AuthThe Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats.AvailabilityGenerally available since 9.2This functionality is generally available and ready for production usage.Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments.This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.
Create a new agent. Use this endpoint to define the agent's behavior, appearance, and capabilities through comprehensive configuration options. To learn more about agents, refer to the agents documentation.
access_modeenumrequiredThe Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats.AvailabilityGenerally available since 9.4This functionality is generally available and ready for production usage.Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments.This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.
Access-control mode: public (any privileged user can read/write), shared (any privileged user can read, only owner can write), private (only owner can read/write). Agents created without an access-control mode default to private.
Values:publicsharedprivate
avatar_colorstring
Optional hex color code for the agent avatar.
avatar_symbolstring
Optional symbol/initials for the agent avatar.
configurationobjectrequired
Configuration settings for the agent.
ai_indicesstring[] · max items: 100
Array of AI indices to associate with the agent.
approvalsobjectThe Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats.AvailabilityPlannedWe plan to add this functionality in a future Elastic Stack update. Subject to changes.Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments.This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.
Auto-approval defaults applied to every run of this agent.
auto_approved_apisobject
Destructive Elasticsearch or Kibana APIs this agent may call without a user confirmation, keyed by backend.
elasticsearchstring[] · max items: 100
Elasticsearch APIs pre-approved for every run of this agent. Each entry is an exact identifier formed from the namespace and name (for example indices.create), a namespace wildcard (for example indices.*), or * for every Elasticsearch API. Entries are not checked against the known APIs, and one that matches no API has no effect.
kibanastring[] · max items: 100
Kibana APIs pre-approved for every run of this agent. Each entry is an exact identifier formed from the namespace and name (for example alerting.delete-alerting-rule-id), a namespace wildcard (for example alerting.*), or * for every Kibana API. Entries are not checked against the known APIs, and one that matches no API has no effect.
connector_idsstring[] · max items: 100
Array of connector IDs to associate with the agent.
enable_elastic_capabilitiesboolean
When true, enables built-in Elastic capabilities for the agent.
instructionsstring
Optional system instructions that define the agent behavior.
plugin_idsstring[] · max items: 100
Array of plugin IDs to assign to the agent.
post_execution_workflow_idsstring[] · max items: 100
skill_idsstring[] · max items: 100
Array of skill IDs to be available to the agent.
subagent_idsstring[] · max items: 50The Elastic Stack includes Elastic's core products such as Elasticsearch, Kibana, Logstash, and Beats.AvailabilityPlannedWe plan to add this functionality in a future Elastic Stack update. Subject to changes.Unless stated otherwise on the page, this functionality is available when your Elastic Stack is deployed on Elastic Cloud Hosted, Elastic Cloud Enterprise, Elastic Cloud on Kubernetes, and self-managed environments.This documentation corresponds to the latest patch available for each minor version. If you're not using the latest patch, check the release notes for changes.
Allowlist of subagent IDs this agent may spawn. Missing or empty disables the run_subagent tool. Use '_self' to enable self-fork.
toolsobject[]required
tool_idsstring[]required
Array of tool IDs that the agent can use.
workflow_idsstring[] · max items: 100
descriptionstringrequired
Description of what the agent does.
idstringrequired
Unique identifier for the agent.
labelsstring[]
Optional labels for categorizing and organizing agents.