Create a managed integration

Server: https://{kibana_url}

POST /api/fleet/managed_integrations

Api key auth Basic auth

Request

Responses

Indicates a successful response

application/json

Bad Request

application/json

Conflict

application/json

Examples

Example request to create a managed integration

Request Console 1 / 2 languages

Console Kibana Dev Tools

POST /api/fleet/managed_integrations
{
  "description": "test",
  "inputs": {
    "ESS Billing-cel": {
      "enabled": true,
      "streams": {
        "ess_billing.billing": {
          "enabled": true,
          "vars": {
            "hide_sensitive": true,
            "http_client_timeout": "30s",
            "lookbehind": 365,
            "tags": [
              "forwarded",
              "billing"
            ]
          }
        },
        "ess_billing.credits": {
          "enabled": false
        }
      },
      "vars": {
        "api_key": "\u003CREPLACE_WITH_YOUR_API_KEY\u003E",
        "organization_id": "1234"
      }
    }
  },
  "name": "ess_billing-1",
  "namespace": "default",
  "package": {
    "name": "ess_billing",
    "version": "1.6.0"
  }
}

curl Shell

curl -X POST "https://{kibana_url}/api/fleet/managed_integrations" \
  -H "kbn-xsrf: true" \
  -H "Content-Type: application/json" \
  -d '{
  "description": "test",
  "inputs": {
    "ESS Billing-cel": {
      "enabled": true,
      "streams": {
        "ess_billing.billing": {
          "enabled": true,
          "vars": {
            "hide_sensitive": true,
            "http_client_timeout": "30s",
            "lookbehind": 365,
            "tags": [
              "forwarded",
              "billing"
            ]
          }
        },
        "ess_billing.credits": {
          "enabled": false
        }
      },
      "vars": {
        "api_key": "\u003CREPLACE_WITH_YOUR_API_KEY\u003E",
        "organization_id": "1234"
      }
    }
  },
  "name": "ess_billing-1",
  "namespace": "default",
  "package": {
    "name": "ess_billing",
    "version": "1.6.0"
  }
}'

Response

{
  "item": {
    "created_at": "2025-11-06T18:27:43.541Z",
    "created_by": "test_user",
    "description": "test",
    "id": "d52a7812-5736-4fdc-aed8-72152afa1ffa",
    "inputs": {
      "ESS Billing-cel": {
        "enabled": true,
        "streams": {
          "ess_billing.billing": {
            "enabled": true,
            "vars": {
              "hide_sensitive": true,
              "http_client_timeout": "30s",
              "lookbehind": 365,
              "tags": [
                "forwarded",
                "billing"
              ]
            }
          },
          "ess_billing.credits": {
            "enabled": false
          }
        },
        "vars": {
          "api_key": {
            "id": "QY1sWpoBbWcMW-edr0Ee",
            "isSecretRef": true
          },
          "organization_id": "1234",
          "url": "https://billing.elastic-cloud.com"
        }
      }
    },
    "name": "ess_billing-1",
    "namespace": "default",
    "package": {
      "name": "ess_billing",
      "title": "Elasticsearch Service Billing",
      "version": "1.6.0"
    },
    "updated_at": "2025-11-06T18:27:43.541Z",
    "updated_by": "test_user"
  }
}

{
  "error": "Bad Request",
  "message": "An error message describing what went wrong",
  "statusCode": 400
}

{
  "error": "Conflict",
  "message": "An error message describing what went wrong",
  "statusCode": 409
}

Example request to create a managed integration reusing an existing AWS cloud connector

