Elastic API Documentation

https://www.elastic.co/docs/api/doc/
Admin
Comprehensive API reference documentation for Elastic Cloud, Elasticsearch, Kibana, Logstash, and...
Tokens:1,025,983
Snippets:8,639
Trust Score:10
Update:1 month ago
Show doc for...
Tokens:
Raw
### Get Fleet Agent Setup Status Examples

Source: https://www.elastic.co/docs/api/doc/serverless.yaml

Examples of JSON responses for the Fleet agent setup status, covering both ready and not-ready states.

```json
{
  "is_action_secrets_storage_enabled": false,
  "is_secrets_storage_enabled": false,
  "is_space_awareness_enabled": false,
  "is_ssl_secrets_storage_enabled": false,
  "isReady": false,
  "missing_optional_features": [
    "encrypted_saved_object_encryption_key_required"
  ],
  "missing_requirements": [
    "fleet_server",
    "api_keys"
  ]
}
```

```json
{
  "is_action_secrets_storage_enabled": true,
  "is_secrets_storage_enabled": true,
  "is_space_awareness_enabled": false,
  "is_ssl_secrets_storage_enabled": false,
  "isReady": true,
  "missing_optional_features": [],
  "missing_requirements": [],
  "package_verification_key_id": "D88DB4CC"
}
```

--------------------------------

### Bulk install packages response example

Source: https://www.elastic.co/docs/api/doc/serverless.yaml

Example response showing the status of bulk installed packages.

```json
{
  "items": [
    {
      "name": "system",
      "result": {
        "assets": [],
        "status": "installed"
      }
    },
    {
      "name": "aws",
      "result": {
        "assets": [],
        "status": "installed"
      }
    }
  ]
}
```

--------------------------------

### Bulk install packages request example

Source: https://www.elastic.co/docs/api/doc/serverless.yaml

Example payload for installing multiple packages from the registry.

```json
{
  "packages": [
    "system",
    "aws"
  ]
}
```

--------------------------------

### Initialize Fleet Setup

Source: https://www.elastic.co/docs/api/doc/serverless.yaml

Example of a successful Fleet setup initialization response.

```json
{
  "isInitialized": true,
  "nonFatalErrors": []
}
```

--------------------------------

### Install Package Request Example

Source: https://www.elastic.co/docs/api/doc/serverless.yaml

Example request body for installing a package from the registry, with an option to ignore constraints.

```json
{
  "ignore_constraints": false
}
```

--------------------------------

### Get Package Information Response

Source: https://www.elastic.co/docs/api/doc/serverless.yaml

Example of a successful response containing package details and installation status.

```json
{
  "item": {
    "assets": {
      "kibana": {
        "dashboard": [],
        "index_pattern": []
      }
    },
    "categories": [
      "cloud"
    ],
    "description": "Collect logs and metrics from Amazon Web Services",
    "name": "aws",
    "status": "installed",
    "title": "AWS",
    "version": "2.10.0"
  }
}
```

--------------------------------

### Start ML Datafeed Request Examples

Source: https://www.elastic.co/docs/api/doc/elasticsearch-serverless.yaml

Examples of starting a machine learning datafeed using the Console, Python, and JavaScript clients.

```Console
POST _ml/datafeeds/datafeed-low_request_rate/_start
{
  "start": "2019-04-07T18:22:16Z"
}
```

```Python
resp = client.ml.start_datafeed(
    datafeed_id="datafeed-low_request_rate",
    start="2019-04-07T18:22:16Z",
)
```

--------------------------------

### Get installed integration packages response

Source: https://www.elastic.co/docs/api/doc/serverless.yaml

Example JSON response for a successful request to retrieve a list of installed integration packages.

```json
{
  "items": [
    {
      "name": "system",
      "status": "installed",
      "title": "System",
      "version": "1.55.0"
    },
    {
      "name": "elastic_agent",
      "status": "installed",
      "title": "Elastic Agent",
      "version": "1.15.0"
    }
  ],
  "searchExcluded": 0,
  "total": 2
}
```

