Kibana

WARNING: When you delete a connector, it cannot be recovered. Kibana DELETE /api/actions/connector/{id}.

Delete an agent by ID. This action cannot be undone. To learn more about agents, refer to the [agents documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/agent-builder-agents). [Required authorization] Route required privileges: agentBuilder:manageAgents. [Added in 9.2.0] Kibana DELETE /api/agent_builder/agents/{id}.

Delete a conversation by ID. This action cannot be undone. To learn more about agent conversations, refer to the [agent chat documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/chat). [Required authorization] Route required privileges: agentBuilder:read. [Added in 9.2.0] Kibana DELETE /api/agent_builder/conversations/{conversation_id}.

Delete an attachment. By default performs a soft delete (can be restored). Use permanent=true to permanently remove unreferenced attachments. [Required authorization] Route required privileges: agentBuilder:read. [Experimental; added in 9.2.0] Kibana DELETE /api/agent_builder/conversations/{conversation_id}/attachments/{attachment_id}.

Delete an installed plugin by ID. This action cannot be undone. To learn more about Agent Builder plugins, refer to the [plugins documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/plugins). [Required authorization] Route required privileges: agentBuilder:write. [Experimental; added in 9.4.0] Kibana DELETE /api/agent_builder/plugins/{pluginId}.

Delete a user-created skill by ID. If agents still reference the skill, the request returns 409 unless force=true, which removes the skill from agents first. Built-in skills cannot be deleted. [Experimental; added in 9.4.0] Kibana DELETE /api/agent_builder/skills/{skillId}.

Delete a tool by ID. This action cannot be undone. To learn more about Agent Builder tools, refer to the [tools documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/tools). [Required authorization] Route required privileges: agentBuilder:manageTools. [Added in 9.2.0] Kibana DELETE /api/agent_builder/tools/{toolId}.

Delete a rule. Kibana DELETE /api/alerting/rule/{id}.

Delete a snooze schedule for a rule. [Generally available; added in 8.19.0] Kibana DELETE /api/alerting/rule/{ruleId}/snooze_schedule/{scheduleId}.

Delete a backfill by ID. Kibana DELETE /api/alerting/rules/backfill/{id}.

Delete an existing agent configuration. You must have `all` privileges for the APM and User Experience feature in Kibana. When successful, the configuration is removed and, if Fleet is enabled, APM package policies are synchronized accordingly. Kibana DELETE /api/apm/settings/agent-configuration.

Delete a previously uploaded source map. You must have `all` Kibana privileges for the APM and User Experience feature. Kibana DELETE /api/apm/sourcemaps/{id}.

**Deprecated in 9.4.0.** Use the Entity Store APIs to unassign asset criticality for a specific entity. Delete the asset criticality record for a specific entity. Kibana DELETE /api/asset_criticality.

Permanently deletes an Attack Discovery schedule and all associated configuration. Kibana DELETE /api/attack_discovery/schedules/{id}.

You must have `read` or `all` privileges and the `delete` sub-feature privilege for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the cases you're deleting. Kibana DELETE /api/cases.

Deletes all comments and alerts from a case. You must have `all` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the cases you're deleting. Kibana DELETE /api/cases/{caseId}/comments.

You must have `all` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the cases you're deleting. Kibana DELETE /api/cases/{caseId}/comments/{commentId}.

Soft-deletes a case template (all versions). Existing cases keep their pinned template reference; the template stops appearing in the case creation flow and in find responses. You must have the "Manage templates" sub-privilege for the Cases feature of the owning solution. [Technical preview] Kibana DELETE /api/cases/templates/{template_id}.

> This documentation is temporarily hosted at a separate location. > > **[View the full Dashboards API reference →](https://elastic.github.io/dashboards-api-spec/dashboards#tag/Dashboards)**. Kibana DELETE /api/dashboards/{id}.

Delete a data view by its identifier. WARNING: When you delete a data view, it cannot be recovered. Kibana DELETE /api/data_views/data_view/{viewId}.

Delete a runtime field from a data view. Kibana DELETE /api/data_views/data_view/{viewId}/runtime_field/{fieldName}.

Permanently deletes the Elastic Security alerts backing index in the current space, including the alerts stored in it. Use with caution; prefer lifecycle policies or the UI when available. Call `GET /api/detection_engine/index` first to confirm the index that will be removed. Kibana DELETE /api/detection_engine/index.

Delete a detection rule using the `rule_id` or `id` field. Kibana DELETE /api/detection_engine/rules.

**DEPRECATED.** Cleanup API for old migration artifacts. Do not add new call sites. **WARNING:** This schedules deletions; ensure no production reads still point at the source index. Migrations favor data integrity over shard size. Consequently, unused or orphaned indices are artifacts of the migration process. Kibana DELETE /api/detection_engine/signals/migration.

Delete an Elastic Endpoint exception list item, specified by the `id` or `item_id` field. Kibana DELETE /api/endpoint_list/items.

Delete a script. Kibana DELETE /api/endpoint/scripts_library/{script_id}.

**Deprecated in 9.4.0.** Deletes the Privilege Monitoring Engine and optionally removes all associated privileged user data. Kibana DELETE /api/entity_analytics/monitoring/engine/delete.

**Deprecated in 9.4.0.** Use the Watchlists API instead. Removes a privileged user from monitoring by their document ID. Kibana DELETE /api/entity_analytics/monitoring/users/{id}.

Delete an exception list using the `id` or `list_id` field. Before deleting an exception list that is linked to detection rules, remove or unlink the exception list from those rules. Deleting a linked exception list can leave rules referencing an exception list that no longer exists. Kibana DELETE /api/exception_lists.

Delete an exception list item using the `id` or `item_id` field. Kibana DELETE /api/exception_lists/items.

Delete an agent binary download source by ID. [Required authorization] Route required privileges: fleet-settings-all. Kibana DELETE /api/fleet/agent_download_sources/{sourceId}.

Deprecated. Use `DELETE /api/fleet/managed_integrations/{policyId}` instead. Delete a managed integration. [Experimental; added in 9.3.0] Kibana DELETE /api/fleet/agentless_policies/{policyId}.

Delete an agent by ID. [Required authorization] Route required privileges: fleet-agents-all. Kibana DELETE /api/fleet/agents/{agentId}.

Delete a file uploaded by an agent. [Required authorization] Route required privileges: fleet-agents-all. Kibana DELETE /api/fleet/agents/files/{fileId}.

Delete a cloud connector by ID. Use the `force` query parameter to delete even if package policies are still using it. [Required authorization] Route required privileges: fleet-agent-policies-all OR integrations-all. [Experimental; added in 9.2.0] Kibana DELETE /api/fleet/cloud_connectors/{cloudConnectorId}.

Revoke or delete an enrollment API key by ID. Use `forceDelete=true` to remove the document. [Required authorization] Route required privileges: fleet-agents-all. Kibana DELETE /api/fleet/enrollment_api_keys/{keyId}.

Uninstall a package and remove all its assets. [Required authorization] Route required privileges: integrations-all AND fleet-agent-policies-all. Kibana DELETE /api/fleet/epm/packages/{pkgName}.

Uninstall a specific version of a package and remove all its assets. [Required authorization] Route required privileges: integrations-all AND fleet-agent-policies-all. Kibana DELETE /api/fleet/epm/packages/{pkgName}/{pkgVersion}.

Delete datastream assets for a specific package, by data stream name. [Required authorization] Route required privileges: integrations-all AND fleet-agent-policies-all. Kibana DELETE /api/fleet/epm/packages/{pkgName}/{pkgVersion}/datastream_assets.

Delete Kibana assets (dashboards, visualizations, etc.) for a specific package version. [Required authorization] Route required privileges: integrations-all AND fleet-agent-policies-all. Kibana DELETE /api/fleet/epm/packages/{pkgName}/{pkgVersion}/kibana_assets.

Delete a Fleet Server host by ID. [Required authorization] Route required privileges: fleet-settings-all. Kibana DELETE /api/fleet/fleet_server_hosts/{itemId}.

Delete a managed integration. [Experimental; added in 9.3.0] Kibana DELETE /api/fleet/managed_integrations/{policyId}.

Delete output by ID. [Required authorization] Route required privileges: fleet-settings-all. Kibana DELETE /api/fleet/outputs/{outputId}.

Delete a package policy by ID. [Required authorization] Route required privileges: fleet-agent-policies-all AND integrations-all. Kibana DELETE /api/fleet/package_policies/{packagePolicyId}.

Delete a proxy by ID [Required authorization] Route required privileges: fleet-settings-all. Kibana DELETE /api/fleet/proxies/{itemId}.

Delete a value list using the list ID. > info > When you delete a list, all of its list items are also deleted. Kibana DELETE /api/lists.

Delete the `.lists` and `.items` data streams. Kibana DELETE /api/lists/index.

Delete a value list item using its `id`, or its `list_id` and `value` fields. Kibana DELETE /api/lists/items.

Delete a centrally-managed Logstash pipeline. If your Elasticsearch cluster is protected with basic authentication, you must have either the `logstash_admin` built-in role or a customized Logstash writer role. [Technical Preview] Kibana DELETE /api/logstash/pipeline/{id}.

[Required authorization] Route required privileges: write-maintenance-window. [Generally available; added in 9.1.0] Kibana DELETE /api/maintenance_window/{id}.

Deletes notes by saved object ID. Send either `noteId` (single ID) or `noteIds` (array of IDs) in the JSON body. The response has HTTP 200 with an empty body on success. Requires the **Timeline and Notes** write privilege (`notes_write`). Kibana DELETE /api/note.

Delete a query pack using the pack ID. Kibana DELETE /api/osquery/packs/{id}.

Delete a saved query using the query ID. Kibana DELETE /api/osquery/saved_queries/{id}.

Cleaning up the the Risk Engine by removing the indices, mapping and transforms. Kibana DELETE /api/risk_score/engine/dangerously_delete_data.

WARNING: This API is deprecated. This is a legacy Saved Objects API and may be removed in a future version of Kibana. Deletes a single Kibana saved object by type and ID. There is currently no complete replacement for deleting arbitrary saved objects via an HTTP API. Kibana DELETE /api/saved_objects/{type}/{id}.

This endpoint allows users to permanently delete all conversations. Kibana DELETE /api/security_ai_assistant/current_user/conversations.

Delete an existing conversation using the conversation ID. This endpoint allows users to permanently delete a conversation. Kibana DELETE /api/security_ai_assistant/current_user/conversations/{id}.

Delete a Knowledge Base Entry by its unique `id`. Kibana DELETE /api/security_ai_assistant/knowledge_base/entries/{id}.

Delete a single entity record from the Entity Store. The entity is immediately removed from the latest index. [Required authorization] Route required privileges: securitySolution. Kibana DELETE /api/security/entity_store/entities/.

Delete a Kibana role by its name. Kibana DELETE /api/security/role/{name}.

Delete a Kibana short URL. [Technical Preview] Kibana DELETE /api/short_url/{id}.

When you delete a space, all saved objects that belong to the space are automatically deleted, which is permanent and cannot be undone. Kibana DELETE /api/spaces/space/{id}.

Deletes a stream definition and the underlying data stream [Required authorization] Route required privileges: manage_stream. [Experimental; added in 9.1.0] Kibana DELETE /api/streams/{name}.

Remove a query from a stream. Noop if the query is not found on the stream. [Required authorization] Route required privileges: manage_stream. [Experimental; added in 9.1.0] Kibana DELETE /api/streams/{name}/queries/{queryId}.

Unlinks an attachment from a stream. Noop if the attachment is not linked to the stream. [Required authorization] Route required privileges: manage_stream. [Experimental; added in 9.3.0] Kibana DELETE /api/streams/{streamName}/attachments/{attachmentType}/{attachmentId}.

Delete a monitor from the Synthetics app. You must have `all` privileges for the Synthetics feature in the Observability section of the Kibana feature privileges. Kibana DELETE /api/synthetics/monitors/{id}.

Delete a parameter from the Synthetics app. You must have `all` privileges for the Synthetics feature in the Observability section of the Kibana feature privileges. Kibana DELETE /api/synthetics/params/{id}.

You must have `all` privileges for the Synthetics and Uptime feature in the Observability section of the Kibana feature privileges. The API does not return a response body for deletion, but it will return an appropriate status code upon successful deletion. Kibana DELETE /api/synthetics/private_locations/{id}.

Permanently deletes a tag by ID. [Experimental; added in 9.5.0] Kibana DELETE /api/tags/{id}.

Delete one or more Timelines or Timeline templates. Kibana DELETE /api/timeline.

> This documentation is temporarily hosted at a separate location. > > **[View the full Visualizations API reference →](https://elastic.github.io/dashboards-api-spec/visualizations#tag/Visualizations)**. Kibana DELETE /api/visualizations/{id}.

Delete multiple workflows by their IDs. [Required authorization] Route required privileges: workflowsManagement:delete. [Generally available; added in 9.4.0] Kibana DELETE /api/workflows.

Delete a single workflow by its ID. [Required authorization] Route required privileges: workflowsManagement:delete. [Generally available; added in 9.4.0] Kibana DELETE /api/workflows/workflow/{id}.

You must have the `write` privileges for the **SLOs** feature in the **Observability** section of the Kibana feature privileges. Kibana DELETE /s/{spaceId}/api/observability/slos/{sloId}.

[Required authorization] Route required privileges: actions:oauth. Kibana GET /api/actions/connector/{connectorId}/oauth/start.

Get connector information. Kibana GET /api/actions/connector/{id}.

Handles the OAuth 2.0 authorization code callback from external providers. Exchanges the authorization code for access and refresh tokens. [Required authorization] Route required privileges: actions:oauth. [Added in 9.4.0] Kibana GET /api/actions/connector/_oauth_callback.

Returns the OAuth callback script. [Added in 9.4.0] Kibana GET /api/actions/connector/_oauth_callback_script.

You do not need any Kibana feature privileges to run this API. Kibana GET /api/actions/connector_types.

Get all connectors. Kibana GET /api/actions/connectors.

Get agent discovery metadata in JSON format. Use this endpoint to provide agent information for A2A protocol integration and discovery. To learn more about the Agent Builder A2A server, refer to the [A2A server documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/a2a-server). [Experimental; added in 9.2.0] Kibana GET /api/agent_builder/a2a/{agentId}.json.