Request Console 1 / 2 languages

Console Kibana Dev Tools

POST /api/fleet/managed_integrations
{
  "cloud_connector": {
    "cloud_connector_id": "existing-aws-connector-id",
    "enabled": true,
    "target_csp": "aws"
  },
  "description": "CSPM integration for AWS reusing existing cloud connector",
  "inputs": {
    "cspm-cloudbeat/cis_aws": {
      "enabled": true,
      "streams": {
        "cloud_security_posture.findings": {
          "enabled": true,
          "vars": {
            "aws.account_type": "organization-account",
            "aws.credentials.type": "cloud_connector",
            "aws.supports_cloud_connectors": true,
            "external_id": {
              "id": "ABCDEFGHIJKLMNOPQRST",
              "isSecretRef": true
            },
            "role_arn": "arn:aws:iam::123456789012:role/TestRole"
          }
        }
      },
      "vars": {
        "cloud_formation_template": "https://console.aws.amazon.com/cloudformation/home#/stacks/quickcreate?templateURL=https://elastic-cspm-cft.s3.eu-central-1.amazonaws.com/cloudformation-cspm-ACCOUNT_TYPE-9.2.0.yml"
      }
    },
    "cspm-cloudbeat/cis_azure": {
      "enabled": false
    },
    "cspm-cloudbeat/cis_gcp": {
      "enabled": false
    }
  },
  "name": "cspm-aws-reuse-policy",
  "namespace": "default",
  "package": {
    "name": "cloud_security_posture",
    "version": "3.1.1"
  },
  "vars": {
    "deployment": "aws",
    "posture": "cspm"
  }
}

curl Shell

curl -X POST "https://{kibana_url}/api/fleet/managed_integrations" \
  -H "kbn-xsrf: true" \
  -H "Content-Type: application/json" \
  -d '{
  "cloud_connector": {
    "cloud_connector_id": "existing-aws-connector-id",
    "enabled": true,
    "target_csp": "aws"
  },
  "description": "CSPM integration for AWS reusing existing cloud connector",
  "inputs": {
    "cspm-cloudbeat/cis_aws": {
      "enabled": true,
      "streams": {
        "cloud_security_posture.findings": {
          "enabled": true,
          "vars": {
            "aws.account_type": "organization-account",
            "aws.credentials.type": "cloud_connector",
            "aws.supports_cloud_connectors": true,
            "external_id": {
              "id": "ABCDEFGHIJKLMNOPQRST",
              "isSecretRef": true
            },
            "role_arn": "arn:aws:iam::123456789012:role/TestRole"
          }
        }
      },
      "vars": {
        "cloud_formation_template": "https://console.aws.amazon.com/cloudformation/home#/stacks/quickcreate?templateURL=https://elastic-cspm-cft.s3.eu-central-1.amazonaws.com/cloudformation-cspm-ACCOUNT_TYPE-9.2.0.yml"
      }
    },
    "cspm-cloudbeat/cis_azure": {
      "enabled": false
    },
    "cspm-cloudbeat/cis_gcp": {
      "enabled": false
    }
  },
  "name": "cspm-aws-reuse-policy",
  "namespace": "default",
  "package": {
    "name": "cloud_security_posture",
    "version": "3.1.1"
  },
  "vars": {
    "deployment": "aws",
    "posture": "cspm"
  }
}'

Response

{
  "item": {
    "created_at": "2025-11-06T18:27:43.541Z",
    "created_by": "test_user",
    "description": "test",
    "id": "d52a7812-5736-4fdc-aed8-72152afa1ffa",
    "inputs": {
      "ESS Billing-cel": {
        "enabled": true,
        "streams": {
          "ess_billing.billing": {
            "enabled": true,
            "vars": {
              "hide_sensitive": true,
              "http_client_timeout": "30s",
              "lookbehind": 365,
              "tags": [
                "forwarded",
                "billing"
              ]
            }
          },
          "ess_billing.credits": {
            "enabled": false
          }
        },
        "vars": {
          "api_key": {
            "id": "QY1sWpoBbWcMW-edr0Ee",
            "isSecretRef": true
          },
          "organization_id": "1234",
          "url": "https://billing.elastic-cloud.com"
        }
      }
    },
    "name": "ess_billing-1",
    "namespace": "default",
    "package": {
      "name": "ess_billing",
      "title": "Elasticsearch Service Billing",
      "version": "1.6.0"
    },
    "updated_at": "2025-11-06T18:27:43.541Z",
    "updated_by": "test_user"
  }
}

{
  "error": "Bad Request",
  "message": "An error message describing what went wrong",
  "statusCode": 400
}

{
  "error": "Conflict",
  "message": "An error message describing what went wrong",
  "statusCode": 409
}

