Kibana API

https://www.elastic.co/docs/api/doc/kibana
Admin
The Kibana API provides programmatic access to manage and interact with various features and...
Tokens:1,139,000
Snippets:7,741
Trust Score:10
Update:17 hours ago
Show doc for...
Tokens:
Raw
### Bulk Install Packages - Request Body

Source: https://www.elastic.co/docs/api/doc/kibana/v9/operation/operation-post-fleet-epm-packages-bulk

Example JSON body for the bulk install request. The packages array contains the names of packages to install. This body is used in the cURL request example.

```json
{
  "packages": [
    "system",
    "aws"
  ]
}
```

--------------------------------

### Bulk Install Packages - Successful Response

Source: https://www.elastic.co/docs/api/doc/kibana/v9/operation/operation-post-fleet-epm-packages-bulk

Example 200 response showing the result of a bulk install. Each item includes the package name and a result object with status 'installed' or 'already_installed'.

```json
{
  "items": [
    {
      "name": "system",
      "result": {
        "assets": [],
        "status": "installed"
      }
    },
    {
      "name": "aws",
      "result": {
        "assets": [],
        "status": "installed"
      }
    }
  ]
}
```

--------------------------------

### Successful response (200) after package installation

Source: https://www.elastic.co/docs/api/doc/kibana/v9/operation/operation-post-fleet-epm-packages-pkgname

Example of a successful response when the package is installed. The _meta object includes the install_source field set to "registry", and the items array contains references to installed assets such as index templates.

```json
{
  "_meta": {
    "install_source": "registry"
  },
  "items": [
    {
      "id": "aws-logs-aws.cloudwatch_logs-default",
      "type": "index_template"
    }
  ]
}
```

--------------------------------

### GET /api/osquery/packs - 200 response example

Source: https://www.elastic.co/docs/api/doc/kibana/v9/operation/operation-osqueryfindpacks

Example successful response containing pack data with pagination details.

```json
{
  "data": [
    {
      "created_at": "2025-02-26T13:37:30.452Z",
      "created_by": "elastic",
      "description": "My pack",
      "enabled": true,
      "name": "my_pack",
      "queries": [
        {
          "id": "ports",
          "interval": 60,
          "query": "SELECT * FROM listening_ports;",
          "removed": false,
          "snapshot": true,
          "timeout": 120
        }
      ],
      "saved_object_id": "1c266590-381f-428c-878f-c80c1334f856",
      "updated_at": "2025-02-26T13:37:30.452Z",
      "updated_by": "elastic",
      "version": 1
    }
  ],
  "page": 1,
  "per_page": 20,
  "total": 1
}
```

--------------------------------

### Execute index search tool request

Source: https://www.elastic.co/docs/api/doc/kibana/v9/operation/operation-post-agent-builder-tools-execute

Example request body for executing a custom example-index-search-tool with an nlQuery parameter.

```json
{
  "tool_id": "example-index-search-tool",
  "tool_params": {
    "nlQuery": "find trades with high execution prices above 100"
  }
}
```

--------------------------------

### 404 response example when no download source is found

Source: https://www.elastic.co/docs/api/doc/kibana/v9/operation/operation-get-fleet-agent-download-sources-sourceid

Not Found response indicating the specified download source ID does not exist.

```json
{
  "error": "Not Found",
  "message": "Agent binary source download-source-id-1 not found",
  "statusCode": 404
}
```

--------------------------------

### Example response for Get a Workflow

Source: https://www.elastic.co/docs/api/doc/kibana/v9/operation/operation-get-workflows-workflow-id