--------------------------------

### Install privileged access detection package response example

Source: https://www.elastic.co/docs/api/doc/serverless.yaml

Example JSON response indicating successful installation of the privileged access detection package.

```json
{
  "message": "Privileged access detection package installed successfully"
}
```

--------------------------------

### Install Prebuilt Detection Rules and Timelines Response

Source: https://www.elastic.co/docs/api/doc/kibana.yaml

Example JSON response indicating the count of installed and updated rules and timelines after a successful installation request.

```json
{
  "rules_installed": 112,
  "rules_updated": 0,
  "timelines_installed": 5,
  "timelines_updated": 2
}
```

--------------------------------

### Install Package Success Response

Source: https://www.elastic.co/docs/api/doc/serverless.yaml

Example response indicating that a package was successfully installed from the registry.

```json
{
  "_meta": {
    "install_source": "registry"
  },
  "items": [
    {
      "id": "aws-logs-aws.cloudwatch_logs-default",
      "type": "index_template"
    }
  ]
}
```

--------------------------------

### Get package policies response example

Source: https://www.elastic.co/docs/api/doc/serverless.yaml

Example of a successful response when listing package policies.

```json
{
  "items": [
    {
      "created_at": "2024-01-15T10:00:00.000Z",
      "enabled": true,
      "id": "package-policy-id-1",
      "inputs": [],
      "name": "nginx-1",
      "namespace": "default",
      "package": {
        "name": "nginx",
        "title": "Nginx",
        "version": "1.20.0"
      },
      "policy_ids": [
        "agent-policy-id-1"
      ],
      "updated_at": "2024-01-15T10:00:00.000Z"
    }
  ],
  "page": 1,
  "perPage": 20,
  "total": 1
}
```

--------------------------------

### Get package dependencies response examples

Source: https://www.elastic.co/docs/api/doc/serverless.yaml

Examples of successful responses for package dependencies, including cases with and without dependencies.

```json
{
  "items": [
    {
      "name": "aws",
      "title": "AWS",
      "version": "^2.0.0"
    },
    {
      "name": "system",
      "title": "System",
      "version": "^1.0.0"
    }
  ]
}
```

```json
{
  "items": []
}
```

--------------------------------

### Get enrollment API keys response example

Source: https://www.elastic.co/docs/api/doc/serverless.yaml

Example of a successful response containing a list of enrollment API keys with pagination metadata.

```json
{
  "items": [
    {
      "active": true,
      "api_key": "api-key-value-1",
      "api_key_id": "api-key-id-1",
      "created_at": "2024-01-01T00:00:00.000Z",
      "id": "key-id-1",
      "name": "Default policy enrollment key",
      "policy_id": "policy-id-1"
    }
  ],
  "list": [
    {
      "active": true,
      "api_key": "api-key-value-1",
      "api_key_id": "api-key-id-1",
      "created_at": "2024-01-01T00:00:00.000Z",
      "id": "key-id-1",
      "name": "Default policy enrollment key",
      "policy_id": "policy-id-1"
    }
  ],
  "page": 1,
  "perPage": 20,
  "total": 1
}
```

--------------------------------

### Get data stream settings response example

Source: https://www.elastic.co/docs/api/doc/elasticsearch-serverless.yaml

Example JSON response showing settings and effective settings for a data stream.

```json
{
  "data_streams": [
    {
      "name": "my-data-stream",
      "settings": {
        "index": {
          "lifecycle": {
            "name": "new-test-policy"
          },
          "number_of_shards": "11"
        }
      },
      "effective_settings": {
        "index": {
          "lifecycle": {
            "name": "new-test-policy"
          },
          "mode": "standard",
          "number_of_shards": "11",
          "number_of_replicas": "0"
        }
      }
    }
  ]
}
```

--------------------------------

### Get Data Streams Response Example

Source: https://www.elastic.co/docs/api/doc/serverless.yaml

Example JSON response structure for a successful request to retrieve data streams from installed packages.

```json
{
  "data_streams": [
    {
      "ilm_policy": "logs-default",
      "index_template": "logs-system.syslog",
      "name": "logs-system.syslog-default",
      "package": "system",
      "package_version": "1.55.0",
      "title": "System syslog logs"
    }
  ]
}
```

