openapi: 3.0.3
info:
contact:
name: Kibana Team
description: 'The Kibana REST APIs enable you to manage resources such as connectors, data views, and saved objects.
The API calls are stateless.
Each request that you make happens in isolation from other calls and must include all of the necessary information for Kibana to fulfill the
request.
API requests return JSON output, which is a format that is machine-readable and works well for automation.
To interact with Kibana APIs, use the following operations:
- GET: Fetches the information.
- PATCH: Applies partial modifications to the existing information.
- POST: Adds new information.
- PUT: Updates the existing information.
- DELETE: Removes the information.
You can prepend any Kibana API endpoint with `kbn:` and run the request in **Dev Tools → Console**.
For example:
```
GET kbn:/api/data_views
```
For more information about the console, refer to [Run API requests](https://www.elastic.co/docs/explore-analyze/query-filter/tools/console).
NOTE: Access to internal Kibana API endpoints will be restricted in Kibana version 9.0. Please move any integrations to publicly documented APIs.
## Documentation source and versions
This documentation is derived from the `main` branch of the [kibana](https://github.com/elastic/kibana) repository.
It is provided under license [Attribution-NonCommercial-NoDerivatives 4.0 International](https://creativecommons.org/licenses/by-nc-nd/4.0/).
This documentation contains work-in-progress information for future Elastic Stack releases.
'
title: Kibana APIs Actions Elastic Agent policies API
version: ''
x-doc-license:
name: Attribution-NonCommercial-NoDerivatives 4.0 International
url: https://creativecommons.org/licenses/by-nc-nd/4.0/
x-feedbackLink:
label: Feedback
url: https://github.com/elastic/docs-content/issues/new?assignees=&labels=feedback%2Ccommunity&projects=&template=api-feedback.yaml&title=%5BFeedback%5D%3A+
servers:
- url: https://{kibana_url}
variables:
kibana_url:
default: localhost:5601
security:
- apiKeyAuth: []
- basicAuth: []
tags:
- name: Elastic Agent policies
description: 'Elastic Agent policies APIs enable you to manage agent policies, including creating, updating, and deleting policies, as well as to retrieve agent policy outputs, manifests, and auto-upgrade status information.
'
x-displayName: Elastic Agent policies
paths:
/api/fleet/agent_policies:
get:
description: '**Spaces method and path for this operation:**
get /s/{space_id}/api/fleet/agent_policies
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
List all agent policies.
[Required authorization] Route required privileges: fleet-agent-policies-read OR fleet-agents-read OR fleet-setup.'
operationId: get-fleet-agent-policies
parameters:
- description: Page number
in: query
name: page
required: false
schema:
type: number
- description: Number of results per page
in: query
name: perPage
required: false
schema:
type: number
- description: Field to sort results by
in: query
name: sortField
required: false
schema:
type: string
- description: Sort order, ascending or descending
in: query
name: sortOrder
required: false
schema:
enum:
- desc
- asc
type: string
- description: When true, only show policies with upgradeable agents
in: query
name: showUpgradeable
required: false
schema:
type: boolean
- description: A KQL query string to filter results
in: query
name: kuery
required: false
schema:
type: string
- description: use withAgentCount instead
in: query
name: noAgentCount
required: false
schema:
deprecated: true
type: boolean
- description: get policies with agent count
in: query
name: withAgentCount
required: false
schema:
type: boolean
- description: get full policies with package policies populated
in: query
name: full
required: false
schema:
type: boolean
- description: 'Format for the response: simplified or legacy'
in: query
name: format
required: false
schema:
enum:
- simplified
- legacy
type: string
responses:
'200':
content:
application/json:
examples:
getAgentPoliciesExample:
description: List of agent policies
value:
items:
- description: A sample agent policy
id: agent-policy-id-1
is_managed: false
is_protected: false
name: My agent policy
namespace: default
revision: 1
status: active
updated_at: '2024-01-15T10:00:00.000Z'
updated_by: user1
page: 1
perPage: 20
total: 1
schema:
additionalProperties: false
type: object
properties:
items:
items:
additionalProperties: false
type: object
properties:
advanced_settings:
additionalProperties: false
type: object
properties:
agent_download_target_directory:
nullable: true
agent_download_timeout:
nullable: true
agent_features_disable_policy_change_acks_enabled:
nullable: true
agent_internal:
nullable: true
agent_limits_go_max_procs:
nullable: true
agent_logging_files_interval:
nullable: true
agent_logging_files_keepfiles:
nullable: true
agent_logging_files_rotateeverybytes:
nullable: true
agent_logging_level:
nullable: true
agent_logging_metrics_period:
nullable: true
agent_logging_to_files:
nullable: true
agent_monitoring_runtime_experimental:
nullable: true
agent_features:
items:
additionalProperties: false
type: object
properties:
enabled:
type: boolean
name:
type: string
required:
- name
- enabled
maxItems: 100
type: array
agentless:
additionalProperties: false
type: object
properties:
cloud_connectors:
additionalProperties: false
type: object
properties:
enabled:
type: boolean
target_csp:
enum:
- aws
- azure
- gcp
type: string
required:
- enabled
resources:
additionalProperties: false
type: object
properties:
requests:
additionalProperties: false
type: object
properties:
cpu:
type: string
memory:
type: string
agents:
type: number
agents_per_version:
items:
additionalProperties: false
type: object
properties:
count:
type: number
version:
type: string
required:
- version
- count
maxItems: 1000
type: array
created_at:
type: string
data_output_id:
nullable: true
type: string
description:
type: string
download_source_id:
nullable: true
type: string
fips_agents:
type: number
fleet_server_host_id:
nullable: true
type: string
global_data_tags:
description: User defined data tags that are added to all of the inputs. The values can be strings or numbers.
items:
additionalProperties: false
type: object
properties:
name:
type: string
value:
anyOf:
- type: string
- type: number
required:
- name
- value
maxItems: 100
type: array
has_agent_version_conditions:
type: boolean
has_fleet_server:
type: boolean
id:
type: string
inactivity_timeout:
default: 1209600
minimum: 0
type: number
is_default:
type: boolean
is_default_fleet_server:
type: boolean
is_managed:
type: boolean
is_preconfigured:
type: boolean
is_protected:
description: Indicates whether the agent policy has tamper protection enabled. Default false.
type: boolean
is_verifier:
description: Indicates this is a short-lived verifier policy used for OTel permission verification.
type: boolean
keep_monitoring_alive:
default: false
description: When set to true, monitoring will be enabled but logs/metrics collection will be disabled
nullable: true
type: boolean
min_agent_version:
nullable: true
type: string
monitoring_diagnostics:
additionalProperties: false
type: object
properties:
limit:
additionalProperties: false
type: object
properties:
burst:
type: number
interval:
type: string
uploader:
additionalProperties: false
type: object
properties:
init_dur:
type: string
max_dur:
type: string
max_retries:
type: number
monitoring_enabled:
items:
enum:
- logs
- metrics
- traces
type: string
maxItems: 3
type: array
monitoring_http:
additionalProperties: false
type: object
properties:
buffer:
additionalProperties: false
type: object
properties:
enabled:
default: false
type: boolean
enabled:
type: boolean
host:
type: string
port:
maximum: 65353
minimum: 0
type: number
monitoring_output_id:
nullable: true
type: string
monitoring_pprof_enabled:
type: boolean
name:
minLength: 1
type: string
namespace:
minLength: 1
type: string
overrides:
additionalProperties:
nullable: true
description: Override settings that are defined in the agent policy. Input settings cannot be overridden. The override option should be used only in unusual circumstances and not as a routine procedure.
nullable: true
type: object
package_agent_version_conditions:
items:
additionalProperties: false
type: object
properties:
name:
type: string
title:
type: string
version_condition:
type: string
required:
- name
- title
- version_condition
maxItems: 1000
nullable: true
type: array
package_policies:
anyOf:
- items:
type: string
maxItems: 10000
type: array
- description: This field is present only when retrieving a single agent policy, or when retrieving a list of agent policies with the ?full=true parameter
items:
additionalProperties: false
type: object
properties:
additional_datastreams_permissions:
description: Additional datastream permissions, that will be added to the agent policy.
items:
type: string
maxItems: 1000
nullable: true
type: array
agents:
type: number
cloud_connector_id:
description: ID of the cloud connector associated with this package policy.
nullable: true
type: string
cloud_connector_name:
description: Transient field for cloud connector name during creation.
maxLength: 255
minLength: 1
nullable: true
type: string
created_at:
type: string
created_by:
type: string
description:
description: Package policy description
type: string
elasticsearch:
additionalProperties: true
type: object
properties:
privileges:
additionalProperties: true
type: object
properties:
cluster:
items:
type: string
maxItems: 100
type: array
enabled:
type: boolean
global_data_tags:
items:
additionalProperties: false
type: object
properties:
name:
description: The name of the custom field. Cannot contain spaces.
type: string
value:
anyOf:
- type: string
- type: number
description: The value of the custom field.
required:
- name
- value
maxItems: 100
nullable: true
type: array
id:
description: Package policy unique identifier.
type: string
inputs:
anyOf:
- items:
additionalProperties: false
type: object
properties:
compiled_input:
nullable: true
config:
additionalProperties:
additionalProperties: false
type: object
properties:
frozen:
type: boolean
type:
type: string
value:
nullable: true
required:
- value
description: Package variable (see integration documentation for more information)
type: object
deprecated:
additionalProperties: false
type: object
properties:
description:
type: string
replaced_by:
additionalProperties:
type: string
type: object
since:
type: string
required:
- description
enabled:
type: boolean
id:
type: string
keep_enabled:
type: boolean
migrate_from:
type: string
name:
type: string
policy_template:
type: string
streams:
items:
additionalProperties: false
type: object
properties:
compiled_stream:
nullable: true
config:
additionalProperties:
additionalProperties: false
type: object
properties:
frozen:
type: boolean
type:
type: string
value:
nullable: true
required:
- value
description: Package variable (see integration documentation for more information)
type: object
data_stream:
additionalProperties: false
type: object
properties:
dataset:
type: string
elasticsearch:
additionalProperties: false
type: object
properties:
dynamic_dataset:
type: boolean
dynamic_namespace:
type: boolean
privileges:
additionalProperties: false
type: object
properties:
indices:
items:
type: string
maxItems: 100
type: array
type:
type: string
required:
- dataset
deprecated:
additionalProperties: false
type: object
properties:
description:
type: string
replaced_by:
additionalProperties:
type: string
type: object
since:
type: string
required:
- description
enabled:
type: boolean
id:
type: string
keep_enabled:
type: boolean
migrate_from:
type: string
release:
enum:
- ga
- beta
- experimental
type: string
var_group_selections:
additionalProperties:
type: string
description: Variable group selections. Maps var_group name to the selected option name within that group.
type: object
vars:
additionalProperties:
additionalProperties: false
type: object
properties:
frozen:
type: boolean
type:
type: string
value:
nullable: true
required:
- value
description: Package variable (see integration documentation for more information)
type: object
required:
- enabled
- data_stream
- compiled_stream
maxItems: 1000
type: array
type:
type: string
var_group_selections:
additionalProperties:
type: string
description: Variable group selections. Maps var_group name to the selected option name within that group.
type: object
vars:
additionalProperties:
additionalProperties: false
type: object
properties:
frozen:
type: boolean
type:
type: string
value:
nullable: true
required:
- value
description: Package variable (see integration documentation for more information)
type: object
required:
- type
- enabled
- streams
- compiled_input
maxItems: 100
type: array
- additionalProperties:
additionalProperties: false
type: object
properties:
deprecated:
additionalProperties: false
type: object
properties:
description:
type: string
replaced_by:
additionalProperties:
type: string
type: object
since:
type: string
required:
- description
enabled:
description: Enable or disable that input. Defaults to `true` (enabled).
type: boolean
streams:
additionalProperties:
additionalProperties: false
type: object
properties:
deprecated:
additionalProperties: false
type: object
properties:
description:
type: string
replaced_by:
additionalProperties:
type: string
type: object
since:
type: string
required:
- description
enabled:
description: Enable or disable that stream. Defaults to `true` (enabled).
type: boolean
var_group_selections:
additionalProperties:
type: string
description: Variable group selections. Maps var_group name to the selected option name within that group.
type: object
vars:
additionalProperties:
anyOf:
- type: string
- type: number
- type: boolean
- items:
type: string
maxItems: 100
type: array
- items:
type: number
maxItems: 100
type: array
- additionalProperties: false
type: object
properties:
id:
type: string
isSecretRef:
type: boolean
required:
- id
- isSecretRef
nullable: true
description: Input/stream level variable. Refer to the integration documentation for more information.
type: object
description: Input streams. Refer to the integration documentation to know which streams are available.
type: object
vars:
additionalProperties:
anyOf:
- type: string
- type: number
- type: boolean
- items:
type: string
maxItems: 100
type: array
- items:
type: number
maxItems: 100
type: array
- additionalProperties: false
type: object
properties:
id:
type: string
isSecretRef:
type: boolean
required:
- id
- isSecretRef
nullable: true
description: Input/stream level variable. Refer to the integration documentation for more information.
type: object
description: Package policy inputs. Refer to the integration documentation to know which inputs are available.
type: object
x-oas-optional: true
description: Package policy inputs.
is_managed:
type: boolean
name:
description: Unique name for the package policy.
type: string
namespace:
description: The package policy namespace. Leave blank to inherit the agent policy's namespace.
type: string
output_id:
nullable: true
type: string
overrides:
additionalProperties: false
description: Override settings that are defined in the package policy. The override option should be used only in unusual circumstances and not as a routine procedure.
nullable: true
type: object
properties:
inputs:
additionalProperties:
nullable: true
type: object
package:
additionalProperties: false
type: object
properties:
experimental_data_stream_features:
items:
additionalProperties: false
type: object
properties:
data_stream:
type: string
features:
additionalProperties: false
type: object
properties:
doc_value_only_numeric:
type: boolean
doc_value_only_other:
type: boolean
synthetic_source:
type: boolean
tsdb:
type: boolean
required:
- data_stream
- features
maxItems: 100
type: array
fips_compatible:
type: boolean
name:
description: Package name
type: string
requires_root:
type: boolean
title:
type: string
version:
description: Package version
type: string
required:
- name
- version
package_agent_version_condition:
type: string
policy_id:
deprecated: true
description: ID of the agent policy which the package policy will be added to.
nullable: true
type: string
policy_ids:
items:
description: IDs of the agent policies which that package policy will be added to.
type: string
maxItems: 1000
type: array
revision:
description: Package policy revision.
type: number
secret_references:
items:
additionalProperties: false
type: object
properties:
id:
type: string
required:
- id
maxItems: 1000
type: array
spaceIds:
items:
type: string
maxItems: 100
type: array
supports_agentless:
default: false
description: Indicates whether the package policy belongs to an agentless agent policy.
nullable: true
type: boolean
supports_cloud_connector:
default: false
description: Indicates whether the package policy supports cloud connectors.
nullable: true
type: boolean
updated_at:
type: string
updated_by:
type: string
var_group_selections:
additionalProperties:
type: string
description: Variable group selections. Maps var_group name to the selected option name within that group.
type: object
vars:
anyOf:
- additionalProperties:
additionalProperties: false
type: object
properties:
frozen:
type: boolean
type:
type: string
value:
nullable: true
required:
- value
description: Package variable (see integration documentation for more information)
type: object
- additionalProperties:
anyOf:
- type: string
- type: number
- type: boolean
- items:
type: string
maxItems: 100
type: array
- items:
type: number
maxItems: 100
type: array
- additionalProperties: false
type: object
properties:
id:
type: string
isSecretRef:
type: boolean
required:
- id
- isSecretRef
nullable: true
description: Input/stream level variable. Refer to the integration documentation for more information.
type: object
x-oas-optional: true
description: Package level variable.
version:
description: Package policy ES version.
type: string
required:
- name
- enabled
- inputs
- id
- revision
- updated_at
- updated_by
- created_at
- created_by
maxItems: 10000
type: array
required_versions:
items:
additionalProperties: false
type: object
properties:
percentage:
description: Target percentage of agents to auto upgrade
maximum: 100
minimum: 0
type: number
version:
description: Target version for automatic agent upgrade
type: string
required:
- version
- percentage
maxItems: 100
nullable: true
type: array
revision:
type: number
schema_version:
type: string
space_ids:
items:
type: string
maxItems: 100
type: array
status:
enum:
- active
- inactive
type: string
supports_agentless:
default: false
description: Indicates whether the agent policy supports agentless integrations.
nullable: true
type: boolean
unenroll_timeout:
minimum: 0
type: number
unprivileged_agents:
type: number
updated_at:
type: string
updated_by:
type: string
version:
type: string
required:
- id
- name
- namespace
- is_protected
- status
- updated_at
- updated_by
- revision
maxItems: 10000
type: array
page:
type: number
perPage:
type: number
total:
type: number
required:
- items
- total
- page
- perPage
description: Successful response
'400':
content:
application/json:
examples:
genericErrorResponseExample:
description: Example of a generic error response
value:
error: Bad Request
message: An error message describing what went wrong
statusCode: 400
schema:
additionalProperties: false
description: Generic Error
type: object
properties:
attributes:
nullable: true
error:
type: string
errorType:
type: string
message:
type: string
statusCode:
type: number
required:
- message
- attributes
description: Bad Request
summary: Get agent policies
tags:
- Elastic Agent policies
x-metaTags:
- content: Kibana
name: product_name
post:
description: '**Spaces method and path for this operation:**
post /s/{space_id}/api/fleet/agent_policies
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
Create a new agent policy.