List all available agents. Use this endpoint to retrieve complete agent information including their current configuration and assigned tools. To learn more about agents, refer to the [agents documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/agent-builder-agents). [Added in 9.2.0] Kibana GET /api/agent_builder/agents.

Get a specific agent by ID. Use this endpoint to retrieve the complete agent definition including all configuration details and tool assignments. To learn more about agents, refer to the [agents documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/agent-builder-agents). [Added in 9.2.0] Kibana GET /api/agent_builder/agents/{id}.

Get the access control for a specific agent. Callers without permission to manage access control receive `permissions.update_access_control: false` and only their own entry. [Added in 9.5.0] Kibana GET /api/agent_builder/agents/{id}/access_control.

List all conversations for a user. Use the optional agent ID to filter conversations by a specific agent. To learn more about agent conversations, refer to the [agent chat documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/chat). [Added in 9.2.0] Kibana GET /api/agent_builder/conversations.

Get a specific conversation by ID. Use this endpoint to retrieve the complete conversation history including all messages and metadata. To learn more about agent conversations, refer to the [agent chat documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/chat). [Added in 9.2.0] Kibana GET /api/agent_builder/conversations/{conversation_id}.

List all attachments for a conversation. Use the optional include_deleted query parameter to include soft-deleted attachments. [Required authorization] Route required privileges: agentBuilder:read. [Experimental; added in 9.2.0] Kibana GET /api/agent_builder/conversations/{conversation_id}/attachments.

Checks staleness for the latest version of all conversation attachments against their origin snapshot. [Required authorization] Route required privileges: agentBuilder:read. [Experimental; added in 9.4.0] Kibana GET /api/agent_builder/conversations/{conversation_id}/attachments/stale.

List all installed plugins and their managed assets. Plugins are installable packages that bundle agent capabilities such as skills, following the [Claude agent plugin specification](https://code.claude.com/docs/en/plugins). [Experimental; added in 9.4.0] Kibana GET /api/agent_builder/plugins.

Get a specific plugin by ID. To learn more about Agent Builder plugins, refer to the [plugins documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/plugins). [Required authorization] Route required privileges: agentBuilder:read. [Experimental; added in 9.4.0] Kibana GET /api/agent_builder/plugins/{pluginId}.

List all available skills (built-in and user-created). To learn more about Agent Builder skills, refer to the [skills documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/skills). [Required authorization] Route required privileges: agentBuilder:read. [Experimental; added in 9.4.0] Kibana GET /api/agent_builder/skills.

Get a specific skill by ID. To learn more about Agent Builder skills, refer to the [skills documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/skills). [Required authorization] Route required privileges: agentBuilder:read. [Experimental; added in 9.4.0] Kibana GET /api/agent_builder/skills/{skillId}.

List all available tools. Use this endpoint to retrieve complete tool definitions including their schemas and configuration requirements. To learn more about Agent Builder tools, refer to the [tools documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/tools). [Added in 9.2.0] Kibana GET /api/agent_builder/tools.

Get a specific tool by ID. Use this endpoint to retrieve the complete tool definition including its schema and configuration requirements. To learn more about Agent Builder tools, refer to the [tools documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/tools). [Added in 9.2.0] Kibana GET /api/agent_builder/tools/{toolId}.

You must have `read` privileges for the **Management > Stack Rules** feature or for at least one of the **Analytics > Discover**, **Analytics > Machine Learning**, **Observability**, or **Security** features. Kibana GET /api/alerting/_health.

Get rule details. Kibana GET /api/alerting/rule/{id}.

Returns the Elasticsearch query that a rule executes, and optionally its response. Kibana GET /api/alerting/rule/{id}/query_inspector.

If you have `read` privileges for one or more Kibana features, the API response contains information about the appropriate rule types. Kibana GET /api/alerting/rule_types.

Get a backfill by ID. Kibana GET /api/alerting/rules/backfill/{id}.

Get information about rules. Kibana GET /api/alerting/rules/_find.

Search for annotations related to a specific service. Kibana GET /api/apm/services/{serviceName}/annotation/search.

Retrieve all agent configurations. You must have `read` privileges for the APM and User Experience feature in Kibana. If agent configuration is not available on the current deployment, the API returns a 404. Kibana GET /api/apm/settings/agent-configuration.

Retrieve `agentName` for a service. Kibana GET /api/apm/settings/agent-configuration/agent_name.

Retrieve the available environments for a given service, to be used in agent configuration. You must have `read` privileges for the APM and User Experience feature in Kibana. If `serviceName` is omitted, environments across all services are returned. Kibana GET /api/apm/settings/agent-configuration/environments.

Retrieve a single agent configuration matching the given service name and environment. You must have `read` privileges for the APM and User Experience feature in Kibana. If no matching configuration is found, the API returns a 404. Kibana GET /api/apm/settings/agent-configuration/view.

Get an array of Fleet artifacts, including source map uploads. You must have `read` or `all` Kibana privileges for the APM and User Experience feature. Kibana GET /api/apm/sourcemaps.

**Deprecated in 9.4.0.** Get the asset criticality record for a specific entity. Kibana GET /api/asset_criticality.

**Deprecated in 9.4.0.** List asset criticality records, paging, sorting and filtering as needed. Kibana GET /api/asset_criticality/list.

Find Attack discoveries that match the search criteria. Supports free text search, filtering, pagination, and sorting. Kibana GET /api/attack_discovery/_find.

Get the latest Attack Discovery generations metadata (that are not dismissed) for the current user. This endpoint retrieves generation metadata including execution status and statistics for Attack Discovery generations. Kibana GET /api/attack_discovery/generations.

Returns a specific Attack Discovery generation, including all generated Attack discoveries and associated metadata, including execution status and statistics. Kibana GET /api/attack_discovery/generations/{execution_uuid}.

Retrieves a specific Attack Discovery schedule by its unique identifier. Returns complete schedule configuration including parameters, interval settings, associated actions, and execution history. Kibana GET /api/attack_discovery/schedules/{id}.

Find Attack Discovery schedules that match the search criteria. Supports pagination and sorting by various fields. Kibana GET /api/attack_discovery/schedules/_find.

You must have `read` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the cases you're seeking. [Technical preview] Kibana GET /api/cases/alerts/{alertId}.

Returns case details. The response does not include a comments property; use the find case comments API to retrieve comments. The totalComment field reflects the actual number of user comments on the case. Kibana GET /api/cases/{caseId}.

You must have `read` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the cases you're seeking. [Technical preview] Kibana GET /api/cases/{caseId}/alerts.

You must have `read` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the cases with the comments you're seeking. Kibana GET /api/cases/{caseId}/comments/{commentId}.

Retrieves a paginated list of comments for a case. You must have `read` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the cases with the comments you're seeking. Kibana GET /api/cases/{caseId}/comments/_find.

Returns the fields you can write to the case's `extended_fields`. The case determines the owner and any applied template. The response includes the owner's global fields (library-wide) and, if the case has a template, that template's fields. Requires the Cases feature to be enabled in the space. Kibana GET /api/cases/{caseId}/fields.

Retrieves a paginated list of user activity for a case. You must have `read` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the case you're seeking. Kibana GET /api/cases/{caseId}/user_actions/_find.

Get setting details such as the closure type, custom fields, templates, and the default connector for cases. You must have `read` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on where the cases were created. Kibana GET /api/cases/configure.

Get information about connectors that are supported for use in cases. You must have `read` privileges for the **Actions and Connectors** feature in the **Management** section of the Kibana feature privileges. Kibana GET /api/cases/configure/connectors/_find.

Returns the fields you can write to a case's `extended_fields` when creating a case for the given owner. Includes the owner's global (library-wide) fields and, when `templateId` is supplied, that template's fields. Migrated legacy custom fields appear as `global` fields. Kibana GET /api/cases/fields.

You must have `read` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the cases you're seeking. Kibana GET /api/cases/_find.

Returns information about the users who opened cases. You must have read privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the cases. Kibana GET /api/cases/reporters.

Aggregates and returns a list of case tags. You must have read privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the cases you're seeking. Kibana GET /api/cases/tags.

Returns a paginated list of case templates. Requires the Cases feature to be enabled in the space. Kibana GET /api/cases/templates.

Returns the details of a case template. Requires the Cases feature to be enabled in the space. Kibana GET /api/cases/templates/{template_id}.

> This documentation is temporarily hosted at a separate location. > > **[View the full Dashboards API reference →](https://elastic.github.io/dashboards-api-spec/dashboards#tag/Dashboards)**. Kibana GET /api/dashboards.

> This documentation is temporarily hosted at a separate location. > > **[View the full Dashboards API reference →](https://elastic.github.io/dashboards-api-spec/dashboards#tag/Dashboards)**. Kibana GET /api/dashboards/{id}.

Retrieve a list of all data views. Use this endpoint to identify available data views in the current Kibana space. Kibana GET /api/data_views.

Retrieve a single data view by its identifier. Data views identify the Elasticsearch data you want to explore and visualize. They can point to one or more data streams, indices, or index aliases, and use optional runtime fields to compute values at query time. Kibana GET /api/data_views/data_view/{viewId}.

Retrieve a single runtime field by name from a data view. Kibana GET /api/data_views/data_view/{viewId}/runtime_field/{fieldName}.

Retrieve the identifier of the default data view for the current Kibana space. Kibana GET /api/data_views/default.

Returns the backing Elasticsearch index for Elastic Security detection alerts in the current space, and whether its mapping is outdated. Use this to verify that an alert index is provisioned before creating or running rules that write alerts to it. Kibana GET /api/detection_engine/index.

Retrieves whether or not the user is authenticated, and the user's Kibana space and index privileges, which determine if the user can create an index for the Elastic Security alerts generated by detection engine rules. Kibana GET /api/detection_engine/privileges.

Retrieve a detection rule using the `rule_id` or `id` field. Kibana GET /api/detection_engine/rules.

Retrieve a paginated list of detection rules. By default, the first page is returned, with 20 results per page. Kibana GET /api/detection_engine/rules/_find.

Retrieve the status of all Elastic prebuilt detection rules and Timelines. Kibana GET /api/detection_engine/rules/prepackaged/_status.

**DEPRECATED.** This endpoint was used for historical `.siem-signals-*` index migration workflows. Do not use for new automations; there is no supported replacement in this public API. **WARNING:** Prefer upgrading through supported Elastic stack upgrades rather than ad-hoc index migrations. Kibana GET /api/detection_engine/signals/migration_status.

List all unique tags from all detection rules. Kibana GET /api/detection_engine/tags.

Get a list of all response actions. Kibana GET /api/endpoint/action.

Get the details of a response action using the action ID. Kibana GET /api/endpoint/action/{action_id}.

Get information for the specified response action file download. Kibana GET /api/endpoint/action/{action_id}/file/{file_id}.

Get a response actions state, which reports whether encryption is enabled. Kibana GET /api/endpoint/action/state.

Get the status of response actions for the specified agent IDs. Kibana GET /api/endpoint/action_status.

Get the details of an Elastic Endpoint exception list item, specified by the `id` or `item_id` field. Kibana GET /api/endpoint_list/items.

Get a list of all Elastic Endpoint exception list items. Kibana GET /api/endpoint_list/items/_find.

Get a list of all endpoint host metadata. Kibana GET /api/endpoint/metadata.

Get host metadata for a specific endpoint. Kibana GET /api/endpoint/metadata/{id}.

Get the most recent policy response for an endpoint. Kibana GET /api/endpoint/policy_response.

Get the protection updates note for a package policy. Kibana GET /api/endpoint/protection_updates_note/{package_policy_id}.

Retrieve a list of scripts. Kibana GET /api/endpoint/scripts_library.

Get a script. Kibana GET /api/endpoint/scripts_library/{script_id}.

**Deprecated in 9.4.0.** Returns the current health status of the Privilege Monitoring Engine, including engine status, error details, and user count statistics. Kibana GET /api/entity_analytics/monitoring/privileges/health.

**Deprecated in 9.4.0.** Use the Watchlists APIs instead. Check if the current user has all required permissions for Privilege Monitoring. Kibana GET /api/entity_analytics/monitoring/privileges/privileges.

**Deprecated in 9.4.0.** Use the Watchlists API instead. Returns a list of all privileged users currently being monitored. Supports optional KQL filtering. Kibana GET /api/entity_analytics/monitoring/users/list.

Returns the installation and ML module setup status of the privileged access detection package, along with the state of each associated ML job. Kibana GET /api/entity_analytics/privileged_user_monitoring/pad/status.

Retrieves the details of an entity analytics watchlist by its unique identifier. [Technical Preview] Kibana GET /api/entity_analytics/watchlists/{id}.

Returns a list of all entity analytics watchlists. [Technical Preview] Kibana GET /api/entity_analytics/watchlists/list.

Get the details of an exception list using the `id` or `list_id` field. Kibana GET /api/exception_lists.

Get a list of all exception list containers. Kibana GET /api/exception_lists/_find.

Get the details of an exception list item using the `id` or `item_id` field. Kibana GET /api/exception_lists/items.

Get a list of all exception list items in the specified list. Kibana GET /api/exception_lists/items/_find.

Get a summary of the specified exception list. Kibana GET /api/exception_lists/summary.

Get information about all Kibana features. Features are used by spaces and security to refine and secure access to Kibana. [Technical Preview] Kibana GET /api/features.

List all agent binary download sources. [Required authorization] Route required privileges: fleet-agent-policies-read OR fleet-settings-read. Kibana GET /api/fleet/agent_download_sources.

Get an agent binary download source by ID. [Required authorization] Route required privileges: fleet-agent-policies-read OR fleet-settings-read. Kibana GET /api/fleet/agent_download_sources/{sourceId}.

List all agent policies. [Required authorization] Route required privileges: fleet-agent-policies-read OR fleet-agents-read OR fleet-setup. Kibana GET /api/fleet/agent_policies.

Get an agent policy by ID. [Required authorization] Route required privileges: fleet-agent-policies-read OR fleet-agents-read OR fleet-setup. Kibana GET /api/fleet/agent_policies/{agentPolicyId}.

Get the auto-upgrade status for agents assigned to an agent policy. [Required authorization] Route required privileges: fleet-agents-read. Kibana GET /api/fleet/agent_policies/{agentPolicyId}/auto_upgrade_agents_status.

