Kibana Serverless APIs
The Kibana REST APIs for Elastic serverless enable you to manage resources such as connectors, data views, and saved objects. The API calls are stateless. Each request that you make happens in isolation from other calls and must include all of the necessary information for Kibana to fulfill the request. API requests return JSON output, which is a format that is machine-readable and works well for automation.
To interact with Kibana APIs, use the following operations:
- GET: Fetches the information.
- POST: Adds new information.
- PUT: Updates the existing information.
- DELETE: Removes the information.
You can prepend any Kibana API endpoint with kbn: and run the request in
Dev Tools → Console. For example:
GET kbn:/api/data_views
This documentation is derived from the main branch of the kibana repository.
It is provided under license Attribution-NonCommercial-NoDerivatives 4.0 International.
Agent Builder 44
- POST Send A2A task
- GET Get A2A agent card
- GET List agents
- POST Create an agent
- POST Get agent consumption data
- DELETE Delete an agent
- GET Get an agent by ID
- PUT Update an agent
- GET Get an agent's access control list
- PUT Update an agent's access control list
- GET List conversations
- POST Create conversation
- DELETE Delete conversation by ID
- GET Get conversation by ID
- POST Add events to a conversation
- PUT Update a conversation's access control
- GET List conversation attachments
- POST Create conversation attachment
- DELETE Delete conversation attachment
- GET Get conversation attachment
- PATCH Rename attachment
- PUT Update conversation attachment
- POST Restore deleted attachment
- PUT Update attachment origin
- GET Check attachment staleness
- POST Send chat message
- POST Send chat message (streaming)
- POST MCP server
- GET List plugins
- DELETE Delete a plugin
- GET Get a plugin by id
- POST Install a plugin
- GET List skills
- POST Create a skill
- DELETE Delete a skill
- GET Get a skill by id
- PUT Update a skill
- GET List tools
- POST Create a tool
- POST Run a tool
- DELETE Delete a tool
- GET Get a tool by id
- PUT Update a tool
- POST Send a message and get the answer
Alerting 21
- DELETE Delete a rule
- GET Get rule details
- POST Create a rule
- PUT Update a rule
- POST Disable a rule
- POST Enable a rule
- POST Mute all alerts
- POST Unmute all alerts
- POST Update the API key for a rule
- GET Get the Elasticsearch query for a rule
- POST Schedule a snooze for the rule
- POST Mute an alert
- POST Snooze an alert
- POST Unmute an alert
- POST Unsnooze an alert
- DELETE Delete a snooze schedule for a rule
- GET Get information about rules
- POST Find backfills for rules
- POST Schedule a backfill for rules
- DELETE Delete a backfill by ID
- GET Get a backfill by ID
Alerting V2 50
- GET List action policies
- POST Create an action policy
- POST Delete action policies in bulk by ID
- POST Disable action policies in bulk by ID
- POST Enable action policies in bulk by ID
- POST Snooze action policies in bulk by ID
- POST Cancel snooze for action policies in bulk by ID
- POST Rotate API keys for action policies in bulk by ID
- DELETE Delete an action policy
- GET Get an action policy
- PATCH Partially update an action policy.