[Required authorization] Route required privileges: fleet-agent-policies-all.'
operationId: post-fleet-agent-policies
parameters:
- description: A required header to protect against CSRF attacks
in: header
name: kbn-xsrf
required: true
schema:
example: 'true'
type: string
- description: Whether to add the system integration to the new agent policy
in: query
name: sys_monitoring
required: false
schema:
type: boolean
requestBody:
content:
application/json:
examples:
postAgentPolicyRequestExample:
description: Create a new agent policy
value:
description: A sample agent policy
monitoring_enabled:
- logs
- metrics
name: My agent policy
namespace: default
schema:
additionalProperties: false
type: object
properties:
advanced_settings:
additionalProperties: false
type: object
properties:
agent_download_target_directory:
nullable: true
agent_download_timeout:
nullable: true
agent_features_disable_policy_change_acks_enabled:
nullable: true
agent_internal:
nullable: true
agent_limits_go_max_procs:
nullable: true
agent_logging_files_interval:
nullable: true
agent_logging_files_keepfiles:
nullable: true
agent_logging_files_rotateeverybytes:
nullable: true
agent_logging_level:
nullable: true
agent_logging_metrics_period:
nullable: true
agent_logging_to_files:
nullable: true
agent_monitoring_runtime_experimental:
nullable: true
agent_features:
items:
additionalProperties: false
type: object
properties:
enabled:
type: boolean
name:
type: string
required:
- name
- enabled
maxItems: 100
type: array
agentless:
additionalProperties: false
type: object
properties:
cloud_connectors:
additionalProperties: false
type: object
properties:
enabled:
type: boolean
target_csp:
enum:
- aws
- azure
- gcp
type: string
required:
- enabled
resources:
additionalProperties: false
type: object
properties:
requests:
additionalProperties: false
type: object
properties:
cpu:
type: string
memory:
type: string
data_output_id:
nullable: true
type: string
description:
type: string
download_source_id:
nullable: true
type: string
fleet_server_host_id:
nullable: true
type: string
force:
type: boolean
global_data_tags:
description: User defined data tags that are added to all of the inputs. The values can be strings or numbers.
items:
additionalProperties: false
type: object
properties:
name:
type: string
value:
anyOf:
- type: string
- type: number
required:
- name
- value
maxItems: 100
type: array
has_agent_version_conditions:
type: boolean
has_fleet_server:
type: boolean
id:
type: string
inactivity_timeout:
default: 1209600
minimum: 0
type: number
is_default:
type: boolean
is_default_fleet_server:
type: boolean
is_managed:
type: boolean
is_protected:
type: boolean
is_verifier:
description: Indicates this is a short-lived verifier policy used for OTel permission verification.
type: boolean
keep_monitoring_alive:
default: false
description: When set to true, monitoring will be enabled but logs/metrics collection will be disabled
nullable: true
type: boolean
monitoring_diagnostics:
additionalProperties: false
type: object
properties:
limit:
additionalProperties: false
type: object
properties:
burst:
type: number
interval:
type: string
uploader:
additionalProperties: false
type: object
properties:
init_dur:
type: string
max_dur:
type: string
max_retries:
type: number
monitoring_enabled:
items:
enum:
- logs
- metrics
- traces
type: string
maxItems: 3
type: array
monitoring_http:
additionalProperties: false
type: object
properties:
buffer:
additionalProperties: false
type: object
properties:
enabled:
default: false
type: boolean
enabled:
type: boolean
host:
type: string
port:
maximum: 65353
minimum: 0
type: number
monitoring_output_id:
nullable: true
type: string
monitoring_pprof_enabled:
type: boolean
name:
minLength: 1
type: string
namespace:
minLength: 1
type: string
overrides:
additionalProperties:
nullable: true
description: Override settings that are defined in the agent policy. Input settings cannot be overridden. The override option should be used only in unusual circumstances and not as a routine procedure.
nullable: true
type: object
required_versions:
items:
additionalProperties: false
type: object
properties:
percentage:
description: Target percentage of agents to auto upgrade
maximum: 100
minimum: 0
type: number
version:
description: Target version for automatic agent upgrade
type: string
required:
- version
- percentage
maxItems: 100
nullable: true
type: array
space_ids:
items:
type: string
maxItems: 100
type: array
supports_agentless:
default: false
deprecated: true
description: Indicates whether the agent policy supports agentless integrations. Deprecated in favor of the Fleet agentless policies API.
nullable: true
type: boolean
unenroll_timeout:
minimum: 0
type: number
required:
- name
- namespace
responses:
'200':
content:
application/json:
examples:
postAgentPolicyExample:
description: The created agent policy
value:
item:
description: A sample agent policy
id: agent-policy-id-2
is_managed: false
is_protected: false
name: My agent policy
namespace: default
revision: 1
status: active
updated_at: '2024-01-15T10:00:00.000Z'
updated_by: user1
schema:
additionalProperties: false
type: object
properties:
item:
additionalProperties: false
type: object
properties:
advanced_settings:
additionalProperties: false
type: object
properties:
agent_download_target_directory:
nullable: true
agent_download_timeout:
nullable: true
agent_features_disable_policy_change_acks_enabled:
nullable: true
agent_internal:
nullable: true
agent_limits_go_max_procs:
nullable: true
agent_logging_files_interval:
nullable: true
agent_logging_files_keepfiles:
nullable: true
agent_logging_files_rotateeverybytes:
nullable: true
agent_logging_level:
nullable: true
agent_logging_metrics_period:
nullable: true
agent_logging_to_files:
nullable: true
agent_monitoring_runtime_experimental:
nullable: true
agent_features:
items:
additionalProperties: false
type: object
properties:
enabled:
type: boolean
name:
type: string
required:
- name
- enabled
maxItems: 100
type: array
agentless:
additionalProperties: false
type: object
properties:
cloud_connectors:
additionalProperties: false
type: object
properties:
enabled:
type: boolean
target_csp:
enum:
- aws
- azure
- gcp
type: string
required:
- enabled
resources:
additionalProperties: false
type: object
properties:
requests:
additionalProperties: false
type: object
properties:
cpu:
type: string
memory:
type: string
agents:
type: number
agents_per_version:
items:
additionalProperties: false
type: object
properties:
count:
type: number
version:
type: string
required:
- version
- count
maxItems: 1000
type: array
created_at:
type: string
data_output_id:
nullable: true
type: string
description:
type: string
download_source_id:
nullable: true
type: string
fips_agents:
type: number
fleet_server_host_id:
nullable: true
type: string
global_data_tags:
description: User defined data tags that are added to all of the inputs. The values can be strings or numbers.
items:
additionalProperties: false
type: object
properties:
name:
type: string
value:
anyOf:
- type: string
- type: number
required:
- name
- value
maxItems: 100
type: array
has_agent_version_conditions:
type: boolean
has_fleet_server:
type: boolean
id:
type: string
inactivity_timeout:
default: 1209600
minimum: 0
type: number
is_default:
type: boolean
is_default_fleet_server:
type: boolean
is_managed:
type: boolean
is_preconfigured:
type: boolean
is_protected:
description: Indicates whether the agent policy has tamper protection enabled. Default false.
type: boolean
is_verifier:
description: Indicates this is a short-lived verifier policy used for OTel permission verification.
type: boolean
keep_monitoring_alive:
default: false
description: When set to true, monitoring will be enabled but logs/metrics collection will be disabled
nullable: true
type: boolean
min_agent_version:
nullable: true
type: string
monitoring_diagnostics:
additionalProperties: false
type: object
properties:
limit:
additionalProperties: false
type: object
properties:
burst:
type: number
interval:
type: string
uploader:
additionalProperties: false
type: object
properties:
init_dur:
type: string
max_dur:
type: string
max_retries:
type: number
monitoring_enabled:
items:
enum:
- logs
- metrics
- traces
type: string
maxItems: 3
type: array
monitoring_http:
additionalProperties: false
type: object
properties:
buffer:
additionalProperties: false
type: object
properties:
enabled:
default: false
type: boolean
enabled:
type: boolean
host:
type: string
port:
maximum: 65353
minimum: 0
type: number
monitoring_output_id:
nullable: true
type: string
monitoring_pprof_enabled:
type: boolean
name:
minLength: 1
type: string
namespace:
minLength: 1
type: string
overrides:
additionalProperties:
nullable: true
description: Override settings that are defined in the agent policy. Input settings cannot be overridden. The override option should be used only in unusual circumstances and not as a routine procedure.
nullable: true
type: object
package_agent_version_conditions:
items:
additionalProperties: false
type: object
properties:
name:
type: string
title:
type: string
version_condition:
type: string
required:
- name
- title
- version_condition
maxItems: 1000
nullable: true
type: array
package_policies:
anyOf:
- items:
type: string
maxItems: 10000
type: array
- description: This field is present only when retrieving a single agent policy, or when retrieving a list of agent policies with the ?full=true parameter
items:
additionalProperties: false
type: object
properties:
additional_datastreams_permissions:
description: Additional datastream permissions, that will be added to the agent policy.
items:
type: string
maxItems: 1000
nullable: true
type: array
agents:
type: number
cloud_connector_id:
description: ID of the cloud connector associated with this package policy.
nullable: true
type: string
cloud_connector_name:
description: Transient field for cloud connector name during creation.
maxLength: 255
minLength: 1
nullable: true
type: string
created_at:
type: string
created_by:
type: string
description:
description: Package policy description
type: string
elasticsearch:
additionalProperties: true
type: object
properties:
privileges:
additionalProperties: true
type: object
properties:
cluster:
items:
type: string
maxItems: 100
type: array
enabled:
type: boolean
global_data_tags:
items:
additionalProperties: false
type: object
properties:
name:
description: The name of the custom field. Cannot contain spaces.
type: string
value:
anyOf:
- type: string
- type: number
description: The value of the custom field.
required:
- name
- value
maxItems: 100
nullable: true
type: array
id:
description: Package policy unique identifier.
type: string
inputs:
anyOf:
- items:
additionalProperties: false
type: object
properties:
compiled_input:
nullable: true
config:
additionalProperties:
additionalProperties: false
type: object
properties:
frozen:
type: boolean
type:
type: string
value:
nullable: true
required:
- value
description: Package variable (see integration documentation for more information)
type: object
deprecated:
additionalProperties: false
type: object
properties:
description:
type: string
replaced_by:
additionalProperties:
type: string
type: object
since:
type: string
required:
- description
enabled:
type: boolean
id:
type: string
keep_enabled:
type: boolean
migrate_from:
type: string
name:
type: string
policy_template:
type: string
streams:
items:
additionalProperties: false
type: object
properties:
compiled_stream:
nullable: true
config:
additionalProperties:
additionalProperties: false
type: object
properties:
frozen:
type: boolean
type:
type: string
value:
nullable: true
required:
- value
description: Package variable (see integration documentation for more information)
type: object
data_stream:
additionalProperties: false
type: object
properties:
dataset:
type: string
elasticsearch:
additionalProperties: false
type: object
properties:
dynamic_dataset:
type: boolean
dynamic_namespace:
type: boolean
privileges:
additionalProperties: false
type: object
properties:
indices:
items:
type: string
maxItems: 100
type: array
type:
type: string
required:
- dataset
deprecated:
additionalProperties: false
type: object
properties:
description:
type: string
replaced_by:
additionalProperties:
type: string
type: object
since:
type: string
required:
- description
enabled:
type: boolean
id:
type: string
keep_enabled:
type: boolean
migrate_from:
type: string
release:
enum:
- ga
- beta
- experimental
type: string
var_group_selections:
additionalProperties:
type: string
description: Variable group selections. Maps var_group name to the selected option name within that group.
type: object
vars:
additionalProperties:
additionalProperties: false
type: object
properties:
frozen:
type: boolean
type:
type: string
value:
nullable: true
required:
- value
description: Package variable (see integration documentation for more information)
type: object
required:
- enabled
- data_stream
- compiled_stream
maxItems: 1000
type: array
type:
type: string
var_group_selections:
additionalProperties:
type: string
description: Variable group selections. Maps var_group name to the selected option name within that group.
type: object
vars:
additionalProperties:
additionalProperties: false
type: object
properties:
frozen:
type: boolean
type:
type: string
value:
nullable: true
required:
- value
description: Package variable (see integration documentation for more information)
type: object
required:
- type
- enabled
- streams
- compiled_input
maxItems: 100
type: array
- additionalProperties:
additionalProperties: false
type: object
properties:
deprecated:
additionalProperties: false
type: object
properties:
description:
type: string
replaced_by:
additionalProperties:
type: string
type: object
since:
type: string
required:
- description
enabled:
description: Enable or disable that input. Defaults to `true` (enabled).
type: boolean
streams:
additionalProperties:
additionalProperties: false
type: object
properties:
deprecated:
additionalProperties: false
type: object
properties:
description:
type: string
replaced_by:
additionalProperties:
type: string
type: object
since:
type: string
required:
- description
enabled:
description: Enable or disable that stream. Defaults to `true` (enabled).
type: boolean
var_group_selections:
additionalProperties:
type: string
description: Variable group selections. Maps var_group name to the selected option name within that group.
