Update list itemedit

Updates an existing list item.

Console supports only Elasticsearch APIs. Console doesn’t allow interactions with Kibana APIs. You must use curl or another HTTP tool instead. For more information, refer to Run Elasticsearch API requests.

You can use PUT or PATCH methods to update list items, where:

  • PUT replaces the original items and deletes fields that are not specified.
  • PATCH updates the specified fields.

Request URLedit

PUT <kibana host>:<port>/api/lists/items

PATCH <kibana host>:<port>/api/lists/items

Request bodyedit

A JSON object with:

  • The id of the list item you want to update.
  • The fields you want to modify.

If you call PUT to update a rule, all unspecified fields are deleted. You cannot modify the list_id and id fields.

For PATCH calls, any of the fields can be modified, whereas for PUT calls, some fields are required.

Name Type Description Required (PUT calls)



Placeholder for metadata about the list item.




The value used to evaluate exceptions. For information on how list item exceptions are evaluated, see Create exception item.




Base-64 encoded value of if_seq_no and if_primary_term parameters, used to prevent update conflicts (see Optimistic concurrency control).


Example requestedit

Updates the value field:

PATCH api/lists/items
  "id": "internal-ip-1",
  "value": "",
  "_version": "WzEsMV0="

Response codeedit

Indicates a successful call.

Response payloadedit

The updated object, including the time it was updated.

Example response:

  "_version": "WzIsMV0=",
  "created_at": "2020-08-11T10:54:46.080Z",
  "created_by": "elastic",
  "id": "internal-ip-1",
  "list_id": "internal-ip-excludes",
  "tie_breaker_id": "ed3f9d84-cd85-4122-b93d-07d1de4fd8bb",
  "type": "ip",
  "updated_at": "2020-08-11T11:00:12.202Z",
  "updated_by": "elastic",
  "value": ""