Example 200 response returning a single workflow, including its definition, metadata, and YAML representation.

```json
{
  "createdAt": "2025-11-20T10:30:00.000Z",
  "createdBy": "elastic",
  "definition": {
    "description": "This is a workflow example",
    "enabled": true,
    "inputs": [
      {
        "default": "hello world",
        "name": "message",
        "type": "string"
      }
    ],
    "name": "Example definition",
    "steps": [
      {
        "name": "hello_world_step",
        "type": "console",
        "with": {
          "message": "{{ inputs.message }}"
        }
      }
    ],
    "triggers": [
      {
        "type": "manual"
      }
    ]
  },
  "description": "This is a workflow example",
  "enabled": true,
  "id": "workflow-a1b2c3d4-e5f6-7890-abcd-ef1234567890",
  "lastUpdatedAt": "2025-11-21T14:00:00.000Z",
  "lastUpdatedBy": "elastic",
  "name": "Example definition",
  "valid": true,
  "yaml": "name: Example definition\nenabled: true\ndescription: This is a workflow example\ntriggers:\n  - type: manual\ninputs:\n  - name: message\n    type: string\n    default: \"hello world\"\nsteps:\n  - name: hello_world_step\n    type: console\n    with:\n      message: \"{{ inputs.message }}\"\n"
}
```

--------------------------------

### 200 response example for GET rule

Source: https://www.elastic.co/docs/api/doc/kibana/v9/operation/operation-readrule

Example successful response (HTTP 200) for the GET /api/detection_engine/rules request. Shows the full rule object including metadata, execution summary, filters, query, threat intelligence, and timestamps. The response includes fields such as created_at, enabled, execution_summary, false_positives, filters, from, id, immutable, interval, language, max_signals, name, query, references, related_integrations, required_fields, risk_score, rule_id, setup, severity, tags, threat, to, type, updated_at, updated_by, and version.

```json
{
  "created_at": "2020-02-03T11:19:04.259Z",
  "created_by": "elastic",
  "description": "Process started by MS Office program in user folder",
  "enabled": false,
  "execution_summary": {
    "last_execution": {
      "date": "2022-03-23T16:06:12.787Z",
      "message": "This rule attempted to query data from Elasticsearch indices listed in the \"Index pattern\" section of the rule definition, but no matching index was found.",
      "metrics": {
        "execution_gap_duration_s": 0,
        "total_indexing_duration_ms": 15,
        "total_search_duration_ms": 135
      },
      "status": "partial failure",
      "status_order": 20
    }
  },
  "false_positives": [],
  "filters": [
    {
      "query": {
        "match": {
          "event.action": {
            "query": "Process Create (rule: ProcessCreate)",
            "type": "phrase"
          }
        }
      }
    }
  ],
  "from": "now-4200s",
  "id": "c41d170b-8ba6-4de6-b8ec-76440a35ace3",
  "immutable": false,
  "interval": "1h",
  "language": "kuery",
  "max_signals": 100,
  "name": "MS Office child process",
  "query": "process.parent.name:EXCEL.EXE or process.parent.name:MSPUB.EXE or process.parent.name:OUTLOOK.EXE or process.parent.name:POWERPNT.EXE or process.parent.name:VISIO.EXE or process.parent.name:WINWORD.EXE",
  "references": [],
  "related_integrations": [
    {
      "package": "o365",
      "version": "^2.3.2"
    }
  ],
  "required_fields": [
    {
      "ecs": true,
      "name": "process.name",
      "type": "keyword"
    },
    {
      "ecs": true,
      "name": "process.parent.name",
      "type": "keyword"
    }
  ],
  "risk_score": 21,
  "rule_id": "process_started_by_ms_office_user_folder",
  "setup": "",
  "severity": "low",
  "tags": [
    "child process",
    "ms office"
  ],
  "threat": [
    {
      "framework": "MITRE ATT&CK",
      "tactic": {
        "id": "TA0001",
        "name": "Initial Access",
        "reference": "https://attack.mitre.org/tactics/TA0001"
      },
      "technique": [
        {
          "id": "T1193",
          "name": "Spearphishing Attachment",
          "reference": "https://attack.mitre.org/techniques/T1193"
        }
      ]
    }
  ],
  "to": "now-300s",
  "type": "query",
  "updated_at": "2020-02-03T11:19:04.462Z",
  "updated_by": "elastic",
  "version": 1
}
```

--------------------------------

### GET /api/fleet/epm/packages/{pkgName} with curl

Source: https://www.elastic.co/docs/api/doc/kibana/v9/operation/operation-get-fleet-epm-packages-pkgname