--------------------------------

### GET /api/entity_analytics/privileged_user_monitoring/pad/status

Source: https://www.elastic.co/docs/api/doc/kibana/operation/operation-getprivilegedaccessdetectionpackagestatus.md

Retrieves the installation and ML module setup status of the privileged access detection package, along with the state of each associated ML job.

```APIDOC
## GET /api/entity_analytics/privileged_user_monitoring/pad/status

### Description
Returns the installation and ML module setup status of the privileged access detection package, along with the state of each associated ML job.

### Method
GET

### Endpoint
/api/entity_analytics/privileged_user_monitoring/pad/status

### Response
#### Success Response (200)
- **jobs** (array[object]) - List of associated ML jobs and their states
- **ml_module_setup_status** (string) - The status of the ML module setup
- **package_installation_status** (string) - The status of the package installation
```

--------------------------------

### Get Privileged Access Detection Package Status Response

Source: https://www.elastic.co/docs/api/doc/serverless.yaml

Example JSON response showing the installation status and ML job states for the privileged access detection package.

```json
{
  "jobs": [
    {
      "description": "Detects high-risk login patterns",
      "job_id": "pad-high-risk-login",
      "state": "opened"
    },
    {
      "description": "Detects privilege escalation events",
      "job_id": "pad-privilege-escalation",
      "state": "opened"
    }
  ],
  "ml_module_setup_status": "complete",
  "package_installation_status": "complete"
}
```

--------------------------------

### POST /deployments/{deployment_id}/{resource_kind}/{ref_id}/instances/_start

Source: https://www.elastic.co/docs/api/doc/cloud/operation/operation-start-deployment-resource-instances-all.md

Starts all instances belonging to a Deployment Resource.

```APIDOC
## POST /deployments/{deployment_id}/{resource_kind}/{ref_id}/instances/_start

### Description
Starts all instances belonging to a Deployment Resource.

### Method
POST

### Endpoint
https://api.elastic-cloud.com/api/v1/deployments/{deployment_id}/{resource_kind}/{ref_id}/instances/_start

### Parameters
#### Path Parameters
- **deployment_id** (string) - Required - Identifier for the Deployment.
- **resource_kind** (string) - Required - The kind of resource (one of elasticsearch, kibana, apm, or integrations_server).
- **ref_id** (string) - Required - User-specified RefId for the Resource (or '_main' if there is only one).

### Response
#### Success Response (202)
- **warnings** (array[object]) - List of warnings generated from validating command

#### Error Responses
- **403** - The start maintenance mode command was prohibited for the given Resource.
- **404** - The Deployment, Resource, or instances could not be found.
- **500** - A Resource that was previously stored no longer exists.
```

--------------------------------

### POST /_slm/start

Source: https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-slm-start.md

Starts the snapshot lifecycle management process.

```APIDOC
## POST /_slm/start

### Description
Starts the snapshot lifecycle management (SLM) process. This is only necessary if SLM has been previously stopped.

### Method
POST

### Endpoint
/_slm/start

### Parameters
#### Query Parameters
- **master_timeout** (string) - Optional - The period to wait for a connection to the master node.
- **timeout** (string) - Optional - The period to wait for a response.

### Response
#### Success Response (200)
- **acknowledged** (boolean) - For a successful response, this value is always true.
```

--------------------------------

### Install an Agent Builder Plugin

Source: https://www.elastic.co/docs/api/doc/serverless.yaml

Use these examples to install a plugin from a GitHub URL or ZIP file. Requires the agentBuilder:write privilege and the kbn-xsrf header.

```curl
curl \
  -X POST "${KIBANA_URL}/api/agent_builder/plugins/install" \
  -H "Authorization: ApiKey ${API_KEY}" \
  -H "kbn-xsrf: true" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://github.com/anthropics/financial-services-plugins/tree/main/financial-analysis"
}'
```

```Console
POST kbn://api/agent_builder/plugins/install
{
  "url": "https://github.com/anthropics/financial-services-plugins/tree/main/financial-analysis"
}
```