- PUT Create or replace an action policy
- POST Disable an action policy
- POST Enable an action policy
- POST Snooze an action policy
- POST Unsnooze an action policy
- POST Update an action policy API key
- POST Bulk acknowledge alert episodes
- POST Bulk activate alert episodes
- POST Bulk assign alert episodes
- POST Bulk deactivate alert episodes
- POST Bulk tag alert episodes
- POST Bulk unacknowledge alert episodes
- POST Acknowledge an alert episode
- POST Activate an alert episode
- POST Assign an alert episode to a user
- POST Deactivate an alert episode
- POST Tag an alert episode
- POST Unacknowledge an alert episode
- GET List action policy executions
- GET List rule executions
- GET List rules
- POST Create a rule
- POST Create rules in bulk
- POST Delete rules in bulk by ID
- POST Disable rules in bulk by ID
- POST Enable rules in bulk by ID
- POST Get rules in bulk
- POST Update the API key of rules in bulk by ID
- POST Delete rules matching a query (dry-run by default)
- POST Disable rules matching a query (dry-run by default)
- POST Enable rules matching a query (dry-run by default)
- POST Update the API key of rules matching a query (dry-run by default)
- DELETE Delete a rule
- GET Get a rule
- PATCH Update a rule
- PUT Create or replace a rule
- POST Disable a rule
- POST Enable a rule
- POST Run a rule now
APM agent configuration 7
APM agent keys 1
APM annotations 2
APM server schema 1
Cases 34
- DELETE Delete cases
- PATCH Update cases
- POST Create a case
- GET Search cases
- GET Get case information
- GET Get all alerts for a case
- DELETE Delete all case comments and alerts
- PATCH Update a case comment or alert
- POST Add a case comment or alert
- GET Find case comments
- DELETE Delete a case comment or alert
- GET Get a case comment or alert
- POST Push a case to an external service
- GET Get the fields applicable to an existing case
- POST Attach a file to a case
- GET Find case activity
- GET Get cases for an alert
- GET Get case settings
- POST Add case settings
- PATCH Update case settings
- GET Get case connectors
- GET Get all field definitions
- POST Create a field definition
- DELETE Delete a field definition
- GET Get a field definition by ID
- PUT Update a field definition
- GET Get the fields applicable to a case
- GET Get case creators
- GET Get case tags
- GET Get all case templates
- POST Create a case template
- DELETE Delete a case template
- GET Get a case template by ID
- PUT Update a case template
Connectors 9
Context Engine 7
Dashboards 5
Data streams 3
Data views 15
- GET Get all data views
- POST Create a data view
- DELETE Delete a data view
- GET Get a data view
- POST Update a data view
- POST Update field metadata
- POST Create a runtime field
- PUT Create or update a runtime field
- DELETE Delete a runtime field
- GET Get a runtime field
- POST Update a runtime field
- GET Get the default data view
- POST Set the default data view
- POST Swap saved object references
- POST Preview swap references
Elastic Agent actions 18
- POST Create an agent action
- POST Reassign an agent
- POST Remove an OpAMP collector
- POST Request agent diagnostics
- POST Restart an agent
- POST Rollback an agent
- POST Unenroll an agent
- POST Upgrade an agent
- GET Get an agent action status
- POST Cancel an agent action
- POST Bulk reassign agents
- POST Bulk remove OpAMP collectors
- POST Bulk request diagnostics from agents
- POST Bulk restart agents
- POST Bulk rollback agents
- POST Bulk unenroll agents
- POST Bulk update agent tags
- POST Bulk upgrade agents
Elastic Agent binary download sources 5
Elastic Agent policies 14
- GET Get agent policies
- POST Create an agent policy
- POST Bulk get agent policies
- GET Get an agent policy
- PUT Update an agent policy
- GET Get auto upgrade agent status
- POST Copy an agent policy
- GET Download an agent policy
- GET Get a full agent policy
- GET Get outputs for an agent policy
- POST Delete an agent policy
- POST Get outputs for agent policies
- GET Get a full K8s agent manifest
- GET Download an agent manifest
Elastic Agent status 1
Elastic Agents 18
- GET Get incoming agent data
- GET Get agents
- POST Get agents by action ids
- DELETE Delete an agent
- GET Get an agent
