Kibana API (v8)
The Kibana REST API enables you to manage resources such as connectors, data views, and saved objects. The API calls are stateless. Each request that you make happens in isolation from other calls and must include all of the necessary information for Kibana to fulfill the request. API requests return JSON output, which is a format that is machine-readable and works well for automation.
To interact with the Kibana API, use the following operations:
- GET: Fetches the information.
- PATCH: Applies partial modifications to the existing information.
- POST: Adds new information.
- PUT: Updates the existing information.
- DELETE: Removes the information.
You can prepend any Kibana API endpoint with kbn: and run the request in Dev Tools → Console.
For example:
GET kbn:/api/data_views
For more information about the console, refer to Run API requests.
Access to internal Kibana API endpoints will be restricted in Kibana version 9.0. Please move any integrations to publicly documented APIs.
- Base URL
-
https://{kibana_url}
This documentation is derived from the 8.19 branch of the kibana repository.
It is provided under license Attribution-NonCommercial-NoDerivatives 4.0 International.
This documentation contains work-in-progress information for future Elastic Stack releases.
Alerting 29
-
GET
Get the alerting framework health
/api/alerting/_health -
GET
Get rule details
/api/alerting/rule/{id} -
POST
Create a rule
/api/alerting/rule/{id} -
PUT
Update a rule
/api/alerting/rule/{id} -
DELETE
Delete a rule
/api/alerting/rule/{id} -
POST
Disable a rule
/api/alerting/rule/{id}/_disable -
POST
Enable a rule
/api/alerting/rule/{id}/_enable -
POST
Mute all alerts
/api/alerting/rule/{id}/_mute_all -
POST
Unmute all alerts
/api/alerting/rule/{id}/_unmute_all -
POST
Update the API key for a rule
/api/alerting/rule/{id}/_update_api_key -
POST
Schedule a snooze for the rule
/api/alerting/rule/{id}/snooze_schedule -
DELETE
Delete a snooze schedule for a rule
/api/alerting/rule/{ruleId}/snooze_schedule/{scheduleId} -
POST
Mute an alert
/api/alerting/rule/{rule_id}/alert/{alert_id}/_mute -
POST
Unmute an alert
/api/alerting/rule/{rule_id}/alert/{alert_id}/_unmute -
GET
Get the rule types
/api/alerting/rule_types -
GET
Get information about rules
/api/alerting/rules/_find -
GET
Get an alert by identifier
/api/alerts/alert/{alertId} -
POST
Create an alert
/api/alerts/alert/{alertId} -
PUT
Update an alert
/api/alerts/alert/{alertId} -
DELETE
Delete an alert
/api/alerts/alert/{alertId} -
POST
Disable an alert
/api/alerts/alert/{alertId}/_disable -
POST
Enable an alert
/api/alerts/alert/{alertId}/_enable -
POST
Mute all alert instances
/api/alerts/alert/{alertId}/_mute_all -
POST
Unmute all alert instances
/api/alerts/alert/{alertId}/_unmute_all -
POST
Mute an alert instance
/api/alerts/alert/{alertId}/alert_instance/{alertInstanceId}/_mute -
POST
Unmute an alert instance
/api/alerts/alert/{alertId}/alert_instance/{alertInstanceId}/_unmute -
GET
Get a paginated set of alerts
/api/alerts/alerts/_find -
GET
Get the alerting framework health
/api/alerts/alerts/_health -
GET
Get the alert types
/api/alerts/alerts/list_alert_types
APM agent configuration 7
-
GET
Get a list of agent configurations
/api/apm/settings/agent-configuration -
PUT
Create or update agent configuration
/api/apm/settings/agent-configuration -
