Update a managed integration

Base URL: https://{kibana_url}

PUT /api/fleet/managed_integrations/{policyId}
PUT /s/{space_id}/api/fleet/managed_integrations/{policyId}

Refer to Spaces for more information.

Update a managed integration by ID. Uses full-replace semantics: the policy is rebuilt entirely from the request body, so any omitted optional field (for example, description, vars, global_data_tags, cloud_connector) is cleared or reset to its default. The integration package name is immutable and the runtime-managed cluster_id is preserved from the existing policy.

Authentication

Api key

Authorization: <value>

These APIs use key-based authentication. You must create an API key and use the encoded value in the request header. For example: Authorization: ApiKey base64AccessApiKey

Basic

Authorization: Basic <credentials>

Path parameters

Header parameters

Request body

additional_datastreams_permissions string[] · max items: 100 nullable: Additional data stream permissions that will be added to the agent policy.
cloud_connector object nullable
create_dataset_templates boolean: When true, install dedicated index templates for streams with a custom data_stream.dataset. Defaults to true for input packages, false for integration packages.
description string · max length: 2048: Policy description.
force boolean: Force package policy creation even if the package is not verified, or if the agent policy is managed.
global_data_tags object[] · max items: 100
id string · max length: 255: Policy unique identifier.
inputs map string to object: Package policy inputs. Refer to the integration documentation to know which inputs are available.
name string · max length: 255 required: Unique name for the policy.
namespace string · max length: 100: Policy namespace. When not specified, it inherits the agent policy namespace.
package object required
policy_template string · max length: 256: The policy template to use for the managed integration. If not provided, the default policy template is used.
var_group_selections map string to string: Variable group selections. Maps var_group name to the selected option name within that group.
vars map string to anyOf: Input/stream level variable. Refer to the integration documentation for more information.

Responses

Indicates a successful response

application/json

item object required

Bad Request

application/json

Not Found

application/json

Conflict — for example, the requested name is already used by another integration policy.

application/json

Base URL: https://{kibana_url}

Examples

Request Console 1 / 2 languages

Example request to attach an AWS cloud connector to a managed integration on update. Because PUT is full-replace, the cloud_connector block must be present on every subsequent update or the connector is detached.

Console Kibana Dev Tools

PUT kbn:/api/fleet/managed_integrations/POLICY_ID
{
  "cloud_connector": {
    "enabled": true,
    "target_csp": "aws"
  },
  "description": "CSPM integration for AWS with cloud connector",
  "inputs": {
    "cspm-cloudbeat/cis_aws": {
      "enabled": true,
      "streams": {
        "cloud_security_posture.findings": {
          "enabled": true,
          "vars": {
            "aws.account_type": "organization-account",
            "aws.credentials.type": "cloud_connector",
            "aws.supports_cloud_connectors": true,
            "external_id": {
              "id": "ABCDEFGHIJKLMNOPQRST",
              "isSecretRef": true
            },
            "role_arn": "arn:aws:iam::123456789012:role/TestRole"
          }
        }
      },
      "vars": {
        "cloud_formation_template": "https://console.aws.amazon.com/cloudformation/home#/stacks/quickcreate?templateURL=https://elastic-cspm-cft.s3.eu-central-1.amazonaws.com/cloudformation-cspm-ACCOUNT_TYPE-9.2.0.yml"
      }
    },
    "cspm-cloudbeat/cis_azure": {
      "enabled": false
    },
    "cspm-cloudbeat/cis_gcp": {
      "enabled": false
    }
  },
  "name": "cspm-aws-policy",
  "namespace": "default",
  "package": {
    "name": "cloud_security_posture",
    "version": "3.1.1"
  },
  "vars": {
    "deployment": "aws",
    "posture": "cspm"
  }
}

