, defaults to 'default' space.

    • users array[object] Required

      Users who have access to the Knowledge Base Entry, defaults to current user. Empty array provides access to all users.

      Hide users attributes Show users attributes object

      Could be any string, not necessarily a UUID.

      • id string

        User id.

      • name string

        User name.

    • createdAt string Required

      Time the Knowledge Base Entry was created.

    • createdBy string Required

      User who created the Knowledge Base Entry.

    • id string(nonempty) Required

      A string that does not contain only whitespace characters.

      Minimum length is 1.

    • updatedAt string Required

      Time the Knowledge Base Entry was last updated.

    • updatedBy string Required

      User who last updated the Knowledge Base Entry.

    • kbResource string Required

      Knowledge Base resource name for grouping entries, e.g. 'security_labs', 'user', etc.

      Values are security_labs, defend_insights, or user.

    • source string Required

      Source document name or filepath.

    • text string Required

      Knowledge Base Entry content.

    • type string Required Discriminator

      Entry type.

      Value is document.

    • required boolean

      Whether this resource should always be included, defaults to false.

    • vector object

      Object containing Knowledge Base Entry text embeddings and modelId used to create the embeddings.

      Hide vector attributes Show vector attributes object

      • modelId string Required

        ID of the model used to create the embeddings.

      • tokens object Required

        Tokens with their corresponding values.

        Hide tokens attribute Show tokens attribute object

        • * number Additional properties

    Hide attributes Show attributes

    • global boolean Required

      Whether this Knowledge Base Entry is global, defaults to false.

    • name string Required

      Name of the Knowledge Base Entry.

    • namespace string Required

      Kibana Space, defaults to 'default' space.

    • users array[object] Required

      Users who have access to the Knowledge Base Entry, defaults to current user. Empty array provides access to all users.

      Hide users attributes Show users attributes object

      Could be any string, not necessarily a UUID.

      • id string

        User id.

      • name string

        User name.

    • createdAt string Required

      Time the Knowledge Base Entry was created.

    • createdBy string Required

      User who created the Knowledge Base Entry.

    • id string(nonempty) Required

      A string that does not contain only whitespace characters.

      Minimum length is 1.

    • updatedAt string Required

      Time the Knowledge Base Entry was last updated.

    • updatedBy string Required

      User who last updated the Knowledge Base Entry.

    • description string Required

      Description for when this index or data stream should be queried for Knowledge Base content. Passed to the LLM as a tool description.

    • field string Required

      Field to query for Knowledge Base content.

    • index string Required

      Index or Data Stream to query for Knowledge Base content.

    • queryDescription string Required

      Description of query field used to fetch Knowledge Base content. Passed to the LLM as part of the tool input schema.

    • type string Required Discriminator

      Entry type.

      Value is index.

    • inputSchema array[object]

      Array of objects defining the input schema, allowing the LLM to extract structured data to be used in retrieval.

      Hide inputSchema attributes Show inputSchema attributes object

      • description string Required

        Description of the field.

      • fieldName string Required

        Name of the field.

      • fieldType string Required

        Type of the field.

    • outputFields array[string]

      Fields to extract from the query result, defaults to all fields if not provided or empty.

  • page integer Required

    The current page number.

  • perPage integer Required

    The number of Knowledge Base Entries returned per page.

  • total integer Required

    The total number of Knowledge Base Entries available.

• 400 application/json

  Bad Request response.

  Hide response attributes Show response attributes object

  • error string

    A short description of the error.

  • message string

    A detailed message explaining the error.

  • statusCode number

    The HTTP status code of the error.