Create cloud onboarding deployment

Base URL
https://{kibana_url}
  • POST /api/fleet/cloud_onboarding_deployments
Auth

Create a new Fleet cloud onboarding deployment.

Required authorization

Privileges fleet-agent-policies-all or integrations-all

Header parameters

kbn-xsrf string required

A required header to protect against CSRF attacks

Request body

authMethod enum

Authentication method for managed integrations.

Values: identity_federation static_keys
connectorId string · min length: 1 · max length: 255

ID of the fleet-cloud-connector to associate with this deployment. Omit for static-keys deployments.

dataFormat enum

Data format: ecs or otel.

Values: ecs otel
globalRegion string · max length: 64

Global AWS region from the Service Settings step.

mechanisms enum[] · max items: 10 required

Delivery mechanisms active in this deployment.

Values: managed_integration ecf agent_based
provider enum required

Cloud provider.

Values: aws azure gcp
services string[] · min items: 1 · max items: 1000 required

Service IDs to be covered by this deployment.

serviceVars map string to string to object

Per-service config keyed by instance ID.

Responses

Successful response

application/json
item object required
agentPolicyId string

Agent policy ID created for agent-based deployments. Present only when agent_based is in mechanisms.

apiKeyId string

Elasticsearch API key ID for push mechanisms (ecf). Set by the backend; used for key rotation/revocation.

attemptCount number · min: 1 required

Number of deployment attempts, including the current one.

authMethod enum

Authentication method for managed integrations.

Values: identity_federation static_keys
connectorId string

ID of the fleet-cloud-connector this deployment belongs to. Absent for static-keys deployments.

dataFormat enum

Data format: ecs or otel.

Values: ecs otel
deploymentId string

Opaque deployment identifier; for AWS, the CFN stack ARN.

deploymentName string

Opaque deployment name; for AWS, the CFN stack name.

ecfStacks object[] · max items: 10

ECF CloudFormation stacks launched as part of this deployment. Written by the wizard after the user clicks Launch.

family enum required

ECF template family.

Values: unified otel crowdstrike
stackName string · min length: 1 · max length: 128 required

CloudFormation stack name (128-char AWS limit).

templateVersion string · min length: 1 · max length: 32 required

ECF semantic version resolved at launch time, e.g. "1.10.0".

globalRegion string

Global AWS region from the Service Settings step.

id string required
mechanisms enum[] · max items: 10 required
Values: managed_integration ecf agent_based
packagePolicyIds string[] · max items: 100

Package policy IDs created for managed_integration services.

provider enum required

Cloud provider.

Values: aws azure gcp
services string[] · max items: 1000 required

Service IDs covered by this deployment.

serviceVars map string to string to object

Per-service config keyed by instance ID. Each value is the ServiceVars object from the Service Settings step.

status enum required

Deployment status.

Values: pending deploying succeeded failed
statusMessage string

Error context when status is failed.

Bad Request

application/json
attributes object required
error string
errorType string
message string required
statusCode number
Base URL
https://{kibana_url}