Install a package by upload

Base URL: https://{kibana_url}

POST /api/fleet/epm/packages
POST /s/{space_id}/api/fleet/epm/packages

Refer to Spaces for more information.

Install a package by uploading a .zip or .tar.gz archive (max 100MB).

Archives that contain Kibana assets requiring additional privileges are subject to a preflight authorization check before the package is installed. Privileges are checked in every space the package will be installed into.

The following asset types require the corresponding Kibana API privilege:

security_rule: rules-all
security_rule with type machine_learning: rules-all and ml:canCreateJob
security_ai_prompt: elasticAssistant

If any required privilege is missing, the request returns 403 and no assets are written. To learn more, refer to Upload an integration to Kibana.

Required authorization

Authentication

Query parameters

Header parameters

Request body

Responses

Successful response

application/gzip; application/zip

Bad Request

application/gzip; application/zip

Forbidden. The caller lacks a Kibana API privilege required by an asset in the archive. No assets are written.

application/gzip; application/zip

Base URL: https://{kibana_url}

Examples

Request Console 1 / 2 languages

Upload a .zip or .tar.gz package archive (max 100MB)

Console Kibana Dev Tools

POST kbn:/api/fleet/epm/packages
<binary package archive>

Generated from the API spec

curl Shell

curl -X POST "${KIBANA_URL}/api/fleet/epm/packages" \
  -H "kbn-xsrf: true" \
  -H "Authorization: ApiKey ${API_KEY}" \
  -H "Content-Type: application/gzip" \
  -d '<binary package archive>'

Generated from the API spec

Response

Package successfully installed from upload

{
  "_meta": {
    "install_source": "upload"
  },
  "items": [
    {
      "id": "my-custom-package-logs-default",
      "type": "index_template"
    }
  ]
}

{
  "error": "Bad Request",
  "message": "An error message describing what went wrong",
  "statusCode": 400
}

{
  "error": "Forbidden",
  "message": "Insufficient privileges to upload this package",
  "statusCode": 403
}