- PUT Update an agent by ID
- GET Get an agent's effective config
- POST Migrate a single agent
- POST Change agent privilege level
- GET Get agent uploads
- GET Get available agent versions
- POST Migrate multiple agents
- POST Bulk change agent privilege level
- DELETE Delete an uploaded file
- GET Get an uploaded file
- GET Get agent setup info
- POST Initiate Fleet setup
- GET Get agent tags
Elastic Package Manager (EPM) 32
- POST Bulk get assets
- GET Get package categories
- POST Create a custom integration
- PUT Update a custom integration
- GET Get packages
- POST Install a package by upload
- POST Bulk install packages
- POST Bulk enable/disable namespace-level customization for packages
- POST Bulk rollback packages
- GET Get Bulk rollback packages details
- POST Bulk uninstall packages
- GET Get Bulk uninstall packages details
- POST Bulk upgrade packages
- GET Get Bulk upgrade packages details
- DELETE Delete a package
- GET Get a package
- POST Install a package from the registry
- PUT Update package settings
- GET Get a package file
- DELETE Delete assets for a package
- GET Get package dependencies
- DELETE Delete Kibana assets for a package
- POST Install Kibana assets for a package
- POST Install Kibana alert rule for a package
- POST Authorize transforms
- POST Review a pending policy upgrade for a package with deprecations
- POST Rollback a package to previous version
- GET Get package stats
- GET Get installed packages
- GET Get a limited package list
- GET Get an inputs template
- GET Get a package signature verification key ID
Fleet agentless policies 7
- GET Deprecated: Get managed integrations
- POST Deprecated: Create a managed integration
- POST Deprecated: Bulk upgrade managed integrations
- POST Deprecated: Preview a managed integrations upgrade
- DELETE Deprecated: Delete a managed integration
- GET Deprecated: Get a managed integration
- PUT Deprecated: Update a managed integration
Fleet cloud connectors 6
Fleet cloud onboarding deployments 5
Fleet enrollment API keys 5
Fleet internals 7
Fleet managed integrations 7
Fleet Message Signing Service 1
Fleet outputs 7
Fleet package policies 9
Fleet proxies 5
Fleet Server hosts 5
Fleet service tokens 1
Fleet uninstall tokens 3
Links 5
Machine learning 3
Maintenance windows 7
Markdowns 5
Observability AI Assistant 1
Roles 5
Saved objects 3
Security AI assistant 21
- POST Apply a bulk action to anonymization fields
- GET Get anonymization fields
- POST Create a model response
- DELETE Delete conversations
- POST Create a conversation
- GET Get conversations
- DELETE Delete a conversation
- GET Get a conversation
- PUT Update a conversation
- GET Read a KnowledgeBase
- POST Create a KnowledgeBase
- GET Read a KnowledgeBase for a resource
- POST Create a KnowledgeBase for a resource
- POST Create a Knowledge Base Entry
- POST Applies a bulk action to multiple Knowledge Base Entries
- GET Finds Knowledge Base Entries that match the given query.
- DELETE Deletes a single Knowledge Base Entry using the `id` field
- GET Read a Knowledge Base Entry
- PUT Update a Knowledge Base Entry
- POST Apply a bulk action to prompts
- GET Get prompts
Security Attack discovery 16
- POST Bulk update Attack discoveries
- GET Find Attack discoveries that match the search criteria
- POST Generate attack discoveries from alerts
- GET Get the latest Attack Discovery generations metadata for the current user
- GET Get a single Attack Discovery generation, including its discoveries and (optional) generation metadata
- POST Dismiss an Attack Discovery generation
- POST Create Attack Discovery schedule
- POST Bulk delete Attack Discovery schedules
- POST Bulk disable Attack Discovery schedules
- POST Bulk enable Attack Discovery schedules
- GET Find Attack Discovery schedules that match the search criteria
- DELETE Delete Attack Discovery schedule
- GET Get Attack Discovery schedule by ID
- PUT Update Attack Discovery schedule
- POST Disable Attack Discovery schedule
- POST Enable Attack Discovery schedule
Security detections 20
- POST Assign and unassign users from attack discovery alerts
- POST Find and/or aggregate attack discovery alerts
- POST Set attack discovery alerts workflow status
- POST Add and remove attack discovery alert tags