Download an agent policy by ID. [Required authorization] Route required privileges: fleet-agent-policies-read OR fleet-setup. Kibana GET /api/fleet/agent_policies/{agentPolicyId}/download.

Get a full agent policy by ID. [Required authorization] Route required privileges: fleet-agent-policies-read. Kibana GET /api/fleet/agent_policies/{agentPolicyId}/full.

Get a list of outputs associated with agent policy by policy id. [Required authorization] Route required privileges: fleet-agent-policies-read AND fleet-settings-read. Kibana GET /api/fleet/agent_policies/{agentPolicyId}/outputs.

Get a summary of agent statuses for a given agent policy. Kibana GET /api/fleet/agent_status.

Get the data streams that an agent is actively sending data to. [Required authorization] Route required privileges: fleet-agents-read. Kibana GET /api/fleet/agent_status/data.

Deprecated. Use `GET /api/fleet/managed_integrations` instead. List managed integrations. [Experimental; added in 9.5.0] Kibana GET /api/fleet/agentless_policies.

Deprecated. Use `GET /api/fleet/managed_integrations/{policyId}` instead. Get a managed integration by ID. [Experimental; added in 9.5.0] Kibana GET /api/fleet/agentless_policies/{policyId}.

List agents, with optional filtering and pagination. [Required authorization] Route required privileges: fleet-agents-read. Kibana GET /api/fleet/agents.

Get the current status of recent agent actions. [Required authorization] Route required privileges: fleet-agents-read. Kibana GET /api/fleet/agents/action_status.

Get a list of Elastic Agent versions available for upgrade. [Required authorization] Route required privileges: fleet-agents-read. Kibana GET /api/fleet/agents/available_versions.

Get an agent by ID. [Required authorization] Route required privileges: fleet-agents-read. Kibana GET /api/fleet/agents/{agentId}.

Get an agent's effective config by ID. [Required authorization] Route required privileges: fleet-agents-read. Kibana GET /api/fleet/agents/{agentId}/effective_config.

Get a list of files uploaded by a specific agent. [Required authorization] Route required privileges: fleet-agents-read. Kibana GET /api/fleet/agents/{agentId}/uploads.

Get a file uploaded by an agent. [Required authorization] Route required privileges: fleet-agents-read. Kibana GET /api/fleet/agents/files/{fileId}/{fileName}.

Get the current Fleet setup status, including whether Fleet is ready to enroll agents and which requirements or optional features are missing. [Required authorization] Route required privileges: fleet-agents-read OR fleet-agent-policies-read OR fleet-settings-read OR fleet-setup. Kibana GET /api/fleet/agents/setup.

Get a list of all tags used across enrolled agents. [Required authorization] Route required privileges: fleet-agents-read. Kibana GET /api/fleet/agents/tags.

Check whether the current user has the required permissions to use Fleet. Optionally verifies Fleet Server setup privileges. Kibana GET /api/fleet/check-permissions.

List all Fleet cloud connectors. [Required authorization] Route required privileges: fleet-agent-policies-read OR integrations-read. [Experimental; added in 9.2.0] Kibana GET /api/fleet/cloud_connectors.

Get a cloud connector by ID. [Required authorization] Route required privileges: fleet-agent-policies-read OR integrations-read. [Experimental; added in 9.2.0] Kibana GET /api/fleet/cloud_connectors/{cloudConnectorId}.

Get a list of package policies that are using a given cloud connector. [Required authorization] Route required privileges: fleet-agent-policies-read OR integrations-read. [Experimental; added in 9.2.0] Kibana GET /api/fleet/cloud_connectors/{cloudConnectorId}/usage.

List all Fleet-managed data streams with metadata including package, namespace, size, and last activity. [Required authorization] Route required privileges: fleet-agents-all AND fleet-agent-policies-all AND fleet-settings-all. Kibana GET /api/fleet/data_streams.

List all enrollment API keys. [Required authorization] Route required privileges: fleet-agents-all OR fleet-setup. Kibana GET /api/fleet/enrollment_api_keys.

Get an enrollment API key by ID. [Required authorization] Route required privileges: fleet-agents-all OR fleet-setup. Kibana GET /api/fleet/enrollment_api_keys/{keyId}.

Get a list of integration categories. [Required authorization] Route required privileges: integrations-read OR fleet-setup OR fleet-all. Kibana GET /api/fleet/epm/categories.

Get a list of data streams created by installed integration packages. [Required authorization] Route required privileges: integrations-read OR fleet-setup OR fleet-all. Kibana GET /api/fleet/epm/data_streams.

Get a list of integration packages available in the registry. [Required authorization] Route required privileges: integrations-read OR fleet-setup OR fleet-all. Kibana GET /api/fleet/epm/packages.

Get the status and results of a bulk package rollback operation. [Required authorization] Route required privileges: integrations-all AND fleet-agent-policies-all. Kibana GET /api/fleet/epm/packages/_bulk_rollback/{taskId}.

Get the status and results of a bulk package uninstall operation. [Required authorization] Route required privileges: integrations-all AND fleet-agent-policies-all. Kibana GET /api/fleet/epm/packages/_bulk_uninstall/{taskId}.

Get the status and results of a bulk package upgrade operation. [Required authorization] Route required privileges: integrations-all AND fleet-agent-policies-all. Kibana GET /api/fleet/epm/packages/_bulk_upgrade/{taskId}.

Get information about a package by name, returning the latest installed or available version. Kibana GET /api/fleet/epm/packages/{pkgName}.

Get information about a specific version of a package. Kibana GET /api/fleet/epm/packages/{pkgName}/{pkgVersion}.

Get the contents of a specific file from a package. [Required authorization] Route required privileges: integrations-read OR fleet-setup OR fleet-all. Kibana GET /api/fleet/epm/packages/{pkgName}/{pkgVersion}/{filePath}.

Get the list of packages that a specific package depends on. [Required authorization] Route required privileges: integrations-read OR fleet-setup OR fleet-all. [Generally available; added in 9.4.0] Kibana GET /api/fleet/epm/packages/{pkgName}/{pkgVersion}/dependencies.

Get usage statistics for a specific package, such as the number of agent policies using it. [Required authorization] Route required privileges: integrations-read OR fleet-setup OR fleet-all. Kibana GET /api/fleet/epm/packages/{pkgName}/stats.

Get a list of all currently installed integration packages. [Required authorization] Route required privileges: integrations-read OR fleet-setup OR fleet-all. Kibana GET /api/fleet/epm/packages/installed.

Get the list of packages that cannot be uninstalled (e.g. elastic_agent, fleet_server). [Required authorization] Route required privileges: integrations-read OR fleet-setup OR fleet-all. Kibana GET /api/fleet/epm/packages/limited.

Get an inputs template for a package, used to pre-populate package policy forms. [Required authorization] Route required privileges: integrations-read OR fleet-setup OR fleet-all. Kibana GET /api/fleet/epm/templates/{pkgName}/{pkgVersion}/inputs.

Get the GPG key ID used to verify the signatures of packages from the Elastic Package Registry. [Required authorization] Route required privileges: integrations-read OR fleet-setup OR fleet-all. Kibana GET /api/fleet/epm/verification_key_id.

List all Fleet Server hosts. [Required authorization] Route required privileges: fleet-agents-all OR fleet-settings-read. Kibana GET /api/fleet/fleet_server_hosts.

Get a Fleet Server host by ID. [Required authorization] Route required privileges: fleet-settings-read. Kibana GET /api/fleet/fleet_server_hosts/{itemId}.

Get the Kubernetes manifest for deploying Elastic Agent. [Required authorization] Route required privileges: fleet-agent-policies-read OR fleet-setup. Kibana GET /api/fleet/kubernetes.

Download the Kubernetes manifest for deploying Elastic Agent. [Required authorization] Route required privileges: fleet-agent-policies-read OR fleet-setup. Kibana GET /api/fleet/kubernetes/download.

List managed integrations. [Experimental; added in 9.5.0] Kibana GET /api/fleet/managed_integrations.

Get a managed integration by ID. [Experimental; added in 9.5.0] Kibana GET /api/fleet/managed_integrations/{policyId}.

List all Fleet outputs. [Required authorization] Route required privileges: fleet-settings-read OR fleet-agent-policies-read. Kibana GET /api/fleet/outputs.

Get output by ID. [Required authorization] Route required privileges: fleet-settings-read OR fleet-agent-policies-read. Kibana GET /api/fleet/outputs/{outputId}.

Get the latest health status of an output by ID. [Required authorization] Route required privileges: fleet-settings-read. Kibana GET /api/fleet/outputs/{outputId}/health.

List all package policies. Kibana GET /api/fleet/package_policies.

Get a package policy by ID. Kibana GET /api/fleet/package_policies/{packagePolicyId}.

List all Fleet proxies. [Required authorization] Route required privileges: fleet-settings-read. Kibana GET /api/fleet/proxies.

Get a proxy by ID. [Required authorization] Route required privileges: fleet-settings-read. Kibana GET /api/fleet/proxies/{itemId}.

Get the synchronization status of remote integrations for a specific output by its ID. [Required authorization] Route required privileges: fleet-settings-read AND integrations-read. [Generally available; added in 9.1.0] Kibana GET /api/fleet/remote_synced_integrations/{outputId}/remote_status.

Get the synchronization status of all remote integrations across connected remote clusters. [Required authorization] Route required privileges: fleet-settings-read AND integrations-read. [Generally available; added in 9.1.0] Kibana GET /api/fleet/remote_synced_integrations/status.

Get the global Fleet settings. [Required authorization] Route required privileges: fleet-settings-read. Kibana GET /api/fleet/settings.

Get the Fleet settings for the current Kibana space. [Generally available; added in 9.1.0] Kibana GET /api/fleet/space_settings.

List the metadata for the latest uninstall tokens per agent policy. [Required authorization] Route required privileges: fleet-agents-all. Kibana GET /api/fleet/uninstall_tokens.

Get one decrypted uninstall token by its ID. [Required authorization] Route required privileges: fleet-agents-all. Kibana GET /api/fleet/uninstall_tokens/{uninstallTokenId}.

Get the details of a value list using the list ID. Kibana GET /api/lists.

Get a paginated subset of value lists. By default, the first page is returned, with 20 results per page. Kibana GET /api/lists/_find.

Verify that `.lists` and `.items` data streams exist. Kibana GET /api/lists/index.

Get the details of a value list item. Kibana GET /api/lists/items.

Get all value list items in the specified list. Kibana GET /api/lists/items/_find.

Returns the caller's authentication state and the Elasticsearch `cluster`, `index`, and `application` privileges for `.lists` and `.items` data streams in the current Kibana space. Use this to decide which list APIs (`read` vs `all` operations) are available before you create or import lists. Kibana GET /api/lists/privileges.

Get information for a centrally-managed Logstash pipeline. To use this API, you must have either the `logstash_admin` built-in role or a customized Logstash reader role. [Technical Preview] Kibana GET /api/logstash/pipeline/{id}.

Get a list of all centrally-managed Logstash pipelines. To use this API, you must have either the `logstash_admin` built-in role or a customized Logstash reader role. > info > Limit the number of pipelines to 10,000 or fewer. [Technical Preview] Kibana GET /api/logstash/pipelines.

[Required authorization] Route required privileges: read-maintenance-window. [Generally available; added in 9.1.0] Kibana GET /api/maintenance_window/{id}.

[Required authorization] Route required privileges: read-maintenance-window. [Generally available; added in 9.2.0] Kibana GET /api/maintenance_window/_find.

Synchronizes Kibana saved objects for machine learning jobs and trained models in the default space. You must have `all` privileges for the **Machine Learning** feature in the **Analytics** section of the Kibana feature privileges. This API runs automatically when you start Kibana and periodically thereafter. Kibana GET /api/ml/saved_objects/sync.

Returns Security Timeline notes as saved objects. **Query modes (mutually exclusive branches on the server):** 1. **`documentIds` is set** — Returns notes whose `eventId` matches the given Elasticsearch document `_id` (single string or array). Kibana GET /api/note.

Get a unified, time-sorted history of live, rule-triggered, and scheduled osquery executions. The response uses cursor-based pagination. [Generally available; Added in 9.4.0] Kibana GET /api/osquery/history.

Get a list of all live queries. Kibana GET /api/osquery/live_queries.

Get the details of a live query using the query ID. Kibana GET /api/osquery/live_queries/{id}.

Get the results of a live query using the query action ID. Kibana GET /api/osquery/live_queries/{id}/results/{actionId}.

Get a list of all query packs. Kibana GET /api/osquery/packs.

Get the details of a query pack using the pack ID. Kibana GET /api/osquery/packs/{id}.

Get a list of all saved queries. Kibana GET /api/osquery/saved_queries.

Get the details of a saved query using the query ID. Kibana GET /api/osquery/saved_queries/{id}.

Get paginated per-agent action results for a specific scheduled query execution, with success/failure aggregation and execution metadata (pack name, query name/text, timestamp). [Generally available; Added in 9.4.0] Kibana GET /api/osquery/scheduled_results/{scheduleId}/{executionCount}.

Get paginated query result rows (the actual osquery output data) for a specific scheduled query execution. [Generally available; Added in 9.4.0] Kibana GET /api/osquery/scheduled_results/{scheduleId}/{executionCount}/results.

Returns time-ordered historical risk score entries from the risk score time-series index for a given entity. [Added in 9.5.0] Kibana GET /api/risk_score/history.

WARNING: This API is deprecated. This is a legacy Saved Objects API and may be removed in a future version of Kibana. Retrieves a single Kibana saved object by type and ID. For transferring or backing up saved objects, prefer the export API (`POST /api/saved_objects/_export`). Kibana GET /api/saved_objects/{type}/{id}.

WARNING: This API is deprecated. This is a legacy Saved Objects API and may be removed in a future version of Kibana. Searches for Kibana saved objects. For transferring or backing up saved objects, prefer the export API (`POST /api/saved_objects/_export`). Kibana GET /api/saved_objects/_find.

WARNING: This API is deprecated. This is a legacy Saved Objects API and may be removed in a future version of Kibana. Retrieve a single Kibana saved object by ID, using any legacy URL alias if it exists. Kibana GET /api/saved_objects/resolve/{type}/{id}.