Generated from the API spec

curl Shell

curl -X PUT "${KIBANA_URL}/api/fleet/managed_integrations/${POLICY_ID}" \
  -H "kbn-xsrf: true" \
  -H "Authorization: ApiKey ${API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{
    "cloud_connector": {
      "enabled": true,
      "target_csp": "aws"
    },
    "description": "CSPM integration for AWS with cloud connector",
    "inputs": {
      "cspm-cloudbeat/cis_aws": {
        "enabled": true,
        "streams": {
          "cloud_security_posture.findings": {
            "enabled": true,
            "vars": {
              "aws.account_type": "organization-account",
              "aws.credentials.type": "cloud_connector",
              "aws.supports_cloud_connectors": true,
              "external_id": {
                "id": "ABCDEFGHIJKLMNOPQRST",
                "isSecretRef": true
              },
              "role_arn": "arn:aws:iam::123456789012:role/TestRole"
            }
          }
        },
        "vars": {
          "cloud_formation_template": "https://console.aws.amazon.com/cloudformation/home#/stacks/quickcreate?templateURL=https://elastic-cspm-cft.s3.eu-central-1.amazonaws.com/cloudformation-cspm-ACCOUNT_TYPE-9.2.0.yml"
        }
      },
      "cspm-cloudbeat/cis_azure": {
        "enabled": false
      },
      "cspm-cloudbeat/cis_gcp": {
        "enabled": false
      }
    },
    "name": "cspm-aws-policy",
    "namespace": "default",
    "package": {
      "name": "cloud_security_posture",
      "version": "3.1.1"
    },
    "vars": {
      "deployment": "aws",
      "posture": "cspm"
    }
  }'

Generated from the API spec

Response

Example response for updating a managed integration

{
  "item": {
    "created_at": "2025-11-06T18:27:43.541Z",
    "created_by": "test_user",
    "description": "updated description",
    "id": "d52a7812-5736-4fdc-aed8-72152afa1ffa",
    "inputs": {
      "ESS Billing-cel": {
        "enabled": true,
        "streams": {
          "ess_billing.billing": {
            "enabled": true,
            "vars": {
              "hide_sensitive": true,
              "http_client_timeout": "30s",
              "lookbehind": 180,
              "tags": [
                "forwarded",
                "billing"
              ]
            }
          },
          "ess_billing.credits": {
            "enabled": true
          }
        },
        "vars": {
          "api_key": {
            "id": "QY1sWpoBbWcMW-edr0Ee",
            "isSecretRef": true
          },
          "organization_id": "1234",
          "url": "https://billing.elastic-cloud.com"
        }
      }
    },
    "name": "ess_billing-1",
    "namespace": "default",
    "package": {
      "name": "ess_billing",
      "title": "Elasticsearch Service Billing",
      "version": "1.6.0"
    },
    "updated_at": "2025-11-07T09:14:02.118Z",
    "updated_by": "test_user"
  }
}

{
  "error": "Bad Request",
  "message": "An error message describing what went wrong",
  "statusCode": 400
}

{
  "message": "Agentless policy d52a7812-5736-4fdc-aed8-72152afa1ffa not found"
}

{
  "error": "Conflict",
  "message": "An integration policy with the name my-agentless-policy already exists. Please rename it or choose a different name.",
  "statusCode": 409
}

Request Console 1 / 2 languages

Example showing full-replace clearing semantics. Compared to the prior state, this request omits description (clearing it) and provides only the minimal required fields. Any optional field not present in the body (for example, description, vars, global_data_tags, cloud_connector) is dropped from the resulting policy.

Console Kibana Dev Tools

PUT kbn:/api/fleet/managed_integrations/POLICY_ID
{
  "inputs": {
    "ESS Billing-cel": {
      "enabled": true,
      "streams": {
        "ess_billing.billing": {
          "enabled": true
        },
        "ess_billing.credits": {
          "enabled": true
        }
      },
      "vars": {
        "api_key": "\u003CREPLACE_WITH_YOUR_API_KEY\u003E",
        "organization_id": "1234"
      }
    }
  },
  "name": "ess_billing-1",
  "namespace": "default",
  "package": {
    "name": "ess_billing",
    "version": "1.6.0"
  }
}

Generated from the API spec

curl Shell

curl -X PUT "${KIBANA_URL}/api/fleet/managed_integrations/${POLICY_ID}" \
  -H "kbn-xsrf: true" \
  -H "Authorization: ApiKey ${API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{
    "inputs": {
      "ESS Billing-cel": {
        "enabled": true,
        "streams": {
          "ess_billing.billing": {
            "enabled": true
          },
          "ess_billing.credits": {
            "enabled": true
          }
        },
        "vars": {
          "api_key": "\u003CREPLACE_WITH_YOUR_API_KEY\u003E",
          "organization_id": "1234"
        }
      }
    },
    "name": "ess_billing-1",
    "namespace": "default",
    "package": {
      "name": "ess_billing",
      "version": "1.6.0"
    }
  }'

