openapi: 3.0.3
info:
  contact:
    name: Kibana Team
  description: 'The Kibana REST APIs enable you to manage resources such as connectors, data views, and saved objects.

    The API calls are stateless.

    Each request that you make happens in isolation from other calls and must include all of the necessary information for Kibana to fulfill the

    request.

    API requests return JSON output, which is a format that is machine-readable and works well for automation.


    To interact with Kibana APIs, use the following operations:


    - GET: Fetches the information.

    - PATCH: Applies partial modifications to the existing information.

    - POST: Adds new information.

    - PUT: Updates the existing information.

    - DELETE: Removes the information.


    You can prepend any Kibana API endpoint with `kbn:` and run the request in **Dev Tools → Console**.

    For example:


    ```

    GET kbn:/api/data_views

    ```


    For more information about the console, refer to [Run API requests](https://www.elastic.co/docs/explore-analyze/query-filter/tools/console).


    NOTE: Access to internal Kibana API endpoints will be restricted in Kibana version 9.0. Please move any integrations to publicly documented APIs.


    ## Documentation source and versions


    This documentation is derived from the `main` branch of the [kibana](https://github.com/elastic/kibana) repository.

    It is provided under license [Attribution-NonCommercial-NoDerivatives 4.0 International](https://creativecommons.org/licenses/by-nc-nd/4.0/).


    This documentation contains work-in-progress information for future Elastic Stack releases.

    '
  title: Kibana APIs Actions Security Lists API API
  version: ''
  x-doc-license:
    name: Attribution-NonCommercial-NoDerivatives 4.0 International
    url: https://creativecommons.org/licenses/by-nc-nd/4.0/
  x-feedbackLink:
    label: Feedback
    url: https://github.com/elastic/docs-content/issues/new?assignees=&labels=feedback%2Ccommunity&projects=&template=api-feedback.yaml&title=%5BFeedback%5D%3A+
servers:
- url: https://{kibana_url}
  variables:
    kibana_url:
      default: localhost:5601
security:
- apiKeyAuth: []
- basicAuth: []
tags:
- description: "Lists can be used with detection rule exceptions to define values that prevent a rule from generating alerts.\n\nLists are made up of:\n\n* **List containers**: A container for values of the same Elasticsearch data type. The following data types can be used:\n    * `boolean`\n    * `byte`\n    * `date`\n    * `date_nanos`\n    * `date_range`\n    * `double`\n    * `double_range`\n    * `float`\n    * `float_range`\n    * `half_float`\n    * `integer`\n    * `integer_range`\n    * `ip`\n    * `ip_range`\n    * `keyword`\n    * `long`\n    * `long_range`\n    * `short`\n    * `text`\n* **List items**: The values used to determine whether the exception prevents an alert from being generated.\n\nAll list items in the same list container must be of the same data type, and each item defines a single value. For example, an IP list container named `internal-ip-addresses-southport` contains five items, where each item defines one internal IP address:\n1. `192.168.1.1`\n2. `192.168.1.3`\n3. `192.168.1.18`\n4. `192.168.1.12`\n5. `192.168.1.7`\n\nTo use these IP addresses as values for defining rule exceptions, use the Security exceptions API to [create an exception list item](../operation/operation-createexceptionlistitem) that references the `internal-ip-addresses-southport` list.\n> info\n> Lists cannot be added directly to rules, nor do they define the operators used to determine when exceptions are applied (`is in list`, `is not in list`). Use an exception item to define the operator and associate it with an [exception container](../operation/operation-createexceptionlist). You can then add the exception container to a rule's `exceptions_list` object.\n\n## Lists requirements\n\nBefore you can start using lists, you must create the `.lists` and `.items` data streams for the relevant Kibana space. To do this, use the [Create list data streams](../operation/operation-createlistindex) endpoint. Once these data streams are created, your role needs privileges to manage rules. Refer to [Enable and access detections](https://www.elastic.co/guide/en/security/current/detections-permissions-section.html#enable-detections-ui) for a complete list of requirements.\n"
  name: Security Lists API
  x-displayName: Security lists
paths:
  /api/lists:
    delete:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb delete">delete</span>&nbsp;<span class="operation-path">/s/{space_id}/api/lists</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Delete a value list using the list ID.

        > info

        > When you delete a list, all of its list items are also deleted.