type: object
vars:
additionalProperties:
anyOf:
- type: string
- type: number
- type: boolean
- items:
type: string
maxItems: 100
type: array
- items:
type: number
maxItems: 100
type: array
- additionalProperties: false
type: object
properties:
id:
type: string
isSecretRef:
type: boolean
required:
- id
- isSecretRef
nullable: true
description: Input/stream level variable. Refer to the integration documentation for more information.
type: object
description: Input streams. Refer to the integration documentation to know which streams are available.
type: object
vars:
additionalProperties:
anyOf:
- type: string
- type: number
- type: boolean
- items:
type: string
maxItems: 100
type: array
- items:
type: number
maxItems: 100
type: array
- additionalProperties: false
type: object
properties:
id:
type: string
isSecretRef:
type: boolean
required:
- id
- isSecretRef
nullable: true
description: Input/stream level variable. Refer to the integration documentation for more information.
type: object
description: Package policy inputs. Refer to the integration documentation to know which inputs are available.
type: object
x-oas-optional: true
description: Package policy inputs.
is_managed:
type: boolean
name:
description: Unique name for the package policy.
type: string
namespace:
description: The package policy namespace. Leave blank to inherit the agent policy's namespace.
type: string
output_id:
nullable: true
type: string
overrides:
additionalProperties: false
description: Override settings that are defined in the package policy. The override option should be used only in unusual circumstances and not as a routine procedure.
nullable: true
type: object
properties:
inputs:
additionalProperties:
nullable: true
type: object
package:
additionalProperties: false
type: object
properties:
experimental_data_stream_features:
items:
additionalProperties: false
type: object
properties:
data_stream:
type: string
features:
additionalProperties: false
type: object
properties:
doc_value_only_numeric:
type: boolean
doc_value_only_other:
type: boolean
synthetic_source:
type: boolean
tsdb:
type: boolean
required:
- data_stream
- features
maxItems: 100
type: array
fips_compatible:
type: boolean
name:
description: Package name
type: string
requires_root:
type: boolean
title:
type: string
version:
description: Package version
type: string
required:
- name
- version
package_agent_version_condition:
type: string
policy_id:
deprecated: true
description: ID of the agent policy which the package policy will be added to.
nullable: true
type: string
policy_ids:
items:
description: IDs of the agent policies which that package policy will be added to.
type: string
maxItems: 1000
type: array
revision:
description: Package policy revision.
type: number
secret_references:
items:
additionalProperties: false
type: object
properties:
id:
type: string
required:
- id
maxItems: 1000
type: array
spaceIds:
items:
type: string
maxItems: 100
type: array
supports_agentless:
default: false
description: Indicates whether the package policy belongs to an agentless agent policy.
nullable: true
type: boolean
supports_cloud_connector:
default: false
description: Indicates whether the package policy supports cloud connectors.
nullable: true
type: boolean
updated_at:
type: string
updated_by:
type: string
var_group_selections:
additionalProperties:
type: string
description: Variable group selections. Maps var_group name to the selected option name within that group.
type: object
vars:
anyOf:
- additionalProperties:
additionalProperties: false
type: object
properties:
frozen:
type: boolean
type:
type: string
value:
nullable: true
required:
- value
description: Package variable (see integration documentation for more information)
type: object
- additionalProperties:
anyOf:
- type: string
- type: number
- type: boolean
- items:
type: string
maxItems: 100
type: array
- items:
type: number
maxItems: 100
type: array
- additionalProperties: false
type: object
properties:
id:
type: string
isSecretRef:
type: boolean
required:
- id
- isSecretRef
nullable: true
description: Input/stream level variable. Refer to the integration documentation for more information.
type: object
x-oas-optional: true
description: Package level variable.
version:
description: Package policy ES version.
type: string
required:
- name
- enabled
- inputs
- id
- revision
- updated_at
- updated_by
- created_at
- created_by
maxItems: 10000
type: array
required_versions:
items:
additionalProperties: false
type: object
properties:
percentage:
description: Target percentage of agents to auto upgrade
maximum: 100
minimum: 0
type: number
version:
description: Target version for automatic agent upgrade
type: string
required:
- version
- percentage
maxItems: 100
nullable: true
type: array
revision:
type: number
schema_version:
type: string
space_ids:
items:
type: string
maxItems: 100
type: array
status:
enum:
- active
- inactive
type: string
supports_agentless:
default: false
description: Indicates whether the agent policy supports agentless integrations.
nullable: true
type: boolean
unenroll_timeout:
minimum: 0
type: number
unprivileged_agents:
type: number
updated_at:
type: string
updated_by:
type: string
version:
type: string
required:
- id
- name
- namespace
- is_protected
- status
- updated_at
- updated_by
- revision
required:
- item
description: Successful response
'400':
content:
application/json:
examples:
genericErrorResponseExample:
description: Example of a generic error response
value:
error: Bad Request
message: An error message describing what went wrong
statusCode: 400
schema:
additionalProperties: false
description: Generic Error
type: object
properties:
attributes:
nullable: true
error:
type: string
errorType:
type: string
message:
type: string
statusCode:
type: number
required:
- message
- attributes
description: Bad Request
summary: Create an agent policy
tags:
- Elastic Agent policies
x-metaTags:
- content: Kibana
name: product_name
/api/fleet/agent_policies/_bulk_get:
post:
description: '**Spaces method and path for this operation:**
post /s/{space_id}/api/fleet/agent_policies/_bulk_get
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
Get multiple agent policies by ID.
[Required authorization] Route required privileges: fleet-agent-policies-read OR fleet-agents-read OR fleet-setup.'
operationId: post-fleet-agent-policies-bulk-get
parameters:
- description: A required header to protect against CSRF attacks
in: header
name: kbn-xsrf
required: true
schema:
example: 'true'
type: string
- description: 'Format for the response: simplified or legacy'
in: query
name: format
required: false
schema:
enum:
- simplified
- legacy
type: string
requestBody:
content:
application/json:
examples:
postBulkGetAgentPoliciesRequestExample:
description: Retrieve multiple agent policies by ID
value:
ids:
- agent-policy-id-1
- agent-policy-id-2
schema:
additionalProperties: false
type: object
properties:
full:
description: get full policies with package policies populated
type: boolean
ids:
description: list of package policy ids
items:
type: string
maxItems: 1000
type: array
ignoreMissing:
type: boolean
required:
- ids
responses:
'200':
content:
application/json:
examples:
postBulkGetAgentPoliciesExample:
description: The requested agent policies
value:
items:
- id: agent-policy-id-1
is_managed: false
is_protected: false
name: My agent policy
namespace: default
revision: 1
status: active
updated_at: '2024-01-15T10:00:00.000Z'
updated_by: user1
schema:
additionalProperties: false
type: object
properties:
items:
items:
additionalProperties: false
type: object
properties:
advanced_settings:
additionalProperties: false
type: object
properties:
agent_download_target_directory:
nullable: true
agent_download_timeout:
nullable: true
agent_features_disable_policy_change_acks_enabled:
nullable: true
agent_internal:
nullable: true
agent_limits_go_max_procs:
nullable: true
agent_logging_files_interval:
nullable: true
agent_logging_files_keepfiles:
nullable: true
agent_logging_files_rotateeverybytes:
nullable: true
agent_logging_level:
nullable: true
agent_logging_metrics_period:
nullable: true
agent_logging_to_files:
nullable: true
agent_monitoring_runtime_experimental:
nullable: true
agent_features:
items:
additionalProperties: false
type: object
properties:
enabled:
type: boolean
name:
type: string
required:
- name
- enabled
maxItems: 100
type: array
agentless:
additionalProperties: false
type: object
properties:
cloud_connectors:
additionalProperties: false
type: object
properties:
enabled:
type: boolean
target_csp:
enum:
- aws
- azure
- gcp
type: string
required:
- enabled
resources:
additionalProperties: false
type: object
properties:
requests:
additionalProperties: false
type: object
properties:
cpu:
type: string
memory:
type: string
agents:
type: number
agents_per_version:
items:
additionalProperties: false
type: object
properties:
count:
type: number
version:
type: string
required:
- version
- count
maxItems: 1000
type: array
created_at:
type: string
data_output_id:
nullable: true
type: string
description:
type: string
download_source_id:
nullable: true
type: string
fips_agents:
type: number
fleet_server_host_id:
nullable: true
type: string
global_data_tags:
description: User defined data tags that are added to all of the inputs. The values can be strings or numbers.
items:
additionalProperties: false
type: object
properties:
name:
type: string
value:
anyOf:
- type: string
- type: number
required:
- name
- value
maxItems: 100
type: array
has_agent_version_conditions:
type: boolean
has_fleet_server:
type: boolean
id:
type: string
inactivity_timeout:
default: 1209600
minimum: 0
type: number
is_default:
type: boolean
is_default_fleet_server:
type: boolean
is_managed:
type: boolean
is_preconfigured:
type: boolean
is_protected:
description: Indicates whether the agent policy has tamper protection enabled. Default false.
type: boolean
is_verifier:
description: Indicates this is a short-lived verifier policy used for OTel permission verification.
type: boolean
keep_monitoring_alive:
default: false
description: When set to true, monitoring will be enabled but logs/metrics collection will be disabled
nullable: true
type: boolean
min_agent_version:
nullable: true
type: string
monitoring_diagnostics:
additionalProperties: false
type: object
properties:
limit:
additionalProperties: false
type: object
properties:
burst:
type: number
interval:
type: string
uploader:
additionalProperties: false
type: object
properties:
init_dur:
type: string
max_dur:
type: string
max_retries:
type: number
monitoring_enabled:
items:
enum:
- logs
- metrics
- traces
type: string
maxItems: 3
type: array
monitoring_http:
additionalProperties: false
type: object
properties:
buffer:
additionalProperties: false
type: object
properties:
enabled:
default: false
type: boolean
enabled:
type: boolean
host:
type: string
port:
maximum: 65353
minimum: 0
type: number
monitoring_output_id:
nullable: true
type: string
monitoring_pprof_enabled:
type: boolean
name:
minLength: 1
type: string
namespace:
minLength: 1
type: string
overrides:
additionalProperties:
nullable: true
description: Override settings that are defined in the agent policy. Input settings cannot be overridden. The override option should be used only in unusual circumstances and not as a routine procedure.
nullable: true
type: object
package_agent_version_conditions:
items:
additionalProperties: false
type: object
properties:
name:
type: string
title:
type: string
version_condition:
type: string
required:
- name
- title
- version_condition
maxItems: 1000
nullable: true
type: array
package_policies:
anyOf:
- items:
type: string
maxItems: 10000
type: array
- description: This field is present only when retrieving a single agent policy, or when retrieving a list of agent policies with the ?full=true parameter
items:
additionalProperties: false
type: object
properties:
additional_datastreams_permissions:
description: Additional datastream permissions, that will be added to the agent policy.
items:
type: string
maxItems: 1000
nullable: true
type: array
agents:
type: number
cloud_connector_id:
description: ID of the cloud connector associated with this package policy.
nullable: true
type: string
cloud_connector_name:
description: Transient field for cloud connector name during creation.
maxLength: 255
minLength: 1
nullable: true
type: string
created_at:
type: string
created_by:
type: string
description:
description: Package policy description
type: string
elasticsearch:
additionalProperties: true
type: object
properties:
privileges:
additionalProperties: true
type: object
properties:
cluster:
items:
type: string
maxItems: 100
type: array
enabled:
type: boolean
global_data_tags:
items:
additionalProperties: false
type: object
properties:
name:
description: The name of the custom field. Cannot contain spaces.
type: string
value:
anyOf:
- type: string
- type: number
description: The value of the custom field.
required:
- name
- value
maxItems: 100
nullable: true
type: array
id:
description: Package policy unique identifier.
type: string
inputs:
anyOf:
- items:
additionalProperties: false
type: object
properties:
compiled_input:
nullable: true
config:
additionalProperties:
additionalProperties: false
type: object
properties:
frozen:
type: boolean
type:
type: string
value:
nullable: true
required:
- value
description: Package variable (see integration documentation for more information)
type: object
deprecated:
additionalProperties: false
type: object
properties:
description:
type: string
replaced_by:
additionalProperties:
type: string
type: object
since:
type: string
required:
- description
enabled:
type: boolean
id:
type: string
keep_enabled:
type: boolean
migrate_from:
type: string
name:
type: string
policy_template:
type: string
streams:
items:
additionalProperties: false
type: object
properties:
compiled_stream:
nullable: true
config:
additionalProperties:
additionalProperties: false
type: object
properties:
frozen:
type: boolean
type:
type: string
value:
nullable: true
required:
- value
description: Package variable (see integration documentation for more information)
type: object
data_stream:
additionalProperties: false
type: object
properties:
dataset:
type: string
elasticsearch:
additionalProperties: false
type: object
properties:
dynamic_dataset:
type: boolean
dynamic_namespace:
type: boolean
privileges:
additionalProperties: false
type: object
properties:
indices:
items:
type: string
maxItems: 100
type: array
type:
type: string
required:
- dataset
deprecated:
additionalProperties: false
type: object
properties:
description:
type: string
replaced_by:
additionalProperties:
type: string
type: object
since:
type: string
required:
- description
enabled:
type: boolean
id:
type: string
keep_enabled:
type: boolean
migrate_from:
type: string
release:
enum:
- ga
- beta
- experimental
type: string
var_group_selections:
additionalProperties:
type: string
description: Variable group selections. Maps var_group name to the selected option name within that group.
type: object
vars:
additionalProperties:
additionalProperties: false
type: object
properties:
frozen:
type: boolean
type:
type: string
value:
nullable: true
required:
- value
description: Package variable (see integration documentation for more information)
type: object
required:
- enabled
- data_stream
- compiled_stream
maxItems: 1000
type: array
type:
type: string
var_group_selections:
additionalProperties:
type: string
description: Variable group selections. Maps var_group name to the selected option name within that group.
type: object
vars:
additionalProperties:
additionalProperties: false
type: object
properties:
frozen:
type: boolean
type:
type: string
value:
nullable: true
required:
- value
description: Package variable (see integration documentation for more information)
type: object
required:
- type
- enabled
- streams
- compiled_input
maxItems: 100
type: array
- additionalProperties:
additionalProperties: false
type: object
properties:
deprecated:
additionalProperties: false
type: object
properties:
description:
type: string
replaced_by:
additionalProperties:
type: string
type: object
since:
type: string
required:
- description
enabled:
description: Enable or disable that input. Defaults to `true` (enabled).
type: boolean
streams:
additionalProperties:
additionalProperties: false
type: object
properties:
deprecated:
additionalProperties: false
type: object
properties:
description:
type: string
replaced_by:
additionalProperties:
type: string
type: object
since:
type: string
required:
- description
enabled:
description: Enable or disable that stream. Defaults to `true` (enabled).
type: boolean
var_group_selections:
additionalProperties:
type: string
description: Variable group selections. Maps var_group name to the selected option name within that group.
type: object
vars:
additionalProperties:
anyOf:
- type: string
- type: number
- type: boolean
- items:
type: string
maxItems: 100
type: array
- items:
type: number
maxItems: 100
type: array
- additionalProperties: false
type: object
properties:
id:
type: string
isSecretRef:
type: boolean
required:
- id
- isSecretRef
nullable: true
description: Input/stream level variable. Refer to the integration documentation for more information.