--------------------------------

### Get Logstash Pipeline Response

Source: https://www.elastic.co/docs/api/doc/elasticsearch-serverless.yaml

Example of a successful response from the GET _logstash/pipeline/my_pipeline endpoint.

```json
{
  "my_pipeline": {
    "description": "Sample pipeline for illustration purposes",
    "last_modified": "2021-01-02T02:50:51.250Z",
    "pipeline_metadata": {
      "type": "logstash_pipeline",
      "version": "1"
    },
    "username": "elastic",
    "pipeline": "input {}\n filter { grok {} }\n output {}",
    "pipeline_settings": {
      "pipeline.workers": 1,
      "pipeline.batch.size": 125,
      "pipeline.batch.delay": 50,
      "queue.type": "memory",
      "queue.max_bytes": "1gb",
      "queue.checkpoint.writes": 1024
    }
  }
}
```

--------------------------------

### POST /deployments/{deployment_id}/{resource_kind}/{ref_id}/instances/{instance_ids}/_start

Source: https://www.elastic.co/docs/api/doc/cloud/operation/operation-start-deployment-resource-instances.md

Starts instances belonging to a Deployment Resource.

```APIDOC
## POST /deployments/{deployment_id}/{resource_kind}/{ref_id}/instances/{instance_ids}/_start

### Description
Starts instances belonging to a Deployment Resource.

### Method
POST

### Endpoint
/deployments/{deployment_id}/{resource_kind}/{ref_id}/instances/{instance_ids}/_start

### Parameters
#### Path Parameters
- **deployment_id** (string) - Required - Identifier for the Deployment.
- **resource_kind** (string) - Required - The kind of resource (one of elasticsearch, kibana, apm, or integrations_server).
- **ref_id** (string) - Required - User-specified RefId for the Resource (or '_main' if there is only one).
- **instance_ids** (array[string]) - Required - A comma-separated list of instance identifiers.

#### Query Parameters
- **ignore_missing** (boolean) - Optional - If true and the instance does not exist then quietly proceed to the next instance, otherwise treated as an error

### Response
#### Success Response (202)
- **warnings** (array[object]) - List of warnings generated from validating command

#### Error Responses
- **403** - The start maintenance mode command was prohibited for the given Resource.
- **404** - The Deployment, Resource, or instances specified cannot be found.
- **500** - A Resource that was previously stored no longer exists.
```

--------------------------------

### Get Fleet Proxies Response Example

Source: https://www.elastic.co/docs/api/doc/serverless.yaml

Example of a successful response when listing Fleet proxies.

```json
{
  "items": [
    {
      "id": "proxy-id-1",
      "is_preconfigured": false,
      "name": "My proxy",
      "url": "http://proxy.example.com:3128"
    }
  ],
  "page": 1,
  "perPage": 20,
  "total": 1
}
```

--------------------------------

### POST /s/{space_id}/api/fleet/agents/setup

Source: https://www.elastic.co/docs/api/doc/serverless/operation/operation-post-fleet-agents-setup.md

Initializes the Fleet setup process. This operation is idempotent.

```APIDOC
## POST /s/{space_id}/api/fleet/agents/setup

### Description
Initialize Fleet. This endpoint is used by Elastic Agents to trigger Fleet setup. Safe to call multiple times; subsequent calls are idempotent.

### Method
POST

### Endpoint
/s/{space_id}/api/fleet/agents/setup

### Parameters
#### Path Parameters
- **space_id** (string) - Required - The identifier for the space.

#### Headers
- **kbn-xsrf** (string) - Required - A required header to protect against CSRF attacks.

### Response
#### Success Response (200)
- **isInitialized** (boolean) - Indicates if Fleet is initialized.
- **nonFatalErrors** (array[object]) - List of non-fatal errors encountered.

#### Error Response (400)
- **attributes** (object) - Error attributes.
- **error** (string) - Error description.
- **errorType** (string) - Type of error.
- **message** (string) - Error message.
- **statusCode** (number) - HTTP status code.
```