Generated from the API spec

Response

Example response for updating a managed integration

{
  "item": {
    "created_at": "2025-11-06T18:27:43.541Z",
    "created_by": "test_user",
    "description": "updated description",
    "id": "d52a7812-5736-4fdc-aed8-72152afa1ffa",
    "inputs": {
      "ESS Billing-cel": {
        "enabled": true,
        "streams": {
          "ess_billing.billing": {
            "enabled": true,
            "vars": {
              "hide_sensitive": true,
              "http_client_timeout": "30s",
              "lookbehind": 180,
              "tags": [
                "forwarded",
                "billing"
              ]
            }
          },
          "ess_billing.credits": {
            "enabled": true
          }
        },
        "vars": {
          "api_key": {
            "id": "QY1sWpoBbWcMW-edr0Ee",
            "isSecretRef": true
          },
          "organization_id": "1234",
          "url": "https://billing.elastic-cloud.com"
        }
      }
    },
    "name": "ess_billing-1",
    "namespace": "default",
    "package": {
      "name": "ess_billing",
      "title": "Elasticsearch Service Billing",
      "version": "1.6.0"
    },
    "updated_at": "2025-11-07T09:14:02.118Z",
    "updated_by": "test_user"
  }
}

{
  "error": "Bad Request",
  "message": "An error message describing what went wrong",
  "statusCode": 400
}

{
  "message": "Agentless policy d52a7812-5736-4fdc-aed8-72152afa1ffa not found"
}

{
  "error": "Conflict",
  "message": "An integration policy with the name my-agentless-policy already exists. Please rename it or choose a different name.",
  "statusCode": 409
}

Request Console 1 / 2 languages

Example request to update a managed integration. PUT uses full-replace semantics: the policy is rebuilt entirely from this body, so any omitted optional field is cleared or reset to its default rather than preserved. For example, omitting description clears it, omitting vars or global_data_tags removes them, and omitting cloud_connector detaches any previously attached connector. Detaching or swapping a cloud connector only removes the reference; the connector itself is not deleted, as connectors have an independent, shareable lifecycle and are managed through the cloud connector API. Two fields are exceptions that cannot be changed using PUT: the integration package.name is immutable, and the runtime-managed cluster_id is preserved from the existing agent policy.

Console Kibana Dev Tools

PUT kbn:/api/fleet/managed_integrations/POLICY_ID
{
  "description": "updated description",
  "inputs": {
    "ESS Billing-cel": {
      "enabled": true,
      "streams": {
        "ess_billing.billing": {
          "enabled": true,
          "vars": {
            "hide_sensitive": true,
            "http_client_timeout": "30s",
            "lookbehind": 180,
            "tags": [
              "forwarded",
              "billing"
            ]
          }
        },
        "ess_billing.credits": {
          "enabled": true
        }
      },
      "vars": {
        "api_key": "\u003CREPLACE_WITH_YOUR_API_KEY\u003E",
        "organization_id": "1234"
      }
    }
  },
  "name": "ess_billing-1",
  "namespace": "default",
  "package": {
    "name": "ess_billing",
    "version": "1.6.0"
  }
}

Generated from the API spec

curl Shell

curl -X PUT "${KIBANA_URL}/api/fleet/managed_integrations/${POLICY_ID}" \
  -H "kbn-xsrf: true" \
  -H "Authorization: ApiKey ${API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{
    "description": "updated description",
    "inputs": {
      "ESS Billing-cel": {
        "enabled": true,
        "streams": {
          "ess_billing.billing": {
            "enabled": true,
            "vars": {
              "hide_sensitive": true,
              "http_client_timeout": "30s",
              "lookbehind": 180,
              "tags": [
                "forwarded",
                "billing"
              ]
            }
          },
          "ess_billing.credits": {
            "enabled": true
          }
        },
        "vars": {
          "api_key": "\u003CREPLACE_WITH_YOUR_API_KEY\u003E",
          "organization_id": "1234"
        }
      }
    },
    "name": "ess_billing-1",
    "namespace": "default",
    "package": {
      "name": "ess_billing",
      "version": "1.6.0"
    }
  }'

Generated from the API spec

Response

Example response for updating a managed integration

{
  "item": {
    "created_at": "2025-11-06T18:27:43.541Z",
    "created_by": "test_user",
    "description": "updated description",
    "id": "d52a7812-5736-4fdc-aed8-72152afa1ffa",
    "inputs": {
      "ESS Billing-cel": {
        "enabled": true,
        "streams": {
          "ess_billing.billing": {
            "enabled": true,
            "vars": {
              "hide_sensitive": true,
              "http_client_timeout": "30s",
              "lookbehind": 180,
              "tags": [
                "forwarded",
                "billing"
              ]
            }
          },
          "ess_billing.credits": {
            "enabled": true
          }
        },
        "vars": {
          "api_key": {
            "id": "QY1sWpoBbWcMW-edr0Ee",
            "isSecretRef": true
          },
          "organization_id": "1234",
          "url": "https://billing.elastic-cloud.com"
        }
      }
    },
    "name": "ess_billing-1",
    "namespace": "default",
    "package": {
      "name": "ess_billing",
      "title": "Elasticsearch Service Billing",
      "version": "1.6.0"
    },
    "updated_at": "2025-11-07T09:14:02.118Z",
    "updated_by": "test_user"
  }
}

