Update a connector

PUT /api/actions/connector/{connectorId}

Headers

kbn-xsrf string Required

Cross-site request forgery protection

Path parameters

connectorId string Required

An identifier for the connector.

application/json; Elastic-Api-Version=2023-10-31

Body object Required

The properties vary depending on the connector type.

config object Required

Defines properties for connectors when type is .bedrock.
Hide config attributes Show config attributes object
- apiUrl string Required
  
  The Amazon Bedrock request URL.
- defaultModel string
  
  The generative artificial intelligence model for Amazon Bedrock to use. Current support is for the Anthropic Claude models.
  
  Default value is anthropic.claude-3-5-sonnet-20240620-v1:0.
name string Required

The display name for the connector.
secrets object

Defines secrets for connectors when type is .bedrock.
Hide secrets attributes Show secrets attributes object
- accessKey string Required
  
  The AWS access key for authentication.
- secret string Required
  
  The AWS secret for authentication.

config object Required

Defines properties for connectors when type is .gemini.
Hide config attributes Show config attributes object
- apiUrl string Required
  
  The Google Gemini request URL.
- defaultModel string
  
  The generative artificial intelligence model for Google Gemini to use.
  
  Default value is gemini-1.5-pro-001.
- gcpProjectID string Required
  
  The Google ProjectID that has Vertex AI endpoint enabled.
- gcpRegion string Required
  
  The GCP region where the Vertex AI endpoint enabled.
name string Required

The display name for the connector.
secrets object

Defines secrets for connectors when type is .gemini.
Hide secrets attribute Show secrets attribute object
- credentialsJSON string Required
  
  The service account credentials JSON file. The service account should have Vertex AI user IAM role assigned to it.

config object Required

Defines properties for connectors when type is .cases-webhook.
Hide config attributes Show config attributes object
- authType string | null
  
  The type of authentication to use: basic, SSL, or none.
  
  Values are webhook-authentication-basic or webhook-authentication-ssl.
- ca string
  
  A base64 encoded version of the certificate authority file that the connector can trust to sign and validate certificates. This option is available for all authentication types.
- certType string
  
  If the authType is webhook-authentication-ssl, specifies whether the certificate authentication data is in a CRT and key file format or a PFX file format.
  
  Values are ssl-crt-key or ssl-pfx.
- createCommentJson string
  
  A JSON payload sent to the create comment URL to create a case comment. You can use variables to add Kibana Cases data to the payload. The required variable is case.comment. Due to Mustache template variables (the text enclosed in triple braces, for example, {{{case.title}}}), the JSON is not validated when you create the connector. The JSON is validated once the Mustache variables have been placed when the REST method runs. Manually ensure that the JSON is valid, disregarding the Mustache variables, so the later validation will pass.
- createCommentMethod string
  
  The REST API HTTP request method to create a case comment in the third-party system. Valid values are patch, post, and put.
  
  Values are patch, post, or put. Default value is put.
- createCommentUrl string
  
  The REST API URL to create a case comment by ID in the third-party system. You can use a variable to add the external system ID to the URL. If you are using the xpack.actions.allowedHosts setting, add the hostname to the allowed hosts.
- createIncidentJson string Required
  
  A JSON payload sent to the create case URL to create a case. You can use variables to add case data to the payload. Required variables are case.title and case.description. Due to Mustache template variables (which is the text enclosed in triple braces, for example, {{{case.title}}}), the JSON is not validated when you create the connector. The JSON is validated after the Mustache variables have been placed when REST method runs. Manually ensure that the JSON is valid to avoid future validation errors; disregard Mustache variables during your review.
- createIncidentMethod string
  
  The REST API HTTP request method to create a case in the third-party system. Valid values are patch, post, and put.
  
  Values are patch, post, or put. Default value is post.
- createIncidentResponseKey string Required
  
  The JSON key in the create external case response that contains the case ID.
- createIncidentUrl string Required
  
  The REST API URL to create a case in the third-party system. If you are using the xpack.actions.allowedHosts setting, add the hostname to the allowed hosts.
- getIncidentResponseExternalTitleKey string Required
  
  The JSON key in get external case response that contains the case title.
- getIncidentUrl string Required
  
  The REST API URL to get the case by ID from the third-party system. If you are using the xpack.actions.allowedHosts setting, add the hostname to the allowed hosts. You can use a variable to add the external system ID to the URL. Due to Mustache template variables (the text enclosed in triple braces, for example, {{{case.title}}}), the JSON is not validated when you create the connector. The JSON is validated after the Mustache variables have been placed when REST method runs. Manually ensure that the JSON is valid, disregarding the Mustache variables, so the later validation will pass.
- hasAuth boolean
  
  If true, a username and password for login type authentication must be provided.
  
  Default value is true.
- headers string
  
  A set of key-value pairs sent as headers with the request URLs for the create case, update case, get case, and create comment methods.
- updateIncidentJson string Required
  
  The JSON payload sent to the update case URL to update the case. You can use variables to add Kibana Cases data to the payload. Required variables are case.title and case.description. Due to Mustache template variables (which is the text enclosed in triple braces, for example, {{{case.title}}}), the JSON is not validated when you create the connector. The JSON is validated after the Mustache variables have been placed when REST method runs. Manually ensure that the JSON is valid to avoid future validation errors; disregard Mustache variables during your review.
- updateIncidentMethod string
  
  The REST API HTTP request method to update the case in the third-party system. Valid values are patch, post, and put.
  
  Values are patch, post, or put. Default value is put.
- updateIncidentUrl string Required
  
  The REST API URL to update the case by ID in the third-party system. You can use a variable to add the external system ID to the URL. If you are using the xpack.actions.allowedHosts setting, add the hostname to the allowed hosts.
- verificationMode string
  
  Controls the verification of certificates. Use full to validate that the certificate has an issue date within the not_before and not_after dates, chains to a trusted certificate authority (CA), and has a hostname or IP address that matches the names within the certificate. Use certificate to validate the certificate and verify that it is signed by a trusted authority; this option does not check the certificate hostname. Use none to skip certificate validation.
  
  Values are certificate, full, or none. Default value is full.
- viewIncidentUrl string Required
  
  The URL to view the case in the external system. You can use variables to add the external system ID or external system title to the URL.
name string Required

The display name for the connector.
secrets object
Hide secrets attributes Show secrets attributes object
- crt string
  
  If authType is webhook-authentication-ssl and certType is ssl-crt-key, it is a base64 encoded version of the CRT or CERT file.
- key string
  
  If authType is webhook-authentication-ssl and certType is ssl-crt-key, it is a base64 encoded version of the KEY file.
- password string
  
  The password for HTTP basic authentication. If hasAuth is set to true and and authType is webhook-authentication-basic, this property is required.
- pfx string
  
  If authType is webhook-authentication-ssl and certType is ssl-pfx, it is a base64 encoded version of the PFX or P12 file.
- user string
  
  The username for HTTP basic authentication. If hasAuth is set to true and authType is webhook-authentication-basic, this property is required.

config object Required

Defines properties for connectors when type is .d3security.
Hide config attribute Show config attribute object
- url string Required
  
  The D3 Security API request URL. If you are using the xpack.actions.allowedHosts setting, add the hostname to the allowed hosts.
name string Required

The display name for the connector.
secrets object Required

Defines secrets for connectors when type is .d3security.
Hide secrets attribute Show secrets attribute object
- token string Required
  
  The D3 Security token.

config object Required

Defines properties for connectors when type is .email.
Hide config attributes Show config attributes object
- clientId string | null
  
  The client identifier, which is a part of OAuth 2.0 client credentials authentication, in GUID format. If service is exchange_server, this property is required.
- from string Required
  
  The from address for all emails sent by the connector. It must be specified in user@host-name format.
- hasAuth boolean
  
  Specifies whether a user and password are required inside the secrets configuration.
  
  Default value is true.
- host string
  
  The host name of the service provider. If the service is elastic_cloud (for Elastic Cloud notifications) or one of Nodemailer's well-known email service providers, this property is ignored. If service is other, this property must be defined.
- oauthTokenUrl string | null
- port integer
  
  The port to connect to on the service provider. If the service is elastic_cloud (for Elastic Cloud notifications) or one of Nodemailer's well-known email service providers, this property is ignored. If service is other, this property must be defined.
- secure boolean
  
  Specifies whether the connection to the service provider will use TLS. If the service is elastic_cloud (for Elastic Cloud notifications) or one of Nodemailer's well-known email service providers, this property is ignored.
- service string
  
  The name of the email service.
  
  Values are elastic_cloud, exchange_server, gmail, other, outlook365, or ses.
- tenantId string | null
  
  The tenant identifier, which is part of OAuth 2.0 client credentials authentication, in GUID format. If service is exchange_server, this property is required.
name string Required

The display name for the connector.
secrets object

Defines secrets for connectors when type is .email.
Hide secrets attributes Show secrets attributes object
- clientSecret string
  
  The Microsoft Exchange Client secret for OAuth 2.0 client credentials authentication. It must be URL-encoded. If service is exchange_server, this property is required.
- password string
  
  The password for HTTP basic authentication. If hasAuth is set to true, this property is required.
- user string
  
  The username for HTTP basic authentication. If hasAuth is set to true, this property is required.