DELETE
Delete agent configuration
/api/apm/settings/agent-configuration -
GET
Get agent name for service
/api/apm/settings/agent-configuration/agent_name -
GET
Get environments for service
/api/apm/settings/agent-configuration/environments -
POST
Lookup single agent configuration
/api/apm/settings/agent-configuration/search -
GET
Get single agent configuration
/api/apm/settings/agent-configuration/view
APM agent keys 1
APM annotations 2
APM server schema 1
APM sourcemaps 3
Cases 25
-
POST
Create a case
/api/cases -
PATCH
Update cases
/api/cases -
DELETE
Delete cases
/api/cases -
GET
Search cases
/api/cases/_find -
GET
Get cases for an alert
/api/cases/alerts/{alertId} -
GET
Get case settings
/api/cases/configure -
POST
Add case settings
/api/cases/configure -
GET
Get case connectors
/api/cases/configure/connectors/_find -
PATCH
Update case settings
/api/cases/configure/{configurationId} -
GET
Get case creators
/api/cases/reporters -
GET
Get case status summary
/api/cases/status -
GET
Get case tags
/api/cases/tags -
GET
Get case information
/api/cases/{caseId} -
GET
Get all alerts for a case
/api/cases/{caseId}/alerts -
GET
Get all case comments
/api/cases/{caseId}/comments -
POST
Add a case comment or alert
/api/cases/{caseId}/comments -
PATCH
Update a case comment or alert
/api/cases/{caseId}/comments -
DELETE
Delete all case comments and alerts
/api/cases/{caseId}/comments -
GET
Find case comments and alerts
/api/cases/{caseId}/comments/_find -
GET
Get a case comment or alert
/api/cases/{caseId}/comments/{commentId} -
DELETE
Delete a case comment or alert
/api/cases/{caseId}/comments/{commentId} -
POST
Push a case to an external service
/api/cases/{caseId}/connector/{connectorId}/_push -
POST
Attach a file to a case
/api/cases/{caseId}/files -
GET
Get case activity
/api/cases/{caseId}/user_actions -
GET
Find case activity
/api/cases/{caseId}/user_actions/_find
Connectors 14
-
GET
Get all connectors
/api/actions -
POST
Create a connector
/api/actions/action -
GET
Get connector information
/api/actions/action/{id} -
PUT
Update a connector
/api/actions/action/{id} -
DELETE
Delete a connector
/api/actions/action/{id} -
POST
Run a connector
/api/actions/action/{id}/_execute -
GET
Get connector information
/api/actions/connector/{id} -
POST
Create a connector
/api/actions/connector/{id} -
PUT
Update a connector
/api/actions/connector/{id} -
DELETE
Delete a connector
/api/actions/connector/{id} -
POST
Run a connector
/api/actions/connector/{id}/_execute -
GET
Get connector types
/api/actions/connector_types -
GET
Get all connectors
/api/actions/connectors -
GET
Get connector types
/api/actions/list_action_types
Data streams 1
Data views 15
-
GET
Get all data views
/api/data_views -
POST
Create a data view
/api/data_views/data_view -
GET
Get a data view
/api/data_views/data_view/{viewId} -
POST
Update a data view
/api/data_views/data_view/{viewId} -
DELETE
Delete a data view
/api/data_views/data_view/{viewId} -
POST
Update data view fields metadata
/api/data_views/data_view/{viewId}/fields -
POST
Create a runtime field
/api/data_views/data_view/{viewId}/runtime_field -
PUT
Create or update a runtime field
/api/data_views/data_view/{viewId}/runtime_field -
GET
Get a runtime field
/api/data_views/data_view/{viewId}/runtime_field/{fieldName} -
POST
Update a runtime field
