---
type: api
title: Update a pack
description: **Spaces method and path for this operation:**
url: https://www.elastic.co/elastic/docs-builder/docs/4493/api/doc/kibana/v8/operation/operation-osqueryupdatepacks
resource: https://www.elastic.co/elastic/docs-builder/docs/4493/api/doc/kibana/v8/operation/operation-osqueryupdatepacks
products:
  - Kibana
---

# Update a pack

- Server: `https://{kibana_url}`

## Paths

- `PUT` `/api/osquery/packs/{id}`
- `PUT` `/s/{space_id}/api/osquery/packs/{id}`

#### Path parameters

- `id` (string) — required
  Example: `3c42c847-eb30-4452-80e0-728584042334`

## Description

Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

Update a query pack using the pack ID.
> info
> You cannot update a prebuilt pack.

## Authentication

- Api key: `Authorization: <value>`
  These APIs use key-based authentication. You must create an API key and use the encoded value in the request header. For example: `Authorization: ApiKey base64AccessApiKey`
- Basic: `Authorization: Basic <credentials>`

## Request body

`application/json`

- `description` (string) — optional
  The pack description.
- `enabled` (boolean) — optional
  Enables the pack.
- `name` (string) — optional
  The pack name.
- `policy_ids` (string[]) — optional
  A list of agents policy IDs.
- `queries` (map string to object) — optional
  An object of queries.
  Map values (object)
  - `ecs_mapping` (map string to object) — optional
    Map osquery results columns or static values to Elastic Common Schema (ECS) fields
    Map values (object)
    - `field` (string) — optional
      The ECS field to map to.
    - `value` (union string | string[]) — optional
      The value to map to the ECS field.
  - `id` (string) — optional
    The ID of the query.
  - `platform` (string) — optional
    Restricts the query to a specified platform. The default is all platforms. To specify multiple platforms, use commas. For example, `linux,darwin`.
  - `query` (string) — optional
    The SQL query you want to run.
  - `removed` (boolean) — optional
    Indicates whether the query is removed.
  - `saved_query_id` (string) — optional
    The ID of a saved query.
  - `snapshot` (boolean) — optional
    Indicates whether the query is a snapshot.
  - `version` (string) — optional
    Uses the Osquery versions greater than or equal to the specified version string.
- `shards` (map string to number) — optional
  An object with shard configuration for policies included in the pack. For each policy, set the shard configuration to a percentage (1–100) of target hosts.

## Response

OK

`application/json`

Type: `object`

## Code examples

#### Console

```console
PUT kbn:/api/osquery/packs/3c42c847-eb30-4452-80e0-728584042334
{
  "name": "updated_my_pack_name"
}
```

#### curl

```curl
curl -X PUT "${KIBANA_URL}/api/osquery/packs/3c42c847-eb30-4452-80e0-728584042334" \
  -H "Authorization: ApiKey ${API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "updated_my_pack_name"
  }'
```