Retrieves package details and installation status for a Fleet EPM package. Requires an API key for authorization. The response includes installation status, installed assets, and package metadata.

```bash
curl \
 --request GET 'https://localhost:5601/api/fleet/epm/packages/{pkgName}' \
 --header "Authorization: $API_KEY"
```

--------------------------------

### Execute custom esql tool request

Source: https://www.elastic.co/docs/api/doc/kibana/v9/operation/operation-post-agent-builder-tools-execute

Example request body for executing a custom example-esql-tool with limit and startTime parameters.

```json
{
  "tool_id": "example-esql-tool",
  "tool_params": {
    "limit": 3,
    "startTime": "2024-01-01T00:00:00Z"
  }
}
```

--------------------------------

### GET /api/cases/configure - 200 response example

Source: https://www.elastic.co/docs/api/doc/kibana/v9/operation/operation-getcaseconfigurationdefaultspace

Example of a successful response (200) containing the case configuration, including connector, custom fields, and templates.

```json
[
  {
    "closure_type": "close-by-user",
    "connector": {
      "fields": null,
      "id": "none",
      "name": "none",
      "type": ".none"
    },
    "created_at": "2024-07-01T17:07:17.767Z",
    "created_by": {
      "email": null,
      "full_name": null,
      "username": "elastic"
    },
    "customFields": [
      {
        "defaultValue": "Custom text field value.",
        "key": "d312efda-ec2b-42ec-9e2c-84981795c581",
        "label": "my-text-field",
        "type": "text",
        "required": false
      }
    ],
    "error": null,
    "id": "856ee650-6c82-11ee-a20a-6164169afa58",
    "mappings": [],
    "observableTypes": [],
    "owner": "cases",
    "templates": [
      {
        "caseFields": {
          "assignees": [
            {
              "uid": "u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0"
            }
          ],
          "category": "Default-category",
          "connector": {
            "fields": null,
            "id": "none",
            "name": "none",
            "type": ".none"
          },
          "customFields": [
            {
              "key": "d312efda-ec2b-42ec-9e2c-84981795c581",
              "type": "text",
              "value": "Default text field value."
            }
          ],
          "description": "A default description for cases.",
          "settings": {
            "syncAlerts": false
          },
          "tags": [
            "Default case tag"
          ],
          "title": "Default case title"
        },
        "description": "A description of the template.",
        "key": "505932fe-ee3a-4960-a661-c781b5acdb05",
        "name": "template-1",
        "tags": [
          "Template tag 1"
        ]
      }
    ],
    "updated_at": null,
    "updated_by": null,
    "version": "WzEyLDNd"
  }
]
```

--------------------------------

### 200 response example for listing agent binary download sources

Source: https://www.elastic.co/docs/api/doc/kibana/v9/operation/operation-get-fleet-agent-download-sources

Example of a successful response (200) containing a list of agent binary download sources. The response includes items with host, id, is_default, and name fields, along with pagination metadata.

```json
{
  "items": [
    {
      "host": "https://artifacts.elastic.co/downloads/",
      "id": "download-source-id-1",
      "is_default": true,
      "name": "Elastic Artifacts"
    }
  ],
  "page": 1,
  "perPage": 20,
  "total": 1
}
```

--------------------------------

### 200 response example for an agent binary download source

Source: https://www.elastic.co/docs/api/doc/kibana/v9/operation/operation-get-fleet-agent-download-sources-sourceid

Successful response containing the download source item with host, id, is_default, and name fields.

```json
{
  "item": {
    "host": "https://artifacts.elastic.co/downloads/",
    "id": "download-source-id-1",
    "is_default": true,
    "name": "Elastic Artifacts"
  }
}
```

--------------------------------

### Example response for get conversation by ID

Source: https://www.elastic.co/docs/api/doc/kibana/v9/operation/operation-get-agent-builder-conversations-conversation-id