The OpenAI connector uses axios to send a POST request to either OpenAI or Azure OpenAPI.

config object Required

Defines properties for connectors when type is .gen-ai.
One of:
Connectors_config_properties_genai_azure object Connectors_config_properties_genai_openai object
Defines properties for connectors when type is .gen-ai and the API provider is `Azure OpenAI'.
Hide attributes Show attributes

apiProvider string Required Discriminator

The OpenAI API provider.

Value is Azure OpenAI.

apiUrl string Required

The OpenAI API endpoint.
Defines properties for connectors when type is .gen-ai and the API provider is `OpenAI'.
Hide attributes Show attributes

apiProvider string Required Discriminator

The OpenAI API provider.

Value is OpenAI.

apiUrl string Required

The OpenAI API endpoint.

defaultModel string

The default model to use for requests.
connector_type_id string Required

The type of connector.

Value is .gen-ai.
name string Required

The display name for the connector.
secrets object Required

Defines secrets for connectors when type is .gen-ai.
Hide secrets attribute Show secrets attribute object
- apiKey string
  
  The OpenAI API key.

config object Required

Defines properties for connectors when type is .index.
Hide config attributes Show config attributes object
- executionTimeField string | null
  
  A field that indicates when the document was indexed.
- index string Required
  
  The Elasticsearch index to be written to.
- refresh boolean
  
  The refresh policy for the write request, which affects when changes are made visible to search. Refer to the refresh setting for Elasticsearch document APIs.
  
  Default value is false.
name string Required

The display name for the connector.

config object Required

Defines properties for connectors when type is .jira.
Hide config attributes Show config attributes object
- apiUrl string Required
  
  The Jira instance URL.
- projectKey string Required
  
  The Jira project key.
name string Required

The display name for the connector.
secrets object Required

Defines secrets for connectors when type is .jira.
Hide secrets attributes Show secrets attributes object
- apiToken string Required
  
  The Jira API authentication token for HTTP basic authentication.
- email string Required
  
  The account email for HTTP Basic authentication.

config object Required

Defines properties for connectors when type is .opsgenie.
Hide config attribute Show config attribute object
- apiUrl string Required
  
  The Opsgenie URL. For example, https://api.opsgenie.com or https://api.eu.opsgenie.com. If you are using the xpack.actions.allowedHosts setting, add the hostname to the allowed hosts.
name string Required

The display name for the connector.
secrets object Required

Defines secrets for connectors when type is .opsgenie.
Hide secrets attribute Show secrets attribute object
- apiKey string Required
  
  The Opsgenie API authentication key for HTTP Basic authentication.

config object Required

Defines properties for connectors when type is .pagerduty.
Hide config attribute Show config attribute object
- apiUrl string | null
  
  The PagerDuty event URL.
name string Required

The display name for the connector.
secrets object Required

Defines secrets for connectors when type is .pagerduty.
Hide secrets attribute Show secrets attribute object
- routingKey string Required
  
  A 32 character PagerDuty Integration Key for an integration on a service.

config object Required

Defines properties for connectors when type is .resilient.
Hide config attributes Show config attributes object
- apiUrl string Required
  
  The IBM Resilient instance URL.
- orgId string Required
  
  The IBM Resilient organization ID.
name string Required

The display name for the connector.
secrets object Required

Defines secrets for connectors when type is .resilient.
Hide secrets attributes Show secrets attributes object
- apiKeyId string Required
  
  The authentication key ID for HTTP Basic authentication.
- apiKeySecret string Required
  
  The authentication key secret for HTTP Basic authentication.

config object Required

Defines properties for connectors when type is .sentinelone.
Hide config attribute Show config attribute object
- url string Required
  
  The SentinelOne tenant URL. If you are using the xpack.actions.allowedHosts setting, add the hostname to the allowed hosts.
name string Required

The display name for the connector.
secrets object Required

Defines secrets for connectors when type is .sentinelone.
Hide secrets attribute Show secrets attribute object
- token string Required
  
  The A SentinelOne API token.

config object Required

Defines properties for connectors when type is .servicenow.
Hide config attributes Show config attributes object
- apiUrl string Required
  
  The ServiceNow instance URL.
- clientId string
  
  The client ID assigned to your OAuth application. This property is required when isOAuth is true.
- isOAuth boolean
  
  The type of authentication to use. The default value is false, which means basic authentication is used instead of open authorization (OAuth).
  
  Default value is false.
- jwtKeyId string
  
  The key identifier assigned to the JWT verifier map of your OAuth application. This property is required when isOAuth is true.
- userIdentifierValue string
  
  The identifier to use for OAuth authentication. This identifier should be the user field you selected when you created an OAuth JWT API endpoint for external clients in your ServiceNow instance. For example, if the selected user field is Email, the user identifier should be the user's email address. This property is required when isOAuth is true.
- usesTableApi boolean
  
  Determines whether the connector uses the Table API or the Import Set API. This property is supported only for ServiceNow ITSM and ServiceNow SecOps connectors. NOTE: If this property is set to false, the Elastic application should be installed in ServiceNow.
  
  Default value is true.
name string Required

The display name for the connector.
secrets object Required

Defines secrets for connectors when type is .servicenow, .servicenow-sir, or .servicenow-itom.
Hide secrets attributes Show secrets attributes object
- clientSecret string
  
  The client secret assigned to your OAuth application. This property is required when isOAuth is true.
- password string
  
  The password for HTTP basic authentication. This property is required when isOAuth is false.
- privateKey string
  
  The RSA private key that you created for use in ServiceNow. This property is required when isOAuth is true.
- privateKeyPassword string
  
  The password for the RSA private key. This property is required when isOAuth is true and you set a password on your private key.
- username string
  
  The username for HTTP basic authentication. This property is required when isOAuth is false.

config object Required

Defines properties for connectors when type is .servicenow.
Hide config attributes Show config attributes object
- apiUrl string Required
  
  The ServiceNow instance URL.
- clientId string
  
  The client ID assigned to your OAuth application. This property is required when isOAuth is true.
- isOAuth boolean
  
  The type of authentication to use. The default value is false, which means basic authentication is used instead of open authorization (OAuth).
  
  Default value is false.
- jwtKeyId string
  
  The key identifier assigned to the JWT verifier map of your OAuth application. This property is required when isOAuth is true.
- userIdentifierValue string
  
  The identifier to use for OAuth authentication. This identifier should be the user field you selected when you created an OAuth JWT API endpoint for external clients in your ServiceNow instance. For example, if the selected user field is Email, the user identifier should be the user's email address. This property is required when isOAuth is true.
name string Required

The display name for the connector.
secrets object Required

Defines secrets for connectors when type is .servicenow, .servicenow-sir, or .servicenow-itom.
Hide secrets attributes Show secrets attributes object
- clientSecret string
  
  The client secret assigned to your OAuth application. This property is required when isOAuth is true.
- password string
  
  The password for HTTP basic authentication. This property is required when isOAuth is false.
- privateKey string
  
  The RSA private key that you created for use in ServiceNow. This property is required when isOAuth is true.
- privateKeyPassword string
  
  The password for the RSA private key. This property is required when isOAuth is true and you set a password on your private key.
- username string
  
  The username for HTTP basic authentication. This property is required when isOAuth is false.

config object

Defines properties for connectors when type is .slack_api.
Hide config attribute Show config attribute object
- allowedChannels array[object]
  
  A list of valid Slack channels.
  Hide allowedChannels attributes Show allowedChannels attributes object
  
  id string Required
  
  The Slack channel ID.
  
  Minimum length is 1.
  
  name string Required
  
  The Slack channel name.
  
  Minimum length is 1.
name string Required

The display name for the connector.
secrets object Required

Defines secrets for connectors when type is .slack.
Hide secrets attribute Show secrets attribute object
- token string Required
  
  Slack bot user OAuth token.

name string Required

The display name for the connector.
secrets object Required

Defines secrets for connectors when type is .slack.
Hide secrets attribute Show secrets attribute object
- webhookUrl string Required
  
  Slack webhook url.

config object Required

Defines properties for connectors when type is .swimlane.
Hide config attributes Show config attributes object
- apiUrl string Required
  
  The Swimlane instance URL.
- appId string Required
  
  The Swimlane application ID.
- connectorType string Required
  
  The type of connector. Valid values are all, alerts, and cases.
  
  Values are all, alerts, or cases.
- mappings object
  
  The field mapping.
  Hide mappings attributes Show mappings attributes object
  
  alertIdConfig object
  
  Mapping for the alert ID.
  