/api/data_views/data_view/{viewId}/runtime_field/{fieldName} -
DELETE
Delete a runtime field from a data view
/api/data_views/data_view/{viewId}/runtime_field/{fieldName} -
GET
Get the default data view
/api/data_views/default -
POST
Set the default data view
/api/data_views/default -
POST
Swap saved object references
/api/data_views/swap_references -
POST
Preview a saved object reference swap
/api/data_views/swap_references/_preview
Elastic Agent actions 3
Elastic Agent binary download sources 5
-
GET
List agent binary download sources
/api/fleet/agent_download_sources -
POST
Create agent binary download source
/api/fleet/agent_download_sources -
GET
Get agent binary download source by ID
/api/fleet/agent_download_sources/{sourceId} -
PUT
Update agent binary download source by ID
/api/fleet/agent_download_sources/{sourceId} -
DELETE
Delete agent binary download source by ID
/api/fleet/agent_download_sources/{sourceId}
Elastic Agent policies 9
-
GET
List agent policies
/api/fleet/agent_policies -
POST
Create agent policy
/api/fleet/agent_policies -
POST
Bulk get agent policies
/api/fleet/agent_policies/_bulk_get -
POST
Delete agent policy by ID
/api/fleet/agent_policies/delete -
GET
Get agent policy by ID
/api/fleet/agent_policies/{agentPolicyId} -
PUT
Update agent policy by ID
/api/fleet/agent_policies/{agentPolicyId} -
POST
Copy agent policy by ID
/api/fleet/agent_policies/{agentPolicyId}/copy -
GET
Download agent policy by ID
/api/fleet/agent_policies/{agentPolicyId}/download -
GET
Get full agent policy by ID
/api/fleet/agent_policies/{agentPolicyId}/full
Elastic Agent status 3
Elastic Agents 21
-
GET
List agents
/api/fleet/agents -
POST
List agents by action ids
/api/fleet/agents -
POST
Bulk reassign agents
/api/fleet/agents/bulk_reassign -
POST
Bulk request diagnostics from agents
/api/fleet/agents/bulk_request_diagnostics -
POST
Bulk unenroll agents
/api/fleet/agents/bulk_unenroll -
POST
Bulk update agent tags
/api/fleet/agents/bulk_update_agent_tags -
POST
Bulk upgrade agents
/api/fleet/agents/bulk_upgrade -
DELETE
Delete file uploaded by agent
/api/fleet/agents/files/{fileId} -
GET
Get file uploaded by agent
/api/fleet/agents/files/{fileId}/{fileName} -
GET
Get agent setup info
/api/fleet/agents/setup -
POST
Initiate agent setup
/api/fleet/agents/setup -
GET
List agent tags
/api/fleet/agents/tags -
GET
Get agent by ID
/api/fleet/agents/{agentId} -
PUT
Update agent by ID
/api/fleet/agents/{agentId} -
DELETE
Delete agent by ID
/api/fleet/agents/{agentId} -
POST
Reassign agent
/api/fleet/agents/{agentId}/reassign -
PUT
Reassign agent
/api/fleet/agents/{agentId}/reassign -
POST
Request agent diagnostics
/api/fleet/agents/{agentId}/request_diagnostics -
POST
Unenroll agent
/api/fleet/agents/{agentId}/unenroll -
POST
Upgrade agent
/api/fleet/agents/{agentId}/upgrade -
GET
List agent uploads
/api/fleet/agents/{agentId}/uploads
Elastic Package Manager (EPM) 18
-
POST
Bulk get assets
/api/fleet/epm/bulk_assets -
GET
List package categories
/api/fleet/epm/categories -
GET
List packages
/api/fleet/epm/packages -
POST
Install by package by direct upload
/api/fleet/epm/packages -
POST
Bulk install packages
/api/fleet/epm/packages/_bulk -
GET
Get limited package list
/api/fleet/epm/packages/limited -
GET
Get package stats
/api/fleet/epm/packages/{pkgName}/stats -
GET
Get package
/api/fleet/epm/packages/{pkgName}/{pkgVersion} -
