Create an agent

Base URL
https://{kibana_url}
  • POST /api/agent_builder/agents
  • POST /s/{space_id}/api/agent_builder/agents
Auth

Create a new agent. Use this endpoint to define the agent's behavior, appearance, and capabilities through comprehensive configuration options. To learn more about agents, refer to the agents documentation.

Required privileges

Privileges agentBuilder:manageAgents

Path parameters

space_id string optional

An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.

Header parameters

kbn-xsrf string required

A required header to protect against CSRF attacks

Request body

access_control object
access_mode enum required

Access-control mode: public (any privileged user can read/write), shared (any privileged user can read, only owner can write), private (only owner can read/write). Agents created without an access-control mode default to private.

Values: public shared private
avatar_color string

Optional hex color code for the agent avatar.

avatar_symbol string

Optional symbol/initials for the agent avatar.

configuration object required

Configuration settings for the agent.

ai_indices string[] · max items: 100

Array of AI indices to associate with the agent.

approvals object

Auto-approval defaults applied to every run of this agent.

auto_approved_apis object

Destructive Elasticsearch or Kibana APIs this agent may call without a user confirmation, keyed by backend.

elasticsearch string[] · max items: 100

Elasticsearch APIs pre-approved for every run of this agent. Each entry is an exact identifier formed from the namespace and name (for example indices.create), a namespace wildcard (for example indices.*), or * for every Elasticsearch API. Entries are not checked against the known APIs, and one that matches no API has no effect.

kibana string[] · max items: 100

Kibana APIs pre-approved for every run of this agent. Each entry is an exact identifier formed from the namespace and name (for example alerting.delete-alerting-rule-id), a namespace wildcard (for example alerting.*), or * for every Kibana API. Entries are not checked against the known APIs, and one that matches no API has no effect.

connector_ids string[] · max items: 100

Array of connector IDs to associate with the agent.

enable_elastic_capabilities boolean

When true, enables built-in Elastic capabilities for the agent.

instructions string

Optional system instructions that define the agent behavior.

plugin_ids string[] · max items: 100

Array of plugin IDs to assign to the agent.

post_execution_workflow_ids string[] · max items: 100
skill_ids string[] · max items: 100

Array of skill IDs to be available to the agent.

subagent_ids string[] · max items: 50

Allowlist of subagent IDs this agent may spawn. Missing or empty disables the run_subagent tool. Use '_self' to enable self-fork.

tools object[] required
tool_ids string[] required

Array of tool IDs that the agent can use.

workflow_ids string[] · max items: 100
description string · max length: 2000 required

Description of what the agent does.

id string · max length: 64 required

Unique identifier for the agent.

labels string[]

Optional labels for categorizing and organizing agents.

name string · max length: 256 required

Display name for the agent.

Response

200

Indicates a successful response

application/json
Base URL
https://{kibana_url}