  Hide alertIdConfig attributes Show alertIdConfig attributes object
  
  fieldType string Required
  
  The type of field in Swimlane.
  
  id string Required
  
  The identifier for the field in Swimlane.
  
  key string Required
  
  The key for the field in Swimlane.
  
  name string Required
  
  The name of the field in Swimlane.
  
  caseIdConfig object
  
  Mapping for the case ID.
  
  Hide caseIdConfig attributes Show caseIdConfig attributes object
  
  fieldType string Required
  
  The type of field in Swimlane.
  
  id string Required
  
  The identifier for the field in Swimlane.
  
  key string Required
  
  The key for the field in Swimlane.
  
  name string Required
  
  The name of the field in Swimlane.
  
  caseNameConfig object
  
  Mapping for the case name.
  
  Hide caseNameConfig attributes Show caseNameConfig attributes object
  
  fieldType string Required
  
  The type of field in Swimlane.
  
  id string Required
  
  The identifier for the field in Swimlane.
  
  key string Required
  
  The key for the field in Swimlane.
  
  name string Required
  
  The name of the field in Swimlane.
  
  commentsConfig object
  
  Mapping for the case comments.
  
  Hide commentsConfig attributes Show commentsConfig attributes object
  
  fieldType string Required
  
  The type of field in Swimlane.
  
  id string Required
  
  The identifier for the field in Swimlane.
  
  key string Required
  
  The key for the field in Swimlane.
  
  name string Required
  
  The name of the field in Swimlane.
  
  descriptionConfig object
  
  Mapping for the case description.
  
  Hide descriptionConfig attributes Show descriptionConfig attributes object
  
  fieldType string Required
  
  The type of field in Swimlane.
  
  id string Required
  
  The identifier for the field in Swimlane.
  
  key string Required
  
  The key for the field in Swimlane.
  
  name string Required
  
  The name of the field in Swimlane.
  
  ruleNameConfig object
  
  Mapping for the name of the alert's rule.
  
  Hide ruleNameConfig attributes Show ruleNameConfig attributes object
  
  fieldType string Required
  
  The type of field in Swimlane.
  
  id string Required
  
  The identifier for the field in Swimlane.
  
  key string Required
  
  The key for the field in Swimlane.
  
  name string Required
  
  The name of the field in Swimlane.
  
  severityConfig object
  
  Mapping for the severity.
  
  Hide severityConfig attributes Show severityConfig attributes object
  
  fieldType string Required
  
  The type of field in Swimlane.
  
  id string Required
  
  The identifier for the field in Swimlane.
  
  key string Required
  
  The key for the field in Swimlane.
  
  name string Required
  
  The name of the field in Swimlane.
name string Required

The display name for the connector.
secrets object Required

Defines secrets for connectors when type is .swimlane.
Hide secrets attribute Show secrets attribute object
- apiToken string
  
  Swimlane API authentication token.

name string Required

The display name for the connector.
secrets object Required

Defines secrets for connectors when type is .teams.
Hide secrets attribute Show secrets attribute object
- webhookUrl string Required
  
  The URL of the incoming webhook. If you are using the xpack.actions.allowedHosts setting, add the hostname to the allowed hosts.

config object Required

Defines properties for connectors when type is .tines.
Hide config attribute Show config attribute object
- url string Required
  
  The Tines tenant URL. If you are using the xpack.actions.allowedHosts setting, make sure this hostname is added to the allowed hosts.
name string Required

The display name for the connector.
secrets object Required

Defines secrets for connectors when type is .tines.
Hide secrets attributes Show secrets attributes object
- email string Required
  
  The email used to sign in to Tines.
- token string Required
  
  The Tines API token.

config object Required

Defines properties for connectors when type is .torq.
Hide config attribute Show config attribute object
- webhookIntegrationUrl string Required
  
  The endpoint URL of the Elastic Security integration in Torq.
name string Required

The display name for the connector.
secrets object Required

Defines secrets for connectors when type is .torq.
Hide secrets attribute Show secrets attribute object
- token string Required
  
  The secret of the webhook authentication header.

config object Required

Defines properties for connectors when type is .webhook.
Hide config attributes Show config attributes object
- authType string | null
  
  The type of authentication to use: basic, SSL, or none.
  
  Values are webhook-authentication-basic or webhook-authentication-ssl.
- ca string
  
  A base64 encoded version of the certificate authority file that the connector can trust to sign and validate certificates. This option is available for all authentication types.
- certType string
  
  If the authType is webhook-authentication-ssl, specifies whether the certificate authentication data is in a CRT and key file format or a PFX file format.
  
  Values are ssl-crt-key or ssl-pfx.
- hasAuth boolean
  
  If true, a username and password for login type authentication must be provided.
  
  Default value is true.
- headers object | null
  
  A set of key-value pairs sent as headers with the request.
- method string
  
  The HTTP request method, either post or put.
  
  Values are post or put. Default value is post.
- url string
  
  The request URL. If you are using the xpack.actions.allowedHosts setting, add the hostname to the allowed hosts.
- verificationMode string
  
  Controls the verification of certificates. Use full to validate that the certificate has an issue date within the not_before and not_after dates, chains to a trusted certificate authority (CA), and has a hostname or IP address that matches the names within the certificate. Use certificate to validate the certificate and verify that it is signed by a trusted authority; this option does not check the certificate hostname. Use none to skip certificate validation.
  
  Values are certificate, full, or none. Default value is full.
name string Required

The display name for the connector.
secrets object Required

Defines secrets for connectors when type is .webhook.
Hide secrets attributes Show secrets attributes object
- crt string
  
  If authType is webhook-authentication-ssl and certType is ssl-crt-key, it is a base64 encoded version of the CRT or CERT file.
- key string
  
  If authType is webhook-authentication-ssl and certType is ssl-crt-key, it is a base64 encoded version of the KEY file.
- password string
  
  The password for HTTP basic authentication or the passphrase for the SSL certificate files. If hasAuth is set to true and authType is webhook-authentication-basic, this property is required.
- pfx string
  
  If authType is webhook-authentication-ssl and certType is ssl-pfx, it is a base64 encoded version of the PFX or P12 file.
- user string
  
  The username for HTTP basic authentication. If hasAuth is set to true and authType is webhook-authentication-basic, this property is required.

config object Required

Defines properties for connectors when type is .xmatters.
Hide config attributes Show config attributes object
- configUrl string | null
  
  The request URL for the Elastic Alerts trigger in xMatters. It is applicable only when usesBasic is true.
- usesBasic boolean
  
  Specifies whether the connector uses HTTP basic authentication (true) or URL authentication (false).
  
  Default value is true.
name string Required

The display name for the connector.
secrets object Required

Defines secrets for connectors when type is .xmatters.
Hide secrets attributes Show secrets attributes object
- password string
  
  A user name for HTTP basic authentication. It is applicable only when usesBasic is true.
- secretsUrl string
  
  The request URL for the Elastic Alerts trigger in xMatters with the API key included in the URL. It is applicable only when usesBasic is false.
- user string
  
  A password for HTTP basic authentication. It is applicable only when usesBasic is true.

Responses

200 application/json; Elastic-Api-Version=2023-10-31

Indicates a successful call.
The properties vary depending on the connector type.
One of:
Connectors_connector_response_properties_bedrock object Connectors_connector_response_properties_gemini object Connectors_connector_response_properties_cases_webhook object Connectors_connector_response_properties_d3security object Connectors_connector_response_properties_email object Connectors_connector_response_properties_genai object Connectors_connector_response_properties_index object Connectors_connector_response_properties_jira object Connectors_connector_response_properties_opsgenie object Connectors_connector_response_properties_pagerduty object Connectors_connector_response_properties_resilient object Connectors_connector_response_properties_sentinelone object Connectors_connector_response_properties_serverlog object Connectors_connector_response_properties_servicenow object Connectors_connector_response_properties_servicenow_itom object Connectors_connector_response_properties_servicenow_sir object Connectors_connector_response_properties_slack_api object Connectors_connector_response_properties_slack_webhook object Connectors_connector_response_properties_swimlane object Connectors_connector_response_properties_teams object Connectors_connector_response_properties_tines object Connectors_connector_response_properties_torq object Connectors_connector_response_properties_webhook object Connectors_connector_response_properties_xmatters object
Hide attributes Show attributes

config object Required

Defines properties for connectors when type is .bedrock.

Hide config attributes Show config attributes object

apiUrl string Required

The Amazon Bedrock request URL.

defaultModel string

The generative artificial intelligence model for Amazon Bedrock to use. Current support is for the Anthropic Claude models.

Default value is anthropic.claude-3-5-sonnet-20240620-v1:0.

connector_type_id string Required Discriminator

The type of connector.

Value is .bedrock.

id string Required

The identifier for the connector.

is_deprecated boolean Required

Indicates whether the connector type is deprecated.

is_missing_secrets boolean

Indicates whether secrets are missing for the connector. Secrets configuration properties vary depending on the connector type.

is_preconfigured boolean Required

Indicates whether it is a preconfigured connector. If true, the config and is_missing_secrets properties are omitted from the response.

is_system_action boolean

Indicates whether the connector is used for system actions.

name string Required

The display name for the connector.
Hide attributes Show attributes

config object

Defines properties for connectors when type is .gemini.

