---
type: api
title: Query AI Indices
description: **Spaces method and path for this operation:**
url: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/operation/operation-post-context-engine-ai-index-query
resource: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/operation/operation-post-context-engine-ai-index-query
products:
  - Kibana
---

# Query AI Indices

Availability: Planned

- Server: `https://{kibana_url}`

## Paths

- `POST` `/api/context_engine/ai_index/_query`
- `POST` `/s/{space_id}/api/context_engine/ai_index/_query`

- [Api key auth](/elastic/docs-builder/docs/4371/api/doc/kibana/authentication#apikeyauth)
- [Basic auth](/elastic/docs-builder/docs/4371/api/doc/kibana/authentication#basicauth)

## Description

Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

Runs an ES|QL query as the current user. The server applies a space filter and limits the response to at most 1000 rows.

The query determines which indices it reads. Elasticsearch index privileges limit which indices the current user can access.

The space comes from the request URL (`/s/{spaceId}/…`) or defaults to the default space. The request body cannot change the space or replace the space filter.

Returns a 404 response when Context Engine is turned off in this space (`contextEngine:enabled`).

**For more information, refer to the [Context Engine documentation](https://www.elastic.co/docs/explore-analyze/ai-features/context-engine).**<br/><br/>[Required authorization] Route required privileges: contextEngine:read.

## Request Body

`application/json`

- `limit` (number · min: 1 · max: 1000) — optional
  Maximum rows to return. Defaults to 100; a trailing `LIMIT` in the query is capped to this value.
- `params` (map string to string | number | boolean) — optional
  Values for `?name` placeholders in the query.
- `query` (string · min: 1 · max: 10000) — required
  The ES|QL query to run. Its FROM decides which Elasticsearch indices are read (normally `ai-index-*`); the server adds the space filter and a row limit.

## Responses

#### `200`

The columns and rows returned by the ES|QL query.

`application/json`

- `columns` ([] object)
  Column metadata for the returned rows.
  - `name` (string)
    Column name.
  - `type` (string)
    Column ES|QL type.
- `values` ([] object)
  Row values, aligned positionally with `columns`, as Elasticsearch returns them. A multi-valued field is an array; `_source` and `flattened` columns are objects.
#### `400`

The ES|QL query was invalid, or its response exceeded the size limit.

`application/json`

- `error` (string)
  The HTTP status text.
- `message` (string)
  A human-readable error message.
- `statusCode` (number)
  The HTTP status code.
#### `403`

Elasticsearch rejected the read; the caller lacks index privileges.

`application/json`

- `error` (string)
  The HTTP status text.
- `message` (string)
  A human-readable error message.
- `statusCode` (number)
  The HTTP status code.
#### `404`

Context Engine is turned off in this space.

`application/json`

- `error` (string)
  The HTTP status text.
- `message` (string)
  A human-readable error message.
- `statusCode` (number)
  The HTTP status code.
## Code Examples

#### Console

```console
POST kbn:/api/context_engine/ai_index/_query
{
  "query": "FROM ai-index-* | WHERE type == ?type | KEEP title, type, attributes | LIMIT 10",
  "params": { "type": "faq" },
  "limit": 10
}
```

#### curl

```curl
curl \
  -X POST "https://${KIBANA_URL}/api/context_engine/ai_index/_query" \
  -H "Authorization: ApiKey ${API_KEY}" \
  -H "kbn-xsrf: true" \
  -H "Content-Type: application/json" \
  -d '{
    "query": "FROM ai-index-* | WHERE type == ?type | KEEP title, type, attributes | LIMIT 10",
    "params": { "type": "faq" },
    "limit": 10
  }'
```

## Response Examples

#### Columns and rows

Example response with column metadata and matching rows. `flattened` columns such as `attributes` are returned as objects.

```json
{
  "columns": [
    {
      "name": "title",
      "type": "text"
    },
    {
      "name": "type",
      "type": "keyword"
    },
    {
      "name": "attributes",
      "type": "flattened"
    }
  ],
  "values": [
    [
      "How to reset a password",
      "faq",
      {
        "source": "zendesk"
      }
    ],
    [
      "Billing cycle explained",
      "faq",
      {
        "source": "zendesk"
      }
    ]
  ]
}
```

#### Unknown column

The ES|QL query references a column that does not exist

```json
{
  "error": "Bad Request",
  "message": "verification_exception\n\tRoot causes:\n\t\tverification_exception: Found 1 problem\nline 1:46: Unknown column [titel], did you mean [title]?",
  "statusCode": 400
}
```

#### Missing index privileges

The caller lacks Elasticsearch index privileges

```json
{
  "error": "Forbidden",
  "message": "security_exception\n\tRoot causes:\n\t\tsecurity_exception: action [indices:data/read/esql] is unauthorized for user [jdoe] with effective roles [support_reader], this action is granted by the index privileges [read_cross_cluster,read,all]",
  "statusCode": 403
}
```

#### Context Engine turned off

Context Engine is turned off in this space

```json
{
  "error": "Not Found",
  "message": "Not Found",
  "statusCode": 404
}
```