--------------------------------

### POST /_license/start_trial

Source: https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-license-post-start-trial.md

Starts a 30-day trial license for the cluster.

```APIDOC
## POST /_license/start_trial

### Description
Start a 30-day trial, which gives access to all subscription features. Note that you are allowed to start a trial only if your cluster has not already activated a trial for the current major product version.

### Method
POST

### Endpoint
/_license/start_trial

### Parameters
#### Query Parameters
- **acknowledge** (boolean) - Required - To start a trial, you must accept the acknowledge messages and set this parameter to true.
- **type** (string) - Optional - The type of trial license to generate.
- **master_timeout** (string) - Optional - Period to wait for a connection to the master node.

### Response
#### Success Response (200)
- **acknowledged** (boolean) - Indicates if the request was acknowledged.
- **error_message** (string) - Error message if applicable.
- **trial_was_started** (boolean) - Indicates if the trial was successfully started.
- **type** (string) - The type of trial license.
```

--------------------------------

### Get Fleet Output Response Example

Source: https://www.elastic.co/docs/api/doc/serverless.yaml

Example JSON response for a successful retrieval of a Fleet output.

```json
{
  "item": {
    "hosts": [
      "https://elasticsearch.example.com:9200"
    ],
    "id": "output-id-1",
    "is_default": true,
    "is_default_monitoring": true,
    "name": "Default output",
    "type": "elasticsearch"
  }
}
```

--------------------------------

### Update Package Settings Request Examples

Source: https://www.elastic.co/docs/api/doc/serverless.yaml

Examples for enabling namespace-level customization or updating policy settings for a package.

```json
{
  "namespace_customization_enabled_for": [
    "production",
    "staging"
  ]
}
```

```json
{
  "keepPoliciesUpToDate": true
}
```

--------------------------------

### POST /api/fleet/setup

Source: https://www.elastic.co/docs/api/doc/kibana/operation/operation-post-fleet-setup.md

Initialize Fleet and create the necessary Elasticsearch resources for Fleet to operate. This operation is idempotent.

```APIDOC
## POST /api/fleet/setup

### Description
Initialize Fleet and create the necessary Elasticsearch resources for Fleet to operate. Safe to call multiple times (idempotent). Returns the initialization status and any non-fatal errors encountered during setup.

### Method
POST

### Endpoint
/api/fleet/setup

### Parameters
#### Headers
- **kbn-xsrf** (string) - Required - A required header to protect against CSRF attacks

### Response
#### Success Response (200)
- **isInitialized** (boolean) - Indicates if Fleet is initialized
- **nonFatalErrors** (array[object]) - List of non-fatal errors encountered during setup

#### Error Response (400)
- **message** (string) - Error message
- **statusCode** (number) - Status code

#### Error Response (500)
- **message** (string) - Error message
```

--------------------------------

### Get Fleet outputs response example

Source: https://www.elastic.co/docs/api/doc/serverless.yaml

Example of a successful response containing a list of Fleet outputs.

```json
{
  "items": [
    {
      "hosts": [
        "https://elasticsearch.example.com:9200"
      ],
      "id": "output-id-1",
      "is_default": true,
      "is_default_monitoring": true,
      "name": "Default output",
      "type": "elasticsearch"
    }
  ],
  "page": 1,
  "perPage": 20,
  "total": 1
}
```

--------------------------------

### Get action details example

Source: https://www.elastic.co/docs/api/doc/kibana.yaml

Example JSON response showing the details of an isolate response action.

```json
{
  "data":
    {
      "agents":
        [
          "ed518850-681a-4d60-bb98-e22640cae2a8"
        ],
      "agentType": "endpoint",
      "command": "isolate",
      "completedAt": "2022-08-08T10:41:57.352Z",
      "createdBy": "elastic",
      "id": "233db9ea-6733-4849-9226-5a7039c7161d",
      "isCompleted": true,
      "isExpired": false,
      "startedAt": "2022-08-08T15:23:37.359Z",
      "wasSuccessful": true
    }
}
```