Hide config attributes Show config attributes object

apiUrl string Required

The Google Gemini request URL.

defaultModel string

The generative artificial intelligence model for Google Gemini to use.

Default value is gemini-1.5-pro-001.

gcpProjectID string Required

The Google ProjectID that has Vertex AI endpoint enabled.

gcpRegion string Required

The GCP region where the Vertex AI endpoint enabled.

connector_type_id string Required Discriminator

The type of connector.

Value is .gemini.

id string Required

The identifier for the connector.

is_deprecated boolean Required

Indicates whether the connector type is deprecated.

is_missing_secrets boolean

Indicates whether secrets are missing for the connector. Secrets configuration properties vary depending on the connector type.

is_preconfigured boolean Required

Indicates whether it is a preconfigured connector. If true, the config and is_missing_secrets properties are omitted from the response.

is_system_action boolean

Indicates whether the connector is used for system actions.

name string Required

The display name for the connector.

referenced_by_count integer

Indicates the number of saved objects that reference the connector. If is_preconfigured is true, this value is not calculated. This property is returned only by the get all connectors API.
Hide attributes Show attributes

config object

Defines properties for connectors when type is .cases-webhook.

Hide config attributes Show config attributes object

authType string | null

The type of authentication to use: basic, SSL, or none.

Values are webhook-authentication-basic or webhook-authentication-ssl.

ca string

A base64 encoded version of the certificate authority file that the connector can trust to sign and validate certificates. This option is available for all authentication types.

certType string

If the authType is webhook-authentication-ssl, specifies whether the certificate authentication data is in a CRT and key file format or a PFX file format.

Values are ssl-crt-key or ssl-pfx.

createCommentJson string

A JSON payload sent to the create comment URL to create a case comment. You can use variables to add Kibana Cases data to the payload. The required variable is case.comment. Due to Mustache template variables (the text enclosed in triple braces, for example, {{{case.title}}}), the JSON is not validated when you create the connector. The JSON is validated once the Mustache variables have been placed when the REST method runs. Manually ensure that the JSON is valid, disregarding the Mustache variables, so the later validation will pass.

createCommentMethod string

The REST API HTTP request method to create a case comment in the third-party system. Valid values are patch, post, and put.

Values are patch, post, or put. Default value is put.

createCommentUrl string

The REST API URL to create a case comment by ID in the third-party system. You can use a variable to add the external system ID to the URL. If you are using the xpack.actions.allowedHosts setting, add the hostname to the allowed hosts.

createIncidentJson string Required

A JSON payload sent to the create case URL to create a case. You can use variables to add case data to the payload. Required variables are case.title and case.description. Due to Mustache template variables (which is the text enclosed in triple braces, for example, {{{case.title}}}), the JSON is not validated when you create the connector. The JSON is validated after the Mustache variables have been placed when REST method runs. Manually ensure that the JSON is valid to avoid future validation errors; disregard Mustache variables during your review.

createIncidentMethod string

The REST API HTTP request method to create a case in the third-party system. Valid values are patch, post, and put.

Values are patch, post, or put. Default value is post.

createIncidentResponseKey string Required

The JSON key in the create external case response that contains the case ID.

createIncidentUrl string Required

The REST API URL to create a case in the third-party system. If you are using the xpack.actions.allowedHosts setting, add the hostname to the allowed hosts.

getIncidentResponseExternalTitleKey string Required

The JSON key in get external case response that contains the case title.

getIncidentUrl string Required

The REST API URL to get the case by ID from the third-party system. If you are using the xpack.actions.allowedHosts setting, add the hostname to the allowed hosts. You can use a variable to add the external system ID to the URL. Due to Mustache template variables (the text enclosed in triple braces, for example, {{{case.title}}}), the JSON is not validated when you create the connector. The JSON is validated after the Mustache variables have been placed when REST method runs. Manually ensure that the JSON is valid, disregarding the Mustache variables, so the later validation will pass.

hasAuth boolean

If true, a username and password for login type authentication must be provided.

Default value is true.

headers string

A set of key-value pairs sent as headers with the request URLs for the create case, update case, get case, and create comment methods.

updateIncidentJson string Required

The JSON payload sent to the update case URL to update the case. You can use variables to add Kibana Cases data to the payload. Required variables are case.title and case.description. Due to Mustache template variables (which is the text enclosed in triple braces, for example, {{{case.title}}}), the JSON is not validated when you create the connector. The JSON is validated after the Mustache variables have been placed when REST method runs. Manually ensure that the JSON is valid to avoid future validation errors; disregard Mustache variables during your review.

updateIncidentMethod string

The REST API HTTP request method to update the case in the third-party system. Valid values are patch, post, and put.

Values are patch, post, or put. Default value is put.

updateIncidentUrl string Required

The REST API URL to update the case by ID in the third-party system. You can use a variable to add the external system ID to the URL. If you are using the xpack.actions.allowedHosts setting, add the hostname to the allowed hosts.

verificationMode string

Controls the verification of certificates. Use full to validate that the certificate has an issue date within the not_before and not_after dates, chains to a trusted certificate authority (CA), and has a hostname or IP address that matches the names within the certificate. Use certificate to validate the certificate and verify that it is signed by a trusted authority; this option does not check the certificate hostname. Use none to skip certificate validation.

Values are certificate, full, or none. Default value is full.

viewIncidentUrl string Required

The URL to view the case in the external system. You can use variables to add the external system ID or external system title to the URL.

connector_type_id string Required Discriminator

The type of connector.

Value is .cases-webhook.

id string Required

The identifier for the connector.

is_deprecated boolean Required

Indicates whether the connector type is deprecated.

is_missing_secrets boolean

Indicates whether secrets are missing for the connector. Secrets configuration properties vary depending on the connector type.

is_preconfigured boolean Required

Indicates whether it is a preconfigured connector. If true, the config and is_missing_secrets properties are omitted from the response.

is_system_action boolean

Indicates whether the connector is used for system actions.

name string Required

The display name for the connector.

referenced_by_count integer

Indicates the number of saved objects that reference the connector. If is_preconfigured is true, this value is not calculated. This property is returned only by the get all connectors API.
Hide attributes Show attributes

config object

Defines properties for connectors when type is .d3security.

Hide config attribute Show config attribute object

url string Required

The D3 Security API request URL. If you are using the xpack.actions.allowedHosts setting, add the hostname to the allowed hosts.

connector_type_id string Required Discriminator

The type of connector.

Value is .d3security.

id string Required

The identifier for the connector.

is_deprecated boolean Required

Indicates whether the connector type is deprecated.

is_missing_secrets boolean

Indicates whether secrets are missing for the connector. Secrets configuration properties vary depending on the connector type.

is_preconfigured boolean Required

Indicates whether it is a preconfigured connector. If true, the config and is_missing_secrets properties are omitted from the response.

is_system_action boolean

Indicates whether the connector is used for system actions.

name string Required

The display name for the connector.

referenced_by_count integer

Indicates the number of saved objects that reference the connector. If is_preconfigured is true, this value is not calculated. This property is returned only by the get all connectors API.
Hide attributes Show attributes

config object

Defines properties for connectors when type is .email.

Hide config attributes Show config attributes object

clientId string | null

The client identifier, which is a part of OAuth 2.0 client credentials authentication, in GUID format. If service is exchange_server, this property is required.

from string Required

The from address for all emails sent by the connector. It must be specified in user@host-name format.

hasAuth boolean

Specifies whether a user and password are required inside the secrets configuration.

Default value is true.

host string

The host name of the service provider. If the service is elastic_cloud (for Elastic Cloud notifications) or one of Nodemailer's well-known email service providers, this property is ignored. If service is other, this property must be defined.

oauthTokenUrl string | null

port integer

The port to connect to on the service provider. If the service is elastic_cloud (for Elastic Cloud notifications) or one of Nodemailer's well-known email service providers, this property is ignored. If service is other, this property must be defined.

secure boolean

Specifies whether the connection to the service provider will use TLS. If the service is elastic_cloud (for Elastic Cloud notifications) or one of Nodemailer's well-known email service providers, this property is ignored.

service string

The name of the email service.

Values are elastic_cloud, exchange_server, gmail, other, outlook365, or ses.

tenantId string | null

The tenant identifier, which is part of OAuth 2.0 client credentials authentication, in GUID format. If service is exchange_server, this property is required.

connector_type_id string Required Discriminator

The type of connector.

Value is .email.

id string Required

The identifier for the connector.

is_deprecated boolean Required

Indicates whether the connector type is deprecated.

is_missing_secrets boolean

Indicates whether secrets are missing for the connector. Secrets configuration properties vary depending on the connector type.

is_preconfigured boolean Required

Indicates whether it is a preconfigured connector. If true, the config and is_missing_secrets properties are omitted from the response.

is_system_action boolean

Indicates whether the connector is used for system actions.

name string Required

The display name for the connector.

referenced_by_count integer

Indicates the number of saved objects that reference the connector. If is_preconfigured is true, this value is not calculated. This property is returned only by the get all connectors API.
Hide attributes Show attributes

config object

Defines properties for connectors when type is .gen-ai.

