Create cloud onboarding deployment
Base URL
https://{kibana_url}
POST
/api/fleet/cloud_onboarding_deployments
Auth
Stack
Experimental
9.5+
The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats.
Availability
Experimental since 9.5
This functionality is experimental and is not ready for production usage. Experimental features may change or be removed at any time. Elastic will work to fix any issues, but experimental features are not subject to the support SLA of official GA features. Specific Support terms apply.
Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments.
This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.
Create a new Fleet cloud onboarding deployment.
Privileges
fleet-agent-policies-all
or
integrations-all
Expand all
A required header to protect against CSRF attacks
{
}
authMethod
enum
Authentication method for managed integrations.
Values:
identity_federation
static_keys
connectorId
string · min length: 1 · max length: 255
ID of the fleet-cloud-connector to associate with this deployment. Omit for static-keys deployments.
dataFormat
enum
Data format: ecs or otel.
Values:
ecs
otel
globalRegion
string · max length: 64
Global AWS region from the Service Settings step.
mechanisms
enum [] · max items: 10 required
Delivery mechanisms active in this deployment.
Values:
managed_integration
ecf
agent_based
provider
enum required
Cloud provider.
Values:
aws
azure
gcp
services
string [] · min items: 1 · max items: 1000 required
Service IDs to be covered by this deployment.
serviceVars
map string to string to object
Per-service config keyed by instance ID.
item
object required
−
Hide 18 properties
agentPolicyId
string
Agent policy ID created for agent-based deployments. Present only when agent_based is in mechanisms.
apiKeyId
string
Elasticsearch API key ID for push mechanisms (ecf). Set by the backend; used for key rotation/revocation.
attemptCount
number · min: 1 required
Number of deployment attempts, including the current one.
authMethod
enum
Authentication method for managed integrations.
Values:
identity_federation
static_keys
connectorId
string
ID of the fleet-cloud-connector this deployment belongs to. Absent for static-keys deployments.
dataFormat
enum
Data format: ecs or otel.
Values:
ecs
otel
deploymentId
string
Opaque deployment identifier; for AWS, the CFN stack ARN.
deploymentName
string
Opaque deployment name; for AWS, the CFN stack name.
ecfStacks
object [] · max items: 10
ECF CloudFormation stacks launched as part of this deployment. Written by the wizard after the user clicks Launch.
+
Show 3 properties
family
enum required
ECF template family.
Values:
unified
otel
crowdstrike
stackName
string · min length: 1 · max length: 128 required
CloudFormation stack name (128-char AWS limit).
templateVersion
string · min length: 1 · max length: 32 required
ECF semantic version resolved at launch time, e.g. "1.10.0".
globalRegion
string
Global AWS region from the Service Settings step.
mechanisms
enum [] · max items: 10 required
Values:
managed_integration
ecf
agent_based
packagePolicyIds
string [] · max items: 100
Package policy IDs created for managed_integration services.
provider
enum required
Cloud provider.
Values:
aws
azure
gcp
services
string [] · max items: 1000 required
Service IDs covered by this deployment.
serviceVars
map string to string to object
Per-service config keyed by instance ID. Each value is the ServiceVars object from the Service Settings step.
status
enum required
Deployment status.
Values:
pending
deploying
succeeded
failed
statusMessage
string
Error context when status is failed.
attributes
object required