Create a package policy

Base URL: https://{kibana_url}

POST /api/fleet/package_policies
POST /s/{space_id}/api/fleet/package_policies

Refer to Spaces for more information.

Create a new package policy and assign it to an agent policy.

Authentication

Api key

Authorization: <value>

These APIs use key-based authentication. You must create an API key and use the encoded value in the request header. For example: Authorization: ApiKey base64AccessApiKey

Basic

Authorization: Basic <credentials>

Query parameters

Header parameters

Request body

Any of:

additional_datastreams_permissions string[] · max items: 1000 nullable: Additional data stream permissions that will be added to the agent policy.
cloud_connector_id string nullable: ID of the cloud connector associated with this package policy.
cloud_connector_name string · min length: 1 · max length: 255 nullable: Transient field for cloud connector name during creation.
condition string · max length: 10000 nullable: Agent condition expression to evaluate whether to apply this integration to its inputs.
create_dataset_templates boolean: When true, install dedicated index templates for streams with a custom data_stream.dataset. Defaults to true for input packages, false for integration packages.
description string: Package policy description
enabled boolean
force boolean: Force package policy creation even if the package is not verified, or if the agent policy is managed.
global_data_tags object[] · max items: 100 nullable
id string: Package policy unique identifier
inputs object[] · max items: 1000 required
is_managed boolean
name string required: Unique name for the package policy.
namespace string · max length: 100: The package policy namespace. Leave blank to inherit the agent policy's namespace.
output_id string nullable
overrides object nullable: Override settings that are defined in the package policy. The override option should be used only in unusual circumstances and not as a routine procedure.
package object
package_agent_version_condition string
policy_id string nullable deprecated: ID of the agent policy which the package policy will be added to.
policy_ids string[] · max items: 1000
spaceIds string[] · max items: 100
supports_agentless boolean nullable deprecated: Indicates whether the package policy belongs to an agentless agent policy. Deprecated in favor of the Fleet managed integrations API.
supports_cloud_connector boolean nullable: Indicates whether the package policy supports cloud connectors.
var_group_selections map string to string: Variable group selections. Maps var_group name to the selected option name within that group.
vars map string to object: Package variable (see integration documentation for more information)

additional_datastreams_permissions string[] · max items: 100 nullable: Additional data stream permissions that will be added to the agent policy.
condition string · max length: 10000 nullable: Agent condition expression to evaluate whether to apply this integration to its inputs.
create_dataset_templates boolean: When true, install dedicated index templates for streams with a custom data_stream.dataset. Defaults to true for input packages, false for integration packages.
description string · max length: 2048: Policy description.
force boolean: Force package policy creation even if the package is not verified, or if the agent policy is managed.
id string · max length: 255: Policy unique identifier.
inputs map string to object: Package policy inputs. Refer to the integration documentation to know which inputs are available.
name string · max length: 255 required: Unique name for the policy.
namespace string · max length: 100: Policy namespace. When not specified, it inherits the agent policy namespace.
output_id string · max length: 255 nullable
package object required: Same fields as package in create_package_policy_request
policy_id string · max length: 255 nullable deprecated: Deprecated. Use policy_ids instead.
policy_ids string[] · max items: 1000: IDs of the agent policies that the package policy will be added to.
supports_agentless boolean nullable deprecated: Indicates whether the package policy belongs to an agentless agent policy. Deprecated in favor of the Fleet managed integrations API.
var_group_selections map string to string: Variable group selections. Maps var_group name to the selected option name within that group.
vars map string to anyOf: Input/stream level variable. Refer to the integration documentation for more information.

Responses

Successful response

application/json

Bad Request

application/json

Conflict

application/json