One of:
Connectors_config_properties_genai_azure object Connectors_config_properties_genai_openai object

Defines properties for connectors when type is .gen-ai and the API provider is `Azure OpenAI'.

Hide attributes Show attributes

apiProvider string Required Discriminator

The OpenAI API provider.

Value is Azure OpenAI.

apiUrl string Required

The OpenAI API endpoint.

Defines properties for connectors when type is .gen-ai and the API provider is `OpenAI'.

Hide attributes Show attributes

apiProvider string Required Discriminator

The OpenAI API provider.

Value is OpenAI.

apiUrl string Required

The OpenAI API endpoint.

defaultModel string

The default model to use for requests.

connector_type_id string Required Discriminator

The type of connector.

Value is .gen-ai.

id string Required

The identifier for the connector.

is_deprecated boolean Required

Indicates whether the connector type is deprecated.

is_missing_secrets boolean

Indicates whether secrets are missing for the connector. Secrets configuration properties vary depending on the connector type.

is_preconfigured boolean Required

Indicates whether it is a preconfigured connector. If true, the config and is_missing_secrets properties are omitted from the response.

is_system_action boolean

Indicates whether the connector is used for system actions.

name string Required

The display name for the connector.

referenced_by_count integer

Indicates the number of saved objects that reference the connector. If is_preconfigured is true, this value is not calculated. This property is returned only by the get all connectors API.
Hide attributes Show attributes

config object

Defines properties for connectors when type is .index.

Hide config attributes Show config attributes object

executionTimeField string | null

A field that indicates when the document was indexed.

index string Required

The Elasticsearch index to be written to.

refresh boolean

The refresh policy for the write request, which affects when changes are made visible to search. Refer to the refresh setting for Elasticsearch document APIs.

Default value is false.

connector_type_id string Required Discriminator

The type of connector.

Value is .index.

id string Required

The identifier for the connector.

is_deprecated boolean Required

Indicates whether the connector type is deprecated.

is_missing_secrets boolean

Indicates whether secrets are missing for the connector. Secrets configuration properties vary depending on the connector type.

is_preconfigured boolean Required

Indicates whether it is a preconfigured connector. If true, the config and is_missing_secrets properties are omitted from the response.

is_system_action boolean

Indicates whether the connector is used for system actions.

name string Required

The display name for the connector.

referenced_by_count integer

Indicates the number of saved objects that reference the connector. If is_preconfigured is true, this value is not calculated. This property is returned only by the get all connectors API.
Hide attributes Show attributes

config object

Defines properties for connectors when type is .jira.

Hide config attributes Show config attributes object

apiUrl string Required

The Jira instance URL.

projectKey string Required

The Jira project key.

connector_type_id string Required Discriminator

The type of connector.

Value is .jira.

id string Required

The identifier for the connector.

is_deprecated boolean Required

Indicates whether the connector type is deprecated.

is_missing_secrets boolean

Indicates whether secrets are missing for the connector. Secrets configuration properties vary depending on the connector type.

is_preconfigured boolean Required

Indicates whether it is a preconfigured connector. If true, the config and is_missing_secrets properties are omitted from the response.

is_system_action boolean

Indicates whether the connector is used for system actions.

name string Required

The display name for the connector.

referenced_by_count integer

Indicates the number of saved objects that reference the connector. If is_preconfigured is true, this value is not calculated. This property is returned only by the get all connectors API.
Hide attributes Show attributes

config object

Defines properties for connectors when type is .opsgenie.

Hide config attribute Show config attribute object

apiUrl string Required

The Opsgenie URL. For example, https://api.opsgenie.com or https://api.eu.opsgenie.com. If you are using the xpack.actions.allowedHosts setting, add the hostname to the allowed hosts.

connector_type_id string Required Discriminator

The type of connector.

Value is .opsgenie.

id string Required

The identifier for the connector.

is_deprecated boolean Required

Indicates whether the connector type is deprecated.

is_missing_secrets boolean

Indicates whether secrets are missing for the connector. Secrets configuration properties vary depending on the connector type.

is_preconfigured boolean Required

Indicates whether it is a preconfigured connector. If true, the config and is_missing_secrets properties are omitted from the response.

is_system_action boolean

Indicates whether the connector is used for system actions.

name string Required

The display name for the connector.

referenced_by_count integer

Indicates the number of saved objects that reference the connector. If is_preconfigured is true, this value is not calculated. This property is returned only by the get all connectors API.
Hide attributes Show attributes

config object

Defines properties for connectors when type is .pagerduty.

Hide config attribute Show config attribute object

apiUrl string | null

The PagerDuty event URL.

connector_type_id string Required Discriminator

The type of connector.

Value is .pagerduty.

id string Required

The identifier for the connector.

is_deprecated boolean Required

Indicates whether the connector type is deprecated.

is_missing_secrets boolean

Indicates whether secrets are missing for the connector. Secrets configuration properties vary depending on the connector type.

is_preconfigured boolean Required

Indicates whether it is a preconfigured connector. If true, the config and is_missing_secrets properties are omitted from the response.

is_system_action boolean

Indicates whether the connector is used for system actions.

name string Required

The display name for the connector.

referenced_by_count integer

Indicates the number of saved objects that reference the connector. If is_preconfigured is true, this value is not calculated. This property is returned only by the get all connectors API.
Hide attributes Show attributes

config object

Defines properties for connectors when type is .resilient.

Hide config attributes Show config attributes object

apiUrl string Required

The IBM Resilient instance URL.

orgId string Required

The IBM Resilient organization ID.

connector_type_id string Required Discriminator

The type of connector.

Value is .resilient.

id string Required

The identifier for the connector.

is_deprecated boolean Required

Indicates whether the connector type is deprecated.

is_missing_secrets boolean

Indicates whether secrets are missing for the connector. Secrets configuration properties vary depending on the connector type.

is_preconfigured boolean Required

Indicates whether it is a preconfigured connector. If true, the config and is_missing_secrets properties are omitted from the response.

is_system_action boolean

Indicates whether the connector is used for system actions.

name string Required

The display name for the connector.

referenced_by_count integer

Indicates the number of saved objects that reference the connector. If is_preconfigured is true, this value is not calculated. This property is returned only by the get all connectors API.
Hide attributes Show attributes

config object

Defines properties for connectors when type is .sentinelone.

Hide config attribute Show config attribute object

url string Required

The SentinelOne tenant URL. If you are using the xpack.actions.allowedHosts setting, add the hostname to the allowed hosts.

connector_type_id string Required Discriminator

The type of connector.

Value is .sentinelone.

id string Required

The identifier for the connector.

is_deprecated boolean Required

Indicates whether the connector type is deprecated.

is_missing_secrets boolean

Indicates whether secrets are missing for the connector. Secrets configuration properties vary depending on the connector type.

is_preconfigured boolean Required

Indicates whether it is a preconfigured connector. If true, the config and is_missing_secrets properties are omitted from the response.

is_system_action boolean

Indicates whether the connector is used for system actions.

name string Required

The display name for the connector.

referenced_by_count integer

Indicates the number of saved objects that reference the connector. If is_preconfigured is true, this value is not calculated. This property is returned only by the get all connectors API.
Hide attributes Show attributes

config object | null

connector_type_id string Required Discriminator

The type of connector.

Value is .server-log.

id string Required

The identifier for the connector.

is_deprecated boolean Required

Indicates whether the connector type is deprecated.

is_missing_secrets boolean

Indicates whether secrets are missing for the connector. Secrets configuration properties vary depending on the connector type.

is_preconfigured boolean Required

Indicates whether it is a preconfigured connector. If true, the config and is_missing_secrets properties are omitted from the response.

is_system_action boolean

Indicates whether the connector is used for system actions.

name string Required

The display name for the connector.

referenced_by_count integer

Indicates the number of saved objects that reference the connector. If is_preconfigured is true, this value is not calculated. This property is returned only by the get all connectors API.
Hide attributes Show attributes

config object

Defines properties for connectors when type is .servicenow.

Hide config attributes Show config attributes object

apiUrl string Required

The ServiceNow instance URL.

clientId string

The client ID assigned to your OAuth application. This property is required when isOAuth is true.

isOAuth boolean

The type of authentication to use. The default value is false, which means basic authentication is used instead of open authorization (OAuth).

Default value is false.

jwtKeyId string

The key identifier assigned to the JWT verifier map of your OAuth application. This property is required when isOAuth is true.

userIdentifierValue string

The identifier to use for OAuth authentication. This identifier should be the user field you selected when you created an OAuth JWT API endpoint for external clients in your ServiceNow instance. For example, if the selected user field is Email, the user identifier should be the user's email address. This property is required when isOAuth is true.

usesTableApi boolean

Determines whether the connector uses the Table API or the Import Set API. This property is supported only for ServiceNow ITSM and ServiceNow SecOps connectors. NOTE: If this property is set to false, the Elastic application should be installed in ServiceNow.