Example 200 response containing the contents of a conversation with the chat agent, including metadata and message rounds.

```json
{
  "agent_id": "elastic-ai-agent",
  "created_at": "2025-09-19T17:45:39.554Z",
  "id": "bcc176c5-38f6-40be-be0c-898e34fa1480",
  "rounds": [
    {
      "id": "170ec3b2-0f5a-4538-8b60-549572386d2a",
      "input": {
        "message": "Hello, how are you?"
      },
      "response": {
        "message": "Since this is a general greeting that doesn't require any organizational or product-specific information, I can respond without using tools.\n\nHello! I'm doing well, thank you for asking. I'm here to help you with any questions you may have. How can I assist you today?"
      },
      "steps": []
    }
  ],
  "title": "General Greeting",
  "updated_at": "2025-09-19T17:45:39.554Z",
  "user": {
    "username": "elastic"
  }
}
```

--------------------------------

### GET /api/osquery/packs/{id} - 200 response example

Source: https://www.elastic.co/docs/api/doc/kibana/v9/operation/operation-osquerygetpacksdetails

Example JSON response for a successful request. Shows pack metadata, policy IDs, and query configurations.

```json
{
  "data": {
    "created_at": "2025-02-26T13:37:30.452Z",
    "created_by": "elastic",
    "description": "My pack",
    "enabled": true,
    "name": "my_pack",
    "policy_ids": [
      "my_policy_id"
    ],
    "queries": {
      "ports": {
        "interval": 60,
        "query": "SELECT * FROM listening_ports;",
        "removed": false,
        "snapshot": true,
        "timeout": 120
      }
    },
    "saved_object_id": "1c266590-381f-428c-878f-c80c1334f856",
    "shards": {},
    "updated_at": "2025-02-26T13:37:30.452Z",
    "updated_by": "elastic",
    "version": 1
  }
}
```

--------------------------------

### Response examples (200)

Source: https://www.elastic.co/docs/api/doc/kibana/v9/operation/operation-runscriptaction

Example 200 response from the run_script action API. Shows the response structure including agentState, hosts, outputs, parameters, and status fields.

```json
{
  "data": {
    "agents": [
      "ed518850-681a-4d60-bb98-e22640cae2a8"
    ],
    "agentState": {
      "ed518850-681a-4d60-bb98-e22640cae2a8": {
        "isCompleted": false,
        "wasSuccessful": false
      }
    },
    "agentType": "sentinel_one",
    "command": "runscript",
    "createdBy": "elastic",
    "hosts": {
      "ed518850-681a-4d60-bb98-e22640cae2a8": {
        "name": "gke-node-1235412"
      }
    },
    "id": "233db9ea-6733-4849-9226-5a7039c7161d",
    "isCompleted": false,
    "isExpired": false,
    "outputs": {},
    "parameters": {
      "scriptId": "1111-2222-3333-4444-5555-6666-7777-8888"
    },
    "startedAt": "2022-07-29T19:08:49.126Z",
    "status": "pending",
    "wasSuccessful": false
  }
}
```

--------------------------------

### GET /api/fleet/epm/packages/{pkgName}

Source: https://www.elastic.co/docs/api/doc/kibana/v9/operation/operation-get-fleet-epm-packages-pkgname