type: object
description: Input streams. Refer to the integration documentation to know which streams are available.
type: object
vars:
additionalProperties:
anyOf:
- type: string
- type: number
- type: boolean
- items:
type: string
maxItems: 100
type: array
- items:
type: number
maxItems: 100
type: array
- additionalProperties: false
type: object
properties:
id:
type: string
isSecretRef:
type: boolean
required:
- id
- isSecretRef
nullable: true
description: Input/stream level variable. Refer to the integration documentation for more information.
type: object
description: Package policy inputs. Refer to the integration documentation to know which inputs are available.
type: object
x-oas-optional: true
description: Package policy inputs.
is_managed:
type: boolean
name:
description: Unique name for the package policy.
type: string
namespace:
description: The package policy namespace. Leave blank to inherit the agent policy's namespace.
type: string
output_id:
nullable: true
type: string
overrides:
additionalProperties: false
description: Override settings that are defined in the package policy. The override option should be used only in unusual circumstances and not as a routine procedure.
nullable: true
type: object
properties:
inputs:
additionalProperties:
nullable: true
type: object
package:
additionalProperties: false
type: object
properties:
experimental_data_stream_features:
items:
additionalProperties: false
type: object
properties:
data_stream:
type: string
features:
additionalProperties: false
type: object
properties:
doc_value_only_numeric:
type: boolean
doc_value_only_other:
type: boolean
synthetic_source:
type: boolean
tsdb:
type: boolean
required:
- data_stream
- features
maxItems: 100
type: array
fips_compatible:
type: boolean
name:
description: Package name
type: string
requires_root:
type: boolean
title:
type: string
version:
description: Package version
type: string
required:
- name
- version
package_agent_version_condition:
type: string
policy_id:
deprecated: true
description: ID of the agent policy which the package policy will be added to.
nullable: true
type: string
policy_ids:
items:
description: IDs of the agent policies which that package policy will be added to.
type: string
maxItems: 1000
type: array
revision:
description: Package policy revision.
type: number
secret_references:
items:
additionalProperties: false
type: object
properties:
id:
type: string
required:
- id
maxItems: 1000
type: array
spaceIds:
items:
type: string
maxItems: 100
type: array
supports_agentless:
default: false
description: Indicates whether the package policy belongs to an agentless agent policy.
nullable: true
type: boolean
supports_cloud_connector:
default: false
description: Indicates whether the package policy supports cloud connectors.
nullable: true
type: boolean
updated_at:
type: string
updated_by:
type: string
var_group_selections:
additionalProperties:
type: string
description: Variable group selections. Maps var_group name to the selected option name within that group.
type: object
vars:
anyOf:
- additionalProperties:
additionalProperties: false
type: object
properties:
frozen:
type: boolean
type:
type: string
value:
nullable: true
required:
- value
description: Package variable (see integration documentation for more information)
type: object
- additionalProperties:
anyOf:
- type: string
- type: number
- type: boolean
- items:
type: string
maxItems: 100
type: array
- items:
type: number
maxItems: 100
type: array
- additionalProperties: false
type: object
properties:
id:
type: string
isSecretRef:
type: boolean
required:
- id
- isSecretRef
nullable: true
description: Input/stream level variable. Refer to the integration documentation for more information.
type: object
x-oas-optional: true
description: Package level variable.
version:
description: Package policy ES version.
type: string
required:
- name
- enabled
- inputs
- id
- revision
- updated_at
- updated_by
- created_at
- created_by
maxItems: 10000
type: array
required_versions:
items:
additionalProperties: false
type: object
properties:
percentage:
description: Target percentage of agents to auto upgrade
maximum: 100
minimum: 0
type: number
version:
description: Target version for automatic agent upgrade
type: string
required:
- version
- percentage
maxItems: 100
nullable: true
type: array
revision:
type: number
schema_version:
type: string
space_ids:
items:
type: string
maxItems: 100
type: array
status:
enum:
- active
- inactive
type: string
supports_agentless:
default: false
description: Indicates whether the agent policy supports agentless integrations.
nullable: true
type: boolean
unenroll_timeout:
minimum: 0
type: number
unprivileged_agents:
type: number
updated_at:
type: string
updated_by:
type: string
version:
type: string
required:
- id
- name
- namespace
- is_protected
- status
- updated_at
- updated_by
- revision
maxItems: 10000
type: array
required:
- items
description: Successful response
'400':
content:
application/json:
examples:
genericErrorResponseExample:
description: Example of a generic error response
value:
error: Bad Request
message: An error message describing what went wrong
statusCode: 400
schema:
additionalProperties: false
description: Generic Error
type: object
properties:
attributes:
nullable: true
error:
type: string
errorType:
type: string
message:
type: string
statusCode:
type: number
required:
- message
- attributes
description: Bad Request
'404':
content:
application/json:
examples:
notFoundExample:
description: One or more agent policies were not found
value:
error: Not Found
message: An error message describing what went wrong
statusCode: 404
description: Not Found
summary: Bulk get agent policies
tags:
- Elastic Agent policies
x-metaTags:
- content: Kibana
name: product_name
/api/fleet/agent_policies/{agentPolicyId}:
get:
description: '**Spaces method and path for this operation:**
get /s/{space_id}/api/fleet/agent_policies/{agentPolicyId}
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
Get an agent policy by ID.
[Required authorization] Route required privileges: fleet-agent-policies-read OR fleet-agents-read OR fleet-setup.'
operationId: get-fleet-agent-policies-agentpolicyid
parameters:
- description: The ID of the agent policy
in: path
name: agentPolicyId
required: true
schema:
type: string
- description: 'Format for the response: simplified or legacy'
in: query
name: format
required: false
schema:
enum:
- simplified
- legacy
type: string
responses:
'200':
content:
application/json:
examples:
getAgentPolicyExample:
description: An agent policy
value:
item:
description: A sample agent policy
id: agent-policy-id-1
is_managed: false
is_protected: false
name: My agent policy
namespace: default
revision: 1
status: active
updated_at: '2024-01-15T10:00:00.000Z'
updated_by: user1
schema:
additionalProperties: false
type: object
properties:
item:
additionalProperties: false
type: object
properties:
advanced_settings:
additionalProperties: false
type: object
properties:
agent_download_target_directory:
nullable: true
agent_download_timeout:
nullable: true
agent_features_disable_policy_change_acks_enabled:
nullable: true
agent_internal:
nullable: true
agent_limits_go_max_procs:
nullable: true
agent_logging_files_interval:
nullable: true
agent_logging_files_keepfiles:
nullable: true
agent_logging_files_rotateeverybytes:
nullable: true
agent_logging_level:
nullable: true
agent_logging_metrics_period:
nullable: true
agent_logging_to_files:
nullable: true
agent_monitoring_runtime_experimental:
nullable: true
agent_features:
items:
additionalProperties: false
type: object
properties:
enabled:
type: boolean
name:
type: string
required:
- name
- enabled
maxItems: 100
type: array
agentless:
additionalProperties: false
type: object
properties:
cloud_connectors:
additionalProperties: false
type: object
properties:
enabled:
type: boolean
target_csp:
enum:
- aws
- azure
- gcp
type: string
required:
- enabled
resources:
additionalProperties: false
type: object
properties:
requests:
additionalProperties: false
type: object
properties:
cpu:
type: string
memory:
type: string
agents:
type: number
agents_per_version:
items:
additionalProperties: false
type: object
properties:
count:
type: number
version:
type: string
required:
- version
- count
maxItems: 1000
type: array
created_at:
type: string
data_output_id:
nullable: true
type: string
description:
type: string
download_source_id:
nullable: true
type: string
fips_agents:
type: number
fleet_server_host_id:
nullable: true
type: string
global_data_tags:
description: User defined data tags that are added to all of the inputs. The values can be strings or numbers.
items:
additionalProperties: false
type: object
properties:
name:
type: string
value:
anyOf:
- type: string
- type: number
required:
- name
- value
maxItems: 100
type: array
has_agent_version_conditions:
type: boolean
has_fleet_server:
type: boolean
id:
type: string
inactivity_timeout:
default: 1209600
minimum: 0
type: number
is_default:
type: boolean
is_default_fleet_server:
type: boolean
is_managed:
type: boolean
is_preconfigured:
type: boolean
is_protected:
description: Indicates whether the agent policy has tamper protection enabled. Default false.
type: boolean
is_verifier:
description: Indicates this is a short-lived verifier policy used for OTel permission verification.
type: boolean
keep_monitoring_alive:
default: false
description: When set to true, monitoring will be enabled but logs/metrics collection will be disabled
nullable: true
type: boolean
min_agent_version:
nullable: true
type: string
monitoring_diagnostics:
additionalProperties: false
type: object
properties:
limit:
additionalProperties: false
type: object
properties:
burst:
type: number
interval:
type: string
uploader:
additionalProperties: false
type: object
properties:
init_dur:
type: string
max_dur:
type: string
max_retries:
type: number
monitoring_enabled:
items:
enum:
- logs
- metrics
- traces
type: string
maxItems: 3
type: array
monitoring_http:
additionalProperties: false
type: object
properties:
buffer:
additionalProperties: false
type: object
properties:
enabled:
default: false
type: boolean
enabled:
type: boolean
host:
type: string
port:
maximum: 65353
minimum: 0
type: number
monitoring_output_id:
nullable: true
type: string
monitoring_pprof_enabled:
type: boolean
name:
minLength: 1
type: string
namespace:
minLength: 1
type: string
overrides:
additionalProperties:
nullable: true
description: Override settings that are defined in the agent policy. Input settings cannot be overridden. The override option should be used only in unusual circumstances and not as a routine procedure.
nullable: true
type: object
package_agent_version_conditions:
items:
additionalProperties: false
type: object
properties:
name:
type: string
title:
type: string
version_condition:
type: string
required:
- name
- title
- version_condition
maxItems: 1000
nullable: true
type: array
package_policies:
anyOf:
- items:
type: string
maxItems: 10000
type: array
- description: This field is present only when retrieving a single agent policy, or when retrieving a list of agent policies with the ?full=true parameter
items:
additionalProperties: false
type: object
properties:
additional_datastreams_permissions:
description: Additional datastream permissions, that will be added to the agent policy.
items:
type: string
maxItems: 1000
nullable: true
type: array
agents:
type: number
cloud_connector_id:
description: ID of the cloud connector associated with this package policy.
nullable: true
type: string
cloud_connector_name:
description: Transient field for cloud connector name during creation.
maxLength: 255
minLength: 1
nullable: true
type: string
created_at:
type: string
created_by:
type: string
description:
description: Package policy description
type: string
elasticsearch:
additionalProperties: true
type: object
properties:
privileges:
additionalProperties: true
type: object
properties:
cluster:
items:
type: string
maxItems: 100
type: array
enabled:
type: boolean
global_data_tags:
items:
additionalProperties: false
type: object
properties:
name:
description: The name of the custom field. Cannot contain spaces.
type: string
value:
anyOf:
- type: string
- type: number
description: The value of the custom field.
required:
- name
- value
maxItems: 100
nullable: true
type: array
id:
description: Package policy unique identifier.
type: string
inputs:
anyOf:
- items:
additionalProperties: false
type: object
properties:
compiled_input:
nullable: true
config:
additionalProperties:
additionalProperties: false
type: object
properties:
frozen:
type: boolean
type:
type: string
value:
nullable: true
required:
- value
description: Package variable (see integration documentation for more information)
type: object
deprecated:
additionalProperties: false
type: object
properties:
description:
type: string
replaced_by:
additionalProperties:
type: string
type: object
since:
type: string
required:
- description
enabled:
type: boolean
id:
type: string
keep_enabled:
type: boolean
migrate_from:
type: string
name:
type: string
policy_template:
type: string
streams:
items:
additionalProperties: false
type: object
properties:
compiled_stream:
nullable: true
config:
additionalProperties:
additionalProperties: false
type: object
properties:
frozen:
type: boolean
type:
type: string
value:
nullable: true
required:
- value
description: Package variable (see integration documentation for more information)
type: object
data_stream:
additionalProperties: false
type: object
properties:
dataset:
type: string
elasticsearch:
additionalProperties: false
type: object
properties:
dynamic_dataset:
type: boolean
dynamic_namespace:
type: boolean
privileges:
additionalProperties: false
type: object
properties:
indices:
items:
type: string
maxItems: 100
type: array
type:
type: string
required:
- dataset
deprecated:
additionalProperties: false
type: object
properties:
description:
type: string
replaced_by:
additionalProperties:
type: string
type: object
since:
type: string
required:
- description
enabled:
type: boolean
id:
type: string
keep_enabled:
type: boolean
migrate_from:
type: string
release:
enum:
- ga
- beta
- experimental
type: string
var_group_selections:
additionalProperties:
type: string
description: Variable group selections. Maps var_group name to the selected option name within that group.
type: object
vars:
additionalProperties:
additionalProperties: false
type: object
properties:
frozen:
type: boolean
type:
type: string
value:
nullable: true
required:
- value
description: Package variable (see integration documentation for more information)
type: object
required:
- enabled
- data_stream
- compiled_stream
maxItems: 1000
type: array
type:
type: string
var_group_selections:
additionalProperties:
type: string
description: Variable group selections. Maps var_group name to the selected option name within that group.
type: object
vars:
additionalProperties:
additionalProperties: false
type: object
properties:
frozen:
type: boolean
type:
type: string
value:
nullable: true
required:
- value
description: Package variable (see integration documentation for more information)
type: object
required:
- type
- enabled
- streams
- compiled_input
maxItems: 100
type: array
- additionalProperties:
additionalProperties: false
type: object
properties:
deprecated:
additionalProperties: false
type: object
properties:
description:
type: string
replaced_by:
additionalProperties:
type: string
type: object
since:
type: string
required:
- description
enabled:
description: Enable or disable that input. Defaults to `true` (enabled).
type: boolean
streams:
additionalProperties:
additionalProperties: false
type: object
properties:
deprecated:
additionalProperties: false
type: object
properties:
description:
type: string
replaced_by:
additionalProperties:
type: string
type: object
since:
type: string
required:
- description
enabled:
description: Enable or disable that stream. Defaults to `true` (enabled).
type: boolean
var_group_selections:
additionalProperties:
type: string
description: Variable group selections. Maps var_group name to the selected option name within that group.
type: object
vars:
additionalProperties:
anyOf:
- type: string
- type: number
- type: boolean
- items:
type: string
maxItems: 100
type: array
- items:
type: number
maxItems: 100
type: array
- additionalProperties: false
type: object
properties:
id:
type: string
isSecretRef:
type: boolean
required:
- id
- isSecretRef
nullable: true
description: Input/stream level variable. Refer to the integration documentation for more information.
type: object
description: Input streams. Refer to the integration documentation to know which streams are available.
type: object
vars:
additionalProperties:
anyOf:
- type: string
- type: number
- type: boolean
- items:
type: string
maxItems: 100
type: array
- items:
type: number
maxItems: 100
type: array
- additionalProperties: false
type: object
properties:
id:
type: string
isSecretRef:
type: boolean
required:
- id
- isSecretRef
nullable: true
description: Input/stream level variable. Refer to the integration documentation for more information.
type: object
description: Package policy inputs. Refer to the integration documentation to know which inputs are available.
type: object
x-oas-optional: true
description: Package policy inputs.