--------------------------------

### Retrieve package file content

Source: https://www.elastic.co/docs/api/doc/serverless.yaml

Example response showing the content of a requested package file.

```json
<file content>
```

--------------------------------

### Get integration categories response example

Source: https://www.elastic.co/docs/api/doc/serverless.yaml

Example of a successful response when retrieving a list of integration categories.

```json
{
  "items": [
    {
      "count": 42,
      "id": "security",
      "title": "Security"
    },
    {
      "count": 38,
      "id": "observability",
      "title": "Observability"
    }
  ]
}
```

--------------------------------

### POST /api/security/entity_store/install

Source: https://www.elastic.co/docs/api/doc/kibana/operation/operation-post-security-entity-store-install.md

Installs the Entity Store and creates engines for the specified entity types.

```APIDOC
## POST /api/security/entity_store/install

### Description
Install the Entity Store and create engines for the specified entity types. A single logExtraction configuration is shared across all entity types.

### Method
POST

### Endpoint
/api/security/entity_store/install
/s/{space_id}/api/security/entity_store/install

### Parameters
#### Headers
- **kbn-xsrf** (string) - Required - A required header to protect against CSRF attacks

#### Request Body
- **entityTypes** (array[string]) - Optional
- **historySnapshot** (object) - Optional
- **logExtraction** (object) - Optional

### Response
#### Success Response (200)
Indicates all requested entity types are already installed.

#### Success Response (201)
Indicates the Entity Store was successfully installed.

#### Error Response (403)
Insufficient privileges.
```

--------------------------------

### Get policy response example

Source: https://www.elastic.co/docs/api/doc/serverless.yaml

Example response structure for retrieving the most recent policy response for an endpoint.

```json
{
  "policy_response": {
    "@timestamp": "2023-07-04T15:48:57.360Z",
    "agent": {
      "id": "ed518850-681a-4d60-bb98-e22640cae2a8",
      "version": "7.16.0"
    },
    "Endpoint": {
      "policy": {
        "applied": {
          "endpoint_policy_version": "2",
          "id": "d5371dcd-93b7-4627-af88-4084f7d6aa3e",
          "name": "My endpoint policy",
          "status": "success",
          "version": "3"
        }
      }
    }
  }
}
```

--------------------------------

### Get endpoint metadata example

Source: https://www.elastic.co/docs/api/doc/serverless.yaml

Example response structure for retrieving host metadata for a specific endpoint.

```json
{
  "host_status": "healthy",
  "last_checkin": "2023-07-04T15:48:57.360Z",
  "metadata": {
    "agent": {
      "id": "abb8a826-6812-448c-a571-6d8269b51449",
      "type": "endpoint",
      "version": "8.10.0"
    },
    "Endpoint": {
      "policy": {
        "applied": {
          "id": "d5371dcd-93b7-4627-af88-4084f7d6aa3e",
          "name": "test",
          "status": "success"
        }
      },
      "status": "enrolled"
    },
    "host": {
      "hostname": "WinDev2104Eval",
      "os": {
        "name": "Windows",
        "platform": "windows",
        "version": "20H2"
      }
    }
  }
}
```