Get a list of all anonymization fields. Kibana GET /api/security_ai_assistant/anonymization_fields/_find.

Get the details of an existing conversation using the conversation ID. This allows users to fetch the specific conversation data by its unique ID. Kibana GET /api/security_ai_assistant/current_user/conversations/{id}.

Get a list of all conversations for the current user. This endpoint allows users to search, filter, sort, and paginate through their conversations. Kibana GET /api/security_ai_assistant/current_user/conversations/_find.

Read a single KB. Kibana GET /api/security_ai_assistant/knowledge_base.

Read a knowledge base with a specific resource identifier. Kibana GET /api/security_ai_assistant/knowledge_base/{resource}.

Retrieve a Knowledge Base Entry by its unique `id`. Kibana GET /api/security_ai_assistant/knowledge_base/entries/{id}.

Finds Knowledge Base Entries that match the given query. Kibana GET /api/security_ai_assistant/knowledge_base/entries/_find.

Get a list of all prompts based on optional filters, sorting, and pagination. Kibana GET /api/security_ai_assistant/prompts/_find.

List entity records from the Entity Store with paging, sorting, and filtering. Supports two modes: page-based pagination (page/per_page) and cursor-based pagination (searchAfter). The two modes cannot be combined. [Required authorization] Route required privileges: securitySolution. Kibana GET /api/security/entity_store/entities.

Get the resolution group for a given entity, returning all linked entities. [Required authorization] Route required privileges: securitySolution AND securitySolution-entity-analytics. [Generally available; added in 9.4.0] Kibana GET /api/security/entity_store/resolution/group.

List managed entity resolution rules and their effective enabled state for this space. [Required authorization] Route required privileges: securitySolution AND securitySolution-entity-analytics. [Generally available; added in 9.5.0] Kibana GET /api/security/entity_store/resolution/rules.

Get the overall Entity Store status and per-engine statuses, optionally including component-level health details. [Required authorization] Route required privileges: securitySolution. Kibana GET /api/security/entity_store/status.

Retrieve all Kibana roles. Kibana GET /api/security/role.

Retrieve a Kibana role by its name. Kibana GET /api/security/role/{name}.

Get a single Kibana short URL. [Technical Preview] Kibana GET /api/short_url/{id}.

Resolve a Kibana short URL by its slug. [Technical Preview] Kibana GET /api/short_url/_slug/{slug}.

Retrieve all available Kibana spaces. The list includes only the spaces that the user is authorized to access. Kibana GET /api/spaces/space.

Retrieve a single Kibana space by its identifier. Kibana GET /api/spaces/space/{id}.

Returns Kibana's overall operational status and a per-service breakdown for Elasticsearch, Saved Objects, and registered plugins. The endpoint is intended for liveness and readiness checks (for example, by Kubernetes probes) and for operators monitoring a Kibana deployment. Kibana GET /api/status.

Fetches list of all streams [Required authorization] Route required privileges: read_stream. [Experimental; added in 9.1.0] Kibana GET /api/streams.

Fetches a stream definition and associated dashboards [Required authorization] Route required privileges: read_stream. [Experimental; added in 9.1.0] Kibana GET /api/streams/{name}.

Fetches the ingest settings of an ingest stream definition [Required authorization] Route required privileges: read_stream. [Experimental; added in 9.1.0] Kibana GET /api/streams/{name}/_ingest.

Fetches all queries linked to a stream that are visible to the current user in the current space. [Required authorization] Route required privileges: read_stream. [Experimental; added in 9.1.0] Kibana GET /api/streams/{name}/queries.

Fetches the query settings of a query stream definition [Required authorization] Route required privileges: read_stream. [Experimental; added in 9.4.0] Kibana GET /api/streams/{name}/_query.

Read the significant events [Required authorization] Route required privileges: read_stream. [Experimental; added in 9.1.0] Kibana GET /api/streams/{name}/significant_events.

Fetches all attachments linked to a stream that are visible to the current user in the current space. Optionally filter by attachment types, search query, and tags. [Required authorization] Route required privileges: read_stream. [Experimental; added in 9.3.0] Kibana GET /api/streams/{streamName}/attachments.

Get a list of monitors. You must have `read` privileges for the Synthetics feature in the Observability section of the Kibana feature privileges. Kibana GET /api/synthetics/monitors.

Get a monitor. Kibana GET /api/synthetics/monitors/{id}.

Get a list of all parameters. You must have `read` privileges for the Synthetics feature in the Observability section of the Kibana feature privileges. Kibana GET /api/synthetics/params.

Get a parameter from the Synthetics app. You must have `read` privileges for the Synthetics feature in the Observability section of the Kibana feature privileges. Kibana GET /api/synthetics/params/{id}.

Get a list of private locations. You must have `read` privileges for the Synthetics and Uptime feature in the Observability section of the Kibana feature privileges. Kibana GET /api/synthetics/private_locations.

You must have `read` privileges for the Synthetics and Uptime feature in the Observability section of the Kibana feature privileges. Kibana GET /api/synthetics/private_locations/{id}.

Returns a paginated list of tags matching the optional `query` text. [Experimental; added in 9.5.0] Kibana GET /api/tags.

Returns a tag by ID. [Experimental; added in 9.5.0] Kibana GET /api/tags/{id}.

Get the health status of the Kibana task manager. Kibana GET /api/task_manager/_health.

Get the details of an existing saved Timeline or Timeline template. Kibana GET /api/timeline.

Get the details of the draft Timeline or Timeline template for the current user. If the user doesn't have a draft Timeline, an empty Timeline is returned. Kibana GET /api/timeline/_draft.

Resolve a Timeline or Timeline template, surfacing outcomes such as `exactMatch`, `aliasMatch`, or `conflict` when object IDs have been remapped during upgrades or imports. Provide **either** `id` for default Timelines or `template_timeline_id` for templates. Kibana GET /api/timeline/resolve.

Get a list of all saved Timelines or Timeline templates. Kibana GET /api/timelines.

Check the status of your cluster. [Technical Preview] Kibana GET /api/upgrade_assistant/status.

You must have `read` privileges for the uptime feature in the Observability section of the Kibana feature privileges. Kibana GET /api/uptime/settings.

> This documentation is temporarily hosted at a separate location. > > **[View the full Visualizations API reference →](https://elastic.github.io/dashboards-api-spec/visualizations#tag/Visualizations)**. Kibana GET /api/visualizations.

> This documentation is temporarily hosted at a separate location. > > **[View the full Visualizations API reference →](https://elastic.github.io/dashboards-api-spec/visualizations#tag/Visualizations)**. Kibana GET /api/visualizations/{id}.

Retrieve a paginated list of workflows with optional filtering. [Required authorization] Route required privileges: workflowsManagement:read OR workflowsManagement:managed:read OR workflowsManagement:readExecution OR workflowsManagement:managed:readExecution. [Generally available; added in 9.4.0] Kibana GET /api/workflows.

Retrieve distinct values and their counts for the specified workflow fields. Useful for building filters such as lists of tags or creators. [Required authorization] Route required privileges: workflowsManagement:read OR workflowsManagement:managed:read. [Generally available; added in 9.4.0] Kibana GET /api/workflows/aggs.

Retrieve the Kibana action connectors that can be used in workflow steps, grouped by connector type. Each type includes its configured instances and availability status. [Required authorization] Route required privileges: workflowsManagement:read. [Generally available; added in 9.4.0] Kibana GET /api/workflows/connectors.

Retrieve details of a single workflow execution by its ID. [Required authorization] Route required privileges: workflowsManagement:readExecution OR workflowsManagement:managed:readExecution. [Generally available; added in 9.4.0] Kibana GET /api/workflows/executions/{executionId}.

Retrieve child workflow executions spawned by sub-workflow steps within a parent execution. [Required authorization] Route required privileges: workflowsManagement:readExecution OR workflowsManagement:managed:readExecution. [Generally available; added in 9.4.0] Kibana GET /api/workflows/executions/{executionId}/children.

Retrieve paginated logs for a workflow execution. Optionally filter by a specific step execution. [Required authorization] Route required privileges: workflowsManagement:readExecution OR workflowsManagement:managed:readExecution. [Generally available; added in 9.4.0] Kibana GET /api/workflows/executions/{executionId}/logs.

Retrieve details of a single step execution within a workflow execution. [Required authorization] Route required privileges: workflowsManagement:readExecution OR workflowsManagement:managed:readExecution. [Generally available; added in 9.4.0] Kibana GET /api/workflows/executions/{executionId}/step/{stepExecutionId}.

Resume a paused `waitForApproval` step (pauses the workflow and waits for a human to approve/decline before execution continues) or `waitForInput` step (passes the expected input values as query parameters in the URL). Returns an HTML confirmation page. [Generally available; added in 9.4.0] Kibana GET /api/workflows/executions/{executionId}/steps/{stepId}/resume/external.

Returns an HTML form for submitting external input to a paused waitForInput step. Does not resume the execution. [Generally available; added in 9.4.0] Kibana GET /api/workflows/executions/{executionId}/steps/{stepId}/resume/external/form.

Retrieve the JSON schema used to validate workflow YAML definitions. The schema includes available step types based on the configured connectors in the current space. [Required authorization] Route required privileges: workflowsManagement:read. [Generally available; added in 9.4.0] Kibana GET /api/workflows/schema.

Retrieve summary statistics about workflows, including total, enabled, and disabled counts; execution history metrics for the last 30 days are included only when the caller has execution read privilege. [Generally available; added in 9.4.0] Kibana GET /api/workflows/stats.

Retrieve a single workflow by its ID. [Required authorization] Route required privileges: workflowsManagement:read OR workflowsManagement:managed:read. [Generally available; added in 9.4.0] Kibana GET /api/workflows/workflow/{id}.

Retrieve a paginated list of executions for a specific workflow. [Required authorization] Route required privileges: workflowsManagement:readExecution OR workflowsManagement:managed:readExecution. [Generally available; added in 9.4.0] Kibana GET /api/workflows/workflow/{workflowId}/executions.

Retrieve a paginated list of step-level execution records for a specific workflow. Optionally filter by step ID and include input or output data. [Required authorization] Route required privileges: workflowsManagement:readExecution OR workflowsManagement:managed:readExecution. [Generally available; added in 9.4.0] Kibana GET /api/workflows/workflow/{workflowId}/executions/steps.

You must have the `read` privileges for the **SLOs** feature in the **Observability** section of the Kibana feature privileges. Kibana GET /s/{spaceId}/api/observability/slos.

Retrieve the status of the bulk deletion operation for SLOs. This endpoint returns the status of the bulk deletion operation, including whether it is completed and the results of the operation. Kibana GET /s/{spaceId}/api/observability/slos/_bulk_delete/{taskId}.

You must have the `read` privileges for the **SLOs** feature in the **Observability** section of the Kibana feature privileges. Kibana GET /s/{spaceId}/api/observability/slos/{sloId}.

You must have the `read` privileges for the **SLOs** feature in the **Observability** section of the Kibana feature privileges. Kibana GET /s/{spaceId}/internal/observability/slos/_definitions.

Rename an attachment without creating a new version. [Required authorization] Route required privileges: agentBuilder:read. [Experimental; added in 9.2.0] Kibana PATCH /api/agent_builder/conversations/{conversation_id}/attachments/{attachment_id}.

You must have `all` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the case you're updating. Kibana PATCH /api/cases.

You must have `all` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the case you're updating. NOTE: You cannot change the comment type or the owner of a comment. Kibana PATCH /api/cases/{caseId}/comments.

Updates setting details such as the closure type, custom fields, templates, and the default connector for cases. Connectors are used to interface with external systems. You must create a connector before you can use it in your cases. Kibana PATCH /api/cases/configure/{configurationId}.

Update specific fields of an existing detection rule using the `rule_id` or `id` field. Kibana PATCH /api/detection_engine/rules.

Update specific fields of an existing list using the list `id`. Kibana PATCH /api/lists.

Update specific fields of an existing value list item using the item `id`. Kibana PATCH /api/lists/items.

[Required authorization] Route required privileges: write-maintenance-window. [Generally available; added in 9.1.0] Kibana PATCH /api/maintenance_window/{id}.

Creates a new note or updates an existing one. **Create:** Send `note` and omit `noteId` to create a new saved object. **Update:** Send `note` with the changed fields and set `noteId` to the note's saved object ID. Optionally include `version` for optimistic concurrency when the client has it from a prior read. Kibana PATCH /api/note.

Pin/unpin an event to/from an existing Timeline. Kibana PATCH /api/pinned_event.

Configuring the Risk Engine Saved Object. Kibana PATCH /api/risk_score/engine/saved_object/configure.

Update an existing Timeline. You can update the title, description, date range, pinned events, pinned queries, and/or pinned saved queries of an existing Timeline. Kibana PATCH /api/timeline.

Favorite a Timeline or Timeline template for the current user. Kibana PATCH /api/timeline/_favorite.

Create a connector. Kibana POST /api/actions/connector/{id}.

You can use this API to test an action that involves interaction with Kibana services or integrations with third-party systems. Kibana POST /api/actions/connector/{id}/_execute.

> warn > This endpoint is designed for A2A protocol clients and should not be used directly via REST APIs. Use an A2A SDK or A2A Inspector instead. [Experimental; added in 9.2.0] Kibana POST /api/agent_builder/a2a/{agentId}.

Create a new agent. Use this endpoint to define the agent's behavior, appearance, and capabilities through comprehensive configuration options. To learn more about agents, refer to the [agents documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/agent-builder-agents). [Added in 9.2.0] Kibana POST /api/agent_builder/agents.

Returns paginated, per-conversation token consumption data for a given agent. Includes input/output token counts, round counts, LLM call counts, and warnings for conversations with high token usage. Requires the manageAgents privilege. [Experimental; added in 9.4.0] Kibana POST /api/agent_builder/agents/{agent_id}/consumption.

Create a new attachment for a conversation with version tracking. [Required authorization] Route required privileges: agentBuilder:read. [Experimental; added in 9.2.0] Kibana POST /api/agent_builder/conversations/{conversation_id}/attachments.

Restore a soft-deleted attachment. [Required authorization] Route required privileges: agentBuilder:read. [Experimental; added in 9.2.0] Kibana POST /api/agent_builder/conversations/{conversation_id}/attachments/{attachment_id}/_restore.