is_managed:
type: boolean
name:
description: Unique name for the package policy.
type: string
namespace:
description: The package policy namespace. Leave blank to inherit the agent policy's namespace.
type: string
output_id:
nullable: true
type: string
overrides:
additionalProperties: false
description: Override settings that are defined in the package policy. The override option should be used only in unusual circumstances and not as a routine procedure.
nullable: true
type: object
properties:
inputs:
additionalProperties:
nullable: true
type: object
package:
additionalProperties: false
type: object
properties:
experimental_data_stream_features:
items:
additionalProperties: false
type: object
properties:
data_stream:
type: string
features:
additionalProperties: false
type: object
properties:
doc_value_only_numeric:
type: boolean
doc_value_only_other:
type: boolean
synthetic_source:
type: boolean
tsdb:
type: boolean
required:
- data_stream
- features
maxItems: 100
type: array
fips_compatible:
type: boolean
name:
description: Package name
type: string
requires_root:
type: boolean
title:
type: string
version:
description: Package version
type: string
required:
- name
- version
package_agent_version_condition:
type: string
policy_id:
deprecated: true
description: ID of the agent policy which the package policy will be added to.
nullable: true
type: string
policy_ids:
items:
description: IDs of the agent policies which that package policy will be added to.
type: string
maxItems: 1000
type: array
revision:
description: Package policy revision.
type: number
secret_references:
items:
additionalProperties: false
type: object
properties:
id:
type: string
required:
- id
maxItems: 1000
type: array
spaceIds:
items:
type: string
maxItems: 100
type: array
supports_agentless:
default: false
description: Indicates whether the package policy belongs to an agentless agent policy.
nullable: true
type: boolean
supports_cloud_connector:
default: false
description: Indicates whether the package policy supports cloud connectors.
nullable: true
type: boolean
updated_at:
type: string
updated_by:
type: string
var_group_selections:
additionalProperties:
type: string
description: Variable group selections. Maps var_group name to the selected option name within that group.
type: object
vars:
anyOf:
- additionalProperties:
additionalProperties: false
type: object
properties:
frozen:
type: boolean
type:
type: string
value:
nullable: true
required:
- value
description: Package variable (see integration documentation for more information)
type: object
- additionalProperties:
anyOf:
- type: string
- type: number
- type: boolean
- items:
type: string
maxItems: 100
type: array
- items:
type: number
maxItems: 100
type: array
- additionalProperties: false
type: object
properties:
id:
type: string
isSecretRef:
type: boolean
required:
- id
- isSecretRef
nullable: true
description: Input/stream level variable. Refer to the integration documentation for more information.
type: object
x-oas-optional: true
description: Package level variable.
version:
description: Package policy ES version.
type: string
required:
- name
- enabled
- inputs
- id
- revision
- updated_at
- updated_by
- created_at
- created_by
maxItems: 10000
type: array
required_versions:
items:
additionalProperties: false
type: object
properties:
percentage:
description: Target percentage of agents to auto upgrade
maximum: 100
minimum: 0
type: number
version:
description: Target version for automatic agent upgrade
type: string
required:
- version
- percentage
maxItems: 100
nullable: true
type: array
revision:
type: number
schema_version:
type: string
space_ids:
items:
type: string
maxItems: 100
type: array
status:
enum:
- active
- inactive
type: string
supports_agentless:
default: false
description: Indicates whether the agent policy supports agentless integrations.
nullable: true
type: boolean
unenroll_timeout:
minimum: 0
type: number
unprivileged_agents:
type: number
updated_at:
type: string
updated_by:
type: string
version:
type: string
required:
- id
- name
- namespace
- is_protected
- status
- updated_at
- updated_by
- revision
required:
- item
description: Successful response
'400':
content:
application/json:
examples:
genericErrorResponseExample:
description: Example of a generic error response
value:
error: Bad Request
message: An error message describing what went wrong
statusCode: 400
schema:
additionalProperties: false
description: Generic Error
type: object
properties:
attributes:
nullable: true
error:
type: string
errorType:
type: string
message:
type: string
statusCode:
type: number
required:
- message
- attributes
description: Bad Request
'404':
content:
application/json:
examples:
notFoundExample:
description: No agent policy was found with the given ID
value:
error: Not Found
message: Agent policy not found
statusCode: 404
description: Not Found
summary: Get an agent policy
tags:
- Elastic Agent policies
x-metaTags:
- content: Kibana
name: product_name
put:
description: '**Spaces method and path for this operation:**
put /s/{space_id}/api/fleet/agent_policies/{agentPolicyId}
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
Update an agent policy by ID.
[Required authorization] Route required privileges: fleet-agent-policies-all.'
operationId: put-fleet-agent-policies-agentpolicyid
parameters:
- description: A required header to protect against CSRF attacks
in: header
name: kbn-xsrf
required: true
schema:
example: 'true'
type: string
- description: The ID of the agent policy
in: path
name: agentPolicyId
required: true
schema:
type: string
- description: 'Format for the response: simplified or legacy'
in: query
name: format
required: false
schema:
enum:
- simplified
- legacy
type: string
requestBody:
content:
application/json:
examples:
putAgentPolicyRequestExample:
description: Update an agent policy
value:
description: An updated agent policy description
monitoring_enabled:
- logs
name: Updated agent policy
namespace: default
schema:
additionalProperties: false
type: object
properties:
advanced_settings:
additionalProperties: false
type: object
properties:
agent_download_target_directory:
nullable: true
agent_download_timeout:
nullable: true
agent_features_disable_policy_change_acks_enabled:
nullable: true
agent_internal:
nullable: true
agent_limits_go_max_procs:
nullable: true
agent_logging_files_interval:
nullable: true
agent_logging_files_keepfiles:
nullable: true
agent_logging_files_rotateeverybytes:
nullable: true
agent_logging_level:
nullable: true
agent_logging_metrics_period:
nullable: true
agent_logging_to_files:
nullable: true
agent_monitoring_runtime_experimental:
nullable: true
agent_features:
items:
additionalProperties: false
type: object
properties:
enabled:
type: boolean
name:
type: string
required:
- name
- enabled
maxItems: 100
type: array
agentless:
additionalProperties: false
type: object
properties:
cloud_connectors:
additionalProperties: false
type: object
properties:
enabled:
type: boolean
target_csp:
enum:
- aws
- azure
- gcp
type: string
required:
- enabled
resources:
additionalProperties: false
type: object
properties:
requests:
additionalProperties: false
type: object
properties:
cpu:
type: string
memory:
type: string
bumpRevision:
type: boolean
data_output_id:
nullable: true
type: string
description:
type: string
download_source_id:
nullable: true
type: string
fleet_server_host_id:
nullable: true
type: string
force:
type: boolean
global_data_tags:
description: User defined data tags that are added to all of the inputs. The values can be strings or numbers.
items:
additionalProperties: false
type: object
properties:
name:
type: string
value:
anyOf:
- type: string
- type: number
required:
- name
- value
maxItems: 100
type: array
has_agent_version_conditions:
type: boolean
has_fleet_server:
type: boolean
id:
type: string
inactivity_timeout:
default: 1209600
minimum: 0
type: number
is_default:
type: boolean
is_default_fleet_server:
type: boolean
is_managed:
type: boolean
is_protected:
type: boolean
is_verifier:
description: Indicates this is a short-lived verifier policy used for OTel permission verification.
type: boolean
keep_monitoring_alive:
default: false
description: When set to true, monitoring will be enabled but logs/metrics collection will be disabled
nullable: true
type: boolean
monitoring_diagnostics:
additionalProperties: false
type: object
properties:
limit:
additionalProperties: false
type: object
properties:
burst:
type: number
interval:
type: string
uploader:
additionalProperties: false
type: object
properties:
init_dur:
type: string
max_dur:
type: string
max_retries:
type: number
monitoring_enabled:
items:
enum:
- logs
- metrics
- traces
type: string
maxItems: 3
type: array
monitoring_http:
additionalProperties: false
type: object
properties:
buffer:
additionalProperties: false
type: object
properties:
enabled:
default: false
type: boolean
enabled:
type: boolean
host:
type: string
port:
maximum: 65353
minimum: 0
type: number
monitoring_output_id:
nullable: true
type: string
monitoring_pprof_enabled:
type: boolean
name:
minLength: 1
type: string
namespace:
minLength: 1
type: string
overrides:
additionalProperties:
nullable: true
description: Override settings that are defined in the agent policy. Input settings cannot be overridden. The override option should be used only in unusual circumstances and not as a routine procedure.
nullable: true
type: object
required_versions:
items:
additionalProperties: false
type: object
properties:
percentage:
description: Target percentage of agents to auto upgrade
maximum: 100
minimum: 0
type: number
version:
description: Target version for automatic agent upgrade
type: string
required:
- version
- percentage
maxItems: 100
nullable: true
type: array
space_ids:
items:
type: string
maxItems: 100
type: array
supports_agentless:
default: false
deprecated: true
description: Indicates whether the agent policy supports agentless integrations. Deprecated in favor of the Fleet agentless policies API.
nullable: true
type: boolean
unenroll_timeout:
minimum: 0
type: number
required:
- name
- namespace
responses:
'200':
content:
application/json:
examples:
putAgentPolicyExample:
description: The updated agent policy
value:
item:
description: An updated agent policy description
id: agent-policy-id-1
is_managed: false
is_protected: false
name: Updated agent policy
namespace: default
revision: 2
status: active
updated_at: '2024-01-15T11:00:00.000Z'
updated_by: user1
schema:
additionalProperties: false
type: object
properties:
item:
additionalProperties: false
type: object
properties:
advanced_settings:
additionalProperties: false
type: object
properties:
agent_download_target_directory:
nullable: true
agent_download_timeout:
nullable: true
agent_features_disable_policy_change_acks_enabled:
nullable: true
agent_internal:
nullable: true
agent_limits_go_max_procs:
nullable: true
agent_logging_files_interval:
nullable: true
agent_logging_files_keepfiles:
nullable: true
agent_logging_files_rotateeverybytes:
nullable: true
agent_logging_level:
nullable: true
agent_logging_metrics_period:
nullable: true
agent_logging_to_files:
nullable: true
agent_monitoring_runtime_experimental:
nullable: true
agent_features:
items:
additionalProperties: false
type: object
properties:
enabled:
type: boolean
name:
type: string
required:
- name
- enabled
maxItems: 100
type: array
agentless:
additionalProperties: false
type: object
properties:
cloud_connectors:
additionalProperties: false
type: object
properties:
enabled:
type: boolean
target_csp:
enum:
- aws
- azure
- gcp
type: string
required:
- enabled
resources:
additionalProperties: false
type: object
properties:
requests:
additionalProperties: false
type: object
properties:
cpu:
type: string
memory:
type: string
agents:
type: number
agents_per_version:
items:
additionalProperties: false
type: object
properties:
count:
type: number
version:
type: string
required:
- version
- count
maxItems: 1000
type: array
created_at:
type: string
data_output_id:
nullable: true
type: string
description:
type: string
download_source_id:
nullable: true
type: string
fips_agents:
type: number
fleet_server_host_id:
nullable: true
type: string
global_data_tags:
description: User defined data tags that are added to all of the inputs. The values can be strings or numbers.
items:
additionalProperties: false
type: object
properties:
name:
type: string
value:
anyOf:
- type: string
- type: number
required:
- name
- value
maxItems: 100
type: array
has_agent_version_conditions:
type: boolean
has_fleet_server:
type: boolean
id:
type: string
inactivity_timeout:
default: 1209600
minimum: 0
type: number
is_default:
type: boolean
is_default_fleet_server:
type: boolean
is_managed:
type: boolean
is_preconfigured:
type: boolean
is_protected:
description: Indicates whether the agent policy has tamper protection enabled. Default false.
type: boolean
is_verifier:
description: Indicates this is a short-lived verifier policy used for OTel permission verification.
type: boolean
keep_monitoring_alive:
default: false
description: When set to true, monitoring will be enabled but logs/metrics collection will be disabled
nullable: true
type: boolean
min_agent_version:
nullable: true
type: string
monitoring_diagnostics:
additionalProperties: false
type: object
properties:
limit:
additionalProperties: false
type: object
properties:
burst:
type: number
interval:
type: string
uploader:
additionalProperties: false
type: object
properties:
init_dur:
type: string
max_dur:
type: string
max_retries:
type: number
monitoring_enabled:
items:
enum:
- logs
- metrics
- traces
type: string
maxItems: 3
type: array
monitoring_http:
additionalProperties: false
type: object
properties:
buffer:
additionalProperties: false
type: object
properties:
enabled:
default: false
type: boolean
enabled:
type: boolean
host:
type: string
port:
maximum: 65353
minimum: 0
type: number
monitoring_output_id:
nullable: true
type: string
monitoring_pprof_enabled:
type: boolean
name:
minLength: 1
type: string
namespace:
minLength: 1
type: string
overrides:
additionalProperties:
nullable: true
description: Override settings that are defined in the agent policy. Input settings cannot be overridden. The override option should be used only in unusual circumstances and not as a routine procedure.
nullable: true
type: object
package_agent_version_conditions:
items:
additionalProperties: false
type: object
properties:
name:
type: string
title:
type: string
version_condition:
type: string
required:
- name
- title
- version_condition
maxItems: 1000
nullable: true
type: array
package_policies:
anyOf:
- items:
type: string
maxItems: 10000
type: array
- description: This field is present only when retrieving a single agent policy, or when retrieving a list of agent policies with the ?full=true parameter
items:
additionalProperties: false
type: object
properties:
additional_datastreams_permissions:
description: Additional datastream permissions, that will be added to the agent policy.
items:
type: string
maxItems: 1000
nullable: true
type: array
agents:
type: number
cloud_connector_id:
description: ID of the cloud connector associated with this package policy.
nullable: true
type: string
cloud_connector_name:
description: Transient field for cloud connector name during creation.
maxLength: 255
minLength: 1
nullable: true
type: string
created_at:
type: string
created_by:
type: string
description:
description: Package policy description
type: string
elasticsearch:
additionalProperties: true
type: object
properties:
privileges:
additionalProperties: true
type: object
properties:
cluster:
items:
type: string
maxItems: 100
type: array
enabled:
type: boolean
global_data_tags:
items:
additionalProperties: false
type: object
properties:
name:
description: The name of the custom field. Cannot contain spaces.
type: string
value:
anyOf:
- type: string
- type: number
description: The value of the custom field.
required:
- name
- value
maxItems: 100
nullable: true
type: array
id:
description: Package policy unique identifier.
