Update cloud onboarding deployment

Base URL
https://{kibana_url}
  • PUT /api/fleet/cloud_onboarding_deployments/{id}
  • PUT /s/{space_id}/api/fleet/cloud_onboarding_deployments/{id}
Auth

Update a cloud onboarding deployment by ID.

Required authorization

Privileges fleet-agent-policies-all or integrations-all

Path parameters

space_id string optional

An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.

id string · max length: 255 required

The saved object ID of the cloud onboarding deployment.

Header parameters

kbn-xsrf string required

A required header to protect against CSRF attacks

Request body

agentPolicyIds string[] · max items: 1000

Agent policy IDs for agent_based deployments. Single-element for new-policy deploys; multiple for existing-policy deploys targeting several policies.

apiKeyId string · max length: 255
attemptCount number · min: 1

Incremented by callers performing a retry.

authMethod enum nullable

Authentication method. Refreshed on each successful deploy so a credential-method change between deploys is reflected on resume.

Values: identity_federation static_keys temporary_keys shared_credentials assume_role null
connectorId string · max length: 255 nullable
deploymentId string · max length: 2048

CFN stack ARN (or equivalent); provided by the client after manual deployment.

deploymentName string · max length: 255
description string · max length: 2048 nullable

Integration description from the Service settings step. Send null to clear it.

ecfStacks object[] · max items: 10

ECF CloudFormation stacks to record for this deployment.

family enum required

ECF template family.

Values: unified otel crowdstrike
serviceConfigs object[] · max items: 1000

Stack-relevant settings (bucket and log group ARNs) per service when the stack was last launched or updated.

bucketArns string[] · max items: 1000 required
logGroupArns string[] · max items: 1000 required
serviceId string · min length: 1 · max length: 128 required
serviceIds string[] · max items: 1000

Service IDs active when the stack was last launched or updated.

stackArn string · min length: 1 · max length: 2048

CloudFormation stack ARN pasted by the user post-launch.

stackName string · min length: 1 · max length: 128 required

CloudFormation stack name (128-char AWS limit).

templateVersion string · min length: 1 · max length: 32 required

ECF semantic version resolved at launch time, e.g. "1.10.0".

instances object[] · max items: 1000

Service instances, including duplicates, from the last deployment. Replaces the stored list, so instances removed since the last deployment are dropped.

instanceId string · min length: 1 · max length: 255 required

Instance ID: the service ID for an original, <serviceId>__dup-<n> for a duplicate.

isDuplicate boolean required

Whether the instance is a duplicate of another service.

name string · max length: 255 required

Display name of the instance. Duplicates use the custom name entered when the instance was duplicated.

serviceId string · min length: 1 · max length: 255 required

ID of the service this instance belongs to.

integrationName string · max length: 160

Integration name used by the last deploy, before any per-package suffix. Refreshed on each deploy because an unedited default name follows the service selection.

mechanisms enum[] · max items: 10

Delivery mechanisms active in this deployment. Replaces the stored mechanisms array.

Values: managed_integration ecf agent_based
namespace string · max length: 100 nullable

Global data stream namespace from the Service settings step. Omit it to keep the stored value, or send null to clear it. When none is set, an agent-based deployment inherits the agent policy namespace, other deployment methods use the default namespace.

packageNames string[] · max items: 100

Names of the integration packages this deployment covers. Refreshed with the service set.

packagePolicyIds string[] · max items: 1000

Package policy IDs created for this deployment (managed_integration and agent_based).

policyIdsByInstance map string to string
<string> string · max length: 255
serviceNames map string to string

Display name of each service as shown in the onboarding flow, by service ID.

<string> string · max length: 256
services string[] · min items: 1 · max items: 1000

Current service set for this deployment. Refreshed on each successful deploy so resume after an incremental service addition restores all deployed services.

serviceVars map string to string to object

Per-service config keyed by instance ID.

status enum

Deployment status.

Values: pending deploying succeeded failed
statusMessage string · max length: 1000

Error context; set when transitioning to failed.

