Kibana APIs
The Kibana REST APIs enable you to manage resources such as connectors, data views, and saved objects. The API calls are stateless. Each request that you make happens in isolation from other calls and must include all of the necessary information for Kibana to fulfill the request. API requests return JSON output, which is a format that is machine-readable and works well for automation.
To interact with Kibana APIs, use the following operations:
- GET: Fetches the information.
- PATCH: Applies partial modifications to the existing information.
- POST: Adds new information.
- PUT: Updates the existing information.
- DELETE: Removes the information.
You can prepend any Kibana API endpoint with kbn: and run the request in Dev Tools → Console.
For example:
GET kbn:/api/data_views
For more information about the console, refer to Run API requests.
NOTE: Access to internal Kibana API endpoints will be restricted in Kibana version 9.0. Please move any integrations to publicly documented APIs.
This documentation is derived from the 8.19 branch of the kibana repository.
It is provided under license Attribution-NonCommercial-NoDerivatives 4.0 International.
This documentation contains work-in-progress information for future Elastic Stack releases.
Alerting 29
- GET Get the alerting framework health
- GET Get the alerting framework health
- GET Get the rule types
- DELETE Delete a rule
- GET Get rule details
- POST Create a rule
- PUT Update a rule
- POST Disable a rule
- POST Enable a rule
- POST Mute all alerts
- POST Unmute all alerts
- POST Update the API key for a rule
- POST Schedule a snooze for the rule
- POST Mute an alert
- POST Unmute an alert
- DELETE Delete a snooze schedule for a rule
- GET Get information about rules
- DELETE Delete an alert
- GET Get an alert by identifier
- POST Create an alert
- PUT Update an alert
- POST Disable an alert
- POST Enable an alert
- POST Mute all alert instances
- POST Unmute all alert instances
- POST Mute an alert instance
- POST Unmute an alert instance
- GET Get a paginated set of alerts
- GET Get the alert types
APM agent configuration 7
APM agent keys 1
APM annotations 2
APM server schema 1
APM sourcemaps 3
Cases 25
- DELETE Delete cases
- PATCH Update cases
- POST Create a case
- GET Search cases
- GET Get case information
- GET Get all alerts for a case
- DELETE Delete all case comments and alerts
- GET Get all case comments
- PATCH Update a case comment or alert
- POST Add a case comment or alert
- GET Find case comments and alerts
- DELETE Delete a case comment or alert
- GET Get a case comment or alert
- POST Push a case to an external service
- POST Attach a file to a case
- GET Get case activity
- GET Find case activity
- GET Get cases for an alert
- GET Get case settings
- POST Add case settings
- PATCH Update case settings
- GET Get case connectors
- GET Get case creators
- GET Get case status summary
- GET Get case tags
Connectors 14
- GET Get all connectors
- GET Get all connectors
- POST Create a connector
- POST Create a connector
- DELETE Delete a connector
- DELETE Delete a connector
- GET Get connector information
- GET Get connector information
- PUT Update a connector
- PUT Update a connector
- POST Run a connector
- POST Run a connector
- GET Get connector types
- GET Get connector types
Data streams 1
Data views 15
- GET Get all data views
- POST Create a data view
- DELETE Delete a data view
- GET Get a data view
- POST Update a data view
- POST Update data view fields metadata
- POST Create a runtime field
- PUT Create or update a runtime field
- DELETE Delete a runtime field from a data view
- GET Get a runtime field
- POST Update a runtime field
- GET Get the default data view
- POST Set the default data view
- POST Swap saved object references
- POST Preview a saved object reference swap
Elastic Agent actions 3
Elastic Agent binary download sources 5
Elastic Agent policies 9
Elastic Agent status 3
Elastic Agents 21
- GET List agents
- POST List agents by action ids
- DELETE Delete agent by ID
- GET Get agent by ID
- PUT Update agent by ID
- POST Reassign agent
- PUT Reassign agent
- POST Request agent diagnostics
- POST Unenroll agent
