Create cloud onboarding deployment | Kibana Serverless API documentation

Create cloud onboarding deployment Experimental

POST /api/fleet/cloud_onboarding_deployments

Spaces method and path for this operation:

post /s/{space_id}/api/fleet/cloud_onboarding_deployments

Refer to Spaces for more information.

Create a new Fleet cloud onboarding deployment.

[Required authorization] Route required privileges: fleet-agent-policies-all OR integrations-all.

Headers

kbn-xsrf string Required

A required header to protect against CSRF attacks

application/json

Body

authMethod string

Authentication method for managed integrations.

Values are identity_federation or static_keys.
connectorId string

ID of the fleet-cloud-connector to associate with this deployment. Omit for static-keys deployments.

Minimum length is 1, maximum length is 255.
dataFormat string

Data format: ecs or otel.

Values are ecs or otel.
globalRegion string

Global AWS region from the Service Settings step.

Maximum length is 64.
mechanisms array[string] Required

Delivery mechanisms active in this deployment.

Not more than 10 elements. Values are managed_integration, ecf, or agent_based.
provider string Required

Cloud provider.

Values are aws, azure, or gcp.
services array[string] Required

Service IDs to be covered by this deployment.

At least 1 but not more than 1000 elements. Minimum length of each is 1.
serviceVars object

Per-service config keyed by instance ID.
Hide serviceVars attribute Show serviceVars attribute object
- * object Additional properties

Responses

200 application/json

Successful response
Hide response attribute Show response attribute object
- item object Required
  
  Additional properties are NOT allowed.
  
  Hide item attributes Show item attributes object
  
  agentPolicyId string
  
  Agent policy ID created for agent-based deployments. Present only when agent_based is in mechanisms.
  
  apiKeyId string
  
  Elasticsearch API key ID for push mechanisms (ecf). Set by the backend; used for key rotation/revocation.
  
  attemptCount number Required
  
  Number of deployment attempts, including the current one.
  
  Minimum value is 1.
  
  authMethod string
  
  Authentication method for managed integrations.
  
  Values are identity_federation or static_keys.
  
  connectorId string
  
  ID of the fleet-cloud-connector this deployment belongs to. Absent for static-keys deployments.
  
  dataFormat string
  
  Data format: ecs or otel.
  
  Values are ecs or otel.
  
  deploymentId string
  
  Opaque deployment identifier; for AWS, the CFN stack ARN.
  
  deploymentName string
  
  Opaque deployment name; for AWS, the CFN stack name.
  
  ecfStacks array[object]
  
  ECF CloudFormation stacks launched as part of this deployment. Written by the wizard after the user clicks Launch.
  
  Not more than 10 elements.
  
  Hide ecfStacks attributes Show ecfStacks attributes object
  
  family string Required
  
  ECF template family.
  
  Values are unified, otel, or crowdstrike.
  
  stackName string Required
  
  CloudFormation stack name (128-char AWS limit).
  
  Minimum length is 1, maximum length is 128.
  
  templateVersion string Required
  
  ECF semantic version resolved at launch time, e.g. "1.10.0".
  
  Minimum length is 1, maximum length is 32.
  
  globalRegion string
  
  Global AWS region from the Service Settings step.
  
  id string Required
  
  mechanisms array[string] Required
  
  Delivery mechanism: managed_integration, ecf, or agent_based.
  
  Not more than 10 elements. Values are managed_integration, ecf, or agent_based.
  
  packagePolicyIds array[string]
  
  Package policy IDs created for managed_integration services.
  
  Not more than 100 elements.
  
  provider string Required
  
  Cloud provider.
  
  Values are aws, azure, or gcp.
  
  services array[string] Required
  
  Service IDs covered by this deployment.
  
  Not more than 1000 elements.
  
  serviceVars object
  
  Per-service config keyed by instance ID. Each value is the ServiceVars object from the Service Settings step.
  
  Hide serviceVars attribute Show serviceVars attribute object
  
  * object Additional properties
  
  status string Required
  
  Deployment status.
  