type: string
inputs:
anyOf:
- items:
additionalProperties: false
type: object
properties:
compiled_input:
nullable: true
config:
additionalProperties:
additionalProperties: false
type: object
properties:
frozen:
type: boolean
type:
type: string
value:
nullable: true
required:
- value
description: Package variable (see integration documentation for more information)
type: object
deprecated:
additionalProperties: false
type: object
properties:
description:
type: string
replaced_by:
additionalProperties:
type: string
type: object
since:
type: string
required:
- description
enabled:
type: boolean
id:
type: string
keep_enabled:
type: boolean
migrate_from:
type: string
name:
type: string
policy_template:
type: string
streams:
items:
additionalProperties: false
type: object
properties:
compiled_stream:
nullable: true
config:
additionalProperties:
additionalProperties: false
type: object
properties:
frozen:
type: boolean
type:
type: string
value:
nullable: true
required:
- value
description: Package variable (see integration documentation for more information)
type: object
data_stream:
additionalProperties: false
type: object
properties:
dataset:
type: string
elasticsearch:
additionalProperties: false
type: object
properties:
dynamic_dataset:
type: boolean
dynamic_namespace:
type: boolean
privileges:
additionalProperties: false
type: object
properties:
indices:
items:
type: string
maxItems: 100
type: array
type:
type: string
required:
- dataset
deprecated:
additionalProperties: false
type: object
properties:
description:
type: string
replaced_by:
additionalProperties:
type: string
type: object
since:
type: string
required:
- description
enabled:
type: boolean
id:
type: string
keep_enabled:
type: boolean
migrate_from:
type: string
release:
enum:
- ga
- beta
- experimental
type: string
var_group_selections:
additionalProperties:
type: string
description: Variable group selections. Maps var_group name to the selected option name within that group.
type: object
vars:
additionalProperties:
additionalProperties: false
type: object
properties:
frozen:
type: boolean
type:
type: string
value:
nullable: true
required:
- value
description: Package variable (see integration documentation for more information)
type: object
required:
- enabled
- data_stream
- compiled_stream
maxItems: 1000
type: array
type:
type: string
var_group_selections:
additionalProperties:
type: string
description: Variable group selections. Maps var_group name to the selected option name within that group.
type: object
vars:
additionalProperties:
additionalProperties: false
type: object
properties:
frozen:
type: boolean
type:
type: string
value:
nullable: true
required:
- value
description: Package variable (see integration documentation for more information)
type: object
required:
- type
- enabled
- streams
- compiled_input
maxItems: 100
type: array
- additionalProperties:
additionalProperties: false
type: object
properties:
deprecated:
additionalProperties: false
type: object
properties:
description:
type: string
replaced_by:
additionalProperties:
type: string
type: object
since:
type: string
required:
- description
enabled:
description: Enable or disable that input. Defaults to `true` (enabled).
type: boolean
streams:
additionalProperties:
additionalProperties: false
type: object
properties:
deprecated:
additionalProperties: false
type: object
properties:
description:
type: string
replaced_by:
additionalProperties:
type: string
type: object
since:
type: string
required:
- description
enabled:
description: Enable or disable that stream. Defaults to `true` (enabled).
type: boolean
var_group_selections:
additionalProperties:
type: string
description: Variable group selections. Maps var_group name to the selected option name within that group.
type: object
vars:
additionalProperties:
anyOf:
- type: string
- type: number
- type: boolean
- items:
type: string
maxItems: 100
type: array
- items:
type: number
maxItems: 100
type: array
- additionalProperties: false
type: object
properties:
id:
type: string
isSecretRef:
type: boolean
required:
- id
- isSecretRef
nullable: true
description: Input/stream level variable. Refer to the integration documentation for more information.
type: object
description: Input streams. Refer to the integration documentation to know which streams are available.
type: object
vars:
additionalProperties:
anyOf:
- type: string
- type: number
- type: boolean
- items:
type: string
maxItems: 100
type: array
- items:
type: number
maxItems: 100
type: array
- additionalProperties: false
type: object
properties:
id:
type: string
isSecretRef:
type: boolean
required:
- id
- isSecretRef
nullable: true
description: Input/stream level variable. Refer to the integration documentation for more information.
type: object
description: Package policy inputs. Refer to the integration documentation to know which inputs are available.
type: object
x-oas-optional: true
description: Package policy inputs.
is_managed:
type: boolean
name:
description: Unique name for the package policy.
type: string
namespace:
description: The package policy namespace. Leave blank to inherit the agent policy's namespace.
type: string
output_id:
nullable: true
type: string
overrides:
additionalProperties: false
description: Override settings that are defined in the package policy. The override option should be used only in unusual circumstances and not as a routine procedure.
nullable: true
type: object
properties:
inputs:
additionalProperties:
nullable: true
type: object
package:
additionalProperties: false
type: object
properties:
experimental_data_stream_features:
items:
additionalProperties: false
type: object
properties:
data_stream:
type: string
features:
additionalProperties: false
type: object
properties:
doc_value_only_numeric:
type: boolean
doc_value_only_other:
type: boolean
synthetic_source:
type: boolean
tsdb:
type: boolean
required:
- data_stream
- features
maxItems: 100
type: array
fips_compatible:
type: boolean
name:
description: Package name
type: string
requires_root:
type: boolean
title:
type: string
version:
description: Package version
type: string
required:
- name
- version
package_agent_version_condition:
type: string
policy_id:
deprecated: true
description: ID of the agent policy which the package policy will be added to.
nullable: true
type: string
policy_ids:
items:
description: IDs of the agent policies which that package policy will be added to.
type: string
maxItems: 1000
type: array
revision:
description: Package policy revision.
type: number
secret_references:
items:
additionalProperties: false
type: object
properties:
id:
type: string
required:
- id
maxItems: 1000
type: array
spaceIds:
items:
type: string
maxItems: 100
type: array
supports_agentless:
default: false
description: Indicates whether the package policy belongs to an agentless agent policy.
nullable: true
type: boolean
supports_cloud_connector:
default: false
description: Indicates whether the package policy supports cloud connectors.
nullable: true
type: boolean
updated_at:
type: string
updated_by:
type: string
var_group_selections:
additionalProperties:
type: string
description: Variable group selections. Maps var_group name to the selected option name within that group.
type: object
vars:
anyOf:
- additionalProperties:
additionalProperties: false
type: object
properties:
frozen:
type: boolean
type:
type: string
value:
nullable: true
required:
- value
description: Package variable (see integration documentation for more information)
type: object
- additionalProperties:
anyOf:
- type: string
- type: number
- type: boolean
- items:
type: string
maxItems: 100
type: array
- items:
type: number
maxItems: 100
type: array
- additionalProperties: false
type: object
properties:
id:
type: string
isSecretRef:
type: boolean
required:
- id
- isSecretRef
nullable: true
description: Input/stream level variable. Refer to the integration documentation for more information.
type: object
x-oas-optional: true
description: Package level variable.
version:
description: Package policy ES version.
type: string
required:
- name
- enabled
- inputs
- id
- revision
- updated_at
- updated_by
- created_at
- created_by
maxItems: 10000
type: array
required_versions:
items:
additionalProperties: false
type: object
properties:
percentage:
description: Target percentage of agents to auto upgrade
maximum: 100
minimum: 0
type: number
version:
description: Target version for automatic agent upgrade
type: string
required:
- version
- percentage
maxItems: 100
nullable: true
type: array
revision:
type: number
schema_version:
type: string
space_ids:
items:
type: string
maxItems: 100
type: array
status:
enum:
- active
- inactive
type: string
supports_agentless:
default: false
description: Indicates whether the agent policy supports agentless integrations.
nullable: true
type: boolean
unenroll_timeout:
minimum: 0
type: number
unprivileged_agents:
type: number
updated_at:
type: string
updated_by:
type: string
version:
type: string
required:
- id
- name
- namespace
- is_protected
- status
- updated_at
- updated_by
- revision
required:
- item
description: Successful response
'400':
content:
application/json:
examples:
genericErrorResponseExample:
description: Example of a generic error response
value:
error: Bad Request
message: An error message describing what went wrong
statusCode: 400
schema:
additionalProperties: false
description: Generic Error
type: object
properties:
attributes:
nullable: true
error:
type: string
errorType:
type: string
message:
type: string
statusCode:
type: number
required:
- message
- attributes
description: Bad Request
summary: Update an agent policy
tags:
- Elastic Agent policies
x-metaTags:
- content: Kibana
name: product_name
/api/fleet/agent_policies/{agentPolicyId}/auto_upgrade_agents_status:
get:
description: '**Spaces method and path for this operation:**
get /s/{space_id}/api/fleet/agent_policies/{agentPolicyId}/auto_upgrade_agents_status
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
Get the auto-upgrade status for agents assigned to an agent policy.
[Required authorization] Route required privileges: fleet-agents-read.'
operationId: get-fleet-agent-policies-agentpolicyid-auto-upgrade-agents-status
parameters:
- description: The ID of the agent policy
in: path
name: agentPolicyId
required: true
schema:
type: string
responses:
'200':
content:
application/json:
examples:
getAutoUpgradeAgentsStatusExample:
description: Auto-upgrade status for agents in the policy
value:
agentsCount: 5
currentVersion: 8.16.0
failedAgentsCount: 0
upgradedAgentsCount: 3
upgradingAgentsCount: 1
schema:
additionalProperties: false
type: object
properties:
currentVersions:
items:
additionalProperties: false
type: object
properties:
agents:
description: Number of agents that upgraded to this version
type: number
failedUpgradeActionIds:
description: List of action IDs related to failed upgrades
items:
type: string
maxItems: 1000
type: array
failedUpgradeAgents:
description: Number of agents that failed to upgrade to this version
type: number
inProgressUpgradeActionIds:
description: List of action IDs related to in-progress upgrades
items:
type: string
maxItems: 1000
type: array
inProgressUpgradeAgents:
description: Number of agents that are upgrading to this version
type: number
version:
description: Agent version
type: string
required:
- version
- agents
- failedUpgradeAgents
- inProgressUpgradeAgents
maxItems: 10000
type: array
totalAgents:
type: number
required:
- currentVersions
- totalAgents
description: Successful response
'400':
content:
application/json:
examples:
genericErrorResponseExample:
description: Example of a generic error response
value:
error: Bad Request
message: An error message describing what went wrong
statusCode: 400
schema:
additionalProperties: false
description: Generic Error
type: object
properties:
attributes:
nullable: true
error:
type: string
errorType:
type: string
message:
type: string
statusCode:
type: number
required:
- message
- attributes
description: Bad Request
summary: Get auto upgrade agent status
tags:
- Elastic Agent policies
x-metaTags:
- content: Kibana
name: product_name
/api/fleet/agent_policies/{agentPolicyId}/copy:
post:
description: '**Spaces method and path for this operation:**
post /s/{space_id}/api/fleet/agent_policies/{agentPolicyId}/copy
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
Copy an agent policy by ID.
[Required authorization] Route required privileges: fleet-agent-policies-all.'
operationId: post-fleet-agent-policies-agentpolicyid-copy
parameters:
- description: A required header to protect against CSRF attacks
in: header
name: kbn-xsrf
required: true
schema:
example: 'true'
type: string
- description: The ID of the agent policy
in: path
name: agentPolicyId
required: true
schema:
type: string
- description: 'Format for the response: simplified or legacy'
in: query
name: format
required: false
schema:
enum:
- simplified
- legacy
type: string
requestBody:
content:
application/json:
examples:
postCopyAgentPolicyRequestExample:
description: Copy an agent policy with a new name
value:
description: A copy of the original agent policy
name: Copy of my agent policy
schema:
additionalProperties: false
type: object
properties:
description:
type: string
name:
minLength: 1
type: string
required:
- name
responses:
'200':
content:
application/json:
examples:
postCopyAgentPolicyExample:
description: The copied agent policy
value:
item:
description: A copy of the original agent policy
id: agent-policy-id-copy-1
is_managed: false
is_protected: false
name: Copy of my agent policy
namespace: default
revision: 1
status: active
updated_at: '2024-01-15T11:00:00.000Z'
updated_by: user1
schema:
additionalProperties: false
type: object
properties:
item:
additionalProperties: false
type: object
properties:
advanced_settings:
additionalProperties: false
type: object
properties:
agent_download_target_directory:
nullable: true
agent_download_timeout:
nullable: true
agent_features_disable_policy_change_acks_enabled:
nullable: true
agent_internal:
nullable: true
agent_limits_go_max_procs:
nullable: true
agent_logging_files_interval:
nullable: true
agent_logging_files_keepfiles:
nullable: true
agent_logging_files_rotateeverybytes:
nullable: true
agent_logging_level:
nullable: true
agent_logging_metrics_period:
nullable: true
agent_logging_to_files:
nullable: true
agent_monitoring_runtime_experimental:
nullable: true
agent_features:
items:
additionalProperties: false
type: object
properties:
enabled:
type: boolean
name:
type: string
required:
- name
- enabled
maxItems: 100
type: array
agentless:
additionalProperties: false
type: object
properties:
cloud_connectors:
additionalProperties: false
type: object
properties:
enabled:
type: boolean
target_csp:
enum:
- aws
- azure
- gcp
type: string
required:
- enabled
resources:
additionalProperties: false
type: object
properties:
requests:
additionalProperties: false
type: object
properties:
cpu:
type: string
memory:
type: string
agents:
type: number
agents_per_version:
items:
additionalProperties: false
type: object
properties:
count:
type: number
version:
type: string
required:
- version
- count
maxItems: 1000
type: array
created_at:
type: string
data_output_id:
nullable: true
type: string
description:
type: string
download_source_id:
nullable: true
type: string
fips_agents:
type: number
fleet_server_host_id:
nullable: true
type: string
global_data_tags:
description: User defined data tags that are added to all of the inputs. The values can be strings or numbers.
items:
additionalProperties: false
type: object
properties:
name:
type: string
value:
anyOf:
- type: string
- type: number
required:
- name
- value
maxItems: 100
type: array
has_agent_version_conditions:
type: boolean
has_fleet_server:
type: boolean
id:
type: string
inactivity_timeout:
default: 1209600
minimum: 0
type: number
is_default:
type: boolean
is_default_fleet_server:
type: boolean
is_managed:
type: boolean
is_preconfigured:
type: boolean
is_protected:
description: Indicates whether the agent policy has tamper protection enabled. Default false.
type: boolean
is_verifier:
description: Indicates this is a short-lived verifier policy used for OTel permission verification.
type: boolean
keep_monitoring_alive:
default: false
description: When set to true, monitoring will be enabled but logs/metrics collection will be disabled
nullable: true
type: boolean
min_agent_version:
nullable: true
type: string
monitoring_diagnostics:
additionalProperties: false
type: object
properties:
limit:
additionalProperties: false
type: object
properties:
burst:
type: number
interval:
type: string
uploader:
additionalProperties: false
type: object
properties:
init_dur:
type: string
max_dur:
type: string
max_retries:
type: number
monitoring_enabled:
items:
enum:
- logs
- metrics
- traces
type: string
maxItems: 3
type: array
monitoring_http:
additionalProperties: false
type: object
properties:
buffer:
additionalProperties: false
type: object
properties:
enabled:
default: false
type: boolean
enabled:
type: boolean
host:
type: string
port:
maximum: 65353
minimum: 0
type: number
monitoring_output_id:
nullable: true
type: string
monitoring_pprof_enabled:
type: boolean
name:
minLength: 1
type: string
namespace:
minLength: 1
type: string
overrides:
additionalProperties:
nullable: true
description: Override settings that are defined in the agent policy. Input settings cannot be overridden. The override option should be used only in unusual circumstances and not as a routine procedure.
nullable: true
type: object
package_agent_version_conditions:
items:
additionalProperties: false
type: object
properties:
name:
type: string
title:
type: string
version_condition:
type: string
required:
- name
- title
- version_condition
maxItems: 1000
nullable: true
type: array
package_policies:
anyOf:
- items:
type: string
maxItems: 10000
type: array
- description: This field is present only when retrieving a single agent policy, or when retrieving a list of agent policies with the ?full=true parameter
items:
additionalProperties: false
type: object
properties:
additional_datastreams_permissions:
description: Additional datastream permissions, that will be added to the agent policy.