Example request to create a managed integration with AWS cloud connector

Request Console 1 / 2 languages

Console Kibana Dev Tools

POST /api/fleet/managed_integrations
{
  "cloud_connector": {
    "enabled": true,
    "target_csp": "aws"
  },
  "description": "CSPM integration for AWS with cloud connector",
  "inputs": {
    "cspm-cloudbeat/cis_aws": {
      "enabled": true,
      "streams": {
        "cloud_security_posture.findings": {
          "enabled": true,
          "vars": {
            "aws.account_type": "organization-account",
            "aws.credentials.type": "cloud_connector",
            "aws.supports_cloud_connectors": true,
            "external_id": {
              "id": "ABCDEFGHIJKLMNOPQRST",
              "isSecretRef": true
            },
            "role_arn": "arn:aws:iam::123456789012:role/TestRole"
          }
        }
      },
      "vars": {
        "cloud_formation_template": "https://console.aws.amazon.com/cloudformation/home#/stacks/quickcreate?templateURL=https://elastic-cspm-cft.s3.eu-central-1.amazonaws.com/cloudformation-cspm-ACCOUNT_TYPE-9.2.0.yml"
      }
    },
    "cspm-cloudbeat/cis_azure": {
      "enabled": false
    },
    "cspm-cloudbeat/cis_gcp": {
      "enabled": false
    }
  },
  "name": "cspm-aws-policy",
  "namespace": "default",
  "package": {
    "name": "cloud_security_posture",
    "version": "3.1.1"
  },
  "vars": {
    "deployment": "aws",
    "posture": "cspm"
  }
}

curl Shell

curl -X POST "https://{kibana_url}/api/fleet/managed_integrations" \
  -H "kbn-xsrf: true" \
  -H "Content-Type: application/json" \
  -d '{
  "cloud_connector": {
    "enabled": true,
    "target_csp": "aws"
  },
  "description": "CSPM integration for AWS with cloud connector",
  "inputs": {
    "cspm-cloudbeat/cis_aws": {
      "enabled": true,
      "streams": {
        "cloud_security_posture.findings": {
          "enabled": true,
          "vars": {
            "aws.account_type": "organization-account",
            "aws.credentials.type": "cloud_connector",
            "aws.supports_cloud_connectors": true,
            "external_id": {
              "id": "ABCDEFGHIJKLMNOPQRST",
              "isSecretRef": true
            },
            "role_arn": "arn:aws:iam::123456789012:role/TestRole"
          }
        }
      },
      "vars": {
        "cloud_formation_template": "https://console.aws.amazon.com/cloudformation/home#/stacks/quickcreate?templateURL=https://elastic-cspm-cft.s3.eu-central-1.amazonaws.com/cloudformation-cspm-ACCOUNT_TYPE-9.2.0.yml"
      }
    },
    "cspm-cloudbeat/cis_azure": {
      "enabled": false
    },
    "cspm-cloudbeat/cis_gcp": {
      "enabled": false
    }
  },
  "name": "cspm-aws-policy",
  "namespace": "default",
  "package": {
    "name": "cloud_security_posture",
    "version": "3.1.1"
  },
  "vars": {
    "deployment": "aws",
    "posture": "cspm"
  }
}'

Response

{
  "item": {
    "created_at": "2025-11-06T18:27:43.541Z",
    "created_by": "test_user",
    "description": "test",
    "id": "d52a7812-5736-4fdc-aed8-72152afa1ffa",
    "inputs": {
      "ESS Billing-cel": {
        "enabled": true,
        "streams": {
          "ess_billing.billing": {
            "enabled": true,
            "vars": {
              "hide_sensitive": true,
              "http_client_timeout": "30s",
              "lookbehind": 365,
              "tags": [
                "forwarded",
                "billing"
              ]
            }
          },
          "ess_billing.credits": {
            "enabled": false
          }
        },
        "vars": {
          "api_key": {
            "id": "QY1sWpoBbWcMW-edr0Ee",
            "isSecretRef": true
          },
          "organization_id": "1234",
          "url": "https://billing.elastic-cloud.com"
        }
      }
    },
    "name": "ess_billing-1",
    "namespace": "default",
    "package": {
      "name": "ess_billing",
      "title": "Elasticsearch Service Billing",
      "version": "1.6.0"
    },
    "updated_at": "2025-11-06T18:27:43.541Z",
    "updated_by": "test_user"
  }
}

{
  "error": "Bad Request",
  "message": "An error message describing what went wrong",
  "statusCode": 400
}

{
  "error": "Conflict",
  "message": "An error message describing what went wrong",
  "statusCode": 409
}