Retrieves details and installation status for a specific Elastic Package (EPM) package. The response includes package metadata, installation information, and configuration options.

```APIDOC
## [GET] /api/fleet/epm/packages/{pkgName}

### Description
Retrieves details and installation status for a specific Elastic Package (EPM) package.

### Method
GET

### Endpoint
/api/fleet/epm/packages/{pkgName}

### Parameters
#### Path Parameters
- **pkgName** (string) - Required - The name of the package.

### Request Example
```curl
curl \
 --request GET 'https://localhost:5601/api/fleet/epm/packages/{pkgName}' \
 --header "Authorization: $API_KEY"
```

### Response
#### Success Response (200)
Package details and installation status.

#### Response Example
```json
{
  "item": {
    "name": "string",
    "title": "string",
    "version": "string",
    "description": "string",
    "type": "integration",
    "categories": ["string"],
    "conditions": {
      "kibana": {
        "version": "string"
      }
    },
    "format_version": "string",
    "download": "string",
    "path": "string",
    "icons": [
      {
        "src": "string",
        "type": "string",
        "size": "string"
      }
    ],
    "assets": [
      {
        "type": "string",
        "id": "string"
      }
    ],
    "policy_templates": [
      {
        "name": "string",
        "title": "string",
        "description": "string",
        "categories": ["string"],
        "icons": [
          {
            "src": "string",
            "type": "string",
            "size": "string"
          }
        ],
        "screenshots": [
          {
            "src": "string",
            "title": "string",
            "size": "string",
            "type": "string",
            "path": "string",
            "dark_mode": true
          }
        ],
        "vars": [
          {
            "name": "string",
            "type": "string",
            "title": "string",
            "description": "string",
            "multi": true,
            "required": true,
            "show_user": true,
            "default": "string"
          }
        ],
        "deployment_modes": {
          "default": {
            "enabled": true,
            "organization": "string"
          },
          "agentless": {
            "enabled": true,
            "organization": "string"
          }
        }
      }
    ],
    "data_streams": [
      {
        "type": "string",
        "dataset": "string",
        "title": "string",
        "release": "ga",
        "package": "string",
        "path": "string",
        "ingest_pipeline": "string",
        "streams": [
          {
            "input": "string",
            "vars": [
              {
                "name": "string",
                "type": "string",
                "title": "string",
                "description": "string",
                "multi": true,
                "required": true,
                "show_user": true,
                "default": "string"
              }
            ],
            "template_path": "string"
          }
        ]
      }
    ],
    "elasticsearch": {
      "index_template": {
        "mappings": {},
        "settings": {},
        "data_stream": {}
      }
    },
    "kibana": {
      "dashboard": [
        {
          "module": "string",
          "id": "string"
        }
      ],
      "visualization": [
        {
          "module": "string",
          "id": "string"
        }
      ],
      "search": [
        {
          "module": "string",
          "id": "string"
        }
      ],
      "index_pattern": [
        {
          "module": "string",
          "id": "string"
        }
      ],
      "map": [
        {
          "module": "string",
          "id": "string"
        }
      ],
      "lens": [
        {
          "module": "string",
          "id": "string"
        }
      ],
      "security_rule": [
        {
          "module": "string",
          "id": "string"
        }
      ],
      "ml_module": [
        {
          "module": "string",
          "id": "string"
        }
      ],
      "csp_rule_template": [
        {
          "module": "string",
          "id": "string"
        }
      ],
      "osquery_pack_asset": [
        {
          "module": "string",
          "id": "string"
        }
      ],
      "osquery_saved_query": [
        {
          "module": "string",
          "id": "string"
        }
      ],
      "tag": [
        {
          "module": "string",
          "id": "string"
        }
      ]
    },
    "readme": "string",
    "license": "basic",
    "categories": ["string"],
    "internal": true,
    "keepPoliciesUpToDate": true,
    "latestVersion": "string",
    "licensePath": "string",
    "notice": "string",
    "owner": {
      "github": "string",
      "type": "elastic"
    },
    "signature_path": "string",
    "source": {
      "license": "string",
      "title": "string",
      "type": "integration"
    },
    "status": "string",
    "var_groups": [
      {
        "name": "string",
        "title": "string",
        "description": "string",
        "options": [
          {
            "name": "string",
            "title": "string",
            "description": "string",
            "hide_in_deployment_modes": ["default"],
            "vars": ["string"]
          }
        ],
        "vars": [
          {
            "name": "string",
            "type": "string",
            "title": "string",
            "description": "string",
            "multi": true,
            "required": true,
            "show_user": true,
            "default": "string"
          }
        ]
      }
    ],
    "installationInfo": {
      "type": "string",
      "install_status": "installed",
      "install_source": "registry",
      "install_format_schema_version": "string",
      "installed_es": [
        {
          "id": "string",
          "type": "index",
          "version": "string",
          "deferred": true,
          "customDataStreamOriginDataset": "string",
          "customDataStreamOriginType": "string"
        }
      ],
      "installed_kibana": [
        {
          "id": "string",
          "type": "dashboard",
          "originId": "string",
          "deferred": true
        }
      ],
      "installed_kibana_space_id": "string",
      "additional_space_installed_kibana": [
        {
          "id": "string",
          "type": "dashboard",
          "originId": "string",
          "deferred": true
        }
      ],
      "verification_status": "verified",
      "verification_key_id": "string",
      "namespaces": ["string"],
      "latest_install_failed_attempts": [
        {
          "created_at": "string",
          "target_version": "string",
          "error": {
            "name": "string",
            "message": "string",
            "stack": "string"
          }
        }
      ],
      "latest_executed_state": {
        "name": "string",
        "started_at": "string",
        "error": "string"
      },
      "is_rollback_ttl_expired": true,
      "rolled_back": true,
      "previous_version": "string",
      "updated_at": "string"
    },
    "metadata": {
      "has_policies": true
    }
  }
}
```

#### Error Response (400)
Bad Request

#### Error Response Example
```json
{
  "attributes": {},
  "error": "string",
  "errorType": "string",
  "message": "string",
  "statusCode": 400
}
```
```

