POST /api/agent_builder/tools
Api key auth

Spaces method and path for this operation:

post /s/{space_id}/api/agent_builder/tools

Refer to Spaces for more information.

Create a new tool. Use this endpoint to define a custom tool with specific functionality and configuration for use by agents. To learn more, refer to the tools documentation.

[Required authorization] Route required privileges: agentBuilder:manageTools.

Headers

  • kbn-xsrf string Required

    A required header to protect against CSRF attacks

application/json

Body

  • configuration object Required

    Tool-specific configuration parameters. See examples for details.

  • description string

    Description of what the tool does.

    Default value is empty.

  • id string Required

    Unique identifier for the tool.

  • tags array[string]

    Optional tags for categorizing and organizing tools.

    Default value is [] (empty).

  • type string Required

    The type of tool to create (e.g., esql, index_search).

    Values are esql, index_search, workflow, or mcp.

Responses

  • 200 application/json

    Indicates a successful response

POST /api/agent_builder/tools 
curl \
 -X POST "https://${KIBANA_URL}/api/agent_builder/tools" \
 -H "Authorization: ApiKey ${API_KEY}" \
 -H "kbn-xsrf: true" \
 -H "Content-Type: application/json" \
 -d '{
   "id": "example-esql-tool",
   "type": "esql",
   "description": "Example ES|QL query tool for analyzing financial trades with time filtering",
   "tags": ["analytics", "finance"],
   "configuration": {
     "query": "FROM financial_trades | WHERE execution_timestamp >= ?startTime | STATS trade_count=COUNT(*), avg_price=AVG(execution_price) BY symbol | SORT trade_count DESC | LIMIT ?limit",
     "params": {
       "startTime": {
         "type": "date",
         "description": "Start time for the analysis in ISO format"
       },
       "limit": {
         "type": "integer",
         "description": "Maximum number of results to return"
       }
     }
   }
 }'

POST kbn:/api/agent_builder/tools
{
  "id": "example-esql-tool",
  "type": "esql",
  "description": "An ES|QL query tool for analyzing financial trades with time filtering",
  "tags": ["analytics", "finance", "updated"],
  "configuration": {
    "query": "FROM financial_trades | WHERE execution_timestamp >= ?startTime | STATS trade_count=COUNT(*), avg_price=AVG(execution_price) BY symbol | SORT trade_count DESC | LIMIT ?limit",
    "params": {
      "startTime": {
        "type": "date",
        "description": "Start time for the analysis in ISO format"
      },
      "limit": {
        "type": "integer",
        "description": "Maximum number of results to return"
      }
    }
  }
}
Request examples
Example request to create an ESQL query tool with a pre-defined query 
{
  "configuration": {
    "params": {
      "limit": {
        "description": "Maximum number of results to return",
        "type": "integer"
      },
      "startTime": {
        "description": "Start time for the analysis in ISO format",
        "type": "date"
      }
    },
    "query": "FROM financial_trades | WHERE execution_timestamp >= ?startTime | STATS trade_count=COUNT(*), avg_price=AVG(execution_price) BY symbol | SORT trade_count DESC | LIMIT ?limit"
  },
  "description": "Example ES|QL query tool for analyzing financial trades with time filtering",
  "id": "example-esql-tool",
  "tags": [
    "analytics",
    "finance"
  ],
  "type": "esql"
}
Example request to create an index_search tool with a pre-defined index pattern 
{
  "configuration": {
    "pattern": "financial_*"
  },
  "description": "Search tool specifically for financial data analysis and reporting",
  "id": "example-index-search-tool",
  "tags": [
    "search",
    "finance"
  ],
  "type": "index_search"
}
Response examples (200)
Example response returning a definition of ESQL tool created 
{
  "configuration": {
    "params": {
      "limit": {
        "description": "Maximum number of results to return",
        "type": "integer"
      },
      "startTime": {
        "description": "Start time for the analysis in ISO format",
        "type": "date"
      }
    },
    "query": "FROM financial_trades | WHERE execution_timestamp >= ?startTime | STATS trade_count=COUNT(*), avg_price=AVG(execution_price) BY symbol | SORT trade_count DESC | LIMIT ?limit"
  },
  "description": "Example ES|QL query tool for analyzing financial trades with time filtering",
  "id": "example-esql-tool",
  "readonly": false,
  "schema": {
    "$schema": "http://json-schema.org/draft-07/schema#",
    "additionalProperties": false,
    "description": "Parameters needed to execute the query",
    "type": "object",
    "properties": {
      "limit": {
        "description": "Maximum number of results to return",
        "type": "integer"
      },
      "startTime": {
        "description": "Start time for the analysis in ISO format",
        "format": "date-time",
        "type": "string"
      }
    },
    "required": [
      "startTime",
      "limit"
    ]
  },
  "tags": [
    "analytics",
    "finance"
  ],
  "type": "esql"
}
Example response returning a definition of search tool tool created 
{
  "configuration": {
    "pattern": "financial_*"
  },
  "description": "Search tool specifically for financial data analysis and reporting",
  "id": "example-index-search-tool",
  "readonly": false,
  "schema": {
    "$schema": "http://json-schema.org/draft-07/schema#",
    "additionalProperties": false,
    "type": "object",
    "properties": {
      "nlQuery": {
        "description": "A natural language query expressing the search request",
        "type": "string"
      }
    },
    "required": [
      "nlQuery"
    ]
  },
  "tags": [
    "search",
    "finance"
  ],
  "type": "index_search"
}