---
type: api
title: Install a package by upload
description: **Spaces method and path for this operation:**
url: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/operation/operation-post-fleet-epm-packages
resource: https://www.elastic.co/elastic/docs-builder/docs/4371/api/doc/kibana/operation/operation-post-fleet-epm-packages
products:
  - Kibana
---

# Install a package by upload

- Server: `https://{kibana_url}`

## Paths

- `POST` `/api/fleet/epm/packages`
- `POST` `/s/{space_id}/api/fleet/epm/packages`

- [Api key auth](/elastic/docs-builder/docs/4371/api/doc/kibana/authentication#apikeyauth)
- [Basic auth](/elastic/docs-builder/docs/4371/api/doc/kibana/authentication#basicauth)

## Description

Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

Install a package by uploading a .zip or .tar.gz archive (max 100MB).

Archives that contain Kibana assets requiring additional privileges are subject to a preflight authorization check before the package is installed. Privileges are checked in every space the package will be installed into.

The following asset types require the corresponding Kibana API privilege:

- `security_rule`: `rules-all`
- `security_rule` with type `machine_learning`: `rules-all` and `ml:canCreateJob`
- `security_ai_prompt`: `elasticAssistant`

If any required privilege is missing, the request returns 403 and no assets are written. To learn more, refer to [Upload an integration to Kibana](https://www.elastic.co/docs/extend/integrations/upload-new-integration).<br/><br/>[Required authorization] Route required privileges: integrations-all AND fleet-agent-policies-all.

## Query String Parameters

- `ignoreMappingUpdateErrors` (boolean · default: false)
  When true, ignore mapping update errors during installation
- `skipDataStreamRollover` (boolean · default: false)
  When true, skip data stream rollover after installation

## Request Body

`application/gzip`


## Responses

#### `200`

Successful response

`application/gzip; application/zip`

- `_meta` (object)
  - `install_source` (string)
  - `name` (string)
- `items` ([] union anyOf · max: 10000)
  - **Kibana_HTTP_APIs_kibana_asset_reference**
    - `deferred` (boolean)
    - `id` (string)
    - `originId` (string)
    - `type` (union enum | string)
      Values: `dashboard`, `lens`, `visualization`, `search`, `index-pattern`, `map`, `ml-module`, `security-rule`, `csp-rule-template`, `osquery-pack-asset`, `osquery-saved-query`, `tag`
  - **Kibana_HTTP_APIs_es_asset_reference**
    - `customDataStreamOriginDataset` (string)
    - `customDataStreamOriginType` (string)
    - `deferred` (boolean)
    - `id` (string)
    - `type` (enum)
      Values: `index`, `index_template`, `component_template`, `ingest_pipeline`, `ilm_policy`, `data_stream_ilm_policy`, `transform`, `ml_model`, `knowledge_base`, `esql_view`
    - `version` (string)
#### `400`

Bad Request

`application/gzip; application/zip`

- `attributes` (object)
- `error` (string)
- `errorType` (string)
- `message` (string)
- `statusCode` (number)
#### `403`

Forbidden. The caller lacks a Kibana API privilege required by an asset in the archive. No assets are written.

`application/gzip; application/zip`

- `attributes` (object)
- `error` (string)
- `errorType` (string)
- `message` (string)
- `statusCode` (number)
## Code Examples

#### Console

```console
POST /api/fleet/epm/packages
<binary package archive>
```

#### curl

```curl
curl -X POST "https://{kibana_url}/api/fleet/epm/packages" \
  -H "kbn-xsrf: true" \
  -H "Content-Type: application/gzip" \
  -d '<binary package archive>'
```

## Response Examples

#### Post install by upload

Package successfully installed from upload

```json
{
  "_meta": {
    "install_source": "upload"
  },
  "items": [
    {
      "id": "my-custom-package-logs-default",
      "type": "index_template"
    }
  ]
}
```

#### Generic error response

Example of a generic error response

```json
{
  "error": "Bad Request",
  "message": "An error message describing what went wrong",
  "statusCode": 400
}
```

#### Missing rules-all privilege

Caller lacks a privilege required by a gated asset type in the archive

```json
{
  "error": "Forbidden",
  "message": "Insufficient privileges to upload this package",
  "statusCode": 403
}
```