Install a package by upload

Base URL
https://{kibana_url}
  • POST /api/fleet/epm/packages
  • POST /s/{space_id}/api/fleet/epm/packages
Auth

Install a package by uploading a .zip or .tar.gz archive (max 100MB).

Archives that contain Kibana assets requiring additional privileges are subject to a preflight authorization check before the package is installed. Privileges are checked in every space the package will be installed into.

The following asset types require the corresponding Kibana API privilege:

  • security_rule: rules-all
  • security_rule with type machine_learning: rules-all and ml:canCreateJob
  • security_ai_prompt: elasticAssistant

If any required privilege is missing, the request returns 403 and no assets are written. To learn more, refer to Upload an integration to Kibana.

Required authorization

Privileges integrations-all and fleet-agent-policies-all

Path parameters

space_id string optional

An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.

Query parameters

ignoreMappingUpdateErrors boolean · default: false

When true, ignore mapping update errors during installation

skipDataStreamRollover boolean · default: false

When true, skip data stream rollover after installation

Header parameters

kbn-xsrf string required

A required header to protect against CSRF attacks

Request body

Type: string · format: binary

Responses

Successful response

application/gzip; application/zip
_meta object required
install_source string required
name string required
items union anyOf[] · max items: 10000 required
Any of:
deferred boolean
id string required
originId string
type union enum | string required
Values: dashboard lens visualization search index-pattern map ml-module security-rule csp-rule-template osquery-pack-asset osquery-saved-query tag

Bad Request

application/gzip; application/zip
attributes object required
error string
errorType string
message string required
statusCode number

Forbidden. The caller lacks a Kibana API privilege required by an asset in the archive. No assets are written.

application/gzip; application/zip
attributes object required
error string
errorType string
message string required
statusCode number
Base URL
https://{kibana_url}