- POST Upgrade agent
- GET List agent uploads
- POST Bulk reassign agents
- POST Bulk request diagnostics from agents
- POST Bulk unenroll agents
- POST Bulk update agent tags
- POST Bulk upgrade agents
- DELETE Delete file uploaded by agent
- GET Get file uploaded by agent
- GET Get agent setup info
- POST Initiate agent setup
- GET List agent tags
Elastic Package Manager (EPM) 18
- POST Bulk get assets
- GET List package categories
- GET List packages
- POST Install by package by direct upload
- POST Bulk install packages
- DELETE Delete ackage
- GET Get package
- GET Get package
- POST Install package
- POST Install package
- DELETE Delete package
- PUT Update package settings
- GET Get package file
- POST Authorize transforms
- GET Get package stats
- GET Get limited package list
- GET Get inputs template
- GET Get package signature verification key ID
Fleet enrollment API keys 8
Fleet internals 4
Fleet Kubernetes 1
Fleet outputs 7
Fleet package policies 9
Fleet proxies 5
Fleet Server hosts 5
Fleet service tokens 2
Fleet uninstall tokens 2
Logstash configuration management 4
Machine learning 1
Maintenance windows 6
Roles 5
Saved objects 15
- POST Rotate a key for encrypted saved objects
- POST Create saved objects
- POST Delete saved objects
- POST Get saved objects
- POST Resolve saved objects
- POST Update saved objects
- POST Export saved objects
- GET Search for saved objects
- POST Import saved objects
- POST Resolve import errors
- POST Create a saved object
- POST Create a saved object
- GET Get a saved object
- PUT Update a saved object
- GET Resolve a saved object
Security AI assistant 19
- POST Apply a bulk action to anonymization fields
- GET Get anonymization fields
- POST Create a model response
- DELETE Delete conversations
- POST Create a conversation
- GET Get conversations
- DELETE Delete a conversation
- GET Get a conversation
- PUT Update a conversation
- GET Read a KnowledgeBase
- POST Create a KnowledgeBase
- POST Create a Knowledge Base Entry
- POST Applies a bulk action to multiple Knowledge Base Entries
- GET Finds Knowledge Base Entries that match the given query.
- DELETE Deletes a single Knowledge Base Entry using the `id` field
- GET Read a Knowledge Base Entry
- PUT Update a Knowledge Base Entry
- POST Apply a bulk action to prompts
- GET Get prompts
Security detections 29
- DELETE Delete an alerts index
- GET Reads the alert index name if it exists
- POST Create an alerts index
- GET Returns user privileges for the Kibana space
- DELETE Delete a detection rule
- GET Retrieve a detection rule
- PATCH Patch a detection rule
- POST Create a detection rule
- PUT Update a detection rule
- POST Apply a bulk action to detection rules
- POST Create multiple detection rules
- POST Delete multiple detection rules
- PATCH Patch multiple detection rules
- PUT Update multiple detection rules
- POST Export detection rules
- GET List all detection rules
- POST Import detection rules
- PUT Install prebuilt detection rules and Timelines
- GET Retrieve the status of prebuilt detection rules and Timelines
- POST Preview rule alerts generated on specified time range
- POST Assign and unassign users from detection alerts
- POST Finalize detection alert migrations
- DELETE Clean up detection alert migrations
- POST Initiate a detection alert migration
- POST Retrieve the status of detection alert migrations
- POST Find and/or aggregate detection alerts
- POST Set a detection alert status
- POST Add and remove detection alert tags
- GET List all detection rule tags
Security Elastic Endpoint exceptions 6
- POST Create an Elastic Endpoint rule exception list
- DELETE Delete an Elastic Endpoint exception list item
- GET Get an Elastic Endpoint rule exception list item
- POST Create an Elastic Endpoint rule exception list item
- PUT Update an Elastic Endpoint rule exception list item
- GET Get Elastic Endpoint exception list items
Security endpoint management 27
- GET Get response actions
- GET Get an action request log
- GET Get response actions status
- GET Get action details
- GET Get file information
- GET Download a file
- POST Run a command
- POST Get a file
- POST Isolate an endpoint
- POST Isolate an endpoint
