Create a package policy

Base URL
https://{kibana_url}
  • POST /api/fleet/package_policies
Auth

Create a new package policy and assign it to an agent policy.

Query parameters

format enum

Format for the response: simplified or legacy

Values: simplified legacy

Header parameters

kbn-xsrf string required

A required header to protect against CSRF attacks

Request body

Any of:
additional_datastreams_permissions string[] · max items: 1000 nullable

Additional data stream permissions that will be added to the agent policy.

cloud_connector_id string nullable

ID of the cloud connector associated with this package policy.

cloud_connector_name string · min length: 1 · max length: 255 nullable

Transient field for cloud connector name during creation.

condition string · max length: 10000 nullable

Agent condition expression to evaluate whether to apply this integration to its inputs.

create_dataset_templates boolean

When true, install dedicated index templates for streams with a custom data_stream.dataset. Defaults to true for input packages, false for integration packages.

description string

Package policy description

enabled boolean
force boolean

Force package policy creation even if the package is not verified, or if the agent policy is managed.

global_data_tags object[] · max items: 100 nullable
name string required

The name of the custom field. Cannot contain spaces.

value number | string required

The value of the custom field.

id string

Package policy unique identifier

inputs object[] · max items: 1000 required
condition string · max length: 10000 nullable

Agent condition expression to evaluate whether to apply this input.

config map string to object

Package variable (see integration documentation for more information)

<string> object
frozen boolean
type string
value object required
deprecated object
description string · max length: 4096 required
replaced_by map string to string
<string> string · max length: 1024
since string · max length: 50
enabled boolean required
id string
keep_enabled boolean
migrate_from string
name string
policy_template string
streams object[] · max items: 1000
compiled_stream object required
condition string · max length: 10000 nullable

Agent condition expression to evaluate whether to apply this stream.

config map string to object

Package variable (see integration documentation for more information)

<string> object
frozen boolean
type string
value object required
data_stream object required
dataset string required
elasticsearch object
dynamic_dataset boolean
dynamic_namespace boolean
privileges object
indices string[] · max items: 100
type string
deprecated object
description string · max length: 4096 required
replaced_by map string to string
<string> string · max length: 1024
since string · max length: 50
enabled boolean required
id string
keep_enabled boolean
migrate_from string
release enum
Values: ga beta experimental
var_group_selections map string to string

Variable group selections. Maps var_group name to the selected option name within that group.

<string> string · max length: 1024
vars map string to object

Package variable (see integration documentation for more information)

<string> object
frozen boolean
type string
value object required
type string required
var_group_selections map string to string

Variable group selections. Maps var_group name to the selected option name within that group.

<string> string · max length: 1024
vars map string to object

Package variable (see integration documentation for more information)

<string> object
frozen boolean
type string
value object required
is_managed boolean
name string required

Unique name for the package policy.

namespace string · max length: 100

The package policy namespace. Leave blank to inherit the agent policy's namespace.

output_id string nullable
overrides object nullable

Override settings that are defined in the package policy. The override option should be used only in unusual circumstances and not as a routine procedure.

inputs map string to object
package object
experimental_data_stream_features object[] · max items: 100
data_stream string · max length: 1024 required
features object required
doc_value_only_numeric boolean
doc_value_only_other boolean
synthetic_source boolean
tsdb boolean
fips_compatible boolean
name string · max length: 255 required

Package name

requires_root boolean
title string · max length: 255
version string · max length: 50 required

Package version

package_agent_version_condition string
policy_id string nullable deprecated

ID of the agent policy which the package policy will be added to.

policy_ids string[] · max items: 1000
spaceIds string[] · max items: 100
supports_agentless boolean nullable deprecated

Indicates whether the package policy belongs to an agentless agent policy. Deprecated in favor of the Fleet managed integrations API.

supports_cloud_connector boolean nullable

Indicates whether the package policy supports cloud connectors.

var_group_selections map string to string

Variable group selections. Maps var_group name to the selected option name within that group.