Default value is true.

connector_type_id string Required Discriminator

The type of connector.

Value is .servicenow.

id string Required

The identifier for the connector.

is_deprecated boolean Required

Indicates whether the connector type is deprecated.

is_missing_secrets boolean

Indicates whether secrets are missing for the connector. Secrets configuration properties vary depending on the connector type.

is_preconfigured boolean Required

Indicates whether it is a preconfigured connector. If true, the config and is_missing_secrets properties are omitted from the response.

is_system_action boolean

Indicates whether the connector is used for system actions.

name string Required

The display name for the connector.

referenced_by_count integer

Indicates the number of saved objects that reference the connector. If is_preconfigured is true, this value is not calculated. This property is returned only by the get all connectors API.
Hide attributes Show attributes

config object

Defines properties for connectors when type is .servicenow.

Hide config attributes Show config attributes object

apiUrl string Required

The ServiceNow instance URL.

clientId string

The client ID assigned to your OAuth application. This property is required when isOAuth is true.

isOAuth boolean

The type of authentication to use. The default value is false, which means basic authentication is used instead of open authorization (OAuth).

Default value is false.

jwtKeyId string

The key identifier assigned to the JWT verifier map of your OAuth application. This property is required when isOAuth is true.

userIdentifierValue string

The identifier to use for OAuth authentication. This identifier should be the user field you selected when you created an OAuth JWT API endpoint for external clients in your ServiceNow instance. For example, if the selected user field is Email, the user identifier should be the user's email address. This property is required when isOAuth is true.

connector_type_id string Required Discriminator

The type of connector.

Value is .servicenow-itom.

id string Required

The identifier for the connector.

is_deprecated boolean Required

Indicates whether the connector type is deprecated.

is_missing_secrets boolean

Indicates whether secrets are missing for the connector. Secrets configuration properties vary depending on the connector type.

is_preconfigured boolean Required

Indicates whether it is a preconfigured connector. If true, the config and is_missing_secrets properties are omitted from the response.

is_system_action boolean

Indicates whether the connector is used for system actions.

name string Required

The display name for the connector.

referenced_by_count integer

Indicates the number of saved objects that reference the connector. If is_preconfigured is true, this value is not calculated. This property is returned only by the get all connectors API.
Hide attributes Show attributes

config object

Defines properties for connectors when type is .servicenow.

Hide config attributes Show config attributes object

apiUrl string Required

The ServiceNow instance URL.

clientId string

The client ID assigned to your OAuth application. This property is required when isOAuth is true.

isOAuth boolean

The type of authentication to use. The default value is false, which means basic authentication is used instead of open authorization (OAuth).

Default value is false.

jwtKeyId string

The key identifier assigned to the JWT verifier map of your OAuth application. This property is required when isOAuth is true.

userIdentifierValue string

The identifier to use for OAuth authentication. This identifier should be the user field you selected when you created an OAuth JWT API endpoint for external clients in your ServiceNow instance. For example, if the selected user field is Email, the user identifier should be the user's email address. This property is required when isOAuth is true.

usesTableApi boolean

Determines whether the connector uses the Table API or the Import Set API. This property is supported only for ServiceNow ITSM and ServiceNow SecOps connectors. NOTE: If this property is set to false, the Elastic application should be installed in ServiceNow.

Default value is true.

connector_type_id string Required Discriminator

The type of connector.

Value is .servicenow-sir.

id string Required

The identifier for the connector.

is_deprecated boolean Required

Indicates whether the connector type is deprecated.

is_missing_secrets boolean

Indicates whether secrets are missing for the connector. Secrets configuration properties vary depending on the connector type.

is_preconfigured boolean Required

Indicates whether it is a preconfigured connector. If true, the config and is_missing_secrets properties are omitted from the response.

is_system_action boolean

Indicates whether the connector is used for system actions.

name string Required

The display name for the connector.

referenced_by_count integer

Indicates the number of saved objects that reference the connector. If is_preconfigured is true, this value is not calculated. This property is returned only by the get all connectors API.
Hide attributes Show attributes

config object

Defines properties for connectors when type is .slack_api.

Hide config attribute Show config attribute object

allowedChannels array[object]

A list of valid Slack channels.

Hide allowedChannels attributes Show allowedChannels attributes object

id string Required

The Slack channel ID.

Minimum length is 1.

name string Required

The Slack channel name.

Minimum length is 1.

connector_type_id string Required Discriminator

The type of connector.

Value is .slack_api.

id string Required

The identifier for the connector.

is_deprecated boolean Required

Indicates whether the connector type is deprecated.

is_missing_secrets boolean

Indicates whether secrets are missing for the connector. Secrets configuration properties vary depending on the connector type.

is_preconfigured boolean Required

Indicates whether it is a preconfigured connector. If true, the config and is_missing_secrets properties are omitted from the response.

is_system_action boolean

Indicates whether the connector is used for system actions.

name string Required

The display name for the connector.

referenced_by_count integer

Indicates the number of saved objects that reference the connector. If is_preconfigured is true, this value is not calculated. This property is returned only by the get all connectors API.
Hide attributes Show attributes

connector_type_id string Required Discriminator

The type of connector.

Value is .slack.

id string Required

The identifier for the connector.

is_deprecated boolean Required

Indicates whether the connector type is deprecated.

is_missing_secrets boolean

Indicates whether secrets are missing for the connector. Secrets configuration properties vary depending on the connector type.

is_preconfigured boolean Required

Indicates whether it is a preconfigured connector. If true, the config and is_missing_secrets properties are omitted from the response.

is_system_action boolean

Indicates whether the connector is used for system actions.

name string Required

The display name for the connector.

referenced_by_count integer

Indicates the number of saved objects that reference the connector. If is_preconfigured is true, this value is not calculated. This property is returned only by the get all connectors API.
Hide attributes Show attributes

config object

Defines properties for connectors when type is .swimlane.

Hide config attributes Show config attributes object

apiUrl string Required

The Swimlane instance URL.

appId string Required

The Swimlane application ID.

connectorType string Required

The type of connector. Valid values are all, alerts, and cases.

Values are all, alerts, or cases.

mappings object

The field mapping.

Hide mappings attributes Show mappings attributes object

alertIdConfig object

Mapping for the alert ID.

Hide alertIdConfig attributes Show alertIdConfig attributes object

fieldType string Required

The type of field in Swimlane.

id string Required

The identifier for the field in Swimlane.

key string Required

The key for the field in Swimlane.

name string Required

The name of the field in Swimlane.

caseIdConfig object

Mapping for the case ID.

Hide caseIdConfig attributes Show caseIdConfig attributes object

fieldType string Required

The type of field in Swimlane.

id string Required

The identifier for the field in Swimlane.

key string Required

The key for the field in Swimlane.

name string Required

The name of the field in Swimlane.

caseNameConfig object

Mapping for the case name.

Hide caseNameConfig attributes Show caseNameConfig attributes object

fieldType string Required

The type of field in Swimlane.

id string Required

The identifier for the field in Swimlane.

key string Required

The key for the field in Swimlane.

name string Required

The name of the field in Swimlane.

commentsConfig object

Mapping for the case comments.

Hide commentsConfig attributes Show commentsConfig attributes object

fieldType string Required

The type of field in Swimlane.

id string Required

The identifier for the field in Swimlane.

key string Required

The key for the field in Swimlane.

name string Required

The name of the field in Swimlane.

descriptionConfig object

Mapping for the case description.

Hide descriptionConfig attributes Show descriptionConfig attributes object

fieldType string Required

The type of field in Swimlane.

id string Required

The identifier for the field in Swimlane.

key string Required

The key for the field in Swimlane.

name string Required

The name of the field in Swimlane.

ruleNameConfig object

Mapping for the name of the alert's rule.

Hide ruleNameConfig attributes Show ruleNameConfig attributes object

fieldType string Required

The type of field in Swimlane.

id string Required

The identifier for the field in Swimlane.

key string Required

The key for the field in Swimlane.

name string Required

The name of the field in Swimlane.

severityConfig object

Mapping for the severity.

Hide severityConfig attributes Show severityConfig attributes object

fieldType string Required

The type of field in Swimlane.

id string Required

The identifier for the field in Swimlane.

key string Required

The key for the field in Swimlane.

name string Required

The name of the field in Swimlane.

connector_type_id string Required Discriminator

The type of connector.