items:
type: string
maxItems: 1000
nullable: true
type: array
agents:
type: number
cloud_connector_id:
description: ID of the cloud connector associated with this package policy.
nullable: true
type: string
cloud_connector_name:
description: Transient field for cloud connector name during creation.
maxLength: 255
minLength: 1
nullable: true
type: string
created_at:
type: string
created_by:
type: string
description:
description: Package policy description
type: string
elasticsearch:
additionalProperties: true
type: object
properties:
privileges:
additionalProperties: true
type: object
properties:
cluster:
items:
type: string
maxItems: 100
type: array
enabled:
type: boolean
global_data_tags:
items:
additionalProperties: false
type: object
properties:
name:
description: The name of the custom field. Cannot contain spaces.
type: string
value:
anyOf:
- type: string
- type: number
description: The value of the custom field.
required:
- name
- value
maxItems: 100
nullable: true
type: array
id:
description: Package policy unique identifier.
type: string
inputs:
anyOf:
- items:
additionalProperties: false
type: object
properties:
compiled_input:
nullable: true
config:
additionalProperties:
additionalProperties: false
type: object
properties:
frozen:
type: boolean
type:
type: string
value:
nullable: true
required:
- value
description: Package variable (see integration documentation for more information)
type: object
deprecated:
additionalProperties: false
type: object
properties:
description:
type: string
replaced_by:
additionalProperties:
type: string
type: object
since:
type: string
required:
- description
enabled:
type: boolean
id:
type: string
keep_enabled:
type: boolean
migrate_from:
type: string
name:
type: string
policy_template:
type: string
streams:
items:
additionalProperties: false
type: object
properties:
compiled_stream:
nullable: true
config:
additionalProperties:
additionalProperties: false
type: object
properties:
frozen:
type: boolean
type:
type: string
value:
nullable: true
required:
- value
description: Package variable (see integration documentation for more information)
type: object
data_stream:
additionalProperties: false
type: object
properties:
dataset:
type: string
elasticsearch:
additionalProperties: false
type: object
properties:
dynamic_dataset:
type: boolean
dynamic_namespace:
type: boolean
privileges:
additionalProperties: false
type: object
properties:
indices:
items:
type: string
maxItems: 100
type: array
type:
type: string
required:
- dataset
deprecated:
additionalProperties: false
type: object
properties:
description:
type: string
replaced_by:
additionalProperties:
type: string
type: object
since:
type: string
required:
- description
enabled:
type: boolean
id:
type: string
keep_enabled:
type: boolean
migrate_from:
type: string
release:
enum:
- ga
- beta
- experimental
type: string
var_group_selections:
additionalProperties:
type: string
description: Variable group selections. Maps var_group name to the selected option name within that group.
type: object
vars:
additionalProperties:
additionalProperties: false
type: object
properties:
frozen:
type: boolean
type:
type: string
value:
nullable: true
required:
- value
description: Package variable (see integration documentation for more information)
type: object
required:
- enabled
- data_stream
- compiled_stream
maxItems: 1000
type: array
type:
type: string
var_group_selections:
additionalProperties:
type: string
description: Variable group selections. Maps var_group name to the selected option name within that group.
type: object
vars:
additionalProperties:
additionalProperties: false
type: object
properties:
frozen:
type: boolean
type:
type: string
value:
nullable: true
required:
- value
description: Package variable (see integration documentation for more information)
type: object
required:
- type
- enabled
- streams
- compiled_input
maxItems: 100
type: array
- additionalProperties:
additionalProperties: false
type: object
properties:
deprecated:
additionalProperties: false
type: object
properties:
description:
type: string
replaced_by:
additionalProperties:
type: string
type: object
since:
type: string
required:
- description
enabled:
description: Enable or disable that input. Defaults to `true` (enabled).
type: boolean
streams:
additionalProperties:
additionalProperties: false
type: object
properties:
deprecated:
additionalProperties: false
type: object
properties:
description:
type: string
replaced_by:
additionalProperties:
type: string
type: object
since:
type: string
required:
- description
enabled:
description: Enable or disable that stream. Defaults to `true` (enabled).
type: boolean
var_group_selections:
additionalProperties:
type: string
description: Variable group selections. Maps var_group name to the selected option name within that group.
type: object
vars:
additionalProperties:
anyOf:
- type: string
- type: number
- type: boolean
- items:
type: string
maxItems: 100
type: array
- items:
type: number
maxItems: 100
type: array
- additionalProperties: false
type: object
properties:
id:
type: string
isSecretRef:
type: boolean
required:
- id
- isSecretRef
nullable: true
description: Input/stream level variable. Refer to the integration documentation for more information.
type: object
description: Input streams. Refer to the integration documentation to know which streams are available.
type: object
vars:
additionalProperties:
anyOf:
- type: string
- type: number
- type: boolean
- items:
type: string
maxItems: 100
type: array
- items:
type: number
maxItems: 100
type: array
- additionalProperties: false
type: object
properties:
id:
type: string
isSecretRef:
type: boolean
required:
- id
- isSecretRef
nullable: true
description: Input/stream level variable. Refer to the integration documentation for more information.
type: object
description: Package policy inputs. Refer to the integration documentation to know which inputs are available.
type: object
x-oas-optional: true
description: Package policy inputs.
is_managed:
type: boolean
name:
description: Unique name for the package policy.
type: string
namespace:
description: The package policy namespace. Leave blank to inherit the agent policy's namespace.
type: string
output_id:
nullable: true
type: string
overrides:
additionalProperties: false
description: Override settings that are defined in the package policy. The override option should be used only in unusual circumstances and not as a routine procedure.
nullable: true
type: object
properties:
inputs:
additionalProperties:
nullable: true
type: object
package:
additionalProperties: false
type: object
properties:
experimental_data_stream_features:
items:
additionalProperties: false
type: object
properties:
data_stream:
type: string
features:
additionalProperties: false
type: object
properties:
doc_value_only_numeric:
type: boolean
doc_value_only_other:
type: boolean
synthetic_source:
type: boolean
tsdb:
type: boolean
required:
- data_stream
- features
maxItems: 100
type: array
fips_compatible:
type: boolean
name:
description: Package name
type: string
requires_root:
type: boolean
title:
type: string
version:
description: Package version
type: string
required:
- name
- version
package_agent_version_condition:
type: string
policy_id:
deprecated: true
description: ID of the agent policy which the package policy will be added to.
nullable: true
type: string
policy_ids:
items:
description: IDs of the agent policies which that package policy will be added to.
type: string
maxItems: 1000
type: array
revision:
description: Package policy revision.
type: number
secret_references:
items:
additionalProperties: false
type: object
properties:
id:
type: string
required:
- id
maxItems: 1000
type: array
spaceIds:
items:
type: string
maxItems: 100
type: array
supports_agentless:
default: false
description: Indicates whether the package policy belongs to an agentless agent policy.
nullable: true
type: boolean
supports_cloud_connector:
default: false
description: Indicates whether the package policy supports cloud connectors.
nullable: true
type: boolean
updated_at:
type: string
updated_by:
type: string
var_group_selections:
additionalProperties:
type: string
description: Variable group selections. Maps var_group name to the selected option name within that group.
type: object
vars:
anyOf:
- additionalProperties:
additionalProperties: false
type: object
properties:
frozen:
type: boolean
type:
type: string
value:
nullable: true
required:
- value
description: Package variable (see integration documentation for more information)
type: object
- additionalProperties:
anyOf:
- type: string
- type: number
- type: boolean
- items:
type: string
maxItems: 100
type: array
- items:
type: number
maxItems: 100
type: array
- additionalProperties: false
type: object
properties:
id:
type: string
isSecretRef:
type: boolean
required:
- id
- isSecretRef
nullable: true
description: Input/stream level variable. Refer to the integration documentation for more information.
type: object
x-oas-optional: true
description: Package level variable.
version:
description: Package policy ES version.
type: string
required:
- name
- enabled
- inputs
- id
- revision
- updated_at
- updated_by
- created_at
- created_by
maxItems: 10000
type: array
required_versions:
items:
additionalProperties: false
type: object
properties:
percentage:
description: Target percentage of agents to auto upgrade
maximum: 100
minimum: 0
type: number
version:
description: Target version for automatic agent upgrade
type: string
required:
- version
- percentage
maxItems: 100
nullable: true
type: array
revision:
type: number
schema_version:
type: string
space_ids:
items:
type: string
maxItems: 100
type: array
status:
enum:
- active
- inactive
type: string
supports_agentless:
default: false
description: Indicates whether the agent policy supports agentless integrations.
nullable: true
type: boolean
unenroll_timeout:
minimum: 0
type: number
unprivileged_agents:
type: number
updated_at:
type: string
updated_by:
type: string
version:
type: string
required:
- id
- name
- namespace
- is_protected
- status
- updated_at
- updated_by
- revision
required:
- item
description: Successful response
'400':
content:
application/json:
examples:
genericErrorResponseExample:
description: Example of a generic error response
value:
error: Bad Request
message: An error message describing what went wrong
statusCode: 400
schema:
additionalProperties: false
description: Generic Error
type: object
properties:
attributes:
nullable: true
error:
type: string
errorType:
type: string
message:
type: string
statusCode:
type: number
required:
- message
- attributes
description: Bad Request
summary: Copy an agent policy
tags:
- Elastic Agent policies
x-metaTags:
- content: Kibana
name: product_name
/api/fleet/agent_policies/{agentPolicyId}/download:
get:
description: '**Spaces method and path for this operation:**
get /s/{space_id}/api/fleet/agent_policies/{agentPolicyId}/download
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
Download an agent policy by ID.
[Required authorization] Route required privileges: fleet-agent-policies-read OR fleet-setup.'
operationId: get-fleet-agent-policies-agentpolicyid-download
parameters:
- description: The ID of the agent policy
in: path
name: agentPolicyId
required: true
schema:
type: string
- description: If true, returns the policy as a downloadable file
in: query
name: download
required: false
schema:
type: boolean
- description: If true, returns the policy formatted for standalone agents
in: query
name: standalone
required: false
schema:
type: boolean
- description: If true, returns the policy formatted for Kubernetes deployment
in: query
name: kubernetes
required: false
schema:
type: boolean
- description: If provided, returns the policy at the specified revision. Cannot be used with standalone or kubernetes flags.
in: query
name: revision
required: false
schema:
type: number
responses:
'200':
content:
application/json:
examples:
getDownloadAgentPolicyExample:
description: The agent policy download response
value:
item: 'id: agent-policy-id-1\nrevision: 1\noutputs:\n default:\n type: elasticsearch\n hosts:\n - https://elasticsearch.example.com:9200\n'
schema:
type: string
description: Successful response — returns the agent policy as a YAML file download
'400':
content:
application/json:
examples:
genericErrorResponseExample:
description: Example of a generic error response
value:
error: Bad Request
message: An error message describing what went wrong
statusCode: 400
schema:
additionalProperties: false
description: Generic Error
type: object
properties:
attributes:
nullable: true
error:
type: string
errorType:
type: string
message:
type: string
statusCode:
type: number
required:
- message
- attributes
description: Bad Request
'404':
content:
application/json:
examples:
notFoundExample:
description: No agent policy was found with the given ID
value:
error: Not Found
message: Agent policy not found
statusCode: 404
schema:
additionalProperties: false
description: Generic Error
type: object
properties:
attributes:
nullable: true
error:
type: string
errorType:
type: string
message:
type: string
statusCode:
type: number
required:
- message
- attributes
description: Not Found
summary: Download an agent policy
tags:
- Elastic Agent policies
x-metaTags:
- content: Kibana
name: product_name
/api/fleet/agent_policies/{agentPolicyId}/full:
get:
description: '**Spaces method and path for this operation:**
get /s/{space_id}/api/fleet/agent_policies/{agentPolicyId}/full
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
Get a full agent policy by ID.
[Required authorization] Route required privileges: fleet-agent-policies-read.'
operationId: get-fleet-agent-policies-agentpolicyid-full
parameters:
- description: The ID of the agent policy
in: path
name: agentPolicyId
required: true
schema:
type: string
- description: If true, returns the policy as a downloadable file
in: query
name: download
required: false
schema:
type: boolean
- description: If true, returns the policy formatted for standalone agents
in: query
name: standalone
required: false
schema:
type: boolean
- description: If true, returns the policy formatted for Kubernetes deployment
in: query
name: kubernetes
required: false
schema:
type: boolean
- description: If provided, returns the policy at the specified revision. Cannot be used with standalone or kubernetes flags.
