openapi: 3.0.0 tags: [] info: title: Fleet description: OpenAPI schema for Fleet API endpoints version: '0.2' contact: name: Fleet Team license: name: Elastic License 2.0 url: https://www.elastic.co/licensing/elastic-license servers: - url: http://localhost:5601/api/fleet description: local paths: /health_check: post: summary: Fleet Server health check tags: - Fleet internals responses: '200': description: OK content: application/json: schema: type: object properties: name: type: string status: type: string host: type: string '400': $ref: '#/components/responses/error' operationId: fleet-server-health-check parameters: - $ref: '#/components/parameters/kbn_xsrf' requestBody: required: true content: application/json: schema: type: object properties: host: type: string /setup: post: summary: Initiate Fleet setup tags: - Fleet internals responses: '200': description: OK content: application/json: schema: $ref: '#/components/schemas/fleet_setup_response' '400': $ref: '#/components/responses/error' '500': description: Internal Server Error content: application/json: schema: type: object properties: message: type: string operationId: setup parameters: - $ref: '#/components/parameters/kbn_xsrf' /settings: get: summary: Get settings tags: - Fleet internals responses: '200': description: OK content: application/json: schema: $ref: '#/components/schemas/fleet_settings_response' '400': $ref: '#/components/responses/error' operationId: get-settings put: summary: Update settings tags: - Fleet internals requestBody: content: application/json: schema: type: object properties: fleet_server_hosts: type: array description: Protocol and path must be the same for each URL items: type: string has_seen_add_data_notice: type: boolean additional_yaml_config: type: string responses: '200': description: OK content: application/json: schema: $ref: '#/components/schemas/fleet_settings_response' '400': $ref: '#/components/responses/error' operationId: update-settings /service-tokens: post: summary: Create service token tags: - Service tokens responses: '200': description: OK content: application/json: schema: type: object properties: name: type: string value: type: string '400': $ref: '#/components/responses/error' operationId: generate-service-token-deprecated parameters: - $ref: '#/components/parameters/kbn_xsrf' deprecated: true /service_tokens: post: summary: Create service token tags: - Service tokens responses: '200': description: OK content: application/json: schema: type: object properties: name: type: string value: type: string '400': $ref: '#/components/responses/error' operationId: generate-service-token parameters: - $ref: '#/components/parameters/kbn_xsrf' /epm/verification_key_id: get: summary: Get package signature verification key ID tags: - Elastic Package Manager (EPM) responses: '200': description: OK content: application/json: schema: type: object properties: body: type: object properties: id: type: string nullable: true description: >- the key ID of the GPG key used to verify package signatures statusCode: type: number headers: type: object '400': $ref: '#/components/responses/error' operationId: packages-get-verification-key-id parameters: [] /epm/bulk_assets: post: summary: Bulk get assets tags: - Elastic Package Manager (EPM) responses: '200': description: OK content: application/json: schema: $ref: '#/components/schemas/get_bulk_assets_response' '400': $ref: '#/components/responses/error' operationId: bulk-get-assets requestBody: content: application/json: schema: type: object properties: assetIds: type: array items: type: object properties: type: type: string id: type: string description: list of items necessary to fetch assets required: - assetIds /epm/categories: get: summary: List package categories tags: - Elastic Package Manager (EPM) responses: '200': description: OK content: application/json: schema: $ref: '#/components/schemas/get_categories_response' '400': $ref: '#/components/responses/error' operationId: get-package-categories parameters: - in: query name: prerelease schema: type: boolean default: false description: >- Whether to include prerelease packages in categories count (e.g. beta, rc, preview) - in: query name: experimental deprecated: true schema: type: boolean default: false - in: query name: include_policy_templates schema: type: boolean default: false /epm/packages/limited: get: summary: Get limited package list tags: - Elastic Package Manager (EPM) responses: '200': description: OK content: application/json: schema: type: object properties: items: type: array items: type: string '400': $ref: '#/components/responses/error' operationId: list-limited-packages parameters: [] /epm/packages: get: summary: List packages tags: - Elastic Package Manager (EPM) responses: '200': description: OK content: application/json: schema: $ref: '#/components/schemas/get_packages_response' '400': $ref: '#/components/responses/error' operationId: list-all-packages parameters: - in: query name: excludeInstallStatus schema: type: boolean default: false description: >- Whether to exclude the install status of each package. Enabling this option will opt in to caching for the response via `cache-control` headers. If you don't need up-to-date installation info for a package, and are querying for a list of available packages, providing this flag can improve performance substantially. - in: query name: prerelease schema: type: boolean default: false description: >- Whether to return prerelease versions of packages (e.g. beta, rc, preview) - in: query name: experimental deprecated: true schema: type: boolean default: false - in: query name: category schema: type: string post: summary: Install by package by direct upload tags: - Elastic Package Manager (EPM) responses: '200': description: OK content: application/json: schema: type: object properties: items: type: array items: type: object properties: id: type: string type: oneOf: - $ref: '#/components/schemas/kibana_saved_object_type' - $ref: '#/components/schemas/elasticsearch_asset_type' required: - id - type _meta: type: object properties: install_source: type: string enum: - upload - registry - bundled required: - items '400': $ref: '#/components/responses/error' operationId: install-package-by-upload description: '' parameters: - $ref: '#/components/parameters/kbn_xsrf' requestBody: content: application/zip: schema: type: string format: binary application/gzip: schema: type: string format: binary /epm/packages/_bulk: post: summary: Bulk install packages tags: - Elastic Package Manager (EPM) responses: '200': description: OK content: application/json: schema: $ref: '#/components/schemas/bulk_install_packages_response' '400': $ref: '#/components/responses/error' operationId: bulk-install-packages parameters: - in: query name: prerelease schema: type: boolean default: false description: >- Whether to return prerelease versions of packages (e.g. beta, rc, preview) requestBody: content: application/json: schema: type: object properties: packages: type: array items: oneOf: - type: string description: package name - type: object properties: name: type: string description: package name version: type: string description: package version description: list of packages to install force: type: boolean description: force install to ignore package verification errors required: - packages /epm/packages/{pkgkey}: get: summary: Get package tags: - Elastic Package Manager (EPM) responses: '200': description: OK content: application/json: schema: type: object allOf: - properties: response: $ref: '#/components/schemas/package_info' - properties: status: type: string enum: - installed - installing - install_failed - not_installed savedObject: type: string required: - status - savedObject '400': $ref: '#/components/responses/error' operationId: get-package-deprecated security: - basicAuth: [] parameters: - schema: type: string name: pkgkey in: path required: true - in: query name: prerelease schema: type: boolean default: false description: >- Whether to return prerelease versions of packages (e.g. beta, rc, preview) deprecated: true post: summary: Install package tags: - Elastic Package Manager (EPM) responses: '200': description: OK content: application/json: schema: type: object properties: response: type: array items: type: object properties: id: type: string type: oneOf: - $ref: '#/components/schemas/kibana_saved_object_type' - $ref: '#/components/schemas/elasticsearch_asset_type' required: - id - type required: - response '400': $ref: '#/components/responses/error' operationId: install-package-deprecated description: '' parameters: - $ref: '#/components/parameters/kbn_xsrf' - schema: type: string name: pkgkey in: path required: true requestBody: content: application/json: schema: type: object properties: force: type: boolean deprecated: true delete: summary: Delete ackage tags: - Elastic Package Manager (EPM) responses: '200': description: OK content: application/json: schema: type: object properties: response: type: array items: type: object properties: id: type: string type: oneOf: - $ref: '#/components/schemas/kibana_saved_object_type' - $ref: '#/components/schemas/elasticsearch_asset_type' required: - id - type required: - response '400': $ref: '#/components/responses/error' operationId: delete-package-deprecated parameters: - $ref: '#/components/parameters/kbn_xsrf' - schema: type: string name: pkgkey in: path required: true requestBody: content: application/json: schema: type: object properties: force: type: boolean deprecated: true /epm/packages/{pkgName}/{pkgVersion}: get: summary: Get package tags: - Elastic Package Manager (EPM) responses: '200': description: OK content: application/json: schema: type: object allOf: - properties: item: $ref: '#/components/schemas/package_info' - properties: status: type: string enum: - installed - installing - install_failed - not_installed savedObject: type: object deprecated: true latestVersion: type: string keepPoliciesUpToDate: type: boolean notice: type: string licensePath: type: string required: - status - savedObject '400': $ref: '#/components/responses/error' operationId: get-package security: - basicAuth: [] parameters: - schema: type: string name: pkgName in: path required: true - schema: type: string name: pkgVersion in: path required: true - schema: type: boolean name: ignoreUnverified