POST
Install package
/api/fleet/epm/packages/{pkgName}/{pkgVersion} -
PUT
Update package settings
/api/fleet/epm/packages/{pkgName}/{pkgVersion} -
DELETE
Delete package
/api/fleet/epm/packages/{pkgName}/{pkgVersion} -
POST
Authorize transforms
/api/fleet/epm/packages/{pkgName}/{pkgVersion}/transforms/authorize -
GET
Get package file
/api/fleet/epm/packages/{pkgName}/{pkgVersion}/{filePath} -
GET
Get package
/api/fleet/epm/packages/{pkgkey} -
POST
Install package
/api/fleet/epm/packages/{pkgkey} -
DELETE
Delete ackage
/api/fleet/epm/packages/{pkgkey} -
GET
Get inputs template
/api/fleet/epm/templates/{pkgName}/{pkgVersion}/inputs -
GET
Get package signature verification key ID
/api/fleet/epm/verification_key_id
Fleet enrollment API keys 8
-
GET
List enrollment API keys
/api/fleet/enrollment-api-keys -
POST
Create enrollment API key
/api/fleet/enrollment-api-keys -
GET
Get enrollment API key by ID
/api/fleet/enrollment-api-keys/{keyId} -
DELETE
Delete enrollment API key by ID
/api/fleet/enrollment-api-keys/{keyId} -
GET
List enrollment API keys
/api/fleet/enrollment_api_keys -
POST
Create enrollment API key
/api/fleet/enrollment_api_keys -
GET
Get enrollment API key by ID
/api/fleet/enrollment_api_keys/{keyId} -
DELETE
Revoke enrollment API key by ID by marking it as inactive
/api/fleet/enrollment_api_keys/{keyId}
Fleet internals 4
Fleet Kubernetes 1
Fleet outputs 7
-
POST
Generate Logstash API key
/api/fleet/logstash_api_keys -
GET
List outputs
/api/fleet/outputs -
POST
Create output
/api/fleet/outputs -
GET
Get output by ID
/api/fleet/outputs/{outputId} -
PUT
Update output by ID
/api/fleet/outputs/{outputId} -
DELETE
Delete output by ID
/api/fleet/outputs/{outputId} -
GET
Get latest output health
/api/fleet/outputs/{outputId}/health
Fleet package policies 9
-
GET
List package policies
/api/fleet/package_policies -
POST
Create package policy
/api/fleet/package_policies -
POST
Bulk get package policies
/api/fleet/package_policies/_bulk_get -
POST
Delete package policy
/api/fleet/package_policies/delete -
POST
Upgrade package policy to a newer package version
/api/fleet/package_policies/upgrade -
POST
Dry run package policy upgrade
/api/fleet/package_policies/upgrade/dryrun -
GET
Get package policy by ID
/api/fleet/package_policies/{packagePolicyId} -
PUT
Update package policy by ID
/api/fleet/package_policies/{packagePolicyId} -
DELETE
Delete package policy by ID
/api/fleet/package_policies/{packagePolicyId}
Fleet proxies 5
Fleet Server hosts 5
-
GET
List Fleet Server hosts
/api/fleet/fleet_server_hosts -
POST
Create Fleet Server host
/api/fleet/fleet_server_hosts -
GET
Get Fleet Server host by ID
/api/fleet/fleet_server_hosts/{itemId} -
PUT
Update Fleet Server host by ID
/api/fleet/fleet_server_hosts/{itemId} -
DELETE
Delete Fleet Server host by ID
/api/fleet/fleet_server_hosts/{itemId}
Fleet service tokens 2
Fleet uninstall tokens 2
Logstash configuration management 4
Machine learning 1
Maintenance windows 6
-
POST
Create a maintenance window.
/api/maintenance_window -
GET
Get maintenance window details.
/api/maintenance_window/{id} -
PATCH
Update a maintenance window.
/api/maintenance_window/{id} -
DELETE
Delete a maintenance window.
/api/maintenance_window/{id} -
POST
Archive a maintenance window.
/api/maintenance_window/{id}/_archive -
POST
Unarchive a maintenance window.