in: query
name: revision
required: false
schema:
type: number
responses:
'200':
content:
application/json:
examples:
getFullAgentPolicyExample:
description: The full agent policy configuration
value:
item:
agent:
monitoring:
logs: true
metrics: true
id: agent-policy-id-1
inputs: []
outputs:
default:
hosts:
- https://elasticsearch.example.com:9200
type: elasticsearch
revision: 1
schema:
additionalProperties: false
type: object
properties:
item:
anyOf:
- type: string
- additionalProperties: false
type: object
properties:
agent:
additionalProperties: false
type: object
properties:
download:
additionalProperties: false
type: object
properties:
auth:
additionalProperties: false
type: object
properties:
api_key:
type: string
headers:
items:
additionalProperties: false
type: object
properties:
key:
type: string
value:
type: string
required:
- key
- value
maxItems: 100
type: array
password:
type: string
username:
type: string
proxy_headers:
additionalProperties:
anyOf:
- type: string
- type: boolean
- type: number
nullable: true
type: object
proxy_url:
type: string
secrets:
additionalProperties: true
type: object
properties:
ssl:
additionalProperties: true
type: object
properties:
key:
additionalProperties: true
type: object
properties:
id:
type: string
required:
- key
sourceURI:
type: string
ssl:
additionalProperties: false
type: object
properties:
certificate:
type: string
certificate_authorities:
items:
type: string
maxItems: 10
type: array
key:
type: string
renegotiation:
type: string
verification_mode:
type: string
target_directory:
type: string
timeout:
type: string
required:
- sourceURI
features:
additionalProperties:
additionalProperties: false
type: object
properties:
enabled:
type: boolean
required:
- enabled
type: object
internal:
nullable: true
limits:
additionalProperties: false
type: object
properties:
go_max_procs:
type: number
logging:
additionalProperties: false
type: object
properties:
files:
additionalProperties: false
type: object
properties:
interval:
type: string
keepfiles:
type: number
rotateeverybytes:
type: number
level:
type: string
metrics:
additionalProperties: false
type: object
properties:
period:
type: string
to_files:
type: boolean
monitoring:
additionalProperties: false
type: object
properties:
_runtime_experimental:
type: string
apm:
nullable: true
diagnostics:
additionalProperties: false
type: object
properties:
limit:
additionalProperties: false
type: object
properties:
burst:
type: number
interval:
type: string
uploader:
additionalProperties: false
type: object
properties:
init_dur:
type: string
max_dur:
type: string
max_retries:
type: number
enabled:
type: boolean
http:
additionalProperties: false
type: object
properties:
enabled:
type: boolean
host:
type: string
port:
type: number
logs:
type: boolean
metrics:
type: boolean
namespace:
type: string
pprof:
additionalProperties: false
type: object
properties:
enabled:
type: boolean
required:
- enabled
traces:
type: boolean
use_output:
type: string
required:
- enabled
- metrics
- logs
- traces
- apm
protection:
additionalProperties: false
type: object
properties:
enabled:
type: boolean
signing_key:
type: string
uninstall_token_hash:
type: string
required:
- enabled
- uninstall_token_hash
- signing_key
required:
- monitoring
- download
- features
- internal
connectors:
additionalProperties:
nullable: true
type: object
exporters:
additionalProperties:
nullable: true
type: object
extensions:
additionalProperties:
nullable: true
type: object
fleet:
anyOf:
- additionalProperties: false
type: object
properties:
hosts:
items:
type: string
maxItems: 100
type: array
proxy_headers:
additionalProperties:
anyOf:
- type: string
- type: boolean
- type: number
nullable: true
type: object
proxy_url:
type: string
secrets:
additionalProperties: true
type: object
properties:
ssl:
additionalProperties: true
type: object
properties:
key:
additionalProperties: true
type: object
properties:
id:
type: string
required:
- key
ssl:
additionalProperties: false
type: object
properties:
certificate:
type: string
certificate_authorities:
items:
type: string
maxItems: 10
type: array
key:
type: string
renegotiation:
type: string
verification_mode:
type: string
required:
- hosts
- additionalProperties: false
type: object
properties:
kibana:
additionalProperties: false
type: object
properties:
hosts:
items:
type: string
maxItems: 100
type: array
path:
type: string
protocol:
type: string
required:
- hosts
- protocol
required:
- kibana
id:
type: string
inputs:
items:
additionalProperties: true
type: object
properties:
data_stream:
additionalProperties: true
type: object
properties:
namespace:
type: string
required:
- namespace
id:
type: string
meta:
additionalProperties: true
type: object
properties:
package:
additionalProperties: true
type: object
properties:
name:
type: string
version:
type: string
required:
- name
- version
name:
type: string
package_policy_id:
type: string
processors:
items:
additionalProperties: true
type: object
properties:
add_fields:
additionalProperties: true
type: object
properties:
fields:
additionalProperties:
anyOf:
- type: string
- type: number
type: object
target:
type: string
required:
- target
- fields
required:
- add_fields
maxItems: 10000
type: array
revision:
type: number
streams:
items:
additionalProperties: true
type: object
properties:
data_stream:
additionalProperties: true
type: object
properties:
dataset:
type: string
type:
type: string
required:
- dataset
id:
type: string
required:
- id
- data_stream
maxItems: 10000
type: array
type:
type: string
use_output:
type: string
required:
- id
- name
- revision
- type
- data_stream
- use_output
- package_policy_id
maxItems: 10000
type: array
namespaces:
items:
type: string
maxItems: 100
type: array
output_permissions:
additionalProperties:
additionalProperties:
nullable: true
type: object
type: object
outputs:
additionalProperties:
additionalProperties: true
type: object
properties:
ca_sha256:
nullable: true
type: string
hosts:
items:
type: string
maxItems: 100
type: array
proxy_headers:
additionalProperties:
anyOf:
- type: string
- type: boolean
- type: number
nullable: true
type: object
proxy_url:
type: string
type:
type: string
required:
- type
type: object
processors:
additionalProperties:
nullable: true
type: object
receivers:
additionalProperties:
nullable: true
type: object
revision:
type: number
secret_references:
items:
additionalProperties: false
type: object
properties:
id:
type: string
required:
- id
maxItems: 10000
type: array
service:
additionalProperties: false
type: object
properties:
extensions:
items:
type: string
maxItems: 1000
type: array
pipelines:
additionalProperties:
additionalProperties: false
type: object
properties:
exporters:
items:
type: string
maxItems: 1000
type: array
processors:
items:
type: string
maxItems: 1000
type: array
receivers:
items:
type: string
maxItems: 1000
type: array
x-oas-optional: true
type: object
signed:
additionalProperties: false
type: object
properties:
data:
type: string
signature:
type: string
required:
- data
- signature
required:
- id
- outputs
- inputs
required:
- item
description: Successful response
'400':
content:
application/json:
examples:
genericErrorResponseExample:
description: Example of a generic error response
value:
error: Bad Request
message: An error message describing what went wrong
statusCode: 400
schema:
additionalProperties: false
description: Generic Error
type: object
properties:
attributes:
nullable: true
error:
type: string
errorType:
type: string
message:
type: string
statusCode:
type: number
required:
- message
- attributes
description: Bad Request
'404':
content:
application/json:
examples:
notFoundExample:
description: No agent policy was found with the given ID
value:
error: Not Found
message: Agent policy not found
statusCode: 404
description: Not Found
summary: Get a full agent policy
tags:
- Elastic Agent policies
x-metaTags:
- content: Kibana
name: product_name
/api/fleet/agent_policies/{agentPolicyId}/outputs:
get:
description: '**Spaces method and path for this operation:**
get /s/{space_id}/api/fleet/agent_policies/{agentPolicyId}/outputs
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
Get a list of outputs associated with agent policy by policy id.
[Required authorization] Route required privileges: fleet-agent-policies-read AND fleet-settings-read.'
operationId: get-fleet-agent-policies-agentpolicyid-outputs
parameters:
- description: The ID of the agent policy
in: path
name: agentPolicyId
required: true
schema:
type: string
responses:
'200':
content:
application/json:
examples:
getAgentPolicyOutputsExample:
description: Outputs associated with the agent policy
value:
item:
data_output:
id: output-id-1
name: Default output
type: elasticsearch
monitoring_output:
id: output-id-1
name: Default output
type: elasticsearch
schema:
additionalProperties: false
type: object
properties:
item:
additionalProperties: false
type: object
properties:
agentPolicyId:
type: string
data:
additionalProperties: false
type: object
properties:
integrations:
items:
additionalProperties: false
type: object
properties:
id:
type: string
integrationPolicyName:
type: string
name:
type: string
pkgName:
type: string
maxItems: 1000
type: array
output:
additionalProperties: false
type: object
properties:
id:
type: string
name:
type: string
required:
- id
- name
required:
- output
monitoring:
additionalProperties: false
type: object
properties:
output:
additionalProperties: false
type: object
properties:
id:
type: string
name:
type: string
required:
- id
- name
required:
- output
required:
- monitoring
- data
required:
- item
description: Successful response
'400':
content:
application/json:
examples:
genericErrorResponseExample:
description: Example of a generic error response
value:
error: Bad Request
message: An error message describing what went wrong
statusCode: 400
schema:
additionalProperties: false
description: Generic Error
type: object
properties:
attributes:
nullable: true
error:
type: string
errorType:
type: string
message:
type: string
statusCode:
type: number
required:
- message
- attributes
description: Bad Request
'404':
content:
application/json:
examples:
notFoundExample:
description: No agent policy was found with the given ID
value:
error: Not Found
message: Agent policy not found
statusCode: 404
description: Not Found
summary: Get outputs for an agent policy
tags:
- Elastic Agent policies
x-metaTags:
- content: Kibana
name: product_name
/api/fleet/agent_policies/delete:
post:
description: '**Spaces method and path for this operation:**
post /s/{space_id}/api/fleet/agent_policies/delete
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
Delete an agent policy by ID.
[Required authorization] Route required privileges: fleet-agent-policies-all.'
operationId: post-fleet-agent-policies-delete
parameters:
- description: A required header to protect against CSRF attacks
in: header
name: kbn-xsrf
required: true
schema:
example: 'true'
type: string
requestBody:
content:
application/json:
examples:
postDeleteAgentPolicyRequestExample:
description: Delete an agent policy by ID
value:
agentPolicyId: agent-policy-id-1
schema:
additionalProperties: false
type: object
properties:
agentPolicyId:
description: The ID of the agent policy
type: string
force:
description: bypass validation checks that can prevent agent policy deletion
type: boolean
required:
- agentPolicyId
responses:
'200':
content:
application/json:
examples:
postDeleteAgentPolicyExample:
description: The agent policy was successfully deleted
value:
id: agent-policy-id-1
name: My agent policy
schema:
additionalProperties: false
type: object
properties:
id:
type: string
name:
type: string
required:
- id
- name
description: Successful response
'400':
content:
application/json:
examples:
genericErrorResponseExample:
description: Example of a generic error response
value:
error: Bad Request
message: An error message describing what went wrong
statusCode: 400
schema:
additionalProperties: false
description: Generic Error
type: object
properties:
attributes:
nullable: true
error:
type: string
errorType:
type: string
message:
type: string
statusCode:
type: number
required:
- message
- attributes
description: Bad Request
summary: Delete an agent policy
tags:
- Elastic Agent policies
x-metaTags:
- content: Kibana
name: product_name
/api/fleet/agent_policies/outputs:
post:
description: '**Spaces method and path for this operation:**
post /s/{space_id}/api/fleet/agent_policies/outputs
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
Get a list of outputs associated with agent policies.
[Required authorization] Route required privileges: fleet-agent-policies-read AND fleet-settings-read.'
operationId: post-fleet-agent-policies-outputs
parameters:
- description: A required header to protect against CSRF attacks
in: header
name: kbn-xsrf
required: true
schema:
example: 'true'
type: string
requestBody:
content:
application/json:
examples:
postListAgentPolicyOutputsRequestExample:
description: Get outputs for multiple agent policies
value:
ids:
- agent-policy-id-1
- agent-policy-id-2
schema:
additionalProperties: false
type: object
properties:
ids:
description: list of package policy ids
items:
type: string
maxItems: 1000
type: array
required:
- ids
responses:
'200':
content:
application/json:
examples:
postListAgentPolicyOutputsExample:
description: Outputs associated with the requested agent policies
value:
items:
- agent_policy_id: agent-policy-id-1
data_output:
id: output-id-1
name: Default output
type: elasticsearch
monitoring_output:
id: output-id-1
name: Default output
type: elasticsearch
schema:
additionalProperties: false
type: object
properties:
items:
items:
additionalProperties: false
type: object
properties:
agentPolicyId:
type: string
data:
additionalProperties: false
type: object
properties:
integrations:
items:
additionalProperties: false
type: object
properties:
id:
type: string
integrationPolicyName:
type: string
name:
type: string
pkgName:
type: string
maxItems: 1000
type: array
output:
additionalProperties: false
type: object
properties:
id:
type: string
name:
type: string
required:
- id
- name
required:
- output
monitoring:
additionalProperties: false
type: object
properties:
output:
additionalProperties: false
type: object
properties:
id:
type: string
name:
type: string
required:
- id
- name
required:
- output
required:
- monitoring
- data
maxItems: 10000
type: array
required:
- items
description: Successful response
'400':
content:
application/json:
examples:
genericErrorResponseExample:
description: Example of a generic error response
value:
error: Bad Request
message: An error message describing what went wrong
statusCode: 400
schema:
additionalProperties: false
description: Generic Error
type: object
properties:
attributes:
nullable: true
error:
type: string
errorType:
type: string
message:
type: string
statusCode:
type: number
required:
- message
- attributes
description: Bad Request
summary: Get outputs for agent policies
tags:
- Elastic Agent policies
x-metaTags:
- content: Kibana
name: product_name
/api/fleet/kubernetes:
get:
description: '**Spaces method and path for this operation:**
get /s/{space_id}/api/fleet/kubernetes
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
Get the Kubernetes manifest for deploying Elastic Agent.
[Required authorization] Route required privileges: fleet-agent-policies-read OR fleet-setup.'
operationId: get-fleet-kubernetes
parameters:
- description: If true, returns the manifest as a downloadable file
in: query
name: download
required: false
schema:
type: boolean
- description: Fleet Server host URL to include in the manifest
in: query
name: fleetServer
required: false
schema:
type: string
- description: Enrollment token to include in the manifest
in: query
name: enrolToken
required: false
schema:
type: string
responses:
'200':
content:
application/json:
examples:
getK8sManifestExample:
description: The Kubernetes manifest for deploying Elastic Agent
value:
item: 'apiVersion: v1\nkind: ConfigMap\nmetadata:\n name: agent-node-datastreams\n namespace: kube-system\n'
schema:
additionalProperties: false
type: object
properties:
item:
type: string
required:
- item
description: Successful response
'400':
content:
application/json:
examples:
genericErrorResponseExample:
description: Example of a generic error response
value:
error: Bad Request
message: An error message describing what went wrong
statusCode: 400
schema:
additionalProperties: false
description: Generic Error
type: object
properties:
attributes:
nullable: true
error:
type: string
errorType:
type: string
message:
type: string
statusCode:
type: number
required:
- message
- attributes
description: Bad Request
summary: Get a full K8s agent manifest
tags:
- Elastic Agent policies
x-metaTags:
- content: Kibana
name: product_name
/api/fleet/kubernetes/download:
get:
description: '**Spaces method and path for this operation:**
get /s/{space_id}/api/fleet/kubernetes/download
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
Download the Kubernetes manifest for deploying Elastic Agent.
[Required authorization] Route required privileges: fleet-agent-policies-read OR fleet-setup.'
operationId: get-fleet-kubernetes-download
parameters:
- description: If true, returns the manifest as a downloadable file
in: query
name: download
required: false
schema:
type: boolean
- description: Fleet Server host URL to include in the manifest
in: query
name: fleetServer
required: false
schema:
type: string
- description: Enrollment token to include in the manifest
in: query
name: enrolToken
required: false
schema:
type: string
responses:
'200':
content:
application/json:
examples:
getDownloadK8sManifestExample:
description: The Kubernetes manifest download
value: 'apiVersion: v1\nkind: ConfigMap\nmetadata:\n name: agent-node-datastreams\n namespace: kube-system\n'
schema:
type: string
description: Successful response — returns the Kubernetes manifest as a YAML file download
'400':
content:
application/json:
examples:
genericErrorResponseExample:
description: Example of a generic error response
value:
error: Bad Request
message: An error message describing what went wrong
statusCode: 400
schema:
additionalProperties: false
description: Generic Error
type: object
properties:
attributes:
nullable: true
error:
type: string
errorType:
type: string
message:
type: string
statusCode:
type: number
required:
- message
- attributes
description: Bad Request
'404':
content:
application/json:
examples:
notFoundExample:
description: No manifest was found
value:
error: Not Found
message: Agent manifest not found
statusCode: 404
schema:
additionalProperties: false
description: Generic Error
type: object
properties:
attributes:
nullable: true
error:
type: string
errorType:
type: string
message:
type: string
statusCode:
type: number
required:
- message
- attributes
description: Not Found
summary: Download an agent manifest
tags:
- Elastic Agent policies
x-metaTags:
- content: Kibana
name: product_name
components:
securitySchemes:
apiKeyAuth:
description: 'These APIs use key-based authentication. You must create an API key and use the encoded value in the request header. For example: `Authorization: ApiKey base64AccessApiKey`
'
in: header
name: Authorization
type: apiKey
basicAuth:
scheme: basic
type: http
x-topics:
- title: Kibana spaces
content: "Spaces enable you to organize your dashboards and other saved objects into meaningful categories.\nYou can use the default space or create your own spaces.\n\nTo run APIs in non-default spaces, you must add `s/{space_id}/` to the path.\nFor example:\n\n```bash\ncurl -X GET \"http://${KIBANA_URL}/s/marketing/api/data_views\" \\\n -H \"Authorization: ApiKey ${API_KEY}\"\n```\n\nIf you use the Kibana console to send API requests, it automatically adds the appropriate space identifier.\n\nTo learn more, check out [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces).\n"