<string> string · max length: 1024
vars map string to object

Package variable (see integration documentation for more information)

<string> object
frozen boolean
type string
value object required

Responses

Successful response

application/json
item object required
additional_datastreams_permissions string[] · max items: 1000 nullable

Additional data stream permissions that will be added to the agent policy.

agents number
cloud_connector_id string nullable

ID of the cloud connector associated with this package policy.

cloud_connector_name string · min length: 1 · max length: 255 nullable

Transient field for cloud connector name during creation.

condition string · max length: 10000 nullable

Agent condition expression to evaluate whether to apply this integration to its inputs.

created_at string required
created_by string required
description string

Package policy description

elasticsearch object
privileges object
cluster string[] · max items: 100
enabled boolean required
global_data_tags object[] · max items: 100 nullable
name string required

The name of the custom field. Cannot contain spaces.

value number | string required

The value of the custom field.

id string required

Package policy unique identifier.

inputs union anyOf required

Package policy inputs.

Any of:
{} { compiled_input, enabled, streams, … }[]
compiled_input object required
condition string · max length: 10000 nullable

Agent condition expression to evaluate whether to apply this input.

config map string to object

Package variable (see integration documentation for more information)

<string> object
frozen boolean
type string
value object required
deprecated object
description string · max length: 4096 required
replaced_by map string to string
<string> string · max length: 1024
since string · max length: 50
enabled boolean required
id string
keep_enabled boolean
migrate_from string
name string
policy_template string
streams object[] · max items: 1000 required
compiled_stream object required
condition string · max length: 10000 nullable

Agent condition expression to evaluate whether to apply this stream.

config map string to object

Package variable (see integration documentation for more information)

<string> object
frozen boolean
type string
value object required
data_stream object required
dataset string required
elasticsearch object
dynamic_dataset boolean
dynamic_namespace boolean
privileges object
indices string[] · max items: 100
type string
deprecated object
description string · max length: 4096 required
replaced_by map string to string
<string> string · max length: 1024
since string · max length: 50
enabled boolean required
id string
keep_enabled boolean
migrate_from string
release enum
Values: ga beta experimental
var_group_selections map string to string

Variable group selections. Maps var_group name to the selected option name within that group.

<string> string · max length: 1024
vars map string to object

Package variable (see integration documentation for more information)

<string> object
frozen boolean
type string
value object required
type string required
var_group_selections map string to string

Variable group selections. Maps var_group name to the selected option name within that group.

<string> string · max length: 1024
vars map string to object

Package variable (see integration documentation for more information)

<string> object
frozen boolean
type string
value object required
is_managed boolean
name string required

Unique name for the package policy.

namespace string · max length: 100

The package policy namespace. Leave blank to inherit the agent policy's namespace.

output_id string nullable
overrides object nullable

Override settings that are defined in the package policy. The override option should be used only in unusual circumstances and not as a routine procedure.

inputs map string to object
package object
Same fields as package in create_package_policy_request
package_agent_version_condition string
policy_id string nullable deprecated

ID of the agent policy which the package policy will be added to.

policy_ids string[] · max items: 1000
revision number required

Package policy revision.

secret_references object[] · max items: 1000
id string required
spaceIds string[] · max items: 100
supports_agentless boolean nullable

Indicates whether the package policy belongs to an agentless agent policy.

supports_cloud_connector boolean nullable

Indicates whether the package policy supports cloud connectors.

updated_at string required
updated_by string required
var_group_selections map string to string

Variable group selections. Maps var_group name to the selected option name within that group.

<string> string · max length: 1024
vars union anyOf

Package level variable.

Any of:

Package variable (see integration documentation for more information)

<string> object
frozen boolean
type string
value object required
version string

Package policy ES version.

Bad Request

application/json
attributes object required
error string
errorType string
message string required
statusCode number

Conflict

application/json
attributes object required
error string
errorType string
message string required
statusCode number
Base URL
https://{kibana_url}