AuthThe Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats.AvailabilityGenerally available since 9.2This functionality is generally available and ready for production usage.Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments.This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.
Update an existing agent configuration. Use this endpoint to modify any aspect of the agent's behavior, appearance, or capabilities. To learn more about agents, refer to the agents documentation.
access_modeenumrequiredThe Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats.AvailabilityGenerally available since 9.4This functionality is generally available and ready for production usage.Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments.This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.
Access-control mode: public (any privileged user can read/write), shared (any privileged user can read, only owner can write), private (only owner can read/write). Agents created without an access-control mode default to private.
Values:publicsharedprivate
avatar_colorstring
Updated hex color code for the agent avatar.
avatar_symbolstring
Updated symbol/initials for the agent avatar.
configurationobject
Updated configuration settings for the agent.
ai_indicesstring[] · max items: 100
Array of AI indices to associate with the agent.
approvalsobjectThe Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats.AvailabilityPlannedWe plan to add this functionality in a future Elastic Stack update. Subject to changes.Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments.This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.
Auto-approval defaults applied to every run of this agent.
auto_approved_apisobject
Destructive Elasticsearch or Kibana APIs this agent may call without a user confirmation, keyed by backend.
elasticsearchstring[] · max items: 100
Elasticsearch APIs pre-approved for every run of this agent. Each entry is an exact identifier formed from the namespace and name (for example indices.create), a namespace wildcard (for example indices.*), or * for every Elasticsearch API. Entries are not checked against the known APIs, and one that matches no API has no effect.
kibanastring[] · max items: 100
Kibana APIs pre-approved for every run of this agent. Each entry is an exact identifier formed from the namespace and name (for example alerting.delete-alerting-rule-id), a namespace wildcard (for example alerting.*), or * for every Kibana API. Entries are not checked against the known APIs, and one that matches no API has no effect.
connector_idsstring[] · max items: 100
Array of connector IDs to associate with the agent.
enable_elastic_capabilitiesboolean
When true, enables built-in Elastic capabilities for the agent.
instructionsstring
Updated system instructions that define the agent behavior.
plugin_idsstring[] · max items: 100
Array of plugin IDs to assign to the agent.
post_execution_workflow_idsstring[] · max items: 100
skill_idsstring[] · max items: 100
Array of skill IDs to be available to the agent.
subagent_idsstring[] · max items: 50The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats.AvailabilityPlannedWe plan to add this functionality in a future Elastic Stack update. Subject to changes.Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments.This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.
Allowlist of subagent IDs this agent may spawn. Missing or empty disables the run_subagent tool. Use '_self' to enable self-fork.
toolsobject[]
tool_idsstring[]required
Array of tool IDs that the agent can use.
workflow_idsstring[] · max items: 100
descriptionstring · max length: 2000
Updated description of what the agent does.
labelsstring[]
Updated labels for categorizing and organizing agents.