- GET Returns user privileges for the Kibana space
- DELETE Delete a detection rule
- GET Retrieve a detection rule
- PATCH Patch a detection rule
- POST Create a detection rule
- PUT Update a detection rule
- POST Apply a bulk action to detection rules
- POST Export detection rules
- GET List all detection rules
- POST Import detection rules
- POST Preview rule alerts generated on specified time range
- POST Assign and unassign users from detection alerts
- POST Find and/or aggregate detection alerts
- POST Set a detection alert status
- POST Add and remove detection alert tags
- GET List all detection rule tags
Security Elastic Endpoint exceptions 6
- POST Create an Elastic Endpoint rule exception list
- DELETE Delete an Elastic Endpoint exception list item
- GET Get an Elastic Endpoint rule exception list item
- POST Create an Elastic Endpoint rule exception list item
- PUT Update an Elastic Endpoint rule exception list item
- GET Get Elastic Endpoint exception list items
Security endpoint management 29
- GET Get response actions
- GET Get response actions status
- GET Get action details
- GET Get file information
- GET Download a file
- POST Cancel a response action
- POST Run a command
- POST Get a file
- POST Isolate an endpoint
- POST Terminate a process
- POST Generate a memory dump from the host machine
- POST Run a script
- POST Get running processes
- POST Scan a file or directory
- GET Get actions state
- POST Suspend a process
- POST Release an isolated endpoint
- POST Upload a file
- GET Get a metadata list
- GET Get metadata
- GET Get a policy response
- GET Get a protection updates note
- POST Create or update a protection updates note
- GET Get a list of scripts
- POST Create script
- DELETE Delete a script
- GET Get script
- PATCH Update script
- GET Download a script file
Security entity analytics 29
- DELETE Delete an asset criticality record
- GET Get an asset criticality record
- POST Upsert an asset criticality record
- POST Bulk upsert asset criticality records
- GET List asset criticality records
- DELETE Delete the Privilege Monitoring Engine
- POST Disable the Privilege Monitoring Engine
- POST Initialize the Privilege Monitoring Engine
- POST Schedule the Privilege Monitoring Engine
- GET Health check on Privilege Monitoring
- GET Run a privileges check on Privilege Monitoring
- POST Create a new monitored user
- POST Upsert multiple monitored users via CSV upload
- DELETE Delete a monitored user
- PUT Update a monitored user
- GET List all monitored users
- POST Installs the privileged access detection package for the Entity Analytics privileged user monitoring experience
- GET Gets the status of the privileged access detection package for the Entity Analytics privileged user monitoring experience
- POST Create a new watchlist
- GET Get a watchlist by ID
- PUT Update an existing watchlist
- POST Upload a CSV file to add entities to a watchlist
- POST Manually assign entities to a watchlist
- POST Manually unassign entities from a watchlist
- GET List all watchlists
- DELETE Cleanup the Risk Engine
- PATCH Configure the Risk Engine Saved Object
- POST Run the risk scoring engine
- GET Get risk score history for an entity
Security entity store 19
- PUT Update the Entity Store
- GET List entities
- DELETE Delete an entity
- POST Create an entity
- PUT Update an entity
- PUT Bulk update entities
- PUT Disable the history snapshot task
- PUT Enable the history snapshot task
- POST Install the Entity Store
- GET Get resolution group
- POST Link entities
- GET List entity resolution rules
- PUT Disable an entity resolution rule
- PUT Enable an entity resolution rule
- POST Unlink entities
- PUT Start Entity Store engines
- GET Get Entity Store status
- PUT Stop Entity Store engines
- POST Uninstall the Entity Store
Security exceptions 16
- POST Create rule exception items
- DELETE Delete an exception list
- GET Get exception list details
- POST Create an exception list
- PUT Update an exception list
- POST Duplicate an exception list
- POST Export an exception list
- GET Get exception lists
- POST Import an exception list
- DELETE Delete an exception list item
- GET Get an exception list item
- POST Create an exception list item