Send a message to an agent and receive a complete response. This synchronous endpoint waits for the agent to fully process your request before returning the final result. Use this for simple chat interactions where you need the complete response. [Added in 9.2.0] Kibana POST /api/agent_builder/converse.

> warn > This endpoint is designed for MCP clients (Claude Desktop, Cursor, VS Code, etc.) and should not be used directly via REST APIs. Use MCP Inspector or native MCP clients instead. [Added in 9.2.0] Kibana POST /api/agent_builder/mcp.

Install a plugin from a [GitHub Claude plugin URL](https://code.claude.com/docs/en/plugins) or a direct ZIP URL. Plugins bundle agent capabilities such as skills. [Experimental; added in 9.4.0] Kibana POST /api/agent_builder/plugins/install.

Create a new user-defined skill. To learn more about Agent Builder skills, refer to the [skills documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/skills). [Required authorization] Route required privileges: agentBuilder:manageSkills. [Experimental; added in 9.4.0] Kibana POST /api/agent_builder/skills.

Create a new tool. Use this endpoint to define a custom tool with specific functionality and configuration for use by agents. To learn more about Agent Builder tools, refer to the [tools documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/tools). [Added in 9.2.0] Kibana POST /api/agent_builder/tools.

Run a tool with parameters. Use this endpoint to run a tool directly with specified inputs and optional external connector integration. To learn more about Agent Builder tools, refer to the [tools documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/tools). [Added in 9.2.0] Kibana POST /api/agent_builder/tools/_execute.

Create a rule. Kibana POST /api/alerting/rule/{id}.

Disable a rule. Kibana POST /api/alerting/rule/{id}/_disable.

Enable a rule. Kibana POST /api/alerting/rule/{id}/_enable.

Mute all alerts. Kibana POST /api/alerting/rule/{id}/_mute_all.

When you snooze a rule, the rule checks continue to run but alerts will not generate actions. You can snooze for a specified period of time and schedule single or recurring downtimes. [Generally available; added in 8.19.0] Kibana POST /api/alerting/rule/{id}/snooze_schedule.

Unmute all alerts. Kibana POST /api/alerting/rule/{id}/_unmute_all.

Update the API key for a rule. Kibana POST /api/alerting/rule/{id}/_update_api_key.

Mute an alert. Kibana POST /api/alerting/rule/{rule_id}/alert/{alert_id}/_mute.

Snooze an alert. [Generally available; added in 9.5.0] Kibana POST /api/alerting/rule/{rule_id}/alert/{alert_id}/_snooze.

Unmute an alert. Kibana POST /api/alerting/rule/{rule_id}/alert/{alert_id}/_unmute.

Unsnooze an alert. [Generally available; added in 9.5.0] Kibana POST /api/alerting/rule/{rule_id}/alert/{alert_id}/_unsnooze.

Find backfills for rules. Kibana POST /api/alerting/rules/backfill/_find.

Schedule a backfill for rules. Kibana POST /api/alerting/rules/backfill/_schedule.

Create a new agent key for APM. The user creating an APM agent API key must have at least the `manage_own_api_key` cluster privilege and the APM application-level privileges that it wishes to grant. Kibana POST /api/apm/agent_keys.

DEPRECATED: This endpoint is intended for internal use by Fleet integrations to push the APM Server configuration schema. Do not use for new integrations. It stores the provided schema object as a Kibana saved object. If Fleet migration is not available on the current deployment, the API returns a 404. Kibana POST /api/apm/fleet/apm_server_schema.

Create a new annotation for a specific service. Kibana POST /api/apm/services/{serviceName}/annotation.

DEPRECATED: This endpoint is intended for internal use by APM agents to fetch their configuration and mark it as applied. Do not use for new integrations. Kibana POST /api/apm/settings/agent-configuration/search.

**Deprecated in 9.4.0.** Use the Entity Store APIs to assign asset criticality to an entity. Create or update an asset criticality record for a specific entity. If a record already exists for the specified entity, that record is overwritten with the specified value. Kibana POST /api/asset_criticality.

**Deprecated in 9.4.0.** Use the Entity Store APIs to bulk assign asset criticality. Bulk upsert up to 1000 asset criticality records. If asset criticality records already exist for the specified entities, those records are overwritten with the specified values. Kibana POST /api/asset_criticality/bulk.

Performs bulk updates on multiple Attack discoveries, including workflow status changes and visibility settings. This endpoint allows efficient batch processing of alert modifications without requiring individual API calls for each alert. Kibana POST /api/attack_discovery/_bulk.

Initiates the generation of attack discoveries by analyzing security alerts using AI. Returns an execution UUID that can be used to track the generation progress and retrieve results. Results may also be retrieved via the find endpoint. Kibana POST /api/attack_discovery/_generate.

Dismisses an Attack Discovery generation for the current user, indicating that its status should not be reported in the UI. This sets the generation's status to "dismissed" and affects how the generation appears in subsequent queries. Kibana POST /api/attack_discovery/generations/{execution_uuid}/_dismiss.

Creates a new Attack Discovery schedule that analyzes security alerts at specified intervals. The schedule defines when and how Attack Discovery analysis should run, including which alerts to analyze, which AI connector to use, and what actions to take when discoveries are found. Kibana POST /api/attack_discovery/schedules.

Deletes multiple Attack Discovery schedules by ID. Kibana POST /api/attack_discovery/schedules/_bulk_delete.

Disables multiple Attack Discovery schedules by ID. Kibana POST /api/attack_discovery/schedules/_bulk_disable.

Enables multiple Attack Discovery schedules by ID. Kibana POST /api/attack_discovery/schedules/_bulk_enable.

Disables an Attack Discovery schedule, preventing it from running according to its configured interval. The schedule configuration is preserved and can be re-enabled later. Any currently running executions will complete, but no new executions will be started. Kibana POST /api/attack_discovery/schedules/{id}/_disable.

Enables a previously disabled Attack Discovery schedule, allowing it to run according to its configured interval. Once enabled, the schedule will begin executing at the next scheduled time based on its interval configuration. Kibana POST /api/attack_discovery/schedules/{id}/_enable.

You must have `all` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the case you're creating. Kibana POST /api/cases.

You must have `all` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the case you're creating. NOTE: Each case can have a maximum of 1,000 alerts. Kibana POST /api/cases/{caseId}/comments.

You must have `all` privileges for the **Actions and Connectors** feature in the **Management** section of the Kibana feature privileges. Kibana POST /api/cases/{caseId}/connector/{connectorId}/_push.

Case settings include external connection details, custom fields, and templates. Connectors are used to interface with external systems. You must create a connector before you can use it in your cases. If you set a default connector, it is automatically selected when you create cases in Kibana. Kibana POST /api/cases/configure.

Creates a case template from a YAML definition. You must have the "Manage templates" sub-privilege for the Cases feature of the owning solution. Set `dry_run=true` to run the full validation (body, YAML definition, name uniqueness, authorization) without creating anything. [Technical preview] Kibana POST /api/cases/templates.

> This documentation is temporarily hosted at a separate location. > > **[View the full Dashboards API reference →](https://elastic.github.io/dashboards-api-spec/dashboards#tag/Dashboards)**. Kibana POST /api/dashboards.

Create a data view. Data views identify the Elasticsearch data you want to explore and visualize. They can point to one or more data streams, indices, or index aliases, and use optional runtime fields to compute values at query time. Note that data views are not required for ES|QL-based visualizations. Kibana POST /api/data_views/data_view.

Update an existing data view. Only the fields provided in the request body are updated. Kibana POST /api/data_views/data_view/{viewId}.

Update field metadata for a data view. Use this endpoint to set custom labels, custom descriptions, and format overrides for individual fields. Kibana POST /api/data_views/data_view/{viewId}/fields.

Create a runtime field for a data view. Runtime fields are computed at query time using a [Painless script](https://www.elastic.co/docs/explore-analyze/scripting/modules-scripting-painless) and do not require reindexing. Kibana POST /api/data_views/data_view/{viewId}/runtime_field.

Update an existing runtime field in a data view. Only the fields provided in the request body are updated. Kibana POST /api/data_views/data_view/{viewId}/runtime_field/{fieldName}.

Set the default data view for the current Kibana space. The default data view is used as a fallback when no specific data view is selected. Kibana POST /api/data_views/default.

Swap saved object references from one data view to another. Use this endpoint to update dashboards, visualizations, and other saved objects that reference a data view. Kibana POST /api/data_views/swap_references.

Preview the effect of swapping saved object references from one data view to another. Returns the list of affected saved objects without making any changes. Kibana POST /api/data_views/swap_references/_preview.

Assign users to attack discovery alerts, and unassign them from alerts. Optionally cascade the change to related detection alerts via `kibana.alert.attack_discovery.alert_ids`. > info > You cannot add and remove the same assignee in the same request. [added in 9.5.0] Kibana POST /api/detection_engine/attacks/assignees.

Find and/or aggregate attack discovery alerts that match the given query. Searches scheduled and ad hoc attack discovery alert indices for the active space only. [added in 9.5.0] Kibana POST /api/detection_engine/attacks/search.

Set the workflow status of one or more attack discovery alerts by IDs, optionally cascading the status to their related detection alerts. [added in 9.5.0] Kibana POST /api/detection_engine/attacks/status.

Add tags to attack discovery alerts, and remove them from alerts, by attack IDs in a single request. Optionally cascade tag changes to related detection alerts. [added in 9.5.0] Kibana POST /api/detection_engine/attacks/tags.

Creates an index for Elastic Security alerts. Calling this API is not required for the detection engine to function properly. You can create rules and alerts without calling this API. Kibana POST /api/detection_engine/index.

Create a new detection rule. > warn > When used with [API key](https://www.elastic.co/docs/deploy-manage/api-keys) authentication, the user's key gets assigned to the affected rules. If the user's key gets deleted or the user becomes inactive, the rules will stop running. Kibana POST /api/detection_engine/rules.

Apply a bulk action, such as bulk edit, duplicate, or delete, to multiple detection rules. The bulk action is applied to all rules that match the query or to the rules listed by their IDs. Kibana POST /api/detection_engine/rules/_bulk_action.

Create exception items that apply to a single detection rule. Kibana POST /api/detection_engine/rules/{id}/exceptions.

Simulates a detection rule using the same rule type and query logic as a persisted rule, over a short time window, without persisting a rule or writing alerts. Use the response to validate queries, see sample matching documents, and inspect execution logs. Pair `invocationCount` and `timeframeEnd` to cap run time. Kibana POST /api/detection_engine/rules/preview.

Assign users to detection alerts, and unassign them from alerts. > info > You cannot add and remove the same assignee in the same request. Kibana POST /api/detection_engine/signals/assignees.

**DEPRECATED.** Completes a legacy alert index migration. Do not automate against this in new code. **WARNING:** Finalizing swaps read aliases; confirm the migration has finished successfully before calling. Finalize successful migrations of detection alerts. Kibana POST /api/detection_engine/signals/finalize_migration.

**DEPRECATED.** Legacy API for on-demand reindexing of old `.siem-signals-*` alert indices. Do not build new integrations; upgrade the Elastic Stack and rely on product-managed data lifecycle instead. **WARNING:** Migrations can be resource intensive and should be planned during a maintenance window. Kibana POST /api/detection_engine/signals/migration.

Find and/or aggregate detection alerts that match the given query. Kibana POST /api/detection_engine/signals/search.

Set the status of one or more detection alerts. Kibana POST /api/detection_engine/signals/status.

Add tags to detection alerts, and remove them from alerts, by alert IDs or a query, in a single request. > info > You cannot add and remove the same alert tag in the same request. Kibana POST /api/detection_engine/signals/tags.

Superuser role required. If a saved object cannot be decrypted using the primary encryption key, then Kibana will attempt to decrypt it using the specified decryption-only keys. Kibana POST /api/encrypted_saved_objects/_rotate_key.

Cancel a running or pending response action (Applies only to some agent types). Kibana POST /api/endpoint/action/cancel.

Run a shell command on an endpoint. Kibana POST /api/endpoint/action/execute.

Get a file from an endpoint. Kibana POST /api/endpoint/action/get_file.

Isolate an endpoint from the network. The endpoint remains isolated until it's released. Kibana POST /api/endpoint/action/isolate.

Terminate a running process on an endpoint. Kibana POST /api/endpoint/action/kill_process.

Generates memory dumps on the targeted host. Kibana POST /api/endpoint/action/memory_dump.

Run a script on a host. Currently supported only for some agent types. Kibana POST /api/endpoint/action/run_script.

Get a list of all processes running on an endpoint. Kibana POST /api/endpoint/action/running_procs.

Scan a specific file or directory on an endpoint for malware. Kibana POST /api/endpoint/action/scan.

Suspend a running process on an endpoint. Kibana POST /api/endpoint/action/suspend_process.

Release an isolated endpoint, allowing it to rejoin a network. Kibana POST /api/endpoint/action/unisolate.

Create the exception list for Elastic Endpoint rule exceptions. When you create the exception list, it will have a `list_id` of `endpoint_list`. If the Elastic Endpoint exception list already exists, your request will return an empty response. Kibana POST /api/endpoint_list.

Create an Elastic Endpoint exception list item, and associate it with the Elastic Endpoint exception list. Kibana POST /api/endpoint_list/items.

Create or update the protection updates note for a package policy. Kibana POST /api/endpoint/protection_updates_note/{package_policy_id}.

**Deprecated in 9.4.0.** Disables the Privilege Monitoring Engine, stopping all monitoring activity without removing data. Kibana POST /api/entity_analytics/monitoring/engine/disable.

**Deprecated in 9.4.0.** Initializes the Privilege Monitoring Engine, setting up the required resources and starting the engine. Kibana POST /api/entity_analytics/monitoring/engine/init.

**Deprecated in 9.4.0.** Schedules the Privilege Monitoring Engine to run as soon as possible, triggering an immediate monitoring cycle. Kibana POST /api/entity_analytics/monitoring/engine/schedule_now.

**Deprecated in 9.4.0.** Use the Watchlists API instead. Creates a new privileged user to be monitored by the Privilege Monitoring Engine. Kibana POST /api/entity_analytics/monitoring/users.

Installs the privileged access detection integration package and sets up the associated ML modules required for the Entity Analytics privileged user monitoring experience. Kibana POST /api/entity_analytics/privileged_user_monitoring/pad/install.

