Create cloud onboarding deployment

Base URL
https://{kibana_url}
  • POST /api/fleet/cloud_onboarding_deployments
  • POST /s/{space_id}/api/fleet/cloud_onboarding_deployments
Auth

Create a new Fleet cloud onboarding deployment.

Required authorization

Privileges fleet-agent-policies-all or integrations-all

Path parameters

space_id string optional

An identifier for the space. If space_id is not provided in the URL, the default space is used. Refer to Spaces for more information.

Header parameters

kbn-xsrf string required

A required header to protect against CSRF attacks

Request body

agentPolicyIds string[] · max items: 1000

Agent policy IDs for agent_based existing-policy deploys. Provided on create so that a mid-deploy tab-close leaves a record that hydrates back into existing mode.

authMethod enum

Authentication method. Allowed values depend on the delivery mechanism:

  • managed_integration: identity_federation | static_keys
  • agent_based: static_keys (direct_access_keys) | temporary_keys | shared_credentials | assume_role
Values: identity_federation static_keys temporary_keys shared_credentials assume_role
connectorId string · min length: 1 · max length: 255

ID of the fleet-cloud-connector to associate with this deployment. Omit for static-keys deployments.

dataFormat enum

Data format: ecs or otel.

Values: ecs otel
globalRegion string · max length: 64

Global AWS region from the Service Settings step.

mechanisms enum[] · max items: 10 required

Delivery mechanisms active in this deployment.

Values: managed_integration ecf agent_based
provider enum required

Cloud provider.

Values: aws azure gcp
services string[] · min items: 1 · max items: 1000 required

Service IDs to be covered by this deployment.

serviceVars map string to string to object

Per-service config keyed by instance ID.

Responses

Successful response

application/json
item object required
agentPolicyIds string[] · max items: 1000

Agent policy IDs for agent_based deployments. Single-element for new-policy deploys; multiple for existing-policy deploys targeting several policies.

apiKeyId string

Elasticsearch API key ID for push mechanisms (ecf). Set by the backend; used for key rotation/revocation.

attemptCount number · min: 1 required

Number of deployment attempts, including the current one.

authMethod enum

Authentication method. Allowed values depend on the delivery mechanism:

  • managed_integration: identity_federation | static_keys
  • agent_based: static_keys (direct_access_keys) | temporary_keys | shared_credentials | assume_role
Values: identity_federation static_keys temporary_keys shared_credentials assume_role
connectorId string

ID of the fleet-cloud-connector this deployment belongs to. Absent for static-keys deployments.

dataFormat enum

Data format: ecs or otel.

Values: ecs otel
deploymentId string

Opaque deployment identifier; for AWS, the CFN stack ARN.

deploymentName string

Opaque deployment name; for AWS, the CFN stack name.

ecfStacks object[] · max items: 10

ECF CloudFormation stacks launched as part of this deployment. Written by the wizard after the user clicks Launch.

family enum required

ECF template family.

Values: unified otel crowdstrike
serviceIds string[] · max items: 1000

Service IDs active when the stack was last launched or updated.

stackArn string · min length: 1 · max length: 2048

CloudFormation stack ARN pasted by the user post-launch.

stackName string · min length: 1 · max length: 128 required

CloudFormation stack name (128-char AWS limit).

templateVersion string · min length: 1 · max length: 32 required

ECF semantic version resolved at launch time, e.g. "1.10.0".

globalRegion string

Global AWS region from the Service Settings step.

id string required
mechanisms enum[] · max items: 10 required
Values: managed_integration ecf agent_based
packagePolicyIds string[] · max items: 1000

Package policy IDs created for this deployment (managed_integration and agent_based).

policyIdsByInstance map string to string

instanceId → policyId mapping persisted after deploy. Hydrated into the wizard on resume to enable cleanup of stale policies when services are removed.

<string> string · max length: 255
provider enum required

Cloud provider.

Values: aws azure gcp
services string[] · max items: 1000 required

Service IDs covered by this deployment.

serviceVars map string to string to object

Per-service config keyed by instance ID. Each value is the ServiceVars object from the Service Settings step.

status enum required

Deployment status.

Values: pending deploying succeeded failed
statusMessage string

Error context when status is failed.

Bad Request

application/json
attributes object required
error string
errorType string
message string required
statusCode number
Base URL
https://{kibana_url}