- PUT Update an exception list item
- GET Get exception list items
- GET Get an exception list summary
- POST Create a shared exception list
Security lists 18
- DELETE Delete a value list
- GET Get value list details
- PATCH Patch a value list
- POST Create a value list
- PUT Update a value list
- GET Get value lists
- DELETE Delete value list data streams
- GET Get status of value list data streams
- POST Create list data streams
- DELETE Delete a value list item
- GET Get a value list item
- PATCH Patch a value list item
- POST Create a value list item
- PUT Update a value list item
- POST Export value list items
- GET Get value list items
- POST Import value list items
- GET Get value list privileges
Security Osquery 21
- GET Get unified query history
- GET Get live queries
- POST Create a live query
- GET Get live query details
- GET Get live query results
- POST Export live query results
- GET Get packs
- POST Create a pack
- DELETE Delete a pack
- GET Get pack details
- PUT Update a pack
- POST Copy a pack
- GET Get saved queries
- POST Create a saved query
- DELETE Delete a saved query
- GET Get saved query details
- PUT Update a saved query
- POST Copy a saved query
- GET Get scheduled action results
- POST Export scheduled query results
- GET Get scheduled query results
Security solution initialization 1
Security timeline 17
- DELETE Delete one or more notes
- GET Get notes
- PATCH Add or update a note
- PATCH Pin/unpin an event
- DELETE Delete Timelines or Timeline templates
- GET Get Timeline or Timeline template details
- PATCH Update a Timeline
- POST Create a Timeline or Timeline template
- POST Copies timeline or timeline template
- GET Get draft Timeline or Timeline template details
- POST Create a clean draft Timeline or Timeline template
- POST Export Timelines
- PATCH Favorite a Timeline or Timeline template
- POST Import Timelines
- POST Install prepackaged Timelines
- GET Resolve a Timeline or Timeline template
- GET Get Timelines or Timeline templates
Service level objectives 15
- GET Get a paginated list of SLOs
- POST Create an SLO
- POST Bulk delete SLO definitions and their associated summary and rollup data.
- GET Retrieve the status of the bulk deletion
- POST Batch delete rollup and summary data
- POST Batch delete rollup and summary data
- POST Compute SLO instance summaries in bulk at a point in time
- DELETE Delete an SLO
- GET Get an SLO
- PUT Update an SLO
- POST Reset an SLO
- GET Compute an SLO instance summary at a point in time
- POST Disable an SLO
- POST Enable an SLO
- GET Get the SLO definitions
Spaces 5
Streams 18
- GET Get stream list
- POST Disable streams
- POST Enable streams
- POST Resync streams
- DELETE Delete a stream
- GET Get a stream
- PUT Create or update a stream
- POST Fork a stream
- GET Get ingest stream settings
- PUT Update ingest stream settings
- GET Get query stream settings
- PUT Upsert query stream settings
- POST Export stream content
- POST Import content into a stream
- GET Get stream attachments
- POST Bulk update attachments
- DELETE Unlink an attachment from a stream
- PUT Link an attachment to a stream
System 1
Tags 5
Task manager 1
unknown 2
Visualizations 5
Workflows 32
- DELETE Bulk delete workflows
- GET Get workflows
- POST Bulk create workflows
- GET Get workflow aggregations
- GET Get available connectors
- GET Get a workflow execution
- POST Cancel a workflow execution
- GET Get child executions
- GET Get execution logs
- POST Resume a workflow execution
- GET Get a step execution
- GET Get execution step executions
- GET Resume a workflow execution from an external link
- POST Submit external input for a paused workflow execution
- GET Get the external input form for a paused workflow execution
- POST Export workflows
- PUT Update a managed workflow
- POST Get workflows by IDs
- GET Get workflow JSON schema
- GET Get workflow statistics
- POST Test a workflow step
- POST Test a workflow
- POST Create a workflow
- DELETE Delete a workflow
- GET Get a workflow
- PUT Update a workflow
- POST Clone a workflow
- POST Run a workflow
- GET Get workflow executions
- POST Cancel all active workflow executions
- GET Get workflow step executions
- GET Search workflow executions