/api/maintenance_window/{id}/_unarchive
Roles 5
Saved objects 15
-
POST
Rotate a key for encrypted saved objects
/api/encrypted_saved_objects/_rotate_key -
POST
Create saved objects
/api/saved_objects/_bulk_create -
POST
Delete saved objects
/api/saved_objects/_bulk_delete -
POST
Get saved objects
/api/saved_objects/_bulk_get -
POST
Resolve saved objects
/api/saved_objects/_bulk_resolve -
POST
Update saved objects
/api/saved_objects/_bulk_update -
POST
Export saved objects
/api/saved_objects/_export -
GET
Search for saved objects
/api/saved_objects/_find -
POST
Import saved objects
/api/saved_objects/_import -
POST
Resolve import errors
/api/saved_objects/_resolve_import_errors -
GET
Resolve a saved object
/api/saved_objects/resolve/{type}/{id} -
POST
Create a saved object
/api/saved_objects/{type} -
GET
Get a saved object
/api/saved_objects/{type}/{id} -
POST
Create a saved object
/api/saved_objects/{type}/{id} -
PUT
Update a saved object
/api/saved_objects/{type}/{id}
Security AI assistant 19
-
POST
Apply a bulk action to anonymization fields
/api/security_ai_assistant/anonymization_fields/_bulk_action -
GET
Get anonymization fields
/api/security_ai_assistant/anonymization_fields/_find -
POST
Create a model response
/api/security_ai_assistant/chat/complete -
POST
Create a conversation
/api/security_ai_assistant/current_user/conversations -
DELETE
Delete conversations
/api/security_ai_assistant/current_user/conversations -
GET
Get conversations
/api/security_ai_assistant/current_user/conversations/_find -
GET
Get a conversation
/api/security_ai_assistant/current_user/conversations/{id} -
PUT
Update a conversation
/api/security_ai_assistant/current_user/conversations/{id} -
DELETE
Delete a conversation
/api/security_ai_assistant/current_user/conversations/{id} -
POST
Create a Knowledge Base Entry
/api/security_ai_assistant/knowledge_base/entries -
POST
Applies a bulk action to multiple Knowledge Base Entries
/api/security_ai_assistant/knowledge_base/entries/_bulk_action -
GET
Finds Knowledge Base Entries that match the given query.
/api/security_ai_assistant/knowledge_base/entries/_find -
GET
Read a Knowledge Base Entry
/api/security_ai_assistant/knowledge_base/entries/{id} -
PUT
Update a Knowledge Base Entry
/api/security_ai_assistant/knowledge_base/entries/{id} -
DELETE
Deletes a single Knowledge Base Entry using the `id` field
/api/security_ai_assistant/knowledge_base/entries/{id} -
GET
Read a KnowledgeBase
/api/security_ai_assistant/knowledge_base/{resource} -
POST
Create a KnowledgeBase
/api/security_ai_assistant/knowledge_base/{resource} -
POST
Apply a bulk action to prompts
/api/security_ai_assistant/prompts/_bulk_action -
GET
Get prompts
/api/security_ai_assistant/prompts/_find
Security detections 29
-
GET
Reads the alert index name if it exists
/api/detection_engine/index -
POST
Create an alerts index
/api/detection_engine/index -
DELETE
Delete an alerts index
/api/detection_engine/index -
GET
Returns user privileges for the Kibana space
/api/detection_engine/privileges -
GET
Retrieve a detection rule
/api/detection_engine/rules -
POST
Create a detection rule
/api/detection_engine/rules -
PUT
Update a detection rule
/api/detection_engine/rules -
PATCH
Patch a detection rule
/api/detection_engine/rules -
DELETE
Delete a detection rule
/api/detection_engine/rules -
POST
Apply a bulk action to detection rules
/api/detection_engine/rules/_bulk_action -
POST
Create multiple detection rules
/api/detection_engine/rules/_bulk_create -
POST
Delete multiple detection rules
/api/detection_engine/rules/_bulk_delete -
PUT
Update multiple detection rules
/api/detection_engine/rules/_bulk_update -
PATCH
Patch multiple detection rules
/api/detection_engine/rules/_bulk_update -
POST
Export detection rules
/api/detection_engine/rules/_export -
GET
List all detection rules
/api/detection_engine/rules/_find -
POST
Import detection rules
/api/detection_engine/rules/_import -
PUT
Install prebuilt detection rules and Timelines
/api/detection_engine/rules/prepackaged -
GET
Retrieve the status of prebuilt detection rules and Timelines