  Values are pending, deploying, succeeded, or failed.
  
  statusMessage string
  
  Error context when status is failed.
400 application/json

Bad Request
Hide response attributes Show response attributes object
- attributes Required
- error string
- errorType string
- message string Required
- statusCode number

POST /api/fleet/cloud_onboarding_deployments

curl \
 --request POST 'https://<KIBANA_URL>/api/fleet/cloud_onboarding_deployments' \
 --header "Authorization: $API_KEY" \
 --header "Content-Type: application/json" \
 --header "kbn-xsrf: true" \
 --data '{
  "connectorId": "cloud-connector-id-1",
  "mechanisms": [
    "agent_based"
  ],
  "provider": "aws",
  "services": [
    "cloudwatch_metrics"
  ],
  "serviceVars": {
    "cloudwatch_metrics": {
      "namespace": "AWS/EC2",
      "regions": [
        "us-east-1"
      ]
    }
  }
}'

Request examples

Create a new AWS cloud onboarding deployment using an Elastic Agent (agent-based)

{
  "connectorId": "cloud-connector-id-1",
  "mechanisms": [
    "agent_based"
  ],
  "provider": "aws",
  "services": [
    "cloudwatch_metrics"
  ],
  "serviceVars": {
    "cloudwatch_metrics": {
      "namespace": "AWS/EC2",
      "regions": [
        "us-east-1"
      ]
    }
  }
}

Create a new AWS cloud onboarding deployment using Elastic Cloud Forwarder (ECF)

{
  "connectorId": "cloud-connector-id-1",
  "mechanisms": [
    "ecf"
  ],
  "provider": "aws",
  "services": [
    "cloudfront_logs"
  ],
  "serviceVars": {
    "cloudfront_logs": {
      "regions": [
        "us-east-1"
      ],
      "s3_bucket_arn": "arn:aws:s3:::my-cloudfront-bucket"
    }
  }
}

Create a new AWS cloud onboarding deployment using identity federation (managed integration)

{
  "connectorId": "cloud-connector-id-1",
  "mechanisms": [
    "managed_integration"
  ],
  "provider": "aws",
  "services": [
    "cloudwatch_metrics",
    "cloudtrail"
  ],
  "serviceVars": {
    "cloudtrail": {
      "regions": [
        "us-east-1"
      ],
      "s3_bucket_arn": "arn:aws:s3:::my-cloudtrail-bucket"
    },
    "cloudwatch_metrics": {
      "namespace": "AWS/EC2",
      "regions": [
        "us-east-1",
        "eu-west-1"
      ]
    }
  }
}

Response examples (200)

Agent-based deployment — agentPolicyId set after the agent policy is selected or created

{
  "item": {
    "agentPolicyId": "agent-policy-id-1",
    "attemptCount": 1,
    "connectorId": "cloud-connector-id-1",
    "id": "onboarding-deployment-id-2",
    "mechanisms": [
      "agent_based"
    ],
    "provider": "aws",
    "services": [
      "cloudwatch_metrics"
    ],
    "serviceVars": {
      "cloudwatch_metrics": {
        "namespace": "AWS/EC2",
        "regions": [
          "us-east-1"
        ]
      }
    },
    "status": "pending"
  }
}

ECF deployment — apiKeyId set after the Elasticsearch API key is created for the ECF service

{
  "item": {
    "apiKeyId": "es-api-key-id-1",
    "attemptCount": 1,
    "connectorId": "cloud-connector-id-1",
    "id": "onboarding-deployment-id-3",
    "mechanisms": [
      "ecf"
    ],
    "provider": "aws",
    "services": [
      "cloudfront_logs"
    ],
    "serviceVars": {
      "cloudfront_logs": {
        "regions": [
          "us-east-1"
        ],
        "s3_bucket_arn": "arn:aws:s3:::my-cloudfront-bucket"
      }
    },
    "status": "pending"
  }
}

Managed integration deployment — packagePolicyIds set after deployment completes

{
  "item": {
    "attemptCount": 1,
    "connectorId": "cloud-connector-id-1",
    "id": "onboarding-deployment-id-1",
    "mechanisms": [
      "managed_integration"
    ],
    "packagePolicyIds": [
      "package-policy-id-1"
    ],
    "provider": "aws",
    "services": [
      "cloudwatch_metrics",
      "cloudtrail"
    ],
    "serviceVars": {
      "cloudtrail": {
        "regions": [
          "us-east-1"
        ],
        "s3_bucket_arn": "arn:aws:s3:::my-cloudtrail-bucket"
      },
      "cloudwatch_metrics": {
        "namespace": "AWS/EC2",
        "regions": [
          "us-east-1",
          "eu-west-1"
        ]
      }
    },
    "status": "pending"
  }
}

Response examples (400)

Example of a generic error response

{
  "error": "Bad Request",
  "message": "An error message describing what went wrong",
  "statusCode": 400
}