Creates a new entity analytics watchlist with an optional set of entity sources. Watchlists apply a risk score modifier to matched entities. [Technical Preview] Kibana POST /api/entity_analytics/watchlists.

Assigns the provided entities to the specified watchlist using a "manual" source label. The entities must already exist in the entity store. If an entity is already on the watchlist, no new document is created — the "manual" label is added to its existing source labels instead. [Technical Preview; added in 9.4.0] Kibana POST /api/entity_analytics/watchlists/{watchlist_id}/entities/assign.

Unassigns the provided entities from the specified watchlist. This only removes the "manual" assignment. If the entity is also assigned via other sources (for example, index or integration), it will remain on the watchlist. [Technical Preview; added in 9.4.0] Kibana POST /api/entity_analytics/watchlists/{watchlist_id}/entities/unassign.

An exception list groups exception items and can be associated with detection rules. You can assign exception lists to multiple detection rules. > info > All exception items added to the same list are evaluated using `OR` logic. Kibana POST /api/exception_lists.

Duplicate an existing exception list. Kibana POST /api/exception_lists/_duplicate.

Create an exception item and associate it with the specified exception list. > info > Before creating exception items, you must create an exception list. Kibana POST /api/exception_lists/items.

An exception list groups exception items and can be associated with detection rules. A shared exception list can apply to multiple detection rules. > info > All exception items added to the same list are evaluated using `OR` logic. Kibana POST /api/exceptions/shared.

Create a new agent binary download source. [Required authorization] Route required privileges: fleet-settings-all. Kibana POST /api/fleet/agent_download_sources.

Create a new agent policy. [Required authorization] Route required privileges: fleet-agent-policies-all. Kibana POST /api/fleet/agent_policies.

Get multiple agent policies by ID. [Required authorization] Route required privileges: fleet-agent-policies-read OR fleet-agents-read OR fleet-setup. Kibana POST /api/fleet/agent_policies/_bulk_get.

Copy an agent policy by ID. [Required authorization] Route required privileges: fleet-agent-policies-all. Kibana POST /api/fleet/agent_policies/{agentPolicyId}/copy.

Delete an agent policy by ID. [Required authorization] Route required privileges: fleet-agent-policies-all. Kibana POST /api/fleet/agent_policies/delete.

Get a list of outputs associated with agent policies. [Required authorization] Route required privileges: fleet-agent-policies-read AND fleet-settings-read. Kibana POST /api/fleet/agent_policies/outputs.

Deprecated. Use `POST /api/fleet/managed_integrations` instead. Create a managed integration. [Experimental; added in 9.3.0] Kibana POST /api/fleet/agentless_policies.

Deprecated. Use `POST /api/fleet/managed_integrations/_upgrade` instead. Upgrade multiple managed integrations to their installed package version, migrating each package policy's config onto the new schema. [Experimental; added in 9.5.0] Kibana POST /api/fleet/agentless_policies/_upgrade.

Deprecated. Use `POST /api/fleet/managed_integrations/_upgrade/dryrun` instead. Preview upgrading multiple managed integrations without applying any change. Targets the installed package version by default; pass `pkgVersion` to preview a specific (for example, not-yet-installed) version. [Experimental; added in 9.5.0] Kibana POST /api/fleet/agentless_policies/_upgrade/dryrun.

Retrieve agents associated with specific action IDs. [Required authorization] Route required privileges: fleet-agents-read. Kibana POST /api/fleet/agents.

Cancel a pending action for a specific agent. [Required authorization] Route required privileges: fleet-agents-all. Kibana POST /api/fleet/agents/actions/{actionId}/cancel.

Bulk migrate agents to another cluster. [Required authorization] Route required privileges: fleet-agents-all. Kibana POST /api/fleet/agents/bulk_migrate.

Change multiple agents' privilege level to unprivileged. [Required authorization] Route required privileges: fleet-agents-all. [Experimental; added in 9.3.0] Kibana POST /api/fleet/agents/bulk_privilege_level_change.

Reassign multiple agents to a different agent policy. [Required authorization] Route required privileges: fleet-agents-all. Kibana POST /api/fleet/agents/bulk_reassign.

Remove multiple OpAMP collectors from the Fleet agents list. Marks the collectors as unenrolled. This action does not invalidate API keys, so collectors can reconnect on their own. [Required authorization] Route required privileges: fleet-agents-all. [Experimental; added in 9.5.0] Kibana POST /api/fleet/agents/bulk_remove_collectors.

Request diagnostics bundles from multiple agents. [Required authorization] Route required privileges: fleet-agents-read. Kibana POST /api/fleet/agents/bulk_request_diagnostics.

Rollback multiple agents to the previous version. [Required authorization] Route required privileges: fleet-agents-all. [Experimental; added in 9.4.0] Kibana POST /api/fleet/agents/bulk_rollback.

Unenroll multiple agents, optionally revoking their enrollment API keys. [Required authorization] Route required privileges: fleet-agents-all. Kibana POST /api/fleet/agents/bulk_unenroll.

Add or remove tags across multiple agents. [Required authorization] Route required privileges: fleet-agents-all. Kibana POST /api/fleet/agents/bulk_update_agent_tags.

Upgrade multiple agents to a newer version, with optional rollout controls. [Required authorization] Route required privileges: fleet-agents-all. Kibana POST /api/fleet/agents/bulk_upgrade.

Create a new action for a specific agent. [Required authorization] Route required privileges: fleet-agents-all. Kibana POST /api/fleet/agents/{agentId}/actions.

Migrate a single agent to another cluster. [Required authorization] Route required privileges: fleet-agents-all. Kibana POST /api/fleet/agents/{agentId}/migrate.

Change the privilege level of a single agent to unprivileged. [Required authorization] Route required privileges: fleet-agents-all. [Experimental; added in 9.3.0] Kibana POST /api/fleet/agents/{agentId}/privilege_level_change.

Reassign an agent to a different agent policy. [Required authorization] Route required privileges: fleet-agents-all. Kibana POST /api/fleet/agents/{agentId}/reassign.

Remove a specific OpAMP collector from the Fleet agents list. Marks the collector as unenrolled. This action does not invalidate API keys, so the collector can reconnect on its own. [Required authorization] Route required privileges: fleet-agents-all. [Experimental; added in 9.5.0] Kibana POST /api/fleet/agents/{agentId}/remove_collector.

Request a diagnostics bundle from a specific agent. [Required authorization] Route required privileges: fleet-agents-read. Kibana POST /api/fleet/agents/{agentId}/request_diagnostics.

Rollback an agent to the previous version. [Required authorization] Route required privileges: fleet-agents-all. [Experimental; added in 9.4.0] Kibana POST /api/fleet/agents/{agentId}/rollback.

Unenroll a specific agent, optionally revoking its enrollment API key. [Required authorization] Route required privileges: fleet-agents-all. Kibana POST /api/fleet/agents/{agentId}/unenroll.

Upgrade a specific agent to a newer version. [Required authorization] Route required privileges: fleet-agents-all. Kibana POST /api/fleet/agents/{agentId}/upgrade.

Initialize Fleet. This endpoint is used by Elastic Agents to trigger Fleet setup. Safe to call multiple times; subsequent calls are idempotent. [Required authorization] Route required privileges: fleet-agents-read OR fleet-agent-policies-read OR fleet-settings-read OR fleet-setup. Kibana POST /api/fleet/agents/setup.

Create a new Fleet cloud connector. [Required authorization] Route required privileges: fleet-agent-policies-all OR integrations-all. [Experimental; added in 9.2.0] Kibana POST /api/fleet/cloud_connectors.

Create an enrollment API key for a given agent policy. [Required authorization] Route required privileges: fleet-agents-all. Kibana POST /api/fleet/enrollment_api_keys.

Revoke or delete multiple enrollment API keys. [Required authorization] Route required privileges: fleet-agents-all. [Generally available; added in 9.5.0] Kibana POST /api/fleet/enrollment_api_keys/_bulk_delete.

Retrieve multiple Kibana saved object assets by their IDs and types. [Required authorization] Route required privileges: integrations-read OR fleet-setup OR fleet-all. Kibana POST /api/fleet/epm/bulk_assets.

Create a new custom integration package with user-defined data streams. [Required authorization] Route required privileges: integrations-all AND fleet-agent-policies-all. Kibana POST /api/fleet/epm/custom_integrations.

Install multiple packages from the Elastic Package Registry in a single request. [Required authorization] Route required privileges: integrations-all AND fleet-agent-policies-all. Kibana POST /api/fleet/epm/packages/_bulk.

Enable or disable namespace-level index template customization for a list of packages in one call. Use this for IaC-style declarative flows. [Required authorization] Route required privileges: integrations-all AND fleet-agent-policies-all. Kibana POST /api/fleet/epm/packages/_bulk_namespace_customization.

Rollback multiple packages to their previous versions. [Required authorization] Route required privileges: integrations-all AND fleet-agent-policies-all. Kibana POST /api/fleet/epm/packages/_bulk_rollback.

Uninstall multiple packages in a single operation. [Required authorization] Route required privileges: integrations-all AND fleet-agent-policies-all. Kibana POST /api/fleet/epm/packages/_bulk_uninstall.

Upgrade multiple packages to their latest versions. [Required authorization] Route required privileges: integrations-all AND fleet-agent-policies-all. Kibana POST /api/fleet/epm/packages/_bulk_upgrade.

Install the latest version of a package from the Elastic Package Registry. [Required authorization] Route required privileges: integrations-all AND fleet-agent-policies-all. Kibana POST /api/fleet/epm/packages/{pkgName}.

Install a specific version of a package from the Elastic Package Registry. [Required authorization] Route required privileges: integrations-all AND fleet-agent-policies-all. Kibana POST /api/fleet/epm/packages/{pkgName}/{pkgVersion}.

Install Kibana assets (dashboards, visualizations, etc.) for a specific package version. [Required authorization] Route required privileges: integrations-all AND fleet-agent-policies-all. Kibana POST /api/fleet/epm/packages/{pkgName}/{pkgVersion}/kibana_assets.

Install Kibana alert rule assets for a specific package version. [Required authorization] Route required privileges: integrations-all AND fleet-agent-policies-all. Kibana POST /api/fleet/epm/packages/{pkgName}/{pkgVersion}/rule_assets.

Reauthorize Elasticsearch transforms installed by a package with secondary authorization headers. Kibana POST /api/fleet/epm/packages/{pkgName}/{pkgVersion}/transforms/authorize.

Review and accept or reject a pending policy upgrade for a package that contains deprecations. [Required authorization] Route required privileges: integrations-all AND fleet-agent-policies-all. [Generally available; added in 9.4.0] Kibana POST /api/fleet/epm/packages/{pkgName}/review_upgrade.

Rollback a package to its previously installed version. [Required authorization] Route required privileges: integrations-all AND fleet-agent-policies-all. [Experimental; added in 9.1.0] Kibana POST /api/fleet/epm/packages/{pkgName}/rollback.

Create a new Fleet Server host. [Required authorization] Route required privileges: fleet-settings-all. Kibana POST /api/fleet/fleet_server_hosts.

Check the health status of a Fleet Server instance by its host ID. Returns the server status and name if available. [Required authorization] Route required privileges: fleet-settings-all. Kibana POST /api/fleet/health_check.

Generate an API key for Logstash to use with a Fleet output. [Required authorization] Route required privileges: fleet-settings-all. Kibana POST /api/fleet/logstash_api_keys.

Create a managed integration. [Experimental; added in 9.3.0] Kibana POST /api/fleet/managed_integrations.

Upgrade multiple managed integrations to their installed package version, migrating each package policy's config onto the new schema. [Experimental; added in 9.5.0] Kibana POST /api/fleet/managed_integrations/_upgrade.

Preview upgrading multiple managed integrations without applying any change. Targets the installed package version by default; pass `pkgVersion` to preview a specific (for example, not-yet-installed) version. [Experimental; added in 9.5.0] Kibana POST /api/fleet/managed_integrations/_upgrade/dryrun.

Rotate the key pair used by Fleet to sign messages sent to Elastic Agents. This operation is irreversible and requires all agents in the Fleet to be re-enrolled after rotation. You must explicitly acknowledge the risk by passing `acknowledge=true` as a query parameter. Kibana POST /api/fleet/message_signing_service/rotate_key_pair.

Create a new Fleet output. [Required authorization] Route required privileges: fleet-settings-all. Kibana POST /api/fleet/outputs.

Create a new package policy and assign it to an agent policy. Kibana POST /api/fleet/package_policies.

Get multiple package policies by ID. Kibana POST /api/fleet/package_policies/_bulk_get.

Delete multiple package policies by ID. [Required authorization] Route required privileges: fleet-agent-policies-all AND integrations-all. Kibana POST /api/fleet/package_policies/delete.

Upgrade a package policy to a newer package version. [Required authorization] Route required privileges: fleet-agent-policies-all AND integrations-all. Kibana POST /api/fleet/package_policies/upgrade.

Preview the changes that would be applied by upgrading a package policy to a newer package version. [Required authorization] Route required privileges: fleet-agent-policies-read AND integrations-read. Kibana POST /api/fleet/package_policies/upgrade/dryrun.

Create a new Fleet proxy. [Required authorization] Route required privileges: fleet-settings-all. Kibana POST /api/fleet/proxies.

Create a Fleet Server service token. The token is used to enroll Fleet Server instances with Kibana. [Required authorization] Route required privileges: fleet-agents-all. Kibana POST /api/fleet/service_tokens.

Initialize Fleet and create the necessary Elasticsearch resources for Fleet to operate. Safe to call multiple times (idempotent). Returns the initialization status and any non-fatal errors encountered during setup. Kibana POST /api/fleet/setup.

Create a new value list. Kibana POST /api/lists.

**DEPRECATED.** `deprecated: true` is set on this operation. Value list backing data streams for the space are now created as part of supported workflows; calling this explicitly is rarely required. **WARNING:** Do not use for new integrations. Kibana POST /api/lists/index.

Create a value list item and associate it with the specified value list. All value list items in the same list must be the same type. For example, each list item in an `ip` list must define a specific IP address. > info > Before creating a list item, you must create a list. Kibana POST /api/lists/items.

[Required authorization] Route required privileges: write-maintenance-window. [Generally available; added in 9.1.0] Kibana POST /api/maintenance_window.