--------------------------------

### Create Value List Response Examples

Source: https://www.elastic.co/docs/api/doc/serverless.yaml

Examples of successful JSON responses returned after creating a value list.

```json
_version: WzAsMV0=
'@timestamp': '2025-01-08T04:47:34.273Z'
created_at: '2025-01-08T04:47:34.273Z'
created_by: elastic
description: This list describes bad internet ips
id: ip_list
immutable: false
name: Simple list with ips
tie_breaker_id: f5508188-b1e9-4e6e-9662-d039a7d89899
type: ip
updated_at: '2025-01-08T04:47:34.273Z'
updated_by: elastic
version: 1
```

```json
_version: WzAsMV0=
'@timestamp': '2025-01-09T18:23:52.241Z'
created_at: '2025-01-09T18:23:52.241Z'
created_by: elastic
description: This list has ip ranges
id: ip_range_list
immutable: false
name: Simple list with ip ranges
tie_breaker_id: 74aebdaf-601f-4940-b351-155728ff7003
type: ip_range
updated_at: '2025-01-09T18:23:52.241Z'
updated_by: elastic
version: 1
```

```json
_version: WzEsMV0=
'@timestamp': '2025-01-09T18:24:55.786Z'
created_at: '2025-01-09T18:24:55.786Z'
created_by: elastic
description: This list describes bad host names
id: keyword_list
immutable: false
name: Simple list with a keyword
tie_breaker_id: f7e7dbaa-daf7-4c9a-a3dc-56643923ef68
type: keyword
updated_at: '2025-01-09T18:24:55.786Z'
updated_by: elastic
version: 1
```

```json
_version: WzIsMV0=
'@timestamp': '2025-01-09T18:25:39.604Z'
created_at: '2025-01-09T18:25:39.604Z'
created_by: elastic
description: This parses the first found ipv4 only
id: keyword_custom_format_list
immutable: false
name: Simple list with a keyword using a custom format
tie_breaker_id: 8247ae63-b780-47b8-9a89-948b643e9ec2
type: keyword
updated_at: '2025-01-09T18:25:39.604Z'
```

--------------------------------

### POST /_ilm/start

Source: https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-ilm-start.md

Starts the index lifecycle management plugin if it is currently stopped.

```APIDOC
## POST /_ilm/start

### Description
Start the index lifecycle management plugin if it is currently stopped. ILM is started automatically when the cluster is formed; restarting is only necessary if it was previously stopped.

### Method
POST

### Endpoint
/_ilm/start

### Parameters
#### Query Parameters
- **master_timeout** (string) - Optional - Period to wait for a connection to the master node.
- **timeout** (string) - Optional - Period to wait for a response.

### Response
#### Success Response (200)
- **acknowledged** (boolean) - For a successful response, this value is always true.
```

--------------------------------

### ML Start Datafeed JSON Request Body

Source: https://www.elastic.co/docs/api/doc/elasticsearch-serverless.yaml

Example JSON request body for starting a datafeed.

```JSON
{
  "start": "2019-04-07T18:22:16Z"
}
```

--------------------------------

### Retrieve integration packages list

Source: https://www.elastic.co/docs/api/doc/serverless.yaml

Example response showing the structure of available integration packages returned by the API.

```json
{
  "items": [
    {
      "categories": [
        "cloud"
      ],
      "description": "Collect logs and metrics from Amazon Web Services",
      "id": "aws",
      "name": "aws",
      "status": "not_installed",
      "title": "AWS",
      "version": "2.10.0"
    }
  ],
  "searchExcluded": 0,
  "total": 1
}
```

--------------------------------

### Get response actions status example

Source: https://www.elastic.co/docs/api/doc/kibana.yaml

Example JSON response showing pending actions per agent.

```json
{
  "data":
    [
      {
        "agent_id": "afdc366c-e2e0-4cdb-ae1d-94575bd2d8e0",
        "pending_actions":
          {
            "execute": 0,
            "get-file": 0,
            "isolate": 0,
            "kill-process": 1,
            "running-processes": 0,
            "scan": 0,
            "unisolate": 0,
            "upload": 0
          }
      }
    ]
}
```

--------------------------------

### POST /_license/start_basic

Source: https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-license-post-start-basic.md

Starts an indefinite basic license, which gives access to all the basic features.

```APIDOC
## POST /_license/start_basic

### Description
Start an indefinite basic license, which gives access to all the basic features. Note that you must not currently have a basic license to perform this action.

### Method
POST

### Endpoint
/_license/start_basic

### Parameters
#### Query Parameters
- **acknowledge** (boolean) - Optional - To start a basic license, you must accept the acknowledge messages and set this parameter to true.
- **master_timeout** (string) - Optional - Period to wait for a connection to the master node.
- **timeout** (string) - Optional - Period to wait for a response. If no response is received before the timeout expires, the request fails and returns an error.

### Response
#### Success Response (200)
- **acknowledged** (boolean) - Indicates if the request was acknowledged.
- **basic_was_started** (boolean) - Indicates if the basic license was successfully started.
- **error_message** (string) - Error details if applicable.
- **type** (string) - The license type.
- **acknowledge** (object) - Acknowledgment details.
```