{
  "error": "Bad Request",
  "message": "An error message describing what went wrong",
  "statusCode": 400
}

{
  "message": "Agentless policy d52a7812-5736-4fdc-aed8-72152afa1ffa not found"
}

{
  "error": "Conflict",
  "message": "An integration policy with the name my-agentless-policy already exists. Please rename it or choose a different name.",
  "statusCode": 409
}

Request Console 1 / 2 languages

Example request to update a managed integration reusing an existing AWS cloud connector by ID instead of creating a new one.

Console Kibana Dev Tools

PUT kbn:/api/fleet/managed_integrations/POLICY_ID
{
  "cloud_connector": {
    "cloud_connector_id": "existing-aws-connector-id",
    "enabled": true,
    "target_csp": "aws"
  },
  "description": "CSPM integration for AWS reusing existing cloud connector",
  "inputs": {
    "cspm-cloudbeat/cis_aws": {
      "enabled": true,
      "streams": {
        "cloud_security_posture.findings": {
          "enabled": true,
          "vars": {
            "aws.account_type": "organization-account",
            "aws.credentials.type": "cloud_connector",
            "aws.supports_cloud_connectors": true,
            "external_id": {
              "id": "ABCDEFGHIJKLMNOPQRST",
              "isSecretRef": true
            },
            "role_arn": "arn:aws:iam::123456789012:role/TestRole"
          }
        }
      },
      "vars": {
        "cloud_formation_template": "https://console.aws.amazon.com/cloudformation/home#/stacks/quickcreate?templateURL=https://elastic-cspm-cft.s3.eu-central-1.amazonaws.com/cloudformation-cspm-ACCOUNT_TYPE-9.2.0.yml"
      }
    },
    "cspm-cloudbeat/cis_azure": {
      "enabled": false
    },
    "cspm-cloudbeat/cis_gcp": {
      "enabled": false
    }
  },
  "name": "cspm-aws-policy",
  "namespace": "default",
  "package": {
    "name": "cloud_security_posture",
    "version": "3.1.1"
  },
  "vars": {
    "deployment": "aws",
    "posture": "cspm"
  }
}

Generated from the API spec

curl Shell

curl -X PUT "${KIBANA_URL}/api/fleet/managed_integrations/${POLICY_ID}" \
  -H "kbn-xsrf: true" \
  -H "Authorization: ApiKey ${API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{
    "cloud_connector": {
      "cloud_connector_id": "existing-aws-connector-id",
      "enabled": true,
      "target_csp": "aws"
    },
    "description": "CSPM integration for AWS reusing existing cloud connector",
    "inputs": {
      "cspm-cloudbeat/cis_aws": {
        "enabled": true,
        "streams": {
          "cloud_security_posture.findings": {
            "enabled": true,
            "vars": {
              "aws.account_type": "organization-account",
              "aws.credentials.type": "cloud_connector",
              "aws.supports_cloud_connectors": true,
              "external_id": {
                "id": "ABCDEFGHIJKLMNOPQRST",
                "isSecretRef": true
              },
              "role_arn": "arn:aws:iam::123456789012:role/TestRole"
            }
          }
        },
        "vars": {
          "cloud_formation_template": "https://console.aws.amazon.com/cloudformation/home#/stacks/quickcreate?templateURL=https://elastic-cspm-cft.s3.eu-central-1.amazonaws.com/cloudformation-cspm-ACCOUNT_TYPE-9.2.0.yml"
        }
      },
      "cspm-cloudbeat/cis_azure": {
        "enabled": false
      },
      "cspm-cloudbeat/cis_gcp": {
        "enabled": false
      }
    },
    "name": "cspm-aws-policy",
    "namespace": "default",
    "package": {
      "name": "cloud_security_posture",
      "version": "3.1.1"
    },
    "vars": {
      "deployment": "aws",
      "posture": "cspm"
    }
  }'