[Required authorization] Route required privileges: write-maintenance-window. [Generally available; added in 9.1.0] Kibana POST /api/maintenance_window/{id}/_archive.

[Required authorization] Route required privileges: write-maintenance-window. [Generally available; added in 9.1.0] Kibana POST /api/maintenance_window/{id}/_unarchive.

Update a list of jobs to add and/or remove them from given spaces. Kibana POST /api/ml/saved_objects/update_jobs_spaces.

Update a list of trained models to add and/or remove them from given spaces. Kibana POST /api/ml/saved_objects/update_trained_models_spaces.

Create a new chat completion by using the Observability AI Assistant. The API returns the model's response based on the current conversation context. It also handles any tool requests within the conversation, which may trigger multiple calls to the underlying large language model (LLM). [Technical Preview] Kibana POST /api/observability_ai_assistant/chat/complete.

Create and run a live query. Kibana POST /api/osquery/live_queries.

Export the results of a live query action as a downloadable file. The response is a streaming file attachment in the requested format. [Generally available; Added in 9.5.0] Kibana POST /api/osquery/live_queries/{id}/results/{actionId}/_export.

Create a query pack. Kibana POST /api/osquery/packs.

Create a copy of a query pack with a unique name by appending a `_copy` suffix. If the name already exists, a numeric suffix is added (e.g., `_copy_2`). The copied pack is always created with `enabled` set to `false`. [Generally available; Added in 9.4.0] Kibana POST /api/osquery/packs/{id}/copy.

Create and save a query for later use. Kibana POST /api/osquery/saved_queries.

Create a copy of a saved query with a unique name by appending a `_copy` suffix. If the name already exists, a numeric suffix is added (e.g., `_copy_2`). [Generally available; Added in 9.4.0] Kibana POST /api/osquery/saved_queries/{id}/copy.

Export all result rows for a specific scheduled query execution as a downloadable file. The response is a streaming file attachment in the requested format. [Generally available; Added in 9.5.0] Kibana POST /api/osquery/scheduled_results/{scheduleId}/{executionCount}/_export.

Schedule the risk scoring engine to run as soon as possible. You can use this to recalculate entity risk scores after updating their asset criticality. Kibana POST /api/risk_score/engine/schedule_now.

WARNING: This API is deprecated. This is a legacy Saved Objects API and may be removed in a future version of Kibana. Creates multiple Kibana saved objects in a single request. Kibana POST /api/saved_objects/_bulk_create.

WARNING: This API is deprecated. This is a legacy Saved Objects API and may be removed in a future version of Kibana. Deletes multiple Kibana saved objects in a single request. There is currently no complete replacement for deleting arbitrary saved objects via an HTTP API. Kibana POST /api/saved_objects/_bulk_delete.

WARNING: This API is deprecated. This is a legacy Saved Objects API and may be removed in a future version of Kibana. Retrieves multiple Kibana saved objects by type and ID in a single request. For transferring or backing up saved objects, prefer the export API (`POST /api/saved_objects/_export`). Kibana POST /api/saved_objects/_bulk_get.

WARNING: This API is deprecated. This is a legacy Saved Objects API and may be removed in a future version of Kibana. Retrieve multiple Kibana saved objects by ID, using any legacy URL aliases if they exist. Kibana POST /api/saved_objects/_bulk_resolve.

WARNING: This API is deprecated. This is a legacy Saved Objects API and may be removed in a future version of Kibana. Creates a Kibana saved object; if an ID is provided it is used, otherwise Kibana generates one. Kibana POST /api/saved_objects/{type}.

WARNING: This API is deprecated. This is a legacy Saved Objects API and may be removed in a future version of Kibana. Creates a Kibana saved object; if an ID is provided it is used, otherwise Kibana generates one. Kibana POST /api/saved_objects/{type}/{id}.

Apply a bulk action to multiple anonymization fields. The bulk action is applied to all anonymization fields that match the filter or to the list of anonymization fields by their IDs. Kibana POST /api/security_ai_assistant/anonymization_fields/_bulk_action.

Create a new Security AI Assistant conversation. This endpoint allows the user to initiate a conversation with the Security AI Assistant by providing the required parameters. Kibana POST /api/security_ai_assistant/current_user/conversations.

Create a knowledge base. Use this endpoint when no specific resource identifier is needed. Kibana POST /api/security_ai_assistant/knowledge_base.

Create a knowledge base with a specific resource identifier. Kibana POST /api/security_ai_assistant/knowledge_base/{resource}.

Create a Knowledge Base Entry. Kibana POST /api/security_ai_assistant/knowledge_base/entries.

The bulk action is applied to all Knowledge Base Entries that match the filter or to the list of Knowledge Base Entries by their IDs. Kibana POST /api/security_ai_assistant/knowledge_base/entries/_bulk_action.

Apply a bulk action to multiple prompts. The bulk action is applied to all prompts that match the filter or to the list of prompts by their IDs. This action allows for bulk create, update, or delete operations. Kibana POST /api/security_ai_assistant/prompts/_bulk_action.

Create a new entity record in the Entity Store for the specified entity type. [Required authorization] Route required privileges: securitySolution. Kibana POST /api/security/entity_store/entities/{entityType}.

Install the Entity Store and create engines for the specified entity types. A single `logExtraction` configuration is shared across all entity types. Supply it once at install to customize settings; omit it (or send an empty object) to use defaults on first install or preserve the existing configuration on re-install. Kibana POST /api/security/entity_store/install.

Link one or more entities to a target entity, creating a resolution group. Changes become visible on subsequent reads after the next index refresh (typically <1s). [Required authorization] Route required privileges: securitySolution AND securitySolution-entity-analytics. [Generally available; added in 9.4.0] Kibana POST /api/security/entity_store/resolution/link.

Remove one or more entities from their resolution group. Changes become visible on subsequent reads after the next index refresh (typically <1s). [Required authorization] Route required privileges: securitySolution AND securitySolution-entity-analytics. [Generally available; added in 9.4.0] Kibana POST /api/security/entity_store/resolution/unlink.

Uninstall the Entity Store, removing engines and associated resources for the specified entity types. [Required authorization] Route required privileges: securitySolution. Kibana POST /api/security/entity_store/uninstall.

Query Kibana roles with optional filters, paging, and sorting. Kibana POST /api/security/role/_query.

Create or update multiple Kibana roles in a single request. Kibana POST /api/security/roles.

Invalidate user sessions that match a query. To use this API, you must be a superuser. Kibana POST /api/security/session/_invalidate.

Run one or more Security Solution initialization flows for the current space. Each flow provisions a specific set of assets, for example list indices, security data views, prebuilt detection rules, endpoint protection, AI prompts, or detection rule monitoring assets. Kibana POST /api/security_solution/initialize.

Kibana URLs may be long and cumbersome, short URLs are much easier to remember and share. Short URLs are created by specifying the locator ID and locator parameters. When a short URL is resolved, the locator ID and locator parameters are used to redirect user to the right Kibana page. [Technical Preview] Kibana POST /api/short_url.

It also allows you to automatically copy related objects, so when you copy a dashboard, this can automatically copy over the associated visualizations, data views, and saved Discover sessions, as required. Kibana POST /api/spaces/_copy_saved_objects.

Disable one or more legacy URL aliases so that they no longer resolve to their target saved objects. Kibana POST /api/spaces/_disable_legacy_url_aliases.

Collect references and space contexts for saved objects. Kibana POST /api/spaces/_get_shareable_references.

Overwrite saved objects that are returned as errors from the copy saved objects to space API. [Required authorization] Route required privileges: copySavedObjectsToSpaces. Kibana POST /api/spaces/_resolve_copy_saved_objects_errors.

Create a new Kibana space. Kibana POST /api/spaces/space.

Update one or more saved objects to add or remove them from some spaces. Kibana POST /api/spaces/_update_objects_spaces.

Exports a content pack with the stream structure (routing, mappings, and processing). Significant-event queries are not included; manage them via the /api/streams/{name}/queries endpoints. [Required authorization] Route required privileges: manage_stream. [Experimental; added in 9.1.0] Kibana POST /api/streams/{name}/content/export.

Forks a wired stream and creates a child stream [Required authorization] Route required privileges: manage_stream. [Experimental; added in 9.1.0] Kibana POST /api/streams/{name}/_fork.

Bulk update queries of a stream. Can add new queries and delete existing ones. [Required authorization] Route required privileges: manage_stream. [Experimental; added in 9.1.0] Kibana POST /api/streams/{name}/queries/_bulk.

Bulk update attachments linked to a stream. Can link new attachments and delete existing ones. Supports mixed attachment types in a single request. [Required authorization] Route required privileges: manage_stream. [Experimental; added in 9.3.0] Kibana POST /api/streams/{streamName}/attachments/_bulk.

Disables wired streams and deletes all existing stream definitions. The data of wired streams is deleted, but the data of classic streams is preserved. [Required authorization] Route required privileges: manage_stream. [Experimental; added in 9.1.0] Kibana POST /api/streams/_disable.

Enables wired streams [Required authorization] Route required privileges: manage_stream. [Experimental; added in 9.1.0] Kibana POST /api/streams/_enable.

Resyncs all streams, making sure that Elasticsearch assets are up to date [Required authorization] Route required privileges: manage_stream. [Experimental; added in 9.1.0] Kibana POST /api/streams/_resync.

Trigger an immediate test execution for the specified monitor. The response includes the generated `testRunId`. If the test encounters issues in one or more service locations, an `errors` array is also returned with details about the failures. [Generally available; added in 9.2.0] Kibana POST /api/synthetics/monitor/test/{monitorId}.

Create a new monitor with the specified attributes. A monitor can be one of the following types: HTTP, TCP, ICMP, or Browser. The required and default fields may vary based on the monitor type. You must have `all` privileges for the Synthetics feature in the Observability section of the Kibana feature privileges. Kibana POST /api/synthetics/monitors.

Delete multiple monitors by sending a list of config IDs. Kibana POST /api/synthetics/monitors/_bulk_delete.

Add one or more parameters to the Synthetics app. You must have `all` privileges for the Synthetics feature in the Observability section of the Kibana feature privileges. Kibana POST /api/synthetics/params.

Delete parameters from the Synthetics app. You must have `all` privileges for the Synthetics feature in the Observability section of the Kibana feature privileges. Kibana POST /api/synthetics/params/_bulk_delete.

You must have `all` privileges for the Synthetics and Uptime feature in the Observability section of the Kibana feature privileges. Kibana POST /api/synthetics/private_locations.

Creates a new tag and returns it. [Experimental; added in 9.5.0] Kibana POST /api/tags.

Create a new Timeline or Timeline template. Kibana POST /api/timeline.

Copies and returns a timeline or timeline template. Kibana POST /api/timeline/_copy.

Create a clean draft Timeline or Timeline template for the current user. > info > If the user already has a draft Timeline, the existing draft Timeline is cleared and returned. Kibana POST /api/timeline/_draft.

Import Timelines. Kibana POST /api/timeline/_import.

Install or update prepackaged Timelines. Kibana POST /api/timeline/_prepackaged.

> This documentation is temporarily hosted at a separate location. > > **[View the full Visualizations API reference →](https://elastic.github.io/dashboards-api-spec/visualizations#tag/Visualizations)**. Kibana POST /api/visualizations.

Create multiple workflows in a single request. Optionally overwrite existing workflows. [Required authorization] Route required privileges: workflowsManagement:create AND workflowsManagement:update. [Generally available; added in 9.4.0] Kibana POST /api/workflows.

Cancel a running workflow execution by its ID. [Required authorization] Route required privileges: workflowsManagement:cancelExecution. [Generally available; added in 9.4.0] Kibana POST /api/workflows/executions/{executionId}/cancel.

Resume a paused workflow execution with the provided input. [Required authorization] Route required privileges: workflowsManagement:execute. [Generally available; added in 9.4.0] Kibana POST /api/workflows/executions/{executionId}/resume.

Resume a workflow execution that is paused and waiting for external input. Submit input values as a JSON request body, authenticated with a token query parameter. Returns an HTML confirmation page. [Generally available; added in 9.4.0] Kibana POST /api/workflows/executions/{executionId}/steps/{stepId}/resume/external.

Export one or more workflows as JSON with YAML content and metadata. [Required authorization] Route required privileges: workflowsManagement:read OR workflowsManagement:managed:read. [Generally available; added in 9.4.0] Kibana POST /api/workflows/export.

Retrieve multiple workflows by their IDs in a single request. Optionally use the `source` parameter to return only specific fields from each workflow document. [Required authorization] Route required privileges: workflowsManagement:read OR workflowsManagement:managed:read. [Generally available; added in 9.4.0] Kibana POST /api/workflows/mget.

Execute a single step from a workflow definition in test mode. [Required authorization] Route required privileges: workflowsManagement:execute. [Generally available; added in 9.4.0] Kibana POST /api/workflows/step/test.

Execute a workflow in test mode without requiring it to be saved or enabled. Provide either a workflow ID to test a saved workflow, a YAML definition to test an unsaved draft, or both to test a modified version of an existing workflow. [Required authorization] Route required privileges: workflowsManagement:execute. [Generally available; added in 9.4.0] Kibana POST /api/workflows/test.

Create a new workflow from a YAML definition. The YAML is validated and parsed before the workflow is saved. An optional custom ID can be provided. [Required authorization] Route required privileges: workflowsManagement:create. [Generally available; added in 9.4.0] Kibana POST /api/workflows/workflow.

Create a copy of an existing workflow. [Required authorization] Route required privileges: workflowsManagement:create AND workflowsManagement:read. [Generally available; added in 9.4.0] Kibana POST /api/workflows/workflow/{id}/clone.

Execute a workflow by its ID with the provided inputs. The workflow must be enabled and have a valid definition. Returns an execution ID that can be used to monitor progress. [Required authorization] Route required privileges: workflowsManagement:execute. [Generally available; added in 9.4.0] Kibana POST /api/workflows/workflow/{id}/run.

Request cancellation for all non-terminal executions of the given workflow in the current space. [Required authorization] Route required privileges: workflowsManagement:cancelExecution. [Generally available; added in 9.4.0] Kibana POST /api/workflows/workflow/{workflowId}/executions/cancel.