/api/detection_engine/rules/prepackaged/_status -
POST
Preview rule alerts generated on specified time range
/api/detection_engine/rules/preview -
POST
Assign and unassign users from detection alerts
/api/detection_engine/signals/assignees -
POST
Finalize detection alert migrations
/api/detection_engine/signals/finalize_migration -
POST
Initiate a detection alert migration
/api/detection_engine/signals/migration -
DELETE
Clean up detection alert migrations
/api/detection_engine/signals/migration -
POST
Retrieve the status of detection alert migrations
/api/detection_engine/signals/migration_status -
POST
Find and/or aggregate detection alerts
/api/detection_engine/signals/search -
POST
Set a detection alert status
/api/detection_engine/signals/status -
POST
Add and remove detection alert tags
/api/detection_engine/signals/tags -
GET
List all detection rule tags
/api/detection_engine/tags
Security Elastic Endpoint exceptions 6
-
POST
Create an Elastic Endpoint rule exception list
/api/endpoint_list -
GET
Get an Elastic Endpoint rule exception list item
/api/endpoint_list/items -
POST
Create an Elastic Endpoint rule exception list item
/api/endpoint_list/items -
PUT
Update an Elastic Endpoint rule exception list item
/api/endpoint_list/items -
DELETE
Delete an Elastic Endpoint exception list item
/api/endpoint_list/items -
GET
Get Elastic Endpoint exception list items
/api/endpoint_list/items/_find
Security endpoint management 27
-
GET
Get response actions
/api/endpoint/action -
POST
Run a command
/api/endpoint/action/execute -
POST
Get a file
/api/endpoint/action/get_file -
POST
Isolate an endpoint
/api/endpoint/action/isolate -
POST
Terminate a process
/api/endpoint/action/kill_process -
POST
Get running processes
/api/endpoint/action/running_procs -
POST
Run a script
/api/endpoint/action/runscript -
POST
Scan a file or directory
/api/endpoint/action/scan -
GET
Get actions state
/api/endpoint/action/state -
POST
Suspend a process
/api/endpoint/action/suspend_process -
POST
Release an isolated endpoint
/api/endpoint/action/unisolate -
POST
Upload a file
/api/endpoint/action/upload -
GET
Get action details
/api/endpoint/action/{action_id} -
GET
Get file information
/api/endpoint/action/{action_id}/file/{file_id} -
GET
Download a file
/api/endpoint/action/{action_id}/file/{file_id}/download -
GET
Get an action request log
/api/endpoint/action_log/{agent_id} -
GET
Get response actions status
/api/endpoint/action_status -
POST
Isolate an endpoint
/api/endpoint/isolate -
GET
Get a metadata list
/api/endpoint/metadata -
GET
Get metadata transforms
/api/endpoint/metadata/transforms -
GET
Get metadata
/api/endpoint/metadata/{id} -
GET
Get an agent policy summary
/api/endpoint/policy/summaries -
GET
Get a policy response
/api/endpoint/policy_response -
GET
Get a protection updates note
/api/endpoint/protection_updates_note/{package_policy_id} -
POST
Create or update a protection updates note
/api/endpoint/protection_updates_note/{package_policy_id} -
POST
Get suggestions
/api/endpoint/suggestions/{suggestion_type} -
POST
Release an isolated endpoint
/api/endpoint/unisolate
Security entity analytics 18
-
GET
Get an asset criticality record
/api/asset_criticality -
POST
Upsert an asset criticality record
/api/asset_criticality -
DELETE
Delete an asset criticality record
/api/asset_criticality -
POST
Bulk upsert asset criticality records
/api/asset_criticality/bulk -
GET
List asset criticality records
/api/asset_criticality/list -
POST
Initialize the Entity Store
/api/entity_store/enable -
GET
List the Entity Engines
/api/entity_store/engines -
POST
Apply DataView indices to all installed engines
/api/entity_store/engines/apply_dataview_indices -
GET
Get an Entity Engine
/api/entity_store/engines/{entityType} -
DELETE
Delete the Entity Engine
/api/entity_store/engines/{entityType} -
POST
Initialize an Entity Engine
/api/entity_store/engines/{entityType}/init -
POST
Start an Entity Engine
/api/entity_store/engines/{entityType}/start -
POST
Stop an Entity Engine
/api/entity_store/engines/{entityType}/stop -
GET
List Entity Store Entities