Value is .swimlane.

id string Required

The identifier for the connector.

is_deprecated boolean Required

Indicates whether the connector type is deprecated.

is_missing_secrets boolean

Indicates whether secrets are missing for the connector. Secrets configuration properties vary depending on the connector type.

is_preconfigured boolean Required

Indicates whether it is a preconfigured connector. If true, the config and is_missing_secrets properties are omitted from the response.

is_system_action boolean

Indicates whether the connector is used for system actions.

name string Required

The display name for the connector.

referenced_by_count integer

Indicates the number of saved objects that reference the connector. If is_preconfigured is true, this value is not calculated. This property is returned only by the get all connectors API.
Hide attributes Show attributes

config object

connector_type_id string Required Discriminator

The type of connector.

Value is .teams.

id string Required

The identifier for the connector.

is_deprecated boolean Required

Indicates whether the connector type is deprecated.

is_missing_secrets boolean

Indicates whether secrets are missing for the connector. Secrets configuration properties vary depending on the connector type.

is_preconfigured boolean Required

Indicates whether it is a preconfigured connector. If true, the config and is_missing_secrets properties are omitted from the response.

is_system_action boolean

Indicates whether the connector is used for system actions.

name string Required

The display name for the connector.

referenced_by_count integer

Indicates the number of saved objects that reference the connector. If is_preconfigured is true, this value is not calculated. This property is returned only by the get all connectors API.
Hide attributes Show attributes

config object

Defines properties for connectors when type is .tines.

Hide config attribute Show config attribute object

url string Required

The Tines tenant URL. If you are using the xpack.actions.allowedHosts setting, make sure this hostname is added to the allowed hosts.

connector_type_id string Required Discriminator

The type of connector.

Value is .tines.

id string Required

The identifier for the connector.

is_deprecated boolean Required

Indicates whether the connector type is deprecated.

is_missing_secrets boolean

Indicates whether secrets are missing for the connector. Secrets configuration properties vary depending on the connector type.

is_preconfigured boolean Required

Indicates whether it is a preconfigured connector. If true, the config and is_missing_secrets properties are omitted from the response.

is_system_action boolean

Indicates whether the connector is used for system actions.

name string Required

The display name for the connector.

referenced_by_count integer

Indicates the number of saved objects that reference the connector. If is_preconfigured is true, this value is not calculated. This property is returned only by the get all connectors API.
Hide attributes Show attributes

config object

Defines properties for connectors when type is .torq.

Hide config attribute Show config attribute object

webhookIntegrationUrl string Required

The endpoint URL of the Elastic Security integration in Torq.

connector_type_id string Required Discriminator

The type of connector.

Value is .torq.

id string Required

The identifier for the connector.

is_deprecated boolean Required

Indicates whether the connector type is deprecated.

is_missing_secrets boolean

Indicates whether secrets are missing for the connector. Secrets configuration properties vary depending on the connector type.

is_preconfigured boolean Required

Indicates whether it is a preconfigured connector. If true, the config and is_missing_secrets properties are omitted from the response.

is_system_action boolean

Indicates whether the connector is used for system actions.

name string Required

The display name for the connector.

referenced_by_count integer

Indicates the number of saved objects that reference the connector. If is_preconfigured is true, this value is not calculated. This property is returned only by the get all connectors API.
Hide attributes Show attributes

config object

Defines properties for connectors when type is .webhook.

Hide config attributes Show config attributes object

authType string | null

The type of authentication to use: basic, SSL, or none.

Values are webhook-authentication-basic or webhook-authentication-ssl.

ca string

A base64 encoded version of the certificate authority file that the connector can trust to sign and validate certificates. This option is available for all authentication types.

certType string

If the authType is webhook-authentication-ssl, specifies whether the certificate authentication data is in a CRT and key file format or a PFX file format.

Values are ssl-crt-key or ssl-pfx.

hasAuth boolean

If true, a username and password for login type authentication must be provided.

Default value is true.

headers object | null

A set of key-value pairs sent as headers with the request.

method string

The HTTP request method, either post or put.

Values are post or put. Default value is post.

url string

The request URL. If you are using the xpack.actions.allowedHosts setting, add the hostname to the allowed hosts.

verificationMode string

Controls the verification of certificates. Use full to validate that the certificate has an issue date within the not_before and not_after dates, chains to a trusted certificate authority (CA), and has a hostname or IP address that matches the names within the certificate. Use certificate to validate the certificate and verify that it is signed by a trusted authority; this option does not check the certificate hostname. Use none to skip certificate validation.

Values are certificate, full, or none. Default value is full.

connector_type_id string Required Discriminator

The type of connector.

Value is .webhook.

id string Required

The identifier for the connector.

is_deprecated boolean Required

Indicates whether the connector type is deprecated.

is_missing_secrets boolean

Indicates whether secrets are missing for the connector. Secrets configuration properties vary depending on the connector type.

is_preconfigured boolean Required

Indicates whether it is a preconfigured connector. If true, the config and is_missing_secrets properties are omitted from the response.

is_system_action boolean

Indicates whether the connector is used for system actions.

name string Required

The display name for the connector.

referenced_by_count integer

Indicates the number of saved objects that reference the connector. If is_preconfigured is true, this value is not calculated. This property is returned only by the get all connectors API.
Hide attributes Show attributes

config object

Defines properties for connectors when type is .xmatters.

Hide config attributes Show config attributes object

configUrl string | null

The request URL for the Elastic Alerts trigger in xMatters. It is applicable only when usesBasic is true.

usesBasic boolean

Specifies whether the connector uses HTTP basic authentication (true) or URL authentication (false).

Default value is true.

connector_type_id string Required Discriminator

The type of connector.

Value is .xmatters.

id string Required

The identifier for the connector.

is_deprecated boolean Required

Indicates whether the connector type is deprecated.

is_missing_secrets boolean

Indicates whether secrets are missing for the connector. Secrets configuration properties vary depending on the connector type.

is_preconfigured boolean Required

Indicates whether it is a preconfigured connector. If true, the config and is_missing_secrets properties are omitted from the response.

is_system_action boolean

Indicates whether the connector is used for system actions.

name string Required

The display name for the connector.

referenced_by_count integer

Indicates the number of saved objects that reference the connector. If is_preconfigured is true, this value is not calculated. This property is returned only by the get all connectors API.
400 application/json; Elastic-Api-Version=2023-10-31

Authorization information is missing or invalid.
Hide response attributes Show response attributes object
- error string
  
  Value is Unauthorized.
- message string
- statusCode integer
  
  Value is 401.
401 application/json; Elastic-Api-Version=2023-10-31

Authorization information is missing or invalid.
Hide response attributes Show response attributes object
- error string
  
  Value is Unauthorized.
- message string
- statusCode integer
  
  Value is 401.
404 application/json; Elastic-Api-Version=2023-10-31

Object is not found.
Hide response attributes Show response attributes object
- error string
  
  Value is Not Found.
- message string
- statusCode integer
  
  Value is 404.

PUT /api/actions/connector/{connectorId}

curl \
 -X PUT https://localhost:5601/api/actions/connector/df770e30-8b8b-11ed-a780-3b746c987a81 \
 -H "Content-Type: application/json; Elastic-Api-Version=2023-10-31" \
 -H "kbn-xsrf: string"

Request example

{
  "name": "updated-connector",
  "config": {
    "index": "updated-index"
  }
}

Response examples (200)

{
  "config": {
    "apiUrl": "string",
    "defaultModel": "anthropic.claude-3-5-sonnet-20240620-v1:0"
  },
  "connector_type_id": ".bedrock",
  "id": "string",
  "is_deprecated": false,
  "is_missing_secrets": false,
  "is_preconfigured": false,
  "is_system_action": false,
  "name": "string"
}

{
  "config": {
    "apiUrl": "string",
    "defaultModel": "gemini-1.5-pro-001",
    "gcpProjectID": "string",
    "gcpRegion": "string"
  },
  "connector_type_id": ".gemini",
  "id": "string",
  "is_deprecated": false,
  "is_missing_secrets": false,
  "is_preconfigured": false,
  "is_system_action": false,
  "name": "string",
  "referenced_by_count": 2
}

{
  "config": {
    "authType": "webhook-authentication-basic",
    "ca": "string",
    "certType": "ssl-crt-key",
    "createCommentJson": "{\"body\": {{{case.comment}}}}",
    "createCommentMethod": "put",
    "createCommentUrl": "https://example.com/issue/{{{external.system.id}}}/comment",
    "createIncidentJson": "{\"fields\": {\"summary\": {{{case.title}}},\"description\": {{{case.description}}},\"labels\": {{{case.tags}}}}}",
    "createIncidentMethod": "post",
    "createIncidentResponseKey": "string",
    "createIncidentUrl": "string",
    "getIncidentResponseExternalTitleKey": "string",
    "getIncidentUrl": "https://example.com/issue/{{{external.system.id}}}",
    "hasAuth": true,
    "headers": "string",
    "updateIncidentJson": "{\"fields\": {\"summary\": {{{case.title}}},\"description\": {{{case.description}}},\"labels\": {{{case.tags}}}}}",
    "updateIncidentMethod": "put",
    "updateIncidentUrl": "https://example.com/issue/{{{external.system.ID}}}",
    "verificationMode": "full",
    "viewIncidentUrl": "https://testing-jira.atlassian.net/browse/{{{external.system.title}}}"
  },
  "connector_type_id": ".cases-webhook",
  "id": "string",
  "is_deprecated": false,
  "is_missing_secrets": false,
  "is_preconfigured": false,
  "is_system_action": false,
  "name": "string",
  "referenced_by_count": 2
}

