Show Menu
Search…
Ctrl+K
ESC
Example searches: “connector_type_id”, “execution_status”, “dsl”, “uuid”, “active”
Toggle dark mode
Elastic APIs hub
Elastic Cloud API
Elastic Cloud Enterprise API
Elastic Cloud Serverless API
Elasticsearch API
Elasticsearch Serverless API
Kibana API
Kibana Serverless API
Observability Intake Serverless API
Back to hub page
API Changelog
Download source
JSON OpenAPI specification
YAML OpenAPI specification
Feedback
Topics
Introduction
Authentication
Endpoints
Alerting
Get rule details
GET
Update a rule
PUT
Create a rule
POST
Delete a rule
DELETE
Disable a rule
POST
Enable a rule
POST
Mute all alerts
POST
Unmute all alerts
POST
Update the API key for a rule
POST
Mute an alert
POST
Unmute an alert
POST
Get information about rules
GET
APM agent configuration
Get a list of agent configurations
GET
Create or update agent configuration
PUT
Delete agent configuration
DELETE
Get agent name for service
GET
Get environments for service
GET
Lookup single agent configuration
POST
Get single agent configuration
GET
APM agent keys
Create an APM agent key
POST
APM annotations
Create a service annotation
POST
Search for annotations
GET
APM server schema
Save APM server schema
POST
APM sourcemaps
Get source maps
GET
Upload source map
POST
Delete source map
DELETE
Connectors
Get connector types
GET
Get connector information
GET
Update a connector
PUT
Create a connector
POST
Delete a connector
DELETE
Run a connector
POST
Get all connectors
GET
Data streams
List data streams
GET
List data streams
GET
Data views
Get all data views
GET
Create a data view
POST
Get a data view
GET
Update a data view
POST
Delete a data view
DELETE
Update data view fields metadata
POST
Create or update a runtime field
PUT
Create a runtime field
POST
Get a runtime field
GET
Update a runtime field
POST
Delete a runtime field from a data view
DELETE
Get the default data view
GET
Set the default data view
POST
Swap saved object references
POST
Preview a saved object reference swap
POST
Elastic Agent actions
Create agent action
POST
Reassign agent
POST
Request agent diagnostics
POST
Unenroll agent
POST
Upgrade agent
POST
Get agent action status
GET
Cancel agent action
POST
Bulk reassign agents
POST
Bulk request diagnostics from agents
POST
Bulk unenroll agents
POST
Bulk update agent tags
POST
Bulk upgrade agents
POST
Elastic Agent binary download sources
List agent binary download sources
GET
Create agent binary download source
POST
Get agent binary download source by ID
GET
Update agent binary download source by ID
PUT
Delete agent binary download source by ID
DELETE
Elastic Agent policies
List agent policies
GET
Create an agent policy
POST
Bulk get agent policies
POST
Get an agent policy by ID
GET
Update an agent policy by ID
PUT
Copy an agent policy by ID
POST
Download an agent policy by ID
GET
Get a full agent policy by ID
GET
Get list of outputs associated with agent policy by policy id
GET
Delete agent policy by ID
POST
Get list of outputs associated with agent policies
POST
Get full K8s agent manifest
GET
Get fleet kubernetes download
GET
Elastic Agent status
Get agent status summary
GET
Elastic Agents
Get incoming agent data
GET
List agents
GET
List agents by action ids
POST
Get agent by ID
GET
Update agent by ID
PUT
Delete agent by ID
DELETE
List agent uploads
GET
Get available agent versions
GET
Delete file uploaded by agent
DELETE
Get file uploaded by agent
GET
Get agent setup info
GET
Initiate agent setup
POST
List agent tags
GET
Elastic Package Manager (EPM)
Bulk get assets
POST
List package categories
GET
Create custom integration
POST
List packages
GET
Install package by upload
POST
Bulk install packages
POST
Get package
GET
Update package settings
PUT
Install package from registry
POST
Delete package
DELETE
Get package file
GET
Authorize transforms
POST
Get package stats
GET
Get installed packages
GET
Get limited package list
GET
Get inputs template
GET
Get a package signature verification key ID
GET
Fleet enrollment API keys
List enrollment API keys
GET
Create enrollment API key
POST
Get enrollment API key by ID
GET
Revoke enrollment API key by ID by marking it as inactive
DELETE
Fleet internals
Check permissions
GET
Check Fleet Server health
POST
Get settings
GET
Update settings
PUT
Initiate Fleet setup
POST
Fleet outputs
Generate Logstash API key
POST
List outputs
GET
Create output
POST
Get output by ID
GET
Update output by ID
PUT
Delete output by ID
DELETE
Get latest output health
GET
Fleet package policies
List package policies
GET
Create package policy
POST
Bulk get package policies
POST
Get package policy by ID
GET
Update package policy by ID
PUT
Delete package policy by ID
DELETE
Bulk delete package policies
POST
Upgrade package policy to a newer package version
POST
Dry run package policy upgrade
POST
Fleet proxies
List proxies
GET
Create proxy
POST
Get proxy by ID
GET
Update proxy by ID
PUT
Delete proxy by ID
DELETE
Fleet Server hosts
List Fleet Server hosts
GET
Create Fleet Server host
POST
Get Fleet Server host by ID
GET
Update Fleet Server host by ID
PUT
Delete Fleet Server host by ID
DELETE
Fleet service tokens
Create a service token
POST
Fleet uninstall tokens