/api/entity_store/entities/list -
GET
Get the status of the Entity Store
/api/entity_store/status -
DELETE
Cleanup the Risk Engine
/api/risk_score/engine/dangerously_delete_data -
PATCH
Configure the Risk Engine Saved Object
/api/risk_score/engine/saved_object/configure -
POST
Run the risk scoring engine
/api/risk_score/engine/schedule_now
Security exceptions 16
-
POST
Create rule exception list items
/api/detection_engine/rules/{id}/exceptions -
GET
Get exception list details
/api/exception_lists -
POST
Create an exception list
/api/exception_lists -
PUT
Update an exception list
/api/exception_lists -
DELETE
Delete an exception list
/api/exception_lists -
POST
Duplicate an exception list
/api/exception_lists/_duplicate -
POST
Export an exception list
/api/exception_lists/_export -
GET
Get exception lists
/api/exception_lists/_find -
POST
Import an exception list
/api/exception_lists/_import -
GET
Get an exception list item
/api/exception_lists/items -
POST
Create an exception list item
/api/exception_lists/items -
PUT
Update an exception list item
/api/exception_lists/items -
DELETE
Delete an exception list item
/api/exception_lists/items -
GET
Get exception list items
/api/exception_lists/items/_find -
GET
Get an exception list summary
/api/exception_lists/summary -
POST
Create a shared exception list
/api/exceptions/shared
Security lists 18
-
GET
Get list details
/api/lists -
POST
Create a list
/api/lists -
PUT
Update a list
/api/lists -
PATCH
Patch a list
/api/lists -
DELETE
Delete a list
/api/lists -
GET
Get lists
/api/lists/_find -
GET
Get status of list data streams
/api/lists/index -
POST
Create list data streams
/api/lists/index -
DELETE
Delete list data streams
/api/lists/index -
GET
Get a list item
/api/lists/items -
POST
Create a list item
/api/lists/items -
PUT
Update a list item
/api/lists/items -
PATCH
Patch a list item
/api/lists/items -
DELETE
Delete a list item
/api/lists/items -
POST
Export list items
/api/lists/items/_export -
GET
Get list items
/api/lists/items/_find -
POST
Import list items
/api/lists/items/_import -
GET
Get list privileges
/api/lists/privileges
Security Osquery 14
-
GET
Get live queries
/api/osquery/live_queries -
POST
Create a live query
/api/osquery/live_queries -
GET
Get live query details
/api/osquery/live_queries/{id} -
GET
Get live query results
/api/osquery/live_queries/{id}/results/{actionId} -
GET
Get packs
/api/osquery/packs -
POST
Create a pack
/api/osquery/packs -
GET
Get pack details
/api/osquery/packs/{id} -
PUT
Update a pack
/api/osquery/packs/{id} -
DELETE
Delete a pack
/api/osquery/packs/{id} -
GET
Get saved queries
/api/osquery/saved_queries -
POST
Create a saved query
/api/osquery/saved_queries -
GET
Get saved query details
/api/osquery/saved_queries/{id} -
PUT
Update a saved query
/api/osquery/saved_queries/{id} -
DELETE
Delete a saved query
/api/osquery/saved_queries/{id}
Security timeline 17
-
GET
Get notes
/api/note -
PATCH
Add or update a note
/api/note -
DELETE
Delete a note
/api/note -
PATCH
Pin/unpin an event
/api/pinned_event -
GET
Get Timeline or Timeline template details
/api/timeline -
POST
Create a Timeline or Timeline template
/api/timeline -
PATCH
Update a Timeline
/api/timeline -
DELETE
Delete Timelines or Timeline templates
/api/timeline -
GET
Copies timeline or timeline template
/api/timeline/_copy -
GET
Get draft Timeline or Timeline template details
/api/timeline/_draft -
POST
Create a clean draft Timeline or Timeline template
/api/timeline/_draft -
POST
Export Timelines
/api/timeline/_export -
PATCH
Favorite a Timeline or Timeline template
/api/timeline/_favorite -
POST
Import Timelines
/api/timeline/_import -
POST
Install prepackaged Timelines
/api/timeline/_prepackaged -
GET
Get an existing saved Timeline or Timeline template
/api/timeline/resolve -
GET
Get Timelines or Timeline templates
/api/timelines
Service level objectives 13
-
GET
Get a paginated list of SLOs
/s/{spaceId}/api/observability/slos -
POST
Create an SLO
/s/{spaceId}/api/observability/slos -
POST
Bulk delete SLO definitions and their associated summary and rollup data.
