Install a package by upload

Server: https://{kibana_url}

POST /api/fleet/epm/packages

Install a package by uploading a .zip or .tar.gz archive (max 100MB).

Archives that contain Kibana assets requiring additional privileges are subject to a preflight authorization check before the package is installed. Privileges are checked in every space the package will be installed into.

The following asset types require the corresponding Kibana API privilege:

security_rule: rules-all
security_rule with type machine_learning: rules-all and ml:canCreateJob
security_ai_prompt: elasticAssistant

If any required privilege is missing, the request returns 403 and no assets are written. To learn more, refer to Upload an integration to Kibana.

[Required authorization] Route required privileges: integrations-all AND fleet-agent-policies-all.

Query Parameters

Request

Responses

Successful response

application/gzip; application/zip

Bad Request

application/gzip; application/zip

Forbidden. The caller lacks a Kibana API privilege required by an asset in the archive. No assets are written.

application/gzip; application/zip

Examples

Upload a .zip or .tar.gz package archive (max 100MB)

Request Console 1 / 2 languages

Console Kibana Dev Tools

POST /api/fleet/epm/packages
<binary package archive>

curl Shell

curl -X POST "https://{kibana_url}/api/fleet/epm/packages" \
  -H "kbn-xsrf: true" \
  -H "Content-Type: application/gzip" \
  -d '<binary package archive>'

Response

{
  "_meta": {
    "install_source": "upload"
  },
  "items": [
    {
      "id": "my-custom-package-logs-default",
      "type": "index_template"
    }
  ]
}

{
  "error": "Bad Request",
  "message": "An error message describing what went wrong",
  "statusCode": 400
}

{
  "error": "Forbidden",
  "message": "Insufficient privileges to upload this package",
  "statusCode": 403
}

Query Parameters { ignoreMappingUpdateErrors , skipDataStreamRollover , }

Request

Responses

Query Parameters