--------------------------------

### Bulk Get Assets Response Example

Source: https://www.elastic.co/docs/api/doc/serverless.yaml

Example response containing the requested Kibana saved object assets.

```json
{
  "items": [
    {
      "appLink": "/app/dashboards#/view/dashboard-id-1",
      "attributes": {
        "title": "My Dashboard"
      },
      "id": "dashboard-id-1",
      "type": "dashboard"
    }
  ]
}
```

--------------------------------

### POST /s/{space_id}/api/fleet/setup

Source: https://www.elastic.co/docs/api/doc/serverless/operation/operation-post-fleet-setup.md

Initializes Fleet and creates the necessary Elasticsearch resources for Fleet to operate.

```APIDOC
## POST /s/{space_id}/api/fleet/setup

### Description
Initialize Fleet and create the necessary Elasticsearch resources for Fleet to operate. This operation is idempotent and safe to call multiple times.

### Method
POST

### Endpoint
/s/{space_id}/api/fleet/setup

### Parameters
#### Path Parameters
- **space_id** (string) - Required - The identifier for the space.

#### Headers
- **kbn-xsrf** (string) - Required - A required header to protect against CSRF attacks.

### Response
#### Success Response (200)
- **isInitialized** (boolean) - Indicates if Fleet is initialized.
- **nonFatalErrors** (array[object]) - A list of non-fatal errors encountered during setup.

#### Error Response (400)
- **error** (string) - Error description.
- **errorType** (string) - Type of error.
- **message** (string) - Error message.
- **statusCode** (number) - HTTP status code.

#### Error Response (500)
- **message** (string) - Internal server error message.
```

--------------------------------

### Enable reasoning with default settings

Source: https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-inference-chat-completion-unified.md

Example of enabling reasoning using default settings.

```json
{
   "reasoning": {
       "enabled": true,
       "summary": "concise",
       "exclude": false
   }
}
```

--------------------------------

### Get Fleet Cloud Connector Response Example

Source: https://www.elastic.co/docs/api/doc/serverless.yaml

Example of a successful response when retrieving a cloud connector by ID.

```json
{
  "item": {
    "accountType": "single-account",
    "cloudProvider": "aws",
    "created_at": "2024-01-15T10:00:00.000Z",
    "id": "cloud-connector-id-1",
    "name": "My AWS connector",
    "packagePolicyCount": 2,
    "updated_at": "2024-01-15T10:00:00.000Z",
    "vars": {}
  }
}
```

--------------------------------

### Get auto-upgrade status example

Source: https://www.elastic.co/docs/api/doc/serverless.yaml

Example JSON response for the auto-upgrade status of agents within a specific policy.

```json
{
  "agentsCount": 5,
  "currentVersion": "8.16.0",
  "failedAgentsCount": 0,
  "upgradedAgentsCount": 3,
  "upgradingAgentsCount": 1
}
```

--------------------------------

### Create an index with default settings

Source: https://www.elastic.co/docs/api/doc/elasticsearch-serverless.yaml

Use this empty object to create an index using the default configuration.

```json
{}
```

--------------------------------

### Get Watchlist Response Example

Source: https://www.elastic.co/docs/api/doc/serverless.yaml

Example JSON response returned when retrieving details for a specific watchlist by ID.

```json
{
  "createdAt": "2026-01-28T12:00:00.000Z",
  "description": "High risk vendor watchlist",
  "id": "watchlist-123",
  "managed": false,
  "name": "High Risk Vendors",
  "riskModifier": 1.5,
  "updatedAt": "2026-02-18T12:00:00.000Z"
}
```
Tokens:
Raw