---
type: api
title: Create a pack
description: **Spaces method and path for this operation:**
url: https://www.elastic.co/elastic/docs-builder/docs/4493/api/doc/kibana/v8/operation/operation-osquerycreatepacks
resource: https://www.elastic.co/elastic/docs-builder/docs/4493/api/doc/kibana/v8/operation/operation-osquerycreatepacks
products:
  - Kibana
---

# Create a pack

- Server: `https://{kibana_url}`

## Paths

- `POST` `/api/osquery/packs`
- `POST` `/s/{space_id}/api/osquery/packs`

## Description

Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

Create a query pack.

## Authentication

- Api key: `Authorization: <value>`
  These APIs use key-based authentication. You must create an API key and use the encoded value in the request header. For example: `Authorization: ApiKey base64AccessApiKey`
- Basic: `Authorization: Basic <credentials>`

## Request body

`application/json`

- `description` (string) — optional
  The pack description.
- `enabled` (boolean) — optional
  Enables the pack.
- `name` (string) — optional
  The pack name.
- `policy_ids` (string[]) — optional
  A list of agents policy IDs.
- `queries` (map string to object) — optional
  An object of queries.
  Map values (object)
  - `ecs_mapping` (map string to object) — optional
    Map osquery results columns or static values to Elastic Common Schema (ECS) fields
    Map values (object)
    - `field` (string) — optional
      The ECS field to map to.
    - `value` (union string | string[]) — optional
      The value to map to the ECS field.
  - `id` (string) — optional
    The ID of the query.
  - `platform` (string) — optional
    Restricts the query to a specified platform. The default is all platforms. To specify multiple platforms, use commas. For example, `linux,darwin`.
  - `query` (string) — optional
    The SQL query you want to run.
  - `removed` (boolean) — optional
    Indicates whether the query is removed.
  - `saved_query_id` (string) — optional
    The ID of a saved query.
  - `snapshot` (boolean) — optional
    Indicates whether the query is a snapshot.
  - `version` (string) — optional
    Uses the Osquery versions greater than or equal to the specified version string.
- `shards` (map string to number) — optional
  An object with shard configuration for policies included in the pack. For each policy, set the shard configuration to a percentage (1–100) of target hosts.

## Response

OK

`application/json`

Type: `object`

## Code examples

#### Console

```console
POST kbn:/api/osquery/packs
{
  "description": "My pack",
  "enabled": true,
  "name": "my_pack",
  "policy_ids": [
    "my_policy_id",
    "fleet-server-policy"
  ],
  "queries": {
    "my_query": {
      "ecs_mapping": {
        "client.port": {
          "field": "port"
        },
        "tags": {
          "value": [
            "tag1",
            "tag2"
          ]
        }
      },
      "interval": 60,
      "query": "SELECT * FROM listening_ports;",
      "timeout": 120
    }
  },
  "shards": {
    "fleet-server-policy": 58,
    "my_policy_id": 35
  }
}
```

#### curl

```curl
curl -X POST "${KIBANA_URL}/api/osquery/packs" \
  -H "Authorization: ApiKey ${API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{
    "description": "My pack",
    "enabled": true,
    "name": "my_pack",
    "policy_ids": [
      "my_policy_id",
      "fleet-server-policy"
    ],
    "queries": {
      "my_query": {
        "ecs_mapping": {
          "client.port": {
            "field": "port"
          },
          "tags": {
            "value": [
              "tag1",
              "tag2"
            ]
          }
        },
        "interval": 60,
        "query": "SELECT * FROM listening_ports;",
        "timeout": 120
      }
    },
    "shards": {
      "fleet-server-policy": 58,
      "my_policy_id": 35
    }
  }'
```