List metadata for latest uninstall tokens per agent policy
GET
Get one decrypted uninstall token by its ID
GET
Message Signing Service
Rotate fleet message signing key pair
POST
Machine learning
Sync machine learning saved objects
GET
roles
Get all roles
GET
Get a role
GET
Create or update a role
PUT
Delete a role
DELETE
Create or update roles
POST
Saved objects
Export saved objects
POST
Import saved objects
POST
Security AI assistant
Apply a bulk action to anonymization fields
POST
Get anonymization fields
GET
Create a model response
POST
Create a conversation
POST
Get conversations
GET
Get a conversation
GET
Update a conversation
PUT
Delete a conversation
DELETE
Apply a bulk action to prompts
POST
Get prompts
GET
Security detections
Returns user privileges for the Kibana space
GET
Retrieve a detection rule
GET
Update a detection rule
PUT
Create a detection rule
POST
Delete a detection rule
DELETE
Patch a detection rule
PATCH
Apply a bulk action to detection rules
POST
Export detection rules
POST
List all detection rules
GET
Import detection rules
POST
Preview rule alerts generated on specified time range
POST
Assign and unassign users from detection alerts
POST
Find and/or aggregate detection alerts
POST
Set a detection alert status
POST
Add and remove detection alert tags
POST
List all detection rule tags
GET
Security endpoint exceptions
Create an endpoint exception list
POST
Get an endpoint exception list item
GET
Update an endpoint exception list item
PUT
Create an endpoint exception list item
POST
Delete an endpoint exception list item
DELETE
Get endpoint exception list items
GET
Security endpoint management
Get response actions
GET
Get an action request log
GET
Get response actions status
GET
Get action details
GET
Get file information
GET
Download a file
GET
Run a command
POST
Get a file
POST
Isolate an endpoint
POST
Terminate a process
POST
Get running processes
POST
Scan a file or directory
POST
Get actions state
GET
Suspend a process
POST
Release an isolated endpoint
POST
Upload a file
POST
Get a metadata list
GET
Get metadata
GET
Get metadata transforms
GET
Get a policy response
GET
Get an agent policy summary
GET
Get a protection updates note
GET
Create or update a protection updates note
POST
Get suggestions
POST
Security entity analytics
Get an asset criticality record
GET
Upsert an asset criticality record
POST
Delete an asset criticality record
DELETE
Bulk upsert asset criticality records
POST
List asset criticality records
GET
List the Entity Engines
GET
Get an Entity Engine
GET
Delete the Entity Engine
DELETE
Initialize an Entity Engine
POST
Start an Entity Engine
POST
Get Entity Engine stats
POST
Stop an Entity Engine
POST
Apply DataView indices to all installed engines
POST
List Entity Store Entities
GET
Cleanup the Risk Engine
DELETE
Run the risk scoring engine
POST
Security exceptions
Create rule exception list items
POST
Get exception list details
GET
Update an exception list
PUT
Create an exception list
POST
Delete an exception list
DELETE
Duplicate an exception list
POST
Export an exception list
POST
Get exception lists
GET
Import an exception list
POST
Get an exception list item
GET
Update an exception list item
PUT
Create an exception list item
POST
Delete an exception list item
DELETE
Get exception list items
GET
Get an exception list summary
GET
Create a shared exception list
POST
Security lists
Get list details
GET
Update a list
PUT
Create a list
POST
Delete a list
DELETE
Patch a list
PATCH
Get lists
GET
Get status of list data streams
GET
Create list data streams
POST
Delete list data streams
DELETE
Get a list item
GET
Update a list item
PUT
Create a list item
POST
Delete a list item
DELETE
Patch a list item
PATCH
Export list items
POST
Get list items
GET
Import list items
POST
Get list privileges
GET
Security Osquery
Get live queries
GET
Create a live query
POST
Get live query details
GET
Get live query results
GET
Get packs
GET
Create a pack
POST
Get pack details
GET
Update a pack
PUT
Delete a pack
DELETE
Get saved queries
GET
Create a saved query
POST
Get saved query details
GET
Update a saved query
PUT
Delete a saved query
DELETE
Security timeline
Get notes
GET
Delete a note
DELETE
Add or update a note
PATCH
Pin an event
PATCH
Get Timeline or Timeline template details
GET
Create a Timeline or Timeline template
POST
Delete Timelines or Timeline templates
DELETE
Update a Timeline
PATCH
Copies timeline or timeline template
GET
Get draft Timeline or Timeline template details
GET
Create a clean draft Timeline or Timeline template
POST
Export Timelines
POST
Favorite a Timeline or Timeline template
PATCH
Import Timelines
POST
Install prepackaged Timelines
POST
Get an existing saved Timeline or Timeline template
GET
Get Timelines or Timeline templates
GET
Service level objectives
Get a paginated list of SLOs
GET
Create an SLO
POST
Batch delete rollup and summary data
POST
Get an SLO
GET
Update an SLO
PUT
Delete an SLO
DELETE
Reset an SLO
POST
Disable an SLO
POST
Enable an SLO
POST
Spaces
Get all spaces
GET
Create a space
POST
Get a space
GET
Update a space
PUT
Delete a space
DELETE
System
Get Kibana's current status
GET
Dismiss highlight
Show more
Fleet outputs