- POST Terminate a process
- POST Get running processes
- POST Run a script
- POST Scan a file or directory
- GET Get actions state
- POST Suspend a process
- POST Release an isolated endpoint
- POST Release an isolated endpoint
- POST Upload a file
- GET Get a metadata list
- GET Get metadata
- GET Get metadata transforms
- GET Get a policy response
- GET Get an agent policy summary
- GET Get a protection updates note
- POST Create or update a protection updates note
- POST Get suggestions
Security entity analytics 18
- DELETE Delete an asset criticality record
- GET Get an asset criticality record
- POST Upsert an asset criticality record
- POST Bulk upsert asset criticality records
- GET List asset criticality records
- POST Initialize the Entity Store
- GET List the Entity Engines
- DELETE Delete the Entity Engine
- GET Get an Entity Engine
- POST Initialize an Entity Engine
- POST Start an Entity Engine
- POST Stop an Entity Engine
- POST Apply DataView indices to all installed engines
- GET List Entity Store Entities
- GET Get the status of the Entity Store
- DELETE Cleanup the Risk Engine
- PATCH Configure the Risk Engine Saved Object
- POST Run the risk scoring engine
Security exceptions 16
- POST Create rule exception list items
- DELETE Delete an exception list
- GET Get exception list details
- POST Create an exception list
- PUT Update an exception list
- POST Duplicate an exception list
- POST Export an exception list
- GET Get exception lists
- POST Import an exception list
- DELETE Delete an exception list item
- GET Get an exception list item
- POST Create an exception list item
- PUT Update an exception list item
- GET Get exception list items
- GET Get an exception list summary
- POST Create a shared exception list
Security lists 18
- DELETE Delete a list
- GET Get list details
- PATCH Patch a list
- POST Create a list
- PUT Update a list
- GET Get lists
- DELETE Delete list data streams
- GET Get status of list data streams
- POST Create list data streams
- DELETE Delete a list item
- GET Get a list item
- PATCH Patch a list item
- POST Create a list item
- PUT Update a list item
- POST Export list items
- GET Get list items
- POST Import list items
- GET Get list privileges
Security Osquery 14
- GET Get live queries
- POST Create a live query
- GET Get live query details
- GET Get live query results
- GET Get packs
- POST Create a pack
- DELETE Delete a pack
- GET Get pack details
- PUT Update a pack
- GET Get saved queries
- POST Create a saved query
- DELETE Delete a saved query
- GET Get saved query details
- PUT Update a saved query
Security timeline 17
- DELETE Delete a note
- GET Get notes
- PATCH Add or update a note
- PATCH Pin/unpin an event
- DELETE Delete Timelines or Timeline templates
- GET Get Timeline or Timeline template details
- PATCH Update a Timeline
- POST Create a Timeline or Timeline template
- GET Copies timeline or timeline template
- GET Get draft Timeline or Timeline template details
- POST Create a clean draft Timeline or Timeline template
- POST Export Timelines
- PATCH Favorite a Timeline or Timeline template
- POST Import Timelines
- POST Install prepackaged Timelines
- GET Get an existing saved Timeline or Timeline template
- GET Get Timelines or Timeline templates
Service level objectives 13
- GET Get a paginated list of SLOs
- POST Create an SLO
- POST Bulk delete SLO definitions and their associated summary and rollup data.
- GET Retrieve the status of the bulk deletion
- POST Batch delete rollup and summary data
- POST Batch delete rollup and summary data
- DELETE Delete an SLO
- GET Get an SLO
- PUT Update an SLO
- POST Reset an SLO
- POST Disable an SLO
- POST Enable an SLO
- GET Get the SLO definitions
Short URLs 4
Spaces 9
Synthetics 17
- GET Get monitors
- POST Create a monitor
- POST Delete monitors
- DELETE Delete a monitor
- GET Get a monitor
- PUT Update a monitor
- GET Get parameters
- POST Add parameters
- POST Delete parameters
- DELETE Delete a parameter
- GET Get a parameter
- PUT Update a parameter
- GET Get private locations
- POST Create a private location
- DELETE Delete a private location
- GET Get a private location
- PUT Update a private location