description: Ignore if the package is fails signature verification in: query - schema: type: boolean name: full description: >- Return all fields from the package manifest, not just those supported by the Elastic Package Registry in: query - in: query name: prerelease schema: type: boolean default: false description: >- Whether to return prerelease versions of packages (e.g. beta, rc, preview) post: summary: Install package tags: - Elastic Package Manager (EPM) responses: '200': description: OK content: application/json: schema: type: object properties: items: type: array items: type: object properties: id: type: string type: oneOf: - $ref: '#/components/schemas/kibana_saved_object_type' - $ref: '#/components/schemas/elasticsearch_asset_type' required: - id - type _meta: type: object properties: install_source: type: string enum: - registry - upload - bundled required: - items '400': $ref: '#/components/responses/error' operationId: install-package description: '' parameters: - $ref: '#/components/parameters/kbn_xsrf' requestBody: content: application/json: schema: type: object properties: force: type: boolean ignore_constraints: type: boolean put: summary: Update package settings tags: - Elastic Package Manager (EPM) responses: '200': description: OK content: application/json: schema: type: object properties: items: type: array items: type: object properties: id: type: string type: oneOf: - $ref: '#/components/schemas/kibana_saved_object_type' - $ref: '#/components/schemas/elasticsearch_asset_type' required: - id - type required: - items '400': $ref: '#/components/responses/error' operationId: update-package description: '' requestBody: content: application/json: schema: type: object properties: keepPoliciesUpToDate: type: boolean delete: summary: Delete package tags: - Elastic Package Manager (EPM) responses: '200': description: OK content: application/json: schema: type: object properties: items: type: array items: type: object properties: id: type: string type: oneOf: - $ref: '#/components/schemas/kibana_saved_object_type' - $ref: '#/components/schemas/elasticsearch_asset_type' required: - id - type required: - items '400': $ref: '#/components/responses/error' operationId: delete-package parameters: - $ref: '#/components/parameters/kbn_xsrf' - schema: type: boolean name: force description: delete package even if policies used by agents in: query requestBody: content: application/json: schema: type: object deprecated: true properties: force: type: boolean /epm/packages/{pkgName}/{pkgVersion}/{filePath}: get: summary: Get package file tags: - Elastic Package Manager (EPM) responses: '200': description: OK content: application/json: schema: type: object properties: body: type: object statusCode: type: number headers: type: object '400': $ref: '#/components/responses/error' operationId: packages-get-file parameters: - schema: type: string name: pkgName in: path required: true - schema: type: string name: pkgVersion in: path required: true - schema: type: string name: filePath in: path required: true /epm/packages/{pkgName}/stats: get: summary: Get package stats tags: - Elastic Package Manager (EPM) responses: '200': description: OK content: application/json: schema: type: object properties: response: $ref: '#/components/schemas/package_usage_stats' required: - response '400': $ref: '#/components/responses/error' operationId: get-package-stats security: - basicAuth: [] parameters: - schema: type: string name: pkgName in: path required: true /agents/setup: get: summary: Get agent setup info tags: - Agents responses: '200': description: OK content: application/json: schema: $ref: '#/components/schemas/fleet_status_response' '400': $ref: '#/components/responses/error' operationId: get-agents-setup-status security: - basicAuth: [] post: summary: Initiate agent setup tags: - Agents operationId: setup-agents responses: '200': description: OK content: application/json: schema: $ref: '#/components/schemas/fleet_setup_response' '400': $ref: '#/components/responses/error' requestBody: content: application/json: schema: type: object properties: admin_username: type: string admin_password: type: string required: - admin_username - admin_password parameters: - $ref: '#/components/parameters/kbn_xsrf' /agent-status: get: summary: Get agent status summary tags: - Agent status responses: '200': description: OK content: application/json: schema: type: object properties: error: type: integer events: type: integer inactive: type: integer offline: type: integer online: type: integer other: type: integer total: type: integer updating: type: integer required: - error - events - inactive - offline - online - other - total - updating '400': $ref: '#/components/responses/error' operationId: get-agent-status-deprecated parameters: - schema: type: string name: policyId in: query required: false deprecated: true /agent_status: get: summary: Get agent status summary tags: - Agent status responses: '200': description: OK content: application/json: schema: type: object properties: error: type: integer events: type: integer inactive: type: integer unenrolled: type: integer offline: type: integer online: type: integer other: type: integer total: type: integer deprecated: true updating: type: integer all: type: integer active: type: integer required: - active - all - error - events - inactive - offline - online - other - total - updating '400': $ref: '#/components/responses/error' operationId: get-agent-status parameters: - schema: type: string name: policyId in: query required: false - schema: type: string name: kuery in: query required: false deprecated: true /agent_status/data: get: summary: Get incoming agent data tags: - Agent status responses: '200': description: OK content: application/json: schema: type: object properties: items: type: array items: type: object additionalProperties: type: object properties: data: type: boolean '400': $ref: '#/components/responses/error' operationId: get-agent-data parameters: - schema: type: array items: type: string name: agentsIds in: query required: true /agents: get: summary: List agents tags: - Agents responses: '200': description: OK content: application/json: schema: $ref: '#/components/schemas/get_agents_response' '400': $ref: '#/components/responses/error' operationId: get-agents parameters: - $ref: '#/components/parameters/page_size' - $ref: '#/components/parameters/page_index' - $ref: '#/components/parameters/kuery' - $ref: '#/components/parameters/show_inactive' - $ref: '#/components/parameters/show_upgradeable' - $ref: '#/components/parameters/sort_field' - $ref: '#/components/parameters/sort_order' - $ref: '#/components/parameters/with_metrics' - name: getStatusSummary in: query required: false schema: type: boolean security: - basicAuth: [] post: summary: List agents by action ids tags: - Agents responses: '200': description: OK content: application/json: schema: $ref: '#/components/schemas/agent_get_by_actions' '400': $ref: '#/components/responses/error' operationId: get-agents-by-actions parameters: - $ref: '#/components/parameters/kbn_xsrf' requestBody: required: true content: application/json: schema: type: object properties: actionIds: type: array items: type: string required: - policy_id /agents/bulk_upgrade: post: summary: Bulk upgrade agents tags: - Agents responses: '200': description: OK content: application/json: schema: type: object properties: actionId: type: string '400': $ref: '#/components/responses/error' operationId: bulk-upgrade-agents parameters: - $ref: '#/components/parameters/kbn_xsrf' requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/bulk_upgrade_agents' example: version: 8.4.0 source_uri: https://artifacts.elastic.co/downloads/beats/elastic-agent rollout_duration_seconds: 3600 agents: - agent1 - agent2 start_time: '2022-08-03T14:00:00.000Z' /agents/action_status: get: summary: Get agent action status tags: - Agent actions parameters: - $ref: '#/components/parameters/page_size' - $ref: '#/components/parameters/page_index' - schema: type: integer default: 5 in: query name: errorSize responses: '200': description: OK content: application/json: schema: type: object properties: items: type: array items: type: object properties: actionId: type: string status: type: string enum: - COMPLETE - EXPIRED - CANCELLED - FAILED - IN_PROGRESS - ROLLOUT_PASSED nbAgentsActioned: type: number description: number of agents actioned nbAgentsActionCreated: type: number description: number of agents included in action from kibana nbAgentsAck: type: number description: number of agents that acknowledged the action nbAgentsFailed: type: number description: number of agents that failed to execute the action version: type: string description: agent version number (UPGRADE action) startTime: type: string description: start time of action (scheduled actions) type: type: string enum: - POLICY_REASSIGN - UPGRADE - UNENROLL - FORCE_UNENROLL - UPDATE_TAGS - CANCEL - REQUEST_DIAGNOSTICS - SETTINGS - POLICY_CHANGE - INPUT_ACTION expiration: type: string completionTime: type: string cancellationTime: type: string newPolicyId: type: string description: new policy id (POLICY_REASSIGN action) policyId: type: string description: policy id (POLICY_CHANGE action) revision: type: string description: new policy revision (POLICY_CHANGE action) creationTime: type: string description: creation time of action latestErrors: type: array description: >- latest errors that happened when the agents executed the action items: type: object properties: agentId: type: string error: type: string timestamp: type: string required: - actionId - complete - nbAgentsActioned - nbAgentsActionCreated - nbAgentsAck - nbAgentsFailed - status - creationTime - type required: - items '400': $ref: '#/components/responses/error' operationId: agents-action-status /agents/{agentId}: parameters: - schema: type: string name: agentId in: path required: true get: summary: Get agent by ID tags: - Agents responses: '200': description: OK content: application/json: schema: type: object properties: item: $ref: '#/components/schemas/agent' required: - item '400': $ref: '#/components/responses/error' operationId: get-agent parameters: - $ref: '#/components/parameters/with_metrics' put: summary: Update agent by ID tags: - Agents responses: '200': description: OK content: application/json: schema: type: object properties: item: $ref: '#/components/schemas/agent' required: - item '400': $ref: '#/components/responses/error' operationId: update-agent parameters: - $ref: '#/components/parameters/kbn_xsrf' requestBody: required: true content: application/json: schema: type: object properties: user_provided_metadata: type: object tags: type: array items: type: string delete: summary: Delete agent by ID tags: - Agents responses: '200': description: OK content: application/json: schema: type: object properties: action: type: string enum: - deleted required: - action '400': $ref: '#/components/responses/error' operationId: delete-agent parameters: - $ref: '#/components/parameters/kbn_xsrf' /agents/{agentId}/actions: parameters: - schema: type: string name: agentId in: path required: true post: summary: Create agent action tags: - Agent actions responses: '200': description: OK content: application/json: schema: type: object properties: body: type: array items: type: number statusCode: type: number headers: type: string '400': $ref: '#/components/responses/error' operationId: new-agent-action parameters: - $ref: '#/components/parameters/kbn_xsrf' requestBody: required: true content: application/json: schema: type: object properties: action: $ref: '#/components/schemas/agent_action' /agents/{agentId}/actions/{actionId}/cancel: parameters: - schema: type: string name: agentId in: path required: true - schema: type: string name: actionId in: path required: true post: summary: Cancel agent action tags: - Agent actions responses: '200': description: OK content: application/json: schema: type: object properties: item: $ref: '#/components/schemas/agent_action' '400': $ref: '#/components/responses/error' operationId: agent-action-cancel parameters: - $ref: '#/components/parameters/kbn_xsrf' /agents/files@{fileId}@{fileName}: parameters: - schema: type: string name: fileId in: path required: true - schema: type: string name: fileName in: path required: true get: summary: Get file uploaded by agent tags: - Agents responses: '200': description: OK content: application/json: schema: type: object properties: body: type: object properties: items: type: object properties: body: {} headers: {} '400': $ref: '#/components/responses/error' operationId: get-agent-upload-file /agents/{agentId}/reassign: parameters: - schema: type: string name: agentId in: path required: true post: summary: Reassign agent tags: - Agents responses: '200': description: OK content: application/json: schema: type: object '400': $ref: '#/components/responses/error' operationId: reassign-agent parameters: - $ref: '#/components/parameters/kbn_xsrf' requestBody: required: true content: application/json: schema: type: object properties: policy_id: type: string required: - policy_id put: summary: Reassign agent tags: - Agents responses: '200': description: OK content: application/json: schema: type: object '400': $ref: '#/components/responses/error' operationId: reassign-agent-deprecated parameters: - $ref: '#/components/parameters/kbn_xsrf' requestBody: required: true content: application/json: schema: type: object properties: policy_id: type: string required: - policy_id deprecated: true /agents/{agentId}/unenroll: parameters: - schema: type: string name: agentId in: path required: true post: summary: Unenroll agent tags: - Agents responses: '200': description: OK content: application/json: schema: type: object '400': description: BAD REQUEST content: application/json: schema: type: object properties: error: type: string message: type: string statusCode: type: number enum: - 400 operationId: unenroll-agent parameters: - $ref: '#/components/parameters/kbn_xsrf' requestBody: content: application/json: schema: type: object properties: revoke: type: boolean force: type: boolean /agents/{agentId}/upgrade: parameters: - schema: type: string name: agentId in: path required: true post: summary: Upgrade agent tags: - Agents responses: '200': description: OK content: application/json: schema: $ref: '#/components/schemas/upgrade_agent' '400': $ref: '#/components/responses/error' operationId: upgrade-agent parameters: - $ref: '#/components/parameters/kbn_xsrf' requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/upgrade_agent' /agents/{agentId}/uploads: parameters: - schema: type: string name: agentId in: path required: true get: summary: List agent uploads tags: - Agents responses: '200': description: OK content: application/json: schema: type: object properties: body: type: object properties: item: type: array items: $ref: '#/components/schemas/agent_diagnostics' '400': $ref: '#/components/responses/error' operationId: list-agent-uploads /agents/bulk_reassign: post: summary: Bulk reassign agents tags: - Agents responses: '200': description: OK content: application/json: schema: type: object properties: actionId: type: string '400': $ref: '#/components/responses/error' operationId: bulk-reassign-agents parameters: - $ref: '#/components/parameters/kbn_xsrf' requestBody: content: application/json: schema: type: object properties: policy_id: type: string description: new agent policy id agents: oneOf: - type: string description: KQL query string, leave empty to action all agents - type: array items: type: string description: list of agent IDs required: - policy_id - agents example: policy_id: policy_id agents: 'fleet-agents.policy_id : ("policy1" or "policy2")' /agents/bulk_unenroll: post: summary: Bulk unenroll agents tags: - Agents responses: '200': description: OK content: application/json: schema: type: object properties: actionId: type: string '400': $ref: '#/components/responses/error' operationId: bulk-unenroll-agents parameters: - $ref: '#/components/parameters/kbn_xsrf' requestBody: content: application/json: schema: type: object properties: revoke: type: boolean description: Revokes API keys of agents force: type: boolean description: Unenroll hosted agents too agents: oneOf: - type: string description: KQL query string, leave empty to action all agents - type: array items: type: string description: list of agent IDs required: - agents example: revoke: true force: false agents: - agent1 - agent2 /agents/bulk_update_agent_tags: post: summary: Bulk update agent tags tags: - Agents responses: '200': description: OK content: application/json: schema: type: object properties: actionId: type: string '400': $ref: '#/components/responses/error' operationId: bulk-update-agent-tags parameters: - $ref: '#/components/parameters/kbn_xsrf' requestBody: content: application/json: schema: type: object properties: agents: oneOf: - type: string description: KQL query string, leave empty to action all agents - type: array items: type: string description: list of agent IDs tagsToAdd: type: array items: type: string tagsToRemove: type: array items: type: string batchSize: type: number required: - agents example: agents: - agent1 - agent2 tagsToAdd: - newTag tagsToRemove: - existingTag /agents/tags: get: summary: List agent tags tags: - Agents responses: '200': description: OK content: application/json: schema: $ref: '#/components/schemas/get_agent_tags_response' '400': $ref: '#/components/responses/error' operationId: get-agent-tags /agents/{agentId}/request_diagnostics: parameters: - schema: type: string name: agentId in: path required: true post: summary: Request agent diagnostics tags: - Agents responses: '200': description: OK content: application/json: schema: type: object properties: actionId: type: string '400': $ref: '#/components/responses/error' operationId: request-diagnostics-agent parameters: - $ref: '#/components/parameters/kbn_xsrf' /agents/bulk_request_diagnostics: post: summary: Bulk request diagnostics from agents tags: - Agents responses: '200': description: OK content: application/json: schema: type: object properties: actionId: type: string '400': $ref: '#/components/responses/error' operationId: bulk-request-diagnostics parameters: - $ref: '#/components/parameters/kbn_xsrf' requestBody: content: application/json: schema: type: object properties: batchSize: type: number agents: oneOf: - type: string description: KQL query string, leave empty to action all agents - type: array items: type: string description: list of agent IDs required: - agents example: agents: 'fleet-agents.policy_id : ("policy1" or "policy2")' /agent_policies: get: summary: List agent policies tags: - Agent policies responses: '200': description: OK content: application/json: schema: type: object properties: items: type: array items: $ref: '#/components/schemas/agent_policy' total: type: number page: type: number perPage: type: number required: - items - total - page - perPage '400': $ref: '#/components/responses/error' operationId: agent-policy-list parameters: - $ref: '#/components/parameters/page_size' - $ref: '#/components/parameters/page_index' - $ref: '#/components/parameters/kuery' - schema: type: boolean in: query name: full description: >- When set to true, retrieve the related package policies for each agent policy. - schema: type: boolean in: query name: noAgentCount description: >- When set to true, do not count how many agents are in the agent policy, this can improve performance if you are searching over a large number of agent policies. The "agents" property will always be 0 if set to true. description: '' post: summary: Create agent policy tags: - Agent policies responses: '200': description: OK content: application/json: schema: type: object properties: item: $ref: '#/components/schemas/agent_policy' '400': $ref: '#/components/responses/error' operationId: create-agent-policy requestBody: content: application/json: schema: $ref: '#/components/schemas/agent_policy_create_request' security: [] parameters: - $ref: '#/components/parameters/kbn_xsrf' /agent_policies/{agentPolicyId}: parameters: - schema: type: string name: agentPolicyId in: path required: true get: summary: Get agent policy by ID tags: - Agent policies responses: '200': description: OK content: application/json: schema: type: object properties: item: $ref: '#/components/schemas/agent_policy' required: - item '400': $ref: '#/components/responses/error' operationId: agent-policy-info description: Get one agent policy parameters: [] put: summary: Update agent policy by ID tags: - Agent policies responses: '200': description: OK content: application/json: schema: type: object properties: item: $ref: '#/components/schemas/agent_policy' required: - item '400': $ref: '#/components/responses/error' operationId: update-agent-policy requestBody: content: application/json: schema: $ref: '#/components/schemas/agent_policy_update_request' parameters: - $ref: '#/components/parameters/kbn_xsrf' /agent_policies/{agentPolicyId}/copy: parameters: - schema: type: string name: agentPolicyId in: path required: true post: summary: Copy agent policy by ID tags: - Agent policies operationId: agent-policy-copy parameters: - $ref: '#/components/parameters/kbn_xsrf' responses: '200': description: OK content: application/json: schema: type: object properties: item: $ref: '#/components/schemas/agent_policy' required: - item '400': $ref: '#/components/responses/error' requestBody: content: application/json: schema: type: object properties: name: type: string description: type: string required: - name description: '' /agent_policies/{agentPolicyId}/full: get: summary: Get full agent policy by ID tags: - Agent policies operationId: agent-policy-full responses: '200': description: OK content: application/json: schema: type: object properties: item: oneOf: - type: string - $ref: '#/components/schemas/agent_policy_full' '400': $ref: '#/components/responses/error' parameters: - schema: type: string name: agentPolicyId in: path required: true - schema: type: string name: download in: query required: false - schema: type: string name: standalone in: query required: false - schema: type: string name: kubernetes in: query required: false /agent_policies/{agentPolicyId}/download: get: summary: Download agent policy by ID tags: - Agent policies operationId: agent-policy-download responses: '200': description: OK content: application/json: schema: type: object properties: item: type: string '400': $ref: '#/components/responses/error' parameters: - schema: type: string name: agentPolicyId in: path required: true - schema: type: string name: download in: query required: false - schema: type: string name: standalone in: query required: false - schema: type: string name: kubernetes in: query required: false /agent_policies/_bulk_get: post: summary: Bulk get agent policies tags: - Agent policies requestBody: content: application/json: schema: type: object properties: ids: type: array items: type: string description: list of agent policy ids full: type: boolean description: get full policies with package policies populated ignoreMissing: type: boolean required: - ids responses: '200': description: OK content: application/json: schema: type: object properties: items: type: array items: $ref: '#/components/schemas/agent_policy' required: - items '400': $ref: '#/components/responses/error' operationId: bulk-get-agent-policies security: [] parameters: [] /agent_policies/delete: post: summary: Delete agent policy by ID tags: - Agent policies operationId: delete-agent-policy responses: '200': description: OK content: application/json: schema: type: object properties: id: type: string success: type: boolean required: - id - success '400': $ref: '#/components/responses/error' requestBody: content: application/json: schema: type: object properties: agentPolicyId: type: string required: - agentPolicyId parameters: - $ref: '#/components/parameters/kbn_xsrf' parameters: [] /data_streams: get: summary: List data streams tags: - Data streams responses: '200': description: OK content: application/json: schema: type: object properties: data_streams: type: array items: $ref: '#/components/schemas/data_stream' '400': $ref: '#/components/responses/error' operationId: data-streams-list parameters: [] /enrollment-api-keys: get: summary: List enrollment API keys tags: - Enrollment API keys responses: '200': description: OK content: application/json: schema: type: object properties: list: type: array items: $ref: '#/components/schemas/enrollment_api_key' deprecated: true items: type: array items: $ref: '#/components/schemas/enrollment_api_key' page: type: number perPage: type: number total: type: number required: - items - page - perPage - total '400': $ref: '#/components/responses/error' operationId: get-enrollment-api-keys-deprecated parameters: [] deprecated: true post: summary: Create enrollment API key tags: - Enrollment API keys responses: '200': description: OK content: application/json: schema: type: object properties: item: $ref: '#/components/schemas/enrollment_api_key' action: type: string enum: - created '400': $ref: '#/components/responses/error' operationId: create-enrollment-api-keys-deprecated parameters: - $ref: '#/components/parameters/kbn_xsrf' deprecated: true /enrollment-api-keys/{keyId}: parameters: - schema: type: string name: keyId in: path required: true get: summary: Get enrollment API key by ID tags: - Enrollment API keys responses: '200': description: OK content: application/json: schema: type: object properties: item: $ref: '#/components/schemas/enrollment_api_key' required: - item '400': $ref: '#/components/responses/error' operationId: get-enrollment-api-key-deprecated deprecated: true delete: summary: Delete enrollment API key by ID tags: - Enrollment API keys responses: '200': description: OK content: application/json: schema: type: object properties: action: type: string enum: - deleted required: - action '400': $ref: '#/components/responses/error' operationId: delete-enrollment-api-key-deprecated parameters: - $ref: '#/components/parameters/kbn_xsrf' deprecated: true /enrollment_api_keys: get: summary: List enrollment API keys tags: - Enrollment API keys responses: '200': description: OK content: application/json: schema: type: object properties: list: type: array items: $ref: '#/components/schemas/enrollment_api_key' deprecated: true items: type: array items: $ref: '#/components/schemas/enrollment_api_key' page: type: number perPage: type: number total: type: number required: - items - page - perPage - total '400': $ref: '#/components/responses/error' operationId: get-enrollment-api-keys parameters: [] post: summary: Create enrollment API key tags: - Enrollment API keys responses: '200': description: OK content: application/json: schema: type: object properties: item: $ref: '#/components/schemas/enrollment_api_key' action: type: string enum: - created '400': $ref: '#/components/responses/error' operationId: create-enrollment-api-keys parameters: - $ref: '#/components/parameters/kbn_xsrf' /enrollment_api_keys/{keyId}: parameters: - schema: type: string name: keyId in: path required: true get: summary: Get enrollment API key by ID tags: - Enrollment API keys responses: '200': description: OK content: application/json: schema: type: object properties: item: $ref: '#/components/schemas/enrollment_api_key' required: - item '400': $ref: '#/components/responses/error' operationId: get-enrollment-api-key delete: summary: Delete enrollment API key by ID tags: - Enrollment API keys responses: '200': description: OK content: application/json: schema: type: object properties: action: type: string enum: - deleted required: - action '400': $ref: '#/components/responses/error' operationId: delete-enrollment-api-key parameters: - $ref: '#/components/parameters/kbn_xsrf' /package_policies: get: summary: List package policies tags: - Package policies responses: '200': description: OK content: application/json: schema: type: object properties: items: type: array items: $ref: '#/components/schemas/package_policy' total: type: number page: type: number perPage: type: number required: - items '400': $ref: '#/components/responses/error' operationId: get-package-policies security: [] parameters: - $ref: '#/components/parameters/page_size' - $ref: '#/components/parameters/page_index' - $ref: '#/components/parameters/kuery' - $ref: '#/components/parameters/format' parameters: [] post: summary: Create package policy tags: - Package policies operationId: create-package-policy responses: '200': description: OK content: application/json: schema: type: object properties: item: $ref: '#/components/schemas/package_policy' required: - item '400': $ref: '#/components/responses/error' '409': $ref: '#/components/responses/error' requestBody: description: >- You should use inputs as an object and not use the deprecated inputs array. content: application/json: schema: $ref: '#/components/schemas/package_policy_request' parameters: - $ref: '#/components/parameters/kbn_xsrf' - $ref: '#/components/parameters/format' /package_policies/_bulk_get: post: summary: Bulk get package policies tags: - Package policies requestBody: content: application/json: schema: type: object properties: ids: type: array items: type: string description: list of package policy ids ignoreMissing: type: boolean required: - ids responses: '200': description: OK content: application/json: schema: type: object properties: items: type: array items: $ref: '#/components/schemas/package_policy' required: - items '400': $ref: '#/components/responses/error' operationId: bulk-get-package-policies security: [] parameters: - $ref: '#/components/parameters/format' /package_policies/delete: post: summary: Delete package policy tags: - Package policies operationId: post-delete-package-policy requestBody: content: application/json: schema: type: object properties: packagePolicyIds: type: array items: type: string force: type: boolean required: - packagePolicyIds responses: '200': description: OK content: application/json: schema: type: array items: type: object properties: id: type: string name: type: string success: type: boolean required: - id - success '400': $ref: '#/components/responses/error' parameters: - $ref: '#/components/parameters/kbn_xsrf' /package_policies/upgrade: post: summary: Upgrade package policy to a newer package version tags: - Package policies operationId: upgrade-package-policy requestBody: content: application/json: schema: type: object properties: packagePolicyIds: type: array items: type: string required: - packagePolicyIds responses: '200': description: OK content: application/json: schema: type: array items: type: object properties: id: type: string name: type: string success: type: boolean required: - id - success '400': $ref: '#/components/responses/error' '409': $ref: '#/components/responses/error' /package_policies/upgrade/dryrun: post: summary: Dry run package policy upgrade tags: - Package policies operationId: upgrade-package-policy-dry-run requestBody: content: application/json: schema: type: object properties: packagePolicyIds: type: array items: type: string packageVersion: type: string required: - packagePolicyIds responses: '200': description: OK content: application/json: schema: type: array items: type: object properties: hasErrors: type: boolean diff: $ref: '#/components/schemas/upgrade_diff' agent_diff: $ref: '#/components/schemas/upgrade_agent_diff' required: - hasErrors '400': $ref: '#/components/responses/error' /package_policies/{packagePolicyId}: parameters: - schema: type: string name: packagePolicyId in: path required: true get: summary: Get package policy by ID tags: - Package policies responses: '200': description: OK content: application/json: schema: type: object properties: item: $ref: '#/components/schemas/package_policy' required: - item '400': $ref: '#/components/responses/error' operationId: get-package-policy parameters: - $ref: '#/components/parameters/format' put: summary: Update package policy by ID tags: - Package policies operationId: update-package-policy requestBody: content: application/json: schema: $ref: '#/components/schemas/package_policy_request' responses: '200': description: OK content: application/json: schema: type: object properties: item: $ref: '#/components/schemas/package_policy' sucess: type: boolean required: - item - sucess '400': $ref: '#/components/responses/error' parameters: - $ref: '#/components/parameters/kbn_xsrf' - $ref: '#/components/parameters/format' delete: summary: Delete package policy by ID tags: - Package policies operationId: delete-package-policy responses: '200': description: OK content: application/json: schema: type: object properties: id: type: string required: - id '400': $ref: '#/components/responses/error' parameters: - schema: type: boolean name: force in: query /outputs: get: summary: List outputs tags: - Outputs responses: '200': description: OK content: application/json: schema: type: object properties: items: type: array items: $ref: '#/components/schemas/output_create_request' total: type: integer page: type: integer perPage: type: integer '400': $ref: '#/components/responses/error' operationId: get-outputs post: summary: Create output tags: - Outputs responses: '200': description: OK content: application/json: schema: type: object properties: item: $ref: '#/components/schemas/output_create_request' '400': $ref: '#/components/responses/error' requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/output_create_request' operationId: post-outputs /outputs/{outputId}: get: summary: Get output by ID tags: - Outputs responses: '200': description: OK content: application/json: schema: $ref: '#/components/schemas/output_create_request' '400': $ref: '#/components/responses/error' operationId: get-output parameters: - schema: type: string name: outputId in: path required: true delete: summary: Delete output by ID tags: - Outputs operationId: delete-output responses: '200': description: OK content: application/json: schema: type: object properties: id: type: string required: - id '400': $ref: '#/components/responses/error' parameters: - $ref: '#/components/parameters/kbn_xsrf' put: summary: Update output by ID tags: - Outputs operationId: update-output requestBody: content: application/json: schema: $ref: '#/components/schemas/output_update_request' responses: '200': description: OK content: application/json: schema: $ref: '#/components/schemas/output_update_request' '400': $ref: '#/components/responses/error' parameters: - $ref: '#/components/parameters/kbn_xsrf' /logstash_api_keys: post: summary: Generate Logstash API key tags: - Outputs responses: '200': description: OK content: application/json: schema: type: object properties: api_key: type: string '400': $ref: '#/components/responses/error' operationId: generate-logstash-api-key parameters: - $ref: '#/components/parameters/kbn_xsrf' /agent_download_sources: get: summary: List agent binary download sources tags: - Agent binary download sources responses: '200': description: OK content: application/json: schema: type: object properties: items: type: array items: $ref: '#/components/schemas/download_sources' total: type: integer page: type: integer perPage: type: integer '400': $ref: '#/components/responses/error' operationId: get-download-sources post: summary: Create agent binary download source tags: - Agent binary download sources responses: '200': description: OK content: application/json: schema: type: object properties: item: $ref: '#/components/schemas/download_sources' '400': $ref: '#/components/responses/error' requestBody: content: application/json: schema: type: object properties: id: type: string name: type: string is_default: type: boolean host: type: string required: - name - host - is_default operationId: post-download-sources /agent_download_sources/{sourceId}: get: summary: Get agent binary download source by ID tags: - Agent binary download sources responses: '200': description: OK content: application/json: schema: type: object properties: item: $ref: '#/components/schemas/download_sources' required: - item '400': $ref: '#/components/responses/error' operationId: get-one-download-source parameters: - schema: type: string name: sourceId in: path required: true delete: summary: Delete agent binary download source by ID tags: - Agent binary download sources operationId: delete-download-source responses: '200': description: OK content: application/json: schema: type: object properties: id: type: string required: - id '400': $ref: '#/components/responses/error' parameters: - $ref: '#/components/parameters/kbn_xsrf' put: summary: Update agent binary download source by ID tags: - Agent binary download sources operationId: update-download-source requestBody: content: application/json: schema: type: object properties: name: type: string is_default: type: boolean host: type: string required: - name - is_default - host responses: '200': description: OK content: application/json: schema: type: object properties: item: $ref: '#/components/schemas/download_sources' required: - item '400': $ref: '#/components/responses/error' parameters: - $ref: '#/components/parameters/kbn_xsrf' /fleet_server_hosts: get: summary: List Fleet Server hosts tags: - Fleet Server hosts responses: '200': description: OK content: application/json: schema: type: object properties: items: type: array items: $ref: '#/components/schemas/fleet_server_host' total: type: integer page: type: integer perPage: type: integer '400': $ref: '#/components/responses/error' operationId: get-fleet-server-hosts post: summary: Create Fleet Server host tags: - Fleet Server hosts responses: '200': description: OK content: application/json: schema: type: object properties: item: $ref: '#/components/schemas/fleet_server_host' '400': $ref: '#/components/responses/error' requestBody: content: application/json: schema: type: object properties: id: type: string name: type: string is_default: type: boolean host_urls: type: array items: type: string required: - name - host_urls operationId: post-fleet-server-hosts /fleet_server_hosts/{itemId}: get: summary: Get Fleet Server host by ID tags: - Fleet Server hosts responses: '200': description: OK content: application/json: schema: type: object properties: item: $ref: '#/components/schemas/fleet_server_host' required: - item '400': $ref: '#/components/responses/error' operationId: get-one-fleet-server-hosts parameters: - schema: type: string name: itemId in: path required: true delete: summary: Delete Fleet Server host by ID tags: - Fleet Server hosts operationId: delete-fleet-server-hosts responses: '200': description: OK content: application/json: schema: type: object properties: id: type: string required: - id '400': $ref: '#/components/responses/error' parameters: - $ref: '#/components/parameters/kbn_xsrf' put: summary: Update Fleet Server host by ID tags: - Fleet Server hosts operationId: update-fleet-server-hosts requestBody: content: application/json: schema: type: object properties: name: type: string is_default: type: boolean host_urls: type: array items: type: string responses: '200': description: OK content: application/json: schema: type: object properties: item: $ref: '#/components/schemas/fleet_server_host' required: - item '400': $ref: '#/components/responses/error' parameters: - $ref: '#/components/parameters/kbn_xsrf' /proxies: get: summary: List proxies tags: - Proxies responses: '200': description: OK content: application/json: schema: type: object properties: items: type: array items: $ref: '#/components/schemas/proxies' total: type: integer page: type: integer perPage: type: integer '400': $ref: '#/components/responses/error' operationId: get-fleet-proxies post: summary: Create proxy tags: - Proxies responses: '200': description: OK content: application/json: schema: type: object properties: item: $ref: '#/components/schemas/proxies' '400': $ref: '#/components/responses/error' requestBody: content: application/json: schema: type: object properties: id: type: string name: type: string url: type: string proxy_headers: type: object certificate_authorities: type: string certificate: type: string certificate_key: type: string required: - name - url operationId: post-fleet-proxies /proxies/{itemId}: get: summary: Get proxy by ID tags: - Proxies responses: '200': description: OK content: application/json: schema: type: object properties: item: $ref: '#/components/schemas/proxies' required: - item '400': $ref: '#/components/responses/error' operationId: get-one-fleet-proxies parameters: - schema: type: string name: itemId in: path required: true delete: summary: Delete proxy by ID tags: - Proxies operationId: delete-fleet-proxies responses: '200': description: OK content: application/json: schema: type: object properties: id: type: string required: - id '400': $ref: '#/components/responses/error' parameters: - $ref: '#/components/parameters/kbn_xsrf' put: summary: Update proxy by ID tags: - Proxies operationId: update-fleet-proxies requestBody: content: application/json: schema: type: object properties: name: type: string url: type: string proxy_headers: type: object certificate_authorities: type: string certificate: type: string certificate_key: type: string responses: '200': description: OK content: application/json: schema: type: object properties: item: $ref: '#/components/schemas/proxies' required: - item '400': $ref: '#/components/responses/error' parameters: - $ref: '#/components/parameters/kbn_xsrf' /kubernetes: get: summary: Get full K8s agent manifest tags: - Kubernetes responses: '200': description: OK content: application/json: schema: type: object properties: item: type: string '400': $ref: '#/components/responses/error' operationId: get-full-k8s-manifest parameters: - schema: type: boolean name: download in: query required: false - schema: type: string name: fleetServer in: query required: false - schema: type: string name: enrolToken in: query required: false components: securitySchemes: basicAuth: type: http scheme: basic Enrollment_API_Key: name: Authorization type: apiKey in: header description: 'e.g. Authorization: ApiKey base64EnrollmentApiKey' Access_API_Key: name: Authorization type: apiKey in: header description: 'e.g. Authorization: ApiKey base64AccessApiKey' parameters: kbn_xsrf: schema: type: string in: header name: kbn-xsrf required: true description: Kibana's anti Cross-Site Request Forgery token. Can be any string value. page_size: name: perPage in: query description: The number of items to return required: false schema: type: integer default: 20 page_index: name: page in: query required: false schema: type: integer default: 1 kuery: name: kuery in: query required: false schema: type: string show_inactive: name: showInactive in: query required: false schema: type: boolean show_upgradeable: name: showUpgradeable in: query required: false schema: type: boolean sort_field: name: sortField in: query required: false schema: type: string deprecated: true sort_order: name: sortOrder in: query required: false schema: type: string enum: - asc - desc with_metrics: name: withMetrics in: query description: Return agent metrics, false by default required: false schema: type: boolean format: name: format in: query description: Simplified or legacy format for package inputs required: false schema: type: string enum: - simplified - legacy responses: error: description: Generic Error content: application/json: schema: type: object properties: statusCode: type: number error: type: string message: type: string schemas: fleet_setup_response: title: Fleet Setup response type: object properties: isInitialized: type: boolean nonFatalErrors: type: array items: type: object properties: name: type: string message: type: string required: - name - message required: - isInitialized - nonFatalErrors settings: title: Settings type: object properties: id: type: string has_seen_add_data_notice: type: boolean fleet_server_hosts: deprecated: true type: array items: type: string prerelease_integrations_enabled: type: boolean required: - fleet_server_hosts - id fleet_settings_response: title: Fleet settings response type: object properties: item: $ref: '#/components/schemas/settings' required: - item saved_object_type: title: Saved Object type oneOf: - type: string enum: - dashboard - visualization - search - index_pattern - map - lens - security_rule - csp_rule_template - ml_module - tag - osquery_pack_asset - osquery_saved_query - type: string enum: - index - component_template - ingest_pipeline - index_template - ilm_policy - transform - data_stream_ilm_policy - ml_model get_bulk_assets_response: title: Bulk get assets response type: object deprecated: true properties: response: type: array items: type: array items: type: object properties: id: type: string type: $ref: '#/components/schemas/saved_object_type' updatedAt: type: string attributes: type: object properties: title: type: string description: type: string required: - items get_categories_response: title: Get categories response type: object properties: response: type: array items: type: object deprecated: true properties: id: type: string title: type: string count: type: number required: - id - title - count items: type: array items: type: object properties: id: type: string title: type: string count: type: number required: - id - title - count required: - items kibana_saved_object_type: title: Kibana saved object asset type type: string enum: - dashboard - visualization - search - index-pattern - map - lens - ml-module - security-rule - csp_rule_template elasticsearch_asset_type: title: Elasticsearch asset type type: string enum: - component_template - ingest_pipeline - index_template - ilm_policy - transform - data_stream_ilm_policy installation_info: title: Installation info object type: object properties: type: type: string created_at: type: string updated_at: type: string namespaces: type: array items: type: string installed_kibana: type: object properties: id: type: string type: $ref: '#/components/schemas/kibana_saved_object_type' installed_es: type: object properties: id: type: string deferred: type: boolean type: $ref: '#/components/schemas/elasticsearch_asset_type' name: type: string version: type: string install_status: type: string enum: - installed - installing - install_failed install_source: type: string enum: - registry - upload - bundled install_kibana_space_id: type: string install_format_schema_version: type: string verification_status: type: string enum: - verified - unverified - unknown verification_key_id: type: string nullable: true experimental_data_stream_features: type: array properties: data_stream: type: string features: type: object properties: synthetic_source: type: boolean nullable: true tsdb: type: boolean nullable: true doc_value_only_numeric: type: boolean nullable: true doc_value_only_other: type: boolean nullable: true required: - installed_kibana - installed_es - name - version - install_status - install_version - install_started_at - install_source - verification_status search_result: title: Search result type: object properties: description: type: string download: type: string icons: type: string name: type: string path: type: string title: type: string type: type: string version: type: string status: type: string installationInfo: $ref: '#/components/schemas/installation_info' savedObject: type: object deprecated: true required: - description - download - icons - name - path - title - type - version - status get_packages_response: title: Get Packages response type: object properties: response: type: array deprecated: true items: $ref: '#/components/schemas/search_result' items: type: array items: $ref: '#/components/schemas/search_result' required: - items bulk_install_packages_response: title: Bulk install packages response type: object properties: response: type: array deprecated: true items: type: object properties: name: type: string version: type: string items: type: array items: type: object properties: name: type: string version: type: string required: - items package_info: title: Package information type: object properties: name: type: string title: type: string version: type: string release: type: string deprecated: true description: >- release label is deprecated, derive from the version instead (packages follow semver) enum: - experimental - beta - ga source: type: object properties: license: type: string enum: - Apache-2.0 - Elastic-2.0 readme: type: string description: type: string type: type: string categories: type: array items: type: string conditions: type: object properties: kibana: type: object properties: versions: type: string elasticsearch: type: object properties: subscription: type: string enum: - basic - gold - platinum - enterprise screenshots: type: array items: type: object properties: src: type: string path: type: string title: type: string size: type: string type: type: string required: - src - path icons: type: array items: type: string assets: type: array items: type: string internal: type: boolean format_version: type: string data_streams: type: array items: type: object properties: title: type: string name: type: string release: type: string ingeset_pipeline: type: string vars: type: array items: type: object properties: name: type: string default: type: string required: - name - default type: type: string package: type: string required: - title - name - release - ingeset_pipeline - type - package download: type: string path: type: string elasticsearch: type: object properties: privileges: type: object properties: cluster: type: array items: type: string required: - name - title - version - description - type - categories - conditions - assets - format_version - download - path package_usage_stats: title: Package usage stats type: object properties: agent_policy_count: type: integer required: - agent_policy_count fleet_status_response: title: Fleet status response type: object properties: isReady: type: boolean missing_requirements: type: array items: type: string enum: - tls_required - api_keys - fleet_admin_user - fleet_server missing_optional_features: type: array items: type: string enum: - encrypted_saved_object_encryption_key_required package_verification_key_id: type: string required: - isReady - missing_requirements - missing_optional_features agent_type: type: string title: Agent type enum: - PERMANENT - EPHEMERAL - TEMPORARY agent_metadata: title: Agent metadata type: object agent_status: type: string title: Agent status enum: - offline - error - online - inactive - warning agent_component_status: title: Agent component status type: string enum: - starting - configuring - healthy - degraded - failed - stopping - stopped agent_component_unit_type: title: Agent component unit type type: string enum: - input - output agent_component_unit: title: Agent component unit type: object properties: id: type: string type: $ref: '#/components/schemas/agent_component_unit_type' status: $ref: '#/components/schemas/agent_component_status' message: type: string payload: type: object agent_component: title: Agent component type: object properties: id: type: string type: type: string status: $ref: '#/components/schemas/agent_component_status' message: type: string units: type: array items: $ref: '#/components/schemas/agent_component_unit' agent: title: Agent type: object properties: type: $ref: '#/components/schemas/agent_type' active: type: boolean enrolled_at: type: string unenrolled_at: type: string unenrollment_started_at: type: string access_api_key_id: type: string default_api_key_id: type: string policy_id: type: string policy_revision: type: number last_checkin: type: string user_provided_metadata: $ref: '#/components/schemas/agent_metadata' local_metadata: $ref: '#/components/schemas/agent_metadata' id: type: string access_api_key: type: string status: $ref: '#/components/schemas/agent_status' default_api_key: type: string components: type: array items: $ref: '#/components/schemas/agent_component' metrics: type: object properties: cpu_avg: type: number description: >- Average agent CPU usage during the last 5 minutes, number between 0-1 memory_size_byte_avg: type: number description: Average agent memory consumption during the last 5 minutes required: - type - active - enrolled_at - id - status get_agents_response: title: Get Agent response type: object properties: list: type: array items: $ref: '#/components/schemas/agent' deprecated: true items: type: array items: $ref: '#/components/schemas/agent' total: type: number page: type: number perPage: type: number statusSummary: type: object properties: offline: type: number error: type: number online: type: number inactive: type: number enrolling: type: number unenrolling: type: number unenrolled: type: number updating: type: number degraded': type: number required: - items - total - page - perPage agent_get_by_actions: title: Agents get by action ids type: array items: type: array items: type: string bulk_upgrade_agents: title: Bulk upgrade agents type: object properties: version: type: string description: version to upgrade to source_uri: type: string description: alternative upgrade binary download url rollout_duration_seconds: type: number description: rolling upgrade window duration in seconds start_time: type: string description: start time of upgrade in ISO 8601 format agents: oneOf: - type: string description: KQL query string, leave empty to action all agents - type: array items: type: string description: list of agent IDs force: type: boolean description: Force upgrade, skipping validation (should be used with caution) required: - agents - version agent_action: title: Agent action oneOf: - properties: data: type: string ack_data: type: string type: type: string enum: - UNENROLL - UPGRADE - POLICY_REASSIGN - properties: type: type: string data: type: object properties: log_level: type: string enum: - debug - info - warning - error upgrade_agent: title: Upgrade agent type: object properties: version: type: string source_uri: type: string force: type: boolean description: Force upgrade, skipping validation (should be used with caution) required: - version agent_diagnostics: title: Agent diagnostics type: object properties: id: type: string name: type: string createTime: type: string filePath: type: string actionId: type: string status: enum: - READY - AWAITING_UPLOAD - DELETED - IN_PROGRESS required: - id - name - createTime - filePath - actionId - status get_agent_tags_response: title: Get Agent Tags response type: object properties: items: type: array items: type: string new_package_policy: title: New package policy type: object description: '' properties: enabled: type: boolean package: type: object properties: name: type: string version: type: string title: type: string required: - name - version namespace: type: string output_id: type: string deprecated: true inputs: type: array items: type: object properties: type: type: string enabled: type: boolean processors: type: array items: type: string streams: type: array items: {} config: type: object vars: type: object required: - type - enabled policy_id: type: string name: type: string description: type: string required: - inputs - name package_policy: title: Package policy allOf: - type: object properties: id: type: string revision: type: number inputs: oneOf: - type: array items: {} - type: object required: - id - revision - $ref: '#/components/schemas/new_package_policy' agent_policy: title: Agent Policy type: object properties: id: type: string name: type: string namespace: type: string description: type: string monitoring_enabled: type: array items: type: string enum: - metrics - logs data_output_id: type: string nullable: true monitoring_output_id: type: string nullable: true fleet_server_host_id: type: string nullable: true download_source_id: type: string nullable: true unenroll_timeout: type: number inactivity_timeout: type: number package_policies: description: >- This field is present only when retrieving a single agent policy, or when retrieving a list of agent policies with the ?full=true parameter type: array items: $ref: '#/components/schemas/package_policy' updated_on: type: string format: date-time updated_by: type: string revision: type: number agents: type: number agent_features: type: array items: type: object properties: name: type: string enabled: type: boolean required: - name - enabled is_protected: description: >- Indicates whether the agent policy has tamper protection enabled. Default false. type: boolean overrides: type: object description: >- Override settings that are defined in the agent policy. Input settings cannot be overridden. The override option should be used only in unusual circumstances and not as a routine procedure. nullable: true required: - id - status - name - namespace agent_policy_create_request: title: Create agent policy request type: object properties: id: type: string name: type: string namespace: type: string description: type: string monitoring_enabled: type: array items: type: string enum: - metrics - logs data_output_id: type: string nullable: true monitoring_output_id: type: string nullable: true fleet_server_host_id: type: string nullable: true download_source_id: type: string nullable: true unenroll_timeout: type: number inactivity_timeout: type: number agent_features: type: array items: type: object properties: name: type: string enabled: type: boolean required: - name - enabled is_protected: type: boolean required: - name - namespace agent_policy_update_request: title: Update agent policy request type: object properties: name: type: string namespace: type: string description: type: string monitoring_enabled: type: array items: type: string enum: - metrics - logs data_output_id: type: string nullable: true monitoring_output_id: type: string nullable: true fleet_server_host_id: type: string nullable: true download_source_id: type: string nullable: true unenroll_timeout: type: number inactivity_timeout: type: number agent_features: type: array items: type: object properties: name: type: string enabled: type: boolean required: - name - enabled is_protected: type: boolean required: - name - namespace full_agent_policy_output: title: Full agent policy type: object properties: hosts: type: array items: type: string ca_sha256: type: string nullable: true proxy_url: type: string proxy_headers: {} type: {} additionalProperties: type: object properties: text: {} required: - type - hosts - ca_sha256 full_agent_policy_output_permissions: title: Full agent policy output permissions additionalProperties: type: object properties: packagePolicyName: type: string data: type: object properties: cluster: type: array items: type: string indices: type: array items: type: object properties: names: type: array items: type: string privileges: type: array items: type: string full_agent_policy: title: Full agent policy type: object properties: id: type: string outputs: type: object additionalProperties: $ref: '#/components/schemas/full_agent_policy_output' output_permissions: type: object additionalProperties: type: object properties: output: type: integer data: $ref: '#/components/schemas/full_agent_policy_output_permissions' fleet: oneOf: - type: object properties: hosts: type: array items: type: string proxy_url: type: string proxy_headers: {} ssl: type: object properties: verification_mode: type: string certificate: type: string key: type: string certificate_authorities: type: array items: type: string renegotiation: type: string - type: object properties: kibana: type: object properties: hosts: type: array items: type: string protocol: type: string path: type: string inputs: type: string revision: type: number agent: type: string nullable: true secret_references: type: array items: type: object properties: id: type: string required: - id - outputs - inputs agent_policy_full: title: Agent policy full response type: object oneOf: - type: object properties: item: type: string - type: object properties: item: $ref: '#/components/schemas/full_agent_policy' data_stream: title: Data stream type: object properties: index: type: string dataset: type: string namespace: type: string type: type: string package: type: string package_version: type: string last_activity_ms: type: number size_in_bytes: type: number size_in_bytes_formatted: type: string dashboard: type: array items: type: object properties: id: type: string title: type: string enrollment_api_key: title: Enrollment API key type: object properties: id: type: string api_key_id: type: string api_key: type: string name: type: string active: type: boolean policy_id: type: string created_at: type: string required: - id - api_key_id - api_key - active - created_at package_policy_request: title: Package Policy Request type: object properties: id: type: string description: Package policy unique identifier name: type: string description: Package policy name (should be unique) example: nginx-123 description: type: string description: Package policy description example: my description namespace: type: string description: namespace by default "default" example: default policy_id: type: string description: Agent policy ID where that package policy will be added example: agent-policy-id package: type: object properties: name: type: string description: Package name example: nginx version: type: string description: Package version example: 1.6.0 required: - name - version vars: type: object description: >- Package root level variable (see integration documentation for more information) inputs: type: object description: >- Package policy inputs (see integration documentation to know what inputs are available) example: nginx-logfile: enabled: true streams: nginx.access: enabled: true vars: paths: - /var/log/nginx/access.log* tags: - nginx-access preserve_original_event: false ignore_older: 72h additionalProperties: type: object properties: enabled: type: boolean description: enable or disable that input, (default