Responses

Successful response

application/json
item object required
agentPolicyIds string[] · max items: 1000

Agent policy IDs for agent_based deployments. Single-element for new-policy deploys; multiple for existing-policy deploys targeting several policies.

apiKeyId string

Elasticsearch API key ID for push mechanisms (ecf). Set by the backend; used for key rotation/revocation.

attemptCount number · min: 1 required

Number of deployment attempts, including the current one.

authMethod enum

Authentication method. Allowed values depend on the delivery mechanism:

  • managed_integration: identity_federation | static_keys
  • agent_based: static_keys (direct_access_keys) | temporary_keys | shared_credentials | assume_role
Values: identity_federation static_keys temporary_keys shared_credentials assume_role
connectorId string

ID of the fleet-cloud-connector this deployment belongs to. Absent for static-keys deployments.

dataFormat enum

Data format: ecs or otel.

Values: ecs otel
deploymentId string

Opaque deployment identifier; for AWS, the CFN stack ARN.

deploymentName string

Opaque deployment name; for AWS, the CFN stack name.

description string

Integration description from the Service settings step.

ecfStacks object[] · max items: 10

ECF CloudFormation stacks launched as part of this deployment. Written by the wizard after the user clicks Launch.

family enum required

ECF template family.

Values: unified otel crowdstrike
serviceConfigs object[] · max items: 1000

Stack-relevant settings (bucket and log group ARNs) per service when the stack was last launched or updated.

bucketArns string[] · max items: 1000 required
logGroupArns string[] · max items: 1000 required
serviceId string · min length: 1 · max length: 128 required
serviceIds string[] · max items: 1000

Service IDs active when the stack was last launched or updated.

stackArn string · min length: 1 · max length: 2048

CloudFormation stack ARN pasted by the user post-launch.

stackName string · min length: 1 · max length: 128 required

CloudFormation stack name (128-char AWS limit).

templateVersion string · min length: 1 · max length: 32 required

ECF semantic version resolved at launch time, e.g. "1.10.0".

globalRegion string

Global AWS region from the Service Settings step.

id string required
instances object[] · max items: 1000

Service instances, including duplicates, from the last deployment. Used to restore the service list when an onboarding is resumed.

instanceId string · min length: 1 · max length: 255 required

Instance ID: the service ID for an original, <serviceId>__dup-<n> for a duplicate.

isDuplicate boolean required

Whether the instance is a duplicate of another service.

name string · max length: 255 required

Display name of the instance. Duplicates use the custom name entered when the instance was duplicated.

serviceId string · min length: 1 · max length: 255 required

ID of the service this instance belongs to.

integrationName string

Integration name as entered in the Service settings step, before any per-package suffix is applied.

mechanisms enum[] · max items: 10 required
Values: managed_integration ecf agent_based
namespace string

Global data stream namespace from the Service settings step. When omitted, an agent-based deployment inherits the agent policy namespace, other deployment methods use the default namespace.

packageNames string[] · max items: 100

Names of the integration packages this deployment covers (e.g. aws, aws_bedrock). Used to list the deployments of a package.

packagePolicyIds string[] · max items: 1000

Package policy IDs created for this deployment (managed_integration and agent_based).

policyIdsByInstance map string to string

instanceId → policyId mapping persisted after deploy. Hydrated into the wizard on resume to enable cleanup of stale policies when services are removed.

<string> string · max length: 255
provider enum required

Cloud provider.

Values: aws azure gcp
serviceNames map string to string

Display name of each service as shown in the onboarding flow, by service ID.

<string> string · max length: 256
services string[] · max items: 1000 required

Service IDs covered by this deployment.

serviceVars map string to string to object

Per-service config keyed by instance ID. Each value is the ServiceVars object from the Service Settings step.

status enum required

Deployment status.

Values: pending deploying succeeded failed
statusMessage string

Error context when status is failed.

updatedAt string

ISO timestamp of the last write.

updatedBy string

Username of the user who last wrote the deployment.

Bad Request

application/json
attributes object required
error string
errorType string
message string required
statusCode number

Not Found

application/json
message string required
Base URL
https://{kibana_url}