{
  "config": {
    "url": "string"
  },
  "connector_type_id": ".d3security",
  "id": "string",
  "is_deprecated": false,
  "is_missing_secrets": false,
  "is_preconfigured": false,
  "is_system_action": false,
  "name": "string",
  "referenced_by_count": 2
}

{
  "config": {
    "clientId": "string",
    "from": "string",
    "hasAuth": true,
    "host": "string",
    "oauthTokenUrl": "string",
    "port": 42,
    "secure": true,
    "service": "elastic_cloud",
    "tenantId": "string"
  },
  "connector_type_id": ".email",
  "id": "string",
  "is_deprecated": false,
  "is_missing_secrets": false,
  "is_preconfigured": false,
  "is_system_action": false,
  "name": "string",
  "referenced_by_count": 2
}

{
  "config": {
    "apiProvider": "Azure OpenAI",
    "apiUrl": "string"
  },
  "connector_type_id": ".gen-ai",
  "id": "string",
  "is_deprecated": false,
  "is_missing_secrets": false,
  "is_preconfigured": false,
  "is_system_action": false,
  "name": "string",
  "referenced_by_count": 2
}

{
  "config": {
    "executionTimeField": "string",
    "index": "string",
    "refresh": false
  },
  "connector_type_id": ".index",
  "id": "string",
  "is_deprecated": false,
  "is_missing_secrets": false,
  "is_preconfigured": false,
  "is_system_action": false,
  "name": "string",
  "referenced_by_count": 2
}

{
  "config": {
    "apiUrl": "string",
    "projectKey": "string"
  },
  "connector_type_id": ".jira",
  "id": "string",
  "is_deprecated": false,
  "is_missing_secrets": false,
  "is_preconfigured": false,
  "is_system_action": false,
  "name": "string",
  "referenced_by_count": 2
}

{
  "config": {
    "apiUrl": "string"
  },
  "connector_type_id": ".opsgenie",
  "id": "string",
  "is_deprecated": false,
  "is_missing_secrets": false,
  "is_preconfigured": false,
  "is_system_action": false,
  "name": "string",
  "referenced_by_count": 2
}

{
  "config": {
    "apiUrl": "https://events.pagerduty.com/v2/enqueue"
  },
  "connector_type_id": ".pagerduty",
  "id": "string",
  "is_deprecated": false,
  "is_missing_secrets": false,
  "is_preconfigured": false,
  "is_system_action": false,
  "name": "string",
  "referenced_by_count": 2
}

{
  "config": {
    "apiUrl": "string",
    "orgId": "string"
  },
  "connector_type_id": ".resilient",
  "id": "string",
  "is_deprecated": false,
  "is_missing_secrets": false,
  "is_preconfigured": false,
  "is_system_action": false,
  "name": "string",
  "referenced_by_count": 2
}

{
  "config": {
    "url": "string"
  },
  "connector_type_id": ".sentinelone",
  "id": "string",
  "is_deprecated": false,
  "is_missing_secrets": false,
  "is_preconfigured": false,
  "is_system_action": false,
  "name": "string",
  "referenced_by_count": 2
}

{
  "config": {},
  "connector_type_id": ".server-log",
  "id": "string",
  "is_deprecated": false,
  "is_missing_secrets": false,
  "is_preconfigured": false,
  "is_system_action": false,
  "name": "string",
  "referenced_by_count": 2
}

{
  "config": {
    "apiUrl": "string",
    "clientId": "string",
    "isOAuth": false,
    "jwtKeyId": "string",
    "userIdentifierValue": "string",
    "usesTableApi": true
  },
  "connector_type_id": ".servicenow",
  "id": "string",
  "is_deprecated": false,
  "is_missing_secrets": false,
  "is_preconfigured": false,
  "is_system_action": false,
  "name": "string",
  "referenced_by_count": 2
}

{
  "config": {
    "apiUrl": "string",
    "clientId": "string",
    "isOAuth": false,
    "jwtKeyId": "string",
    "userIdentifierValue": "string"
  },
  "connector_type_id": ".servicenow-itom",
  "id": "string",
  "is_deprecated": false,
  "is_missing_secrets": false,
  "is_preconfigured": false,
  "is_system_action": false,
  "name": "string",
  "referenced_by_count": 2
}

{
  "config": {
    "apiUrl": "string",
    "clientId": "string",
    "isOAuth": false,
    "jwtKeyId": "string",
    "userIdentifierValue": "string",
    "usesTableApi": true
  },
  "connector_type_id": ".servicenow-sir",
  "id": "string",
  "is_deprecated": false,
  "is_missing_secrets": false,
  "is_preconfigured": false,
  "is_system_action": false,
  "name": "string",
  "referenced_by_count": 2
}

{
  "config": {
    "allowedChannels": [
      {
        "id": "C123ABC456",
        "name": "string"
      }
    ]
  },
  "connector_type_id": ".slack_api",
  "id": "string",
  "is_deprecated": false,
  "is_missing_secrets": false,
  "is_preconfigured": false,
  "is_system_action": false,
  "name": "string",
  "referenced_by_count": 2
}

{
  "connector_type_id": ".slack",
  "id": "string",
  "is_deprecated": false,
  "is_missing_secrets": false,
  "is_preconfigured": false,
  "is_system_action": false,
  "name": "string",
  "referenced_by_count": 2
}

{
  "config": {
    "apiUrl": "string",
    "appId": "string",
    "connectorType": "all",
    "mappings": {
      "alertIdConfig": {
        "fieldType": "string",
        "id": "string",
        "key": "string",
        "name": "string"
      },
      "caseIdConfig": {
        "fieldType": "string",
        "id": "string",
        "key": "string",
        "name": "string"
      },
      "caseNameConfig": {
        "fieldType": "string",
        "id": "string",
        "key": "string",
        "name": "string"
      },
      "commentsConfig": {
        "fieldType": "string",
        "id": "string",
        "key": "string",
        "name": "string"
      },
      "descriptionConfig": {
        "fieldType": "string",
        "id": "string",
        "key": "string",
        "name": "string"
      },
      "ruleNameConfig": {
        "fieldType": "string",
        "id": "string",
        "key": "string",
        "name": "string"
      },
      "severityConfig": {
        "fieldType": "string",
        "id": "string",
        "key": "string",
        "name": "string"
      }
    }
  },
  "connector_type_id": ".swimlane",
  "id": "string",
  "is_deprecated": false,
  "is_missing_secrets": false,
  "is_preconfigured": false,
  "is_system_action": false,
  "name": "string",
  "referenced_by_count": 2
}

{
  "config": {},
  "connector_type_id": ".teams",
  "id": "string",
  "is_deprecated": false,
  "is_missing_secrets": false,
  "is_preconfigured": false,
  "is_system_action": false,
  "name": "string",
  "referenced_by_count": 2
}

{
  "config": {
    "url": "string"
  },
  "connector_type_id": ".tines",
  "id": "string",
  "is_deprecated": false,
  "is_missing_secrets": false,
  "is_preconfigured": false,
  "is_system_action": false,
  "name": "string",
  "referenced_by_count": 2
}

{
  "config": {
    "webhookIntegrationUrl": "string"
  },
  "connector_type_id": ".torq",
  "id": "string",
  "is_deprecated": false,
  "is_missing_secrets": false,
  "is_preconfigured": false,
  "is_system_action": false,
  "name": "string",
  "referenced_by_count": 2
}

{
  "config": {
    "authType": "webhook-authentication-basic",
    "ca": "string",
    "certType": "ssl-crt-key",
    "hasAuth": true,
    "headers": {},
    "method": "post",
    "url": "string",
    "verificationMode": "full"
  },
  "connector_type_id": ".webhook",
  "id": "string",
  "is_deprecated": false,
  "is_missing_secrets": false,
  "is_preconfigured": false,
  "is_system_action": false,
  "name": "string",
  "referenced_by_count": 2
}

{
  "config": {
    "configUrl": "string",
    "usesBasic": true
  },
  "connector_type_id": ".xmatters",
  "id": "string",
  "is_deprecated": false,
  "is_missing_secrets": false,
  "is_preconfigured": false,
  "is_system_action": false,
  "name": "string",
  "referenced_by_count": 2
}

Response examples (400)

{
  "error": "Unauthorized",
  "message": "string",
  "statusCode": 401
}

Response examples (401)

{
  "error": "Unauthorized",
  "message": "string",
  "statusCode": 401
}

Response examples (404)

{
  "error": "Not Found",
  "message": "Saved object [action/baf33fc0-920c-11ed-b36a-874bd1548a00] not found",
  "statusCode": 404
}