---
type: api
title: Receive a provisioning callback
description: Called by the CloudFormation stack launched from Kibana to report the IAM role ARN and stack ARN it created. The request is not authenticated: present the one-time token issued when the callback was created in the `x-elastic-callback-token` header. The token is not an Elasticsearch credential and admits nothing but this report. `role_arn` and `stack_arn` must be in the same AWS account. While the record is pending, a repeat report with the same values succeeds and different values return 409; an expired or cancelled record returns 410.
url: https://www.elastic.co/elastic/docs-builder/docs/4843/api/doc/kibana-serverless/operation/operation-receive-provisioning-callback
resource: https://www.elastic.co/elastic/docs-builder/docs/4843/api/doc/kibana-serverless/operation/operation-receive-provisioning-callback
products:
  - Kibana
---

# Receive a provisioning callback

Authentication: required

Availability: Experimental

- Server: `https://{kibana_url}`

## Paths

- `POST` `/api/fleet/iac_provisioner/callbacks/{callbackId}`
- `POST` `/s/{space_id}/api/fleet/iac_provisioner/callbacks/{callbackId}`

#### Path parameters

- `space_id` (string) — optional
  An identifier for the space. If `space_id` is not provided in the URL, the default space is used. Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
- `callbackId` (string · min length: 1 · max length: 128) — required
  ID of the callback record, as issued to the stack.

## Description

Called by the CloudFormation stack launched from Kibana to report the IAM role ARN and stack ARN it created. The request is not authenticated: present the one-time token issued when the callback was created in the `x-elastic-callback-token` header. The token is not an Elasticsearch credential and admits nothing but this report. `role_arn` and `stack_arn` must be in the same AWS account. While the record is pending, a repeat report with the same values succeeds and different values return 409; an expired or cancelled record returns 410.

## Header parameters

- `kbn-xsrf` (string) — required
  A required header to protect against CSRF attacks

## Request body

`application/json`

- `role_arn` (string · min length: 1 · max length: 2048) — required
  ARN of the IAM role the stack created.
- `stack_arn` (string · min length: 1 · max length: 2048) — required
  ARN (StackId) of the CloudFormation stack.

## Responses

#### `200`

The values were stored, or were already stored

`application/json`

- `status` (enum)
  State of the callback record. `pending`: waiting for the stack. `receiving`: a report is being applied. `received`: values stored and the identity exists. `cancelled`: the form stopped waiting and the token is refused.
  Values: `pending`, `receiving`, `received`, `cancelled`
#### `400`

Bad Request

`application/json`

- `attributes` (object)
- `error` (string)
- `errorType` (string)
- `message` (string)
- `statusCode` (number)
#### `404`

Not Found

`application/json`

- `message` (string)
#### `409`

Conflict

`application/json`

- `attributes` (object)
- `error` (string)
- `errorType` (string)
- `message` (string)
- `statusCode` (number)
#### `410`

Gone

`application/json`

- `attributes` (object)
- `error` (string)
- `errorType` (string)
- `message` (string)
- `statusCode` (number)
## Code examples

#### Console

```console
POST kbn:/api/fleet/iac_provisioner/callbacks/CALLBACK_ID
{
  "role_arn": "arn:aws:iam::123456789012:role/ElasticWorkloadIdentity-abc123",
  "stack_arn": "arn:aws:cloudformation:us-east-1:123456789012:stack/elastic-identity/11111111-2222-3333-4444-555555555555"
}
```

#### curl

```curl
curl -X POST "${KIBANA_URL}/api/fleet/iac_provisioner/callbacks/${CALLBACK_ID}" \
  -H "kbn-xsrf: true" \
  -H "Authorization: ApiKey ${API_KEY}" \
  -H "Content-Type: application/json" \
  -d '{
    "role_arn": "arn:aws:iam::123456789012:role/ElasticWorkloadIdentity-abc123",
    "stack_arn": "arn:aws:cloudformation:us-east-1:123456789012:stack/elastic-identity/11111111-2222-3333-4444-555555555555"
  }'
```

## Response examples

#### Identity created

`application/json`

The report was applied and the federated identity exists

```json
{
  "status": "received"
}
```

#### Role and stack accounts differ

`application/json`

The role and the stack are in different AWS accounts

```json
{
  "error": "Bad Request",
  "message": "role_arn and stack_arn must be in the same AWS account",
  "statusCode": 400
}
```

#### Unknown callback or token

`application/json`

No record has this ID, or the token is not the one issued for it

```json
{
  "error": "Not Found",
  "message": "Callback not found",
  "statusCode": 404
}
```

#### Different values already received

`application/json`

A report with different values was already received

```json
{
  "error": "Conflict",
  "message": "Callback already received with different values",
  "statusCode": 409
}
```

#### Callback expired or cancelled

`application/json`

The record expired or was cancelled before the report arrived

```json
{
  "error": "Gone",
  "message": "Callback is no longer accepting values",
  "statusCode": 410
}
```