/s/{spaceId}/api/observability/slos/_bulk_delete -
GET
Retrieve the status of the bulk deletion
/s/{spaceId}/api/observability/slos/_bulk_delete/{taskId} -
POST
Batch delete rollup and summary data
/s/{spaceId}/api/observability/slos/_bulk_purge_rollup -
POST
Batch delete rollup and summary data
/s/{spaceId}/api/observability/slos/_delete_instances -
GET
Get an SLO
/s/{spaceId}/api/observability/slos/{sloId} -
PUT
Update an SLO
/s/{spaceId}/api/observability/slos/{sloId} -
DELETE
Delete an SLO
/s/{spaceId}/api/observability/slos/{sloId} -
POST
Reset an SLO
/s/{spaceId}/api/observability/slos/{sloId}/_reset -
POST
Disable an SLO
/s/{spaceId}/api/observability/slos/{sloId}/disable -
POST
Enable an SLO
/s/{spaceId}/api/observability/slos/{sloId}/enable -
GET
Get the SLO definitions
/s/{spaceId}/internal/observability/slos/_definitions
Short URLs 4
Spaces 9
-
POST
Copy saved objects between spaces
/api/spaces/_copy_saved_objects -
POST
Disable legacy URL aliases
/api/spaces/_disable_legacy_url_aliases -
POST
Get shareable references
/api/spaces/_get_shareable_references -
POST
Update saved objects in spaces
/api/spaces/_update_objects_spaces -
GET
Get all spaces
/api/spaces/space -
POST
Create a space
/api/spaces/space -
GET
Get a space
/api/spaces/space/{id} -
PUT
Update a space
/api/spaces/space/{id} -
DELETE
Delete a space
/api/spaces/space/{id}
Synthetics 17
-
GET
Get monitors
/api/synthetics/monitors -
POST
Create a monitor
/api/synthetics/monitors -
POST
Delete monitors
/api/synthetics/monitors/_bulk_delete -
GET
Get a monitor
/api/synthetics/monitors/{id} -
PUT
Update a monitor
/api/synthetics/monitors/{id} -
DELETE
Delete a monitor
/api/synthetics/monitors/{id} -
GET
Get parameters
/api/synthetics/params -
POST
Add parameters
/api/synthetics/params -
POST
Delete parameters
/api/synthetics/params/_bulk_delete -
GET
Get a parameter
/api/synthetics/params/{id} -
PUT
Update a parameter
/api/synthetics/params/{id} -
DELETE
Delete a parameter
/api/synthetics/params/{id} -
GET
Get private locations
/api/synthetics/private_locations -
POST
Create a private location
/api/synthetics/private_locations -
GET
Get a private location
/api/synthetics/private_locations/{id} -
PUT
Update a private location
/api/synthetics/private_locations/{id} -
DELETE
Delete a private location
/api/synthetics/private_locations/{id}
System 1
Task manager 1
Unknown 2
Upgrade assistant 6
-
POST
Batch start or resume reindexing
/api/upgrade_assistant/reindex/batch -
GET
Get the batch reindex queue
/api/upgrade_assistant/reindex/batch/queue -
GET
Get the reindex status
/api/upgrade_assistant/reindex/{index} -
POST
Start or resume reindexing
/api/upgrade_assistant/reindex/{index} -
POST
Cancel reindexing
/api/upgrade_assistant/reindex/{index}/cancel -
GET
Get the upgrade readiness status
/api/upgrade_assistant/status