Create a value list item

Base URL: https://{kibana_url}

POST /api/lists/items
POST /s/{space_id}/api/lists/items

Refer to Spaces for more information.

Create a value list item and associate it with the specified value list.

All value list items in the same list must be the same type. For example, each list item in an ip list must define a specific IP address.

Note

Before creating a list item, you must create a list.

Authentication

Api key

Authorization: <value>

These APIs use key-based authentication. You must create an API key and use the encoded value in the request header. For example: Authorization: ApiKey base64AccessApiKey

Basic

Authorization: Basic <credentials>

Request body

Responses

Successful response

application/json

Invalid input data response

application/json

Unsuccessful authentication response

application/json

Not enough privileges response

application/json

Not enough privileges response

application/json

List item already exists response

application/json

Internal server error response

application/json

Base URL: https://{kibana_url}

Examples

Request Console 1 / 2 languages

Console Kibana Dev Tools

POST kbn:/api/lists/items
{
  "list_id": "ip_list",
  "value": "127.0.0.1"
}

Generated from the API spec

curl Shell

curl -X POST "${KIBANA_URL}/api/lists/items" \
  -H "Authorization: ApiKey ${API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{
    "list_id": "ip_list",
    "value": "127.0.0.1"
  }'

Generated from the API spec

Response

{
  "_version": "WzAsMV0=",
  "@timestamp": "2025-01-08T04:59:06.154Z",
  "created_at": "2025-01-08T04:59:06.154Z",
  "created_by": "elastic",
  "id": "21b01cfb-058d-44b9-838c-282be16c91cc",
  "list_id": "ip_list",
  "tie_breaker_id": "b57c762c-3036-465c-9bfb-7bfb5e6e515a",
  "type": "ip",
  "updated_at": "2025-01-08T04:59:06.154Z",
  "updated_by": "elastic",
  "value": "127.0.0.1"
}

{
  "error": "Bad Request",
  "message": "uri [/api/lists/items] with method [post] exists but is not available with the current configuration",
  "statusCode": 400
}

{
  "error": "Unauthorized",
  "message": "[security_exception\\n\\tRoot causes:\\n\\t\\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]",
  "statusCode": 401
}

{
  "error": "Forbidden",
  "message": "API [POST /api/lists/items] is unauthorized for user, this action is granted by the Kibana privileges [lists-all]",
  "statusCode": 403
}

{
  "message": "list id: \\\u0022ip_list\\\u0022 does not exist",
  "status_code": 404
}

{
  "message": "list item id: \\\u0022ip_item\\\u0022 already exists",
  "status_code": 409
}

{
  "message": "Internal Server Error",
  "status_code": 500
}

Request Console 1 / 2 languages

Console Kibana Dev Tools

POST kbn:/api/lists/items
{
  "list_id": "ip_range_list",
  "value": "192.168.0.0/16"
}

Generated from the API spec

curl Shell

curl -X POST "${KIBANA_URL}/api/lists/items" \
  -H "Authorization: ApiKey ${API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{
    "list_id": "ip_range_list",
    "value": "192.168.0.0/16"
  }'

Generated from the API spec

Response

{
  "_version": "WzEsMV0=",
  "@timestamp": "2025-01-09T18:33:08.202Z",
  "created_at": "2025-01-09T18:33:08.202Z",
  "created_by": "elastic",
  "id": "ip_range_item",
  "list_id": "ip_range_list",
  "tie_breaker_id": "ea1b4189-efda-4637-b8f9-74655a5ebb61",
  "type": "ip_range",
  "updated_at": "2025-01-09T18:33:08.202Z",
  "updated_by": "elastic",
  "value": "192.168.0.0/16"
}

{
  "error": "Bad Request",
  "message": "uri [/api/lists/items] with method [post] exists but is not available with the current configuration",
  "statusCode": 400
}

{
  "error": "Unauthorized",
  "message": "[security_exception\\n\\tRoot causes:\\n\\t\\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]",
  "statusCode": 401
}

{
  "error": "Forbidden",
  "message": "API [POST /api/lists/items] is unauthorized for user, this action is granted by the Kibana privileges [lists-all]",
  "statusCode": 403
}

{
  "message": "list id: \\\u0022ip_list\\\u0022 does not exist",
  "status_code": 404
}

{
  "message": "list item id: \\\u0022ip_item\\\u0022 already exists",
  "status_code": 409
}

{
  "message": "Internal Server Error",
  "status_code": 500
}

Request Console 1 / 2 languages

Console Kibana Dev Tools

POST kbn:/api/lists/items
{
  "list_id": "keyword_list",
  "value": "zeek"
}

Generated from the API spec

curl Shell

curl -X POST "${KIBANA_URL}/api/lists/items" \
  -H "Authorization: ApiKey ${API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{
    "list_id": "keyword_list",
    "value": "zeek"
  }'

Generated from the API spec

Response

{
  "_version": "WzIsMV0=",
  "@timestamp": "2025-01-09T18:34:29.422Z",
  "created_at": "2025-01-09T18:34:29.422Z",
  "created_by": "elastic",
  "id": "7f24737d-1da8-4626-a568-33070591bb4e",
  "list_id": "keyword_list",
  "tie_breaker_id": "2108ced2-5e5d-401e-a88e-4dd69fc5fa27",
  "type": "keyword",
  "updated_at": "2025-01-09T18:34:29.422Z",
  "updated_by": "elastic",
  "value": "zeek"
}

{
  "error": "Bad Request",
  "message": "uri [/api/lists/items] with method [post] exists but is not available with the current configuration",
  "statusCode": 400
}

{
  "error": "Unauthorized",
  "message": "[security_exception\\n\\tRoot causes:\\n\\t\\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]",
  "statusCode": 401
}

{
  "error": "Forbidden",
  "message": "API [POST /api/lists/items] is unauthorized for user, this action is granted by the Kibana privileges [lists-all]",
  "statusCode": 403
}

{
  "message": "list id: \\\u0022ip_list\\\u0022 does not exist",
  "status_code": 404
}

{
  "message": "list item id: \\\u0022ip_item\\\u0022 already exists",
  "status_code": 409
}

{
  "message": "Internal Server Error",
  "status_code": 500
}

Authentication

Request body { }

Responses

Request body