Example request to create a managed integration with Azure cloud connector

Request Console 1 / 2 languages

Console Kibana Dev Tools

POST /api/fleet/managed_integrations
{
  "cloud_connector": {
    "enabled": true,
    "target_csp": "azure"
  },
  "description": "CSPM integration for Azure with cloud connector",
  "inputs": {
    "cspm-cloudbeat/cis_aws": {
      "enabled": false
    },
    "cspm-cloudbeat/cis_azure": {
      "enabled": true,
      "streams": {
        "cloud_security_posture.findings": {
          "enabled": true,
          "vars": {
            "azure_credentials_cloud_connector_id": {
              "type": "text",
              "value": "existing-azure-credentials-connector-id"
            },
            "azure.account_type": "organization-account",
            "client_id": {
              "id": "client-secret-id",
              "isSecretRef": true
            },
            "tenant_id": {
              "id": "tenant-secret-id",
              "isSecretRef": true
            }
          }
        }
      }
    },
    "cspm-cloudbeat/cis_gcp": {
      "enabled": false
    }
  },
  "name": "cspm-azure-policy",
  "namespace": "default",
  "package": {
    "name": "cloud_security_posture",
    "version": "3.1.1"
  },
  "vars": {
    "deployment": "azure",
    "posture": "cspm"
  }
}

curl Shell

curl -X POST "https://{kibana_url}/api/fleet/managed_integrations" \
  -H "kbn-xsrf: true" \
  -H "Content-Type: application/json" \
  -d '{
  "cloud_connector": {
    "enabled": true,
    "target_csp": "azure"
  },
  "description": "CSPM integration for Azure with cloud connector",
  "inputs": {
    "cspm-cloudbeat/cis_aws": {
      "enabled": false
    },
    "cspm-cloudbeat/cis_azure": {
      "enabled": true,
      "streams": {
        "cloud_security_posture.findings": {
          "enabled": true,
          "vars": {
            "azure_credentials_cloud_connector_id": {
              "type": "text",
              "value": "existing-azure-credentials-connector-id"
            },
            "azure.account_type": "organization-account",
            "client_id": {
              "id": "client-secret-id",
              "isSecretRef": true
            },
            "tenant_id": {
              "id": "tenant-secret-id",
              "isSecretRef": true
            }
          }
        }
      }
    },
    "cspm-cloudbeat/cis_gcp": {
      "enabled": false
    }
  },
  "name": "cspm-azure-policy",
  "namespace": "default",
  "package": {
    "name": "cloud_security_posture",
    "version": "3.1.1"
  },
  "vars": {
    "deployment": "azure",
    "posture": "cspm"
  }
}'

Response

{
  "item": {
    "created_at": "2025-11-06T18:27:43.541Z",
    "created_by": "test_user",
    "description": "test",
    "id": "d52a7812-5736-4fdc-aed8-72152afa1ffa",
    "inputs": {
      "ESS Billing-cel": {
        "enabled": true,
        "streams": {
          "ess_billing.billing": {
            "enabled": true,
            "vars": {
              "hide_sensitive": true,
              "http_client_timeout": "30s",
              "lookbehind": 365,
              "tags": [
                "forwarded",
                "billing"
              ]
            }
          },
          "ess_billing.credits": {
            "enabled": false
          }
        },
        "vars": {
          "api_key": {
            "id": "QY1sWpoBbWcMW-edr0Ee",
            "isSecretRef": true
          },
          "organization_id": "1234",
          "url": "https://billing.elastic-cloud.com"
        }
      }
    },
    "name": "ess_billing-1",
    "namespace": "default",
    "package": {
      "name": "ess_billing",
      "title": "Elasticsearch Service Billing",
      "version": "1.6.0"
    },
    "updated_at": "2025-11-06T18:27:43.541Z",
    "updated_by": "test_user"
  }
}

{
  "error": "Bad Request",
  "message": "An error message describing what went wrong",
  "statusCode": 400
}

{
  "error": "Conflict",
  "message": "An error message describing what went wrong",
  "statusCode": 409
}

Request { additional_datastreams_permissions , cloud_connector , create_dataset_templates , description , force , global_data_tags , id , inputs , name , namespace , package , policy_template , var_group_selections , vars , }

Responses

Request