to true) vars: type: object description: >- Input level variable (see integration documentation for more information) streams: type: object description: >- Input streams (see integration documentation to know what streams are available) additionalProperties: type: object properties: enabled: type: boolean description: enable or disable that stream, (default to true) vars: type: object description: >- Stream level variable (see integration documentation for more information) force: type: boolean description: >- Force package policy creation even if package is not verified, or if the agent policy is managed. required: - name - policy_id - package upgrade_diff: title: Package policy Upgrade dryrun type: array items: allOf: - $ref: '#/components/schemas/package_policy' - type: object allOf: - $ref: '#/components/schemas/new_package_policy' - type: object properties: errors: type: array items: type: object properties: key: type: string message: type: string missingVars: type: array items: type: string full_agent_policy_input_stream: title: Full agent policy input stream allOf: - type: object additionalProperties: true properties: id: type: string data_stream: type: object properties: dataset: type: string type: type: string required: - dataset - type required: - id - data_stream full_agent_policy_input: title: Full agent policy input allOf: - type: object additionalProperties: true properties: id: type: string name: type: string revision: type: number type: type: string data_stream: type: object properties: namespace: type: string required: - namespace use_output: type: string meta: type: object additionalProperties: true properties: package: type: object properties: name: type: string version: type: string required: - name - version streams: $ref: '#/components/schemas/full_agent_policy_input_stream' required: - id - name - revision - type - data_stream - use_output upgrade_agent_diff: title: Package policy Upgrade dryrun type: array items: type: array items: $ref: '#/components/schemas/full_agent_policy_input' output_create_request_elasticsearch: title: elasticsearch type: object properties: id: type: string is_default: type: boolean is_default_monitoring: type: boolean name: type: string type: type: string enum: - elasticsearch hosts: type: array items: type: string ca_sha256: type: string ca_trusted_fingerprint: type: string config: type: object config_yaml: type: string ssl: type: object properties: certificate_authorities: type: array items: type: string certificate: type: string key: type: string proxy_id: type: string shipper: type: object properties: disk_queue_enabled: type: boolean disk_queue_path: type: string disk_queue_max_size: type: number disk_queue_encryption_enabled: type: boolean disk_queue_compression_enabled: type: boolean compression_level: type: number loadbalance: type: boolean required: - name output_create_request_kafka: title: kafka type: object properties: id: type: string is_default: type: boolean is_default_monitoring: type: boolean name: type: string type: type: string enum: - kafka hosts: type: array items: type: string ca_sha256: type: string ca_trusted_fingerprint: type: string config: type: object config_yaml: type: string ssl: type: object properties: certificate_authorities: type: array items: type: string certificate: type: string key: type: string verification_mode: type: string enum: - none - full - certificate - strict proxy_id: type: string shipper: type: object properties: disk_queue_enabled: type: boolean disk_queue_path: type: string disk_queue_max_size: type: number disk_queue_encryption_enabled: type: boolean disk_queue_compression_enabled: type: boolean compression_level: type: number loadbalance: type: boolean version: type: string key: type: string compression: type: string compression_level: type: number client_id: type: string auth_type: type: string connection_type: type: string enum: - plaintext - encryption username: type: string password: type: string sasl: type: object properties: mechanism: type: string partition: type: string random: type: object properties: group_events: type: number round_robin: type: object properties: group_events: type: number topics: type: array items: type: object properties: topic: type: string when: type: object properties: type: type: string condition: type: string headers: type: array items: type: object properties: key: type: string value: type: string timeout: type: number broker_timeout: type: number required_acks: type: number required: - name - type - topics - auth_type - hosts output_create_request_logstash: title: logstash type: object properties: id: type: string is_default: type: boolean is_default_monitoring: type: boolean name: type: string type: type: string enum: - logstash hosts: type: array items: type: string ca_sha256: type: string ca_trusted_fingerprint: type: string config: type: object config_yaml: type: string ssl: type: object properties: certificate_authorities: type: array items: type: string certificate: type: string key: type: string proxy_id: type: string shipper: type: object properties: disk_queue_enabled: type: boolean disk_queue_path: type: string disk_queue_max_size: type: number disk_queue_encryption_enabled: type: boolean disk_queue_compression_enabled: type: boolean compression_level: type: number loadbalance: type: boolean required: - name - hosts - type output_create_request: title: Output oneOf: - $ref: '#/components/schemas/output_create_request_elasticsearch' - $ref: '#/components/schemas/output_create_request_kafka' - $ref: '#/components/schemas/output_create_request_logstash' discriminator: propertyName: type mapping: elasticsearch: '#/components/schemas/output_create_request_elasticsearch' kafka: '#/components/schemas/output_create_request_kafka' logstash: '#/components/schemas/output_create_request_logstash' output_update_request_elasticsearch: title: elasticsearch type: object properties: id: type: string is_default: type: boolean is_default_monitoring: type: boolean name: type: string type: type: string enum: - elasticsearch hosts: type: array items: type: string ca_sha256: type: string ca_trusted_fingerprint: type: string config: type: object config_yaml: type: string ssl: type: object properties: certificate_authorities: type: array items: type: string certificate: type: string key: type: string proxy_id: type: string shipper: type: object properties: disk_queue_enabled: type: boolean disk_queue_path: type: string disk_queue_max_size: type: number disk_queue_encryption_enabled: type: boolean disk_queue_compression_enabled: type: boolean compression_level: type: number loadbalance: type: boolean required: - name - hosts - type output_update_request_kafka: title: kafka type: object properties: id: type: string is_default: type: boolean is_default_monitoring: type: boolean name: type: string type: type: string enum: - kafka hosts: type: array items: type: string ca_sha256: type: string ca_trusted_fingerprint: type: string config: type: object config_yaml: type: string ssl: type: object properties: certificate_authorities: type: array items: type: string certificate: type: string key: type: string verification_mode: type: string enum: - none - full - certificate - strict proxy_id: type: string shipper: type: object properties: disk_queue_enabled: type: boolean disk_queue_path: type: string disk_queue_max_size: type: number disk_queue_encryption_enabled: type: boolean disk_queue_compression_enabled: type: boolean compression_level: type: number loadbalance: type: boolean version: type: string key: type: string compression: type: string compression_level: type: number client_id: type: string auth_type: type: string connection_type: type: string enum: - plaintext - encryption username: type: string password: type: string sasl: type: object properties: mechanism: type: string partition: type: string random: type: object properties: group_events: type: number round_robin: type: object properties: group_events: type: number topics: type: array items: type: object properties: topic: type: string when: type: object properties: type: type: string condition: type: string headers: type: array items: type: object properties: key: type: string value: type: string timeout: type: number broker_timeout: type: number required_acks: type: number required: - name output_update_request_logstash: title: logstash type: object properties: id: type: string is_default: type: boolean is_default_monitoring: type: boolean name: type: string type: type: string enum: - logstash hosts: type: array items: type: string ca_sha256: type: string ca_trusted_fingerprint: type: string config: type: object config_yaml: type: string ssl: type: object properties: certificate_authorities: type: array items: type: string certificate: type: string key: type: string proxy_id: type: string shipper: type: object properties: disk_queue_enabled: type: boolean disk_queue_path: type: string disk_queue_max_size: type: number disk_queue_encryption_enabled: type: boolean disk_queue_compression_enabled: type: boolean compression_level: type: number loadbalance: type: boolean required: - name output_update_request: title: Output oneOf: - $ref: '#/components/schemas/output_update_request_elasticsearch' - $ref: '#/components/schemas/output_update_request_kafka' - $ref: '#/components/schemas/output_update_request_logstash' discriminator: propertyName: type mapping: elasticsearch: '#/components/schemas/output_update_request_elasticsearch' kafka: '#/components/schemas/output_update_request_kafka' logstash: '#/components/schemas/output_update_request_logstash' download_sources: title: Download Source type: object properties: id: type: string is_default: type: boolean name: type: string host: type: string required: - is_default - name - host fleet_server_host: title: Fleet Server Host type: object properties: id: type: string name: type: string is_default: type: boolean is_preconfigured: type: boolean host_urls: type: array items: type: string required: - fleet_server_hosts - id - is_default - is_preconfigured - host_urls proxies: title: Fleet Proxy type: object properties: id: type: string name: type: string url: type: string proxy_headers: type: object certificate_authorities: type: string certificate: type: string certificate_key: type: string required: - name - url security: - basicAuth: []