--------------------------------

### Execute builtin esql tool request

Source: https://www.elastic.co/docs/api/doc/kibana/v9/operation/operation-post-agent-builder-tools-execute

Example request body for executing the built-in platform.core.execute_esql tool with an ES|QL query.

```json
{
  "tool_id": "platform.core.execute_esql",
  "tool_params": {
    "query": "FROM financial_trades | LIMIT 3"
  }
}
```

--------------------------------

### Successful response with created package policy

Source: https://www.elastic.co/docs/api/doc/kibana/v9/operation/operation-post-fleet-package-policies

Example 200 response showing the created package policy. Includes metadata such as creation and update timestamps, the policy ID, enabled status, and the package details. The inputs array is empty in this example.

```json
{
  "item": {
    "created_at": "2024-01-15T10:00:00.000Z",
    "enabled": true,
    "id": "package-policy-id-2",
    "inputs": [],
    "name": "nginx-1",
    "namespace": "default",
    "package": {
      "name": "nginx",
      "title": "Nginx",
      "version": "1.20.0"
    },
    "policy_ids": [
      "agent-policy-id-1"
    ],
    "updated_at": "2024-01-15T10:00:00.000Z"
  }
}
```

--------------------------------

### GET /api/workflows 200 response example

Source: https://www.elastic.co/docs/api/doc/kibana/v9/operation/operation-get-workflows

Example successful response returning a paginated list of workflows. Includes workflow metadata, definition with inputs and steps, execution history, and pagination details.

```json
{
  "page": 1,
  "results": [
    {
      "createdAt": "2025-11-20T10:30:00.000Z",
      "definition": {
        "description": "This is a workflow example",
        "enabled": true,
        "inputs": [
          {
            "default": "hello world",
            "name": "message",
            "type": "string"
          }
        ],
        "name": "Example definition",
        "steps": [
          {
            "name": "hello_world_step",
            "type": "console",
            "with": {
              "message": "{{ inputs.message }}"
            }
          }
        ],
        "triggers": [
          {
            "type": "manual"
          }
        ]
      },
      "description": "This is a workflow example",
      "enabled": true,
      "history": [
        {
          "duration": 5000,
          "finishedAt": "2025-11-20T12:00:05.000Z",
          "id": "exec-001",
          "startedAt": "2025-11-20T12:00:00.000Z",
          "status": "completed",
          "workflowId": "workflow-a1b2c3d4-e5f6-7890-abcd-ef1234567890",
          "workflowName": "Example definition"
        }
      ],
      "id": "workflow-a1b2c3d4-e5f6-7890-abcd-ef1234567890",
      "name": "Example definition",
      "tags": [
        "example"
      ],
      "valid": true
    }
  ],
  "size": 20,
  "total": 1
}
```
Tokens:
Raw