You must have `all` privileges for the **SLOs** feature in the **Observability** section of the Kibana feature privileges. Kibana POST /s/{spaceId}/api/observability/slos.

Bulk delete SLO definitions and their associated summary and rollup data. This endpoint initiates a bulk deletion operation for SLOs, which may take some time to complete. The status of the operation can be checked using the `GET /api/slo/_bulk_delete/{taskId}` endpoint. Kibana POST /s/{spaceId}/api/observability/slos/_bulk_delete.

The deletion occurs for the specified list of `sloId`. You must have `all` privileges for the **SLOs** feature in the **Observability** section of the Kibana feature privileges. Kibana POST /s/{spaceId}/api/observability/slos/_bulk_purge_rollup.

You must have the `write` privileges for the **SLOs** feature in the **Observability** section of the Kibana feature privileges. Kibana POST /s/{spaceId}/api/observability/slos/{sloId}/disable.

You must have the `write` privileges for the **SLOs** feature in the **Observability** section of the Kibana feature privileges. Kibana POST /s/{spaceId}/api/observability/slos/{sloId}/enable.

You must have the `write` privileges for the **SLOs** feature in the **Observability** section of the Kibana feature privileges. Kibana POST /s/{spaceId}/api/observability/slos/{sloId}/_reset.

The deletion occurs for the specified list of `sloId` and `instanceId`. You must have `all` privileges for the **SLOs** feature in the **Observability** section of the Kibana feature privileges. Kibana POST /s/{spaceId}/api/observability/slos/_delete_instances.

Update a connector. Kibana PUT /api/actions/connector/{id}.

Update an existing agent configuration. Use this endpoint to modify any aspect of the agent's behavior, appearance, or capabilities. To learn more about agents, refer to the [agents documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/agent-builder-agents). [Added in 9.2.0] Kibana PUT /api/agent_builder/agents/{id}.

Replace the per-agent access-control entries. The agent owner, cluster admins, and anyone access control grants Manager can call this endpoint. Each call replaces the entire entries list — the most recent successful update wins. [Added in 9.5.0] Kibana PUT /api/agent_builder/agents/{id}/access_control.

Update an attachment content. Creates a new version if content changed. [Required authorization] Route required privileges: agentBuilder:read. [Experimental; added in 9.2.0] Kibana PUT /api/agent_builder/conversations/{conversation_id}/attachments/{attachment_id}.

Update the origin reference for an attachment. Use this after saving a by-value attachment to link it to its persistent store. [Required authorization] Route required privileges: agentBuilder:read. [Experimental; added in 9.4.0] Kibana PUT /api/agent_builder/conversations/{conversation_id}/attachments/{attachment_id}/origin.

Update an existing user-created skill. To learn more about Agent Builder skills, refer to the [skills documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/skills). [Required authorization] Route required privileges: agentBuilder:manageSkills. [Experimental; added in 9.4.0] Kibana PUT /api/agent_builder/skills/{skillId}.

Update an existing tool. Use this endpoint to modify any aspect of the tool's configuration or metadata. To learn more about Agent Builder tools, refer to the [tools documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/tools). [Added in 9.2.0] Kibana PUT /api/agent_builder/tools/{toolId}.

Update a rule. Kibana PUT /api/alerting/rule/{id}.

Create or update an agent configuration. You must have `all` privileges for the APM and User Experience feature in Kibana. When updating an existing configuration, the `?overwrite=true` query parameter is required. If the configuration already exists and `overwrite` is not set to `true`, the API returns a 400 error. Kibana PUT /api/apm/settings/agent-configuration.

Updates an existing Attack Discovery schedule with new configuration. All schedule properties can be modified including name, parameters, interval, and actions. The update operation replaces the entire schedule configuration with the provided values. Kibana PUT /api/attack_discovery/schedules/{id}.

Fully replaces a case template. Every accepted update creates a new template version; previous versions stay retrievable with the `version` query parameter of the get template API, and cases keep the version they were created with. [Technical preview] Kibana PUT /api/cases/templates/{template_id}.

> This documentation is temporarily hosted at a separate location. > > **[View the full Dashboards API reference →](https://elastic.github.io/dashboards-api-spec/dashboards#tag/Dashboards)**. Kibana PUT /api/dashboards/{id}.

Create or update a runtime field for a data view. If the runtime field already exists, it is replaced with the new definition. Kibana PUT /api/data_views/data_view/{viewId}/runtime_field.

Update a detection rule using the `rule_id` or `id` field. The original rule is replaced, and all unspecified fields are deleted. Kibana PUT /api/detection_engine/rules.

Install and update all Elastic prebuilt detection rules and Timelines. This endpoint allows you to install and update prebuilt detection rules and Timelines provided by Elastic. When you call this endpoint, it will: - Install any new prebuilt detection rules that are not currently installed in your system. Kibana PUT /api/detection_engine/rules/prepackaged.

Update an Elastic Endpoint exception list item, specified by the `id` or `item_id` field. Kibana PUT /api/endpoint_list/items.

**Deprecated in 9.4.0.** Use the Watchlists API instead. Updates the details of an existing monitored privileged user by their document ID. Kibana PUT /api/entity_analytics/monitoring/users/{id}.

Updates the name, description, risk modifier, or managed status of an existing entity analytics watchlist. [Technical Preview] Kibana PUT /api/entity_analytics/watchlists/{id}.

Update an exception list using the `id` or `list_id` field. Kibana PUT /api/exception_lists.

Update an exception list item using the `id` or `item_id` field. Kibana PUT /api/exception_lists/items.

Update an agent binary download source by ID. [Required authorization] Route required privileges: fleet-settings-all. Kibana PUT /api/fleet/agent_download_sources/{sourceId}.

Update an agent policy by ID. [Required authorization] Route required privileges: fleet-agent-policies-all. Kibana PUT /api/fleet/agent_policies/{agentPolicyId}.

Deprecated. Use `PUT /api/fleet/managed_integrations/{policyId}` instead. Update a managed integration by ID. [Experimental; added in 9.5.0] Kibana PUT /api/fleet/agentless_policies/{policyId}.

Update an agent by ID. [Required authorization] Route required privileges: fleet-agents-all. Kibana PUT /api/fleet/agents/{agentId}.

Update a cloud connector by ID. [Required authorization] Route required privileges: fleet-agent-policies-all OR integrations-all. [Experimental; added in 9.2.0] Kibana PUT /api/fleet/cloud_connectors/{cloudConnectorId}.

Update the datasets of an existing custom integration package. [Required authorization] Route required privileges: fleet-settings-all AND integrations-all. Kibana PUT /api/fleet/epm/custom_integrations/{pkgName}.

Update settings for a package, such as whether policies are kept up to date automatically. [Required authorization] Route required privileges: integrations-all AND fleet-agent-policies-all. Kibana PUT /api/fleet/epm/packages/{pkgName}.

Update settings for a specific version of a package. [Required authorization] Route required privileges: integrations-all AND fleet-agent-policies-all. Kibana PUT /api/fleet/epm/packages/{pkgName}/{pkgVersion}.

Update a Fleet Server host by ID. [Required authorization] Route required privileges: fleet-settings-all. Kibana PUT /api/fleet/fleet_server_hosts/{itemId}.

Update a managed integration by ID. Uses full-replace semantics: the policy is rebuilt entirely from the request body, so any omitted optional field (for example, `description`, `vars`, `global_data_tags`, `cloud_connector`) is cleared or reset to its default. [Experimental; added in 9.5.0] Kibana PUT /api/fleet/managed_integrations/{policyId}.

Update output by ID. [Required authorization] Route required privileges: fleet-settings-all. Kibana PUT /api/fleet/outputs/{outputId}.

Update a package policy by ID. Kibana PUT /api/fleet/package_policies/{packagePolicyId}.

Update a proxy by ID. [Required authorization] Route required privileges: fleet-settings-all. Kibana PUT /api/fleet/proxies/{itemId}.

Update the global Fleet settings. [Required authorization] Route required privileges: fleet-settings-all. Kibana PUT /api/fleet/settings.

Create or update Fleet settings for the current Kibana space. [Required authorization] Route required privileges: fleet-settings-all. [Generally available; added in 9.1.0] Kibana PUT /api/fleet/space_settings.

Update a value list using the list `id`. The original list is replaced, and all unspecified fields are deleted. > info > You cannot modify the `id` value. Kibana PUT /api/lists.

Update a value list item using the list item ID. The original list item is replaced, and all unspecified fields are deleted. > info > You cannot modify the `id` value. Kibana PUT /api/lists/items.

Create a centrally-managed Logstash pipeline or update a pipeline. To use this API, you must have either the `logstash_admin` built-in role or a customized Logstash writer role. [Technical Preview] Kibana PUT /api/logstash/pipeline/{id}.

Update a query pack using the pack ID. > info > You cannot update a prebuilt pack. Kibana PUT /api/osquery/packs/{id}.

Update a saved query using the query ID. > info > You cannot update a prebuilt saved query. Kibana PUT /api/osquery/saved_queries/{id}.

WARNING: This API is deprecated. This is a legacy Saved Objects API and may be removed in a future version of Kibana. Updates multiple Kibana saved objects in a single request. Kibana PUT /api/saved_objects/_bulk_update.

WARNING: This API is deprecated. This is a legacy Saved Objects API and may be removed in a future version of Kibana. Updates a single Kibana saved object by type and ID. Kibana PUT /api/saved_objects/{type}/{id}.

Update an existing conversation using the conversation ID. This endpoint allows users to modify the details of an existing conversation. Kibana PUT /api/security_ai_assistant/current_user/conversations/{id}.

Update an existing Knowledge Base Entry by its unique `id`. Kibana PUT /api/security_ai_assistant/knowledge_base/entries/{id}.

Update the Entity Store log extraction configuration. [Required authorization] Route required privileges: securitySolution. Kibana PUT /api/security/entity_store.

Update multiple entity records in the Entity Store in a single request. [Required authorization] Route required privileges: securitySolution. Kibana PUT /api/security/entity_store/entities/bulk.

Update an existing entity record in the Entity Store. By default only certain fields can be updated. Set the `force` query parameter to `true` to update protected fields. [Required authorization] Route required privileges: securitySolution. Kibana PUT /api/security/entity_store/entities/{entityType}.

Disable a managed entity resolution rule in this space. [Required authorization] Route required privileges: securitySolution AND securitySolution-entity-analytics. [Generally available; added in 9.5.0] Kibana PUT /api/security/entity_store/resolution/rules/{id}/disable.

Enable a managed entity resolution rule in this space. [Required authorization] Route required privileges: securitySolution AND securitySolution-entity-analytics. [Generally available; added in 9.5.0] Kibana PUT /api/security/entity_store/resolution/rules/{id}/enable.

Start previously stopped entity engines, resuming data processing for the specified entity types. [Required authorization] Route required privileges: securitySolution. Kibana PUT /api/security/entity_store/start.

Stop running entity engines, pausing data processing for the specified entity types. [Required authorization] Route required privileges: securitySolution. Kibana PUT /api/security/entity_store/stop.

Create a new Kibana role or update the attributes of an existing role. Kibana roles are stored in the Elasticsearch native realm. Kibana PUT /api/security/role/{name}.

Update an existing Kibana space. Kibana PUT /api/spaces/space/{id}.

Creates or updates a stream definition. Classic streams can not be created through this API, only updated [Required authorization] Route required privileges: manage_stream. [Experimental; added in 9.1.0] Kibana PUT /api/streams/{name}.

Upserts the ingest settings of an ingest stream definition [Required authorization] Route required privileges: manage_stream. [Experimental; added in 9.1.0] Kibana PUT /api/streams/{name}/_ingest.

Adds a query to a stream. Noop if the query is already present on the stream. [Required authorization] Route required privileges: manage_stream. [Experimental; added in 9.1.0] Kibana PUT /api/streams/{name}/queries/{queryId}.

Upserts the query settings of a query stream definition [Required authorization] Route required privileges: manage_stream. [Experimental; added in 9.4.0] Kibana PUT /api/streams/{name}/_query.

Links an attachment to a stream. Noop if the attachment is already linked to the stream. [Required authorization] Route required privileges: manage_stream. [Experimental; added in 9.3.0] Kibana PUT /api/streams/{streamName}/attachments/{attachmentType}/{attachmentId}.

Update a monitor with the specified attributes. The required and default fields may vary based on the monitor type. You must have `all` privileges for the Synthetics feature in the Observability section of the Kibana feature privileges. You can also partially update a monitor. Kibana PUT /api/synthetics/monitors/{id}.

Update a parameter in the Synthetics app. You must have `all` privileges for the Synthetics feature in the Observability section of the Kibana feature privileges. Kibana PUT /api/synthetics/params/{id}.

Update an existing private location's label. You must have `all` privileges for the Synthetics and Uptime feature in the Observability section of the Kibana feature privileges. When a private location's label is updated, all monitors using this location will also be updated to maintain data consistency. Kibana PUT /api/synthetics/private_locations/{id}.

Updates a tag if it exists, or creates it at the provided ID. [Experimental; added in 9.5.0] Kibana PUT /api/tags/{id}.

Update uptime setting attributes like `heartbeatIndices`, `certExpirationThreshold`, `certAgeThreshold`, `defaultConnectors`, or `defaultEmail`. You must have `all` privileges for the uptime feature in the Observability section of the Kibana feature privileges. Kibana PUT /api/uptime/settings.

> This documentation is temporarily hosted at a separate location. > > **[View the full Visualizations API reference →](https://elastic.github.io/dashboards-api-spec/visualizations#tag/Visualizations)**. Kibana PUT /api/visualizations/{id}.

Partially update an existing managed workflow. This elevated route can update fields beyond the enabled state. [Required authorization] Route required privileges: workflowsManagement:update AND workflowsManagement:managed:update. [Generally available; added in 9.5.0] Kibana PUT /api/workflows/managed/workflow/{id}.

Partially update an existing workflow. You can update individual fields such as name, description, enabled state, tags, or the YAML definition without providing all fields. [Required authorization] Route required privileges: workflowsManagement:update. [Generally available; added in 9.4.0] Kibana PUT /api/workflows/workflow/{id}.

You must have the `write` privileges for the **SLOs** feature in the **Observability** section of the Kibana feature privileges. Kibana PUT /s/{spaceId}/api/observability/slos/{sloId}.