Generated from the API spec

Response

Example response for updating a managed integration

{
  "item": {
    "created_at": "2025-11-06T18:27:43.541Z",
    "created_by": "test_user",
    "description": "updated description",
    "id": "d52a7812-5736-4fdc-aed8-72152afa1ffa",
    "inputs": {
      "ESS Billing-cel": {
        "enabled": true,
        "streams": {
          "ess_billing.billing": {
            "enabled": true,
            "vars": {
              "hide_sensitive": true,
              "http_client_timeout": "30s",
              "lookbehind": 180,
              "tags": [
                "forwarded",
                "billing"
              ]
            }
          },
          "ess_billing.credits": {
            "enabled": true
          }
        },
        "vars": {
          "api_key": {
            "id": "QY1sWpoBbWcMW-edr0Ee",
            "isSecretRef": true
          },
          "organization_id": "1234",
          "url": "https://billing.elastic-cloud.com"
        }
      }
    },
    "name": "ess_billing-1",
    "namespace": "default",
    "package": {
      "name": "ess_billing",
      "title": "Elasticsearch Service Billing",
      "version": "1.6.0"
    },
    "updated_at": "2025-11-07T09:14:02.118Z",
    "updated_by": "test_user"
  }
}

{
  "error": "Bad Request",
  "message": "An error message describing what went wrong",
  "statusCode": 400
}

{
  "message": "Agentless policy d52a7812-5736-4fdc-aed8-72152afa1ffa not found"
}

{
  "error": "Conflict",
  "message": "An integration policy with the name my-agentless-policy already exists. Please rename it or choose a different name.",
  "statusCode": 409
}

Request Console 1 / 2 languages

Example request to update a managed integration to a different package version. The package name is immutable, but the version may change.

Console Kibana Dev Tools

PUT kbn:/api/fleet/managed_integrations/POLICY_ID
{
  "description": "bumped to a newer package version",
  "inputs": {
    "ESS Billing-cel": {
      "enabled": true,
      "streams": {
        "ess_billing.billing": {
          "enabled": true
        },
        "ess_billing.credits": {
          "enabled": false
        }
      },
      "vars": {
        "api_key": "\u003CREPLACE_WITH_YOUR_API_KEY\u003E",
        "organization_id": "1234"
      }
    }
  },
  "name": "ess_billing-1",
  "namespace": "default",
  "package": {
    "name": "ess_billing",
    "version": "1.7.0"
  }
}

Generated from the API spec

curl Shell

curl -X PUT "${KIBANA_URL}/api/fleet/managed_integrations/${POLICY_ID}" \
  -H "kbn-xsrf: true" \
  -H "Authorization: ApiKey ${API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{
    "description": "bumped to a newer package version",
    "inputs": {
      "ESS Billing-cel": {
        "enabled": true,
        "streams": {
          "ess_billing.billing": {
            "enabled": true
          },
          "ess_billing.credits": {
            "enabled": false
          }
        },
        "vars": {
          "api_key": "\u003CREPLACE_WITH_YOUR_API_KEY\u003E",
          "organization_id": "1234"
        }
      }
    },
    "name": "ess_billing-1",
    "namespace": "default",
    "package": {
      "name": "ess_billing",
      "version": "1.7.0"
    }
  }'

Generated from the API spec

Response

Example response for updating a managed integration

{
  "item": {
    "created_at": "2025-11-06T18:27:43.541Z",
    "created_by": "test_user",
    "description": "updated description",
    "id": "d52a7812-5736-4fdc-aed8-72152afa1ffa",
    "inputs": {
      "ESS Billing-cel": {
        "enabled": true,
        "streams": {
          "ess_billing.billing": {
            "enabled": true,
            "vars": {
              "hide_sensitive": true,
              "http_client_timeout": "30s",
              "lookbehind": 180,
              "tags": [
                "forwarded",
                "billing"
              ]
            }
          },
          "ess_billing.credits": {
            "enabled": true
          }
        },
        "vars": {
          "api_key": {
            "id": "QY1sWpoBbWcMW-edr0Ee",
            "isSecretRef": true
          },
          "organization_id": "1234",
          "url": "https://billing.elastic-cloud.com"
        }
      }
    },
    "name": "ess_billing-1",
    "namespace": "default",
    "package": {
      "name": "ess_billing",
      "title": "Elasticsearch Service Billing",
      "version": "1.6.0"
    },
    "updated_at": "2025-11-07T09:14:02.118Z",
    "updated_by": "test_user"
  }
}

{
  "error": "Bad Request",
  "message": "An error message describing what went wrong",
  "statusCode": 400
}

{
  "message": "Agentless policy d52a7812-5736-4fdc-aed8-72152afa1ffa not found"
}

{
  "error": "Conflict",
  "message": "An integration policy with the name my-agentless-policy already exists. Please rename it or choose a different name.",
  "statusCode": 409
}

Authentication

Path parameters

Header parameters

Request body { }

Responses

Request body