        '
      operationId: DeleteList
      parameters:
      - description: Value list identifier to delete, including all of its list items.
        in: query
        name: id
        required: true
        schema:
          $ref: '#/components/schemas/Security_Lists_API_ListId'
      - description: Determines whether exception items referencing this value list should be deleted.
        in: query
        name: deleteReferences
        required: false
        schema:
          default: false
          example: false
          type: boolean
      - description: Determines whether to delete value list without performing any additional checks of where this list may be utilized.
        in: query
        name: ignoreReferences
        required: false
        schema:
          default: false
          example: false
          type: boolean
      responses:
        '200':
          content:
            application/json:
              examples:
                ipList:
                  value:
                    _version: WzIsMV0=
                    '@timestamp': '2025-01-08T04:47:34.273Z'
                    created_at: '2025-01-08T04:47:34.273Z'
                    created_by: elastic
                    description: List of bad internet ips.
                    id: 21b01cfb-058d-44b9-838c-282be16c91cd
                    immutable: false
                    name: Bad ips
                    tie_breaker_id: f5508188-b1e9-4e6e-9662-d039a7d89899
                    type: ip
                    updated_at: '2025-01-08T05:39:39.292Z'
                    updated_by: elastic
                    version: 3
              schema:
                $ref: '#/components/schemas/Security_Lists_API_List'
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                badRequest:
                  value:
                    error: Bad Request
                    message: '[request query]: id: Required'
                    statusCode: 400
              schema:
                oneOf:
                - $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
                - $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
          description: Invalid input data response
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: '[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]'
                    statusCode: 401
              schema:
                $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
          description: Unsuccessful authentication response
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  value:
                    error: Forbidden
                    message: API [DELETE /api/lists?id=ip_list] is unauthorized for user, this action is granted by the Kibana privileges [lists-all]
                    statusCode: 403
              schema:
                $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
          description: Not enough privileges response
        '404':
          content:
            application/json:
              examples:
                notFound:
                  value:
                    message: 'list id: \"ip_list\" was not found'
                    status_code: 404
              schema:
                $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
          description: List not found response
        '500':
          content:
            application/json:
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
              schema:
                $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
          description: Internal server error response
      summary: Delete a value list
      tags:
      - Security Lists API
      x-metaTags:
      - content: Kibana
        name: product_name
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/lists</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Get the details of a value list using the list ID.'
      operationId: ReadList
      parameters:
      - description: Value list identifier (`id`) returned when the list was created.
        in: query
        name: id
        required: true
        schema:
          $ref: '#/components/schemas/Security_Lists_API_ListId'
      responses:
        '200':
          content:
            application/json:
              examples:
                ip:
                  value:
                    _version: WzEsMV0=
                    '@timestamp': '2025-01-08T04:47:34.273Z'
                    created_at: '2025-01-08T04:47:34.273Z'
                    created_by: elastic
                    description: This list describes bad internet ip
                    id: ip_list
                    immutable: false
                    name: My bad ips
                    tie_breaker_id: f5508188-b1e9-4e6e-9662-d039a7d89899
                    type: ip
                    updated_at: '2025-01-08T05:21:53.843Z'
                    updated_by: elastic
                    version: 1
              schema:
                $ref: '#/components/schemas/Security_Lists_API_List'
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                badRequest:
                  value:
                    error: Bad Request
                    message: '[request query]: id: Required'
                    statusCode: 400
              schema:
                oneOf:
                - $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
                - $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
          description: Invalid input data response
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: "[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]"
                    statusCode: 401
              schema:
                $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
          description: Unsuccessful authentication response
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  value:
                    error: Forbidden
                    message: API [GET /api/lists?id=ip_list] is unauthorized for user, this action is granted by the Kibana privileges [lists-read]
                    statusCode: 403
              schema:
                $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
          description: Not enough privileges response
        '404':
          content:
            application/json:
              examples:
                notFound:
                  value:
                    message: 'list id: \"foo\" not found'
                    status_code: 404
              schema:
                $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
          description: List not found response
        '500':
          content:
            application/json:
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
              schema:
                $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
          description: Internal server error response
      summary: Get value list details
      tags:
      - Security Lists API
      x-metaTags:
      - content: Kibana
        name: product_name
    patch:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb patch">patch</span>&nbsp;<span class="operation-path">/s/{space_id}/api/lists</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Update specific fields of an existing list using the list `id`.'
      operationId: PatchList
      requestBody:
        content:
          application/json:
            examples:
              patchName:
                value:
                  id: ip_list
                  name: Bad ips list - UPDATED
            schema:
              example:
                id: ip_list
                name: Bad ips list - UPDATED
              type: object
              properties:
                _version:
                  $ref: '#/components/schemas/Security_Lists_API_ListVersionId'
                description:
                  $ref: '#/components/schemas/Security_Lists_API_ListDescription'
                id:
                  $ref: '#/components/schemas/Security_Lists_API_ListId'
                meta:
                  $ref: '#/components/schemas/Security_Lists_API_ListMetadata'
                name:
                  $ref: '#/components/schemas/Security_Lists_API_ListName'
                version:
                  $ref: '#/components/schemas/Security_Lists_API_ListVersion'
              required:
              - id
        description: Value list's properties
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                ip:
                  value:
                    _version: WzEsMV0=
                    '@timestamp': '2025-01-08T04:47:34.273Z'
                    created_at: '2025-01-08T04:47:34.273Z'
                    created_by: elastic
                    description: This list describes bad internet ips
                    id: ip_list
                    immutable: false
                    name: Bad ips list - UPDATED
                    tie_breaker_id: f5508188-b1e9-4e6e-9662-d039a7d89899
                    type: ip
                    updated_at: '2025-01-08T05:21:53.843Z'
                    updated_by: elastic
                    version: 2
              schema:
                $ref: '#/components/schemas/Security_Lists_API_List'
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                badRequest:
                  value:
                    error: Bad Request
                    message: '[request body]: name: Expected string, received number'
                    statusCode: 400
              schema:
                oneOf:
                - $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
                - $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
          description: Invalid input data response
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: '[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]'
                    statusCode: 401
              schema:
                $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
          description: Unsuccessful authentication response
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  value:
                    error: Forbidden
                    message: API [PATCH /api/lists] is unauthorized for user, this action is granted by the Kibana privileges [lists-all]
                    statusCode: 403
              schema:
                $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
          description: Not enough privileges response
        '404':
          content:
            application/json:
              examples:
                notFound:
                  value:
                    message: 'list id: \"foo\" not found'
                    status_code: 404
              schema:
                $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
          description: List not found response
        '500':
          content:
            application/json:
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
              schema:
                $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
          description: Internal server error response
      summary: Patch a value list
      tags:
      - Security Lists API
      x-metaTags:
      - content: Kibana
        name: product_name
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/lists</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Create a new value list.'
      operationId: CreateList
      requestBody:
        content:
          application/json:
            examples:
              ip:
                value:
                  description: This list describes bad internet ips
                  id: ip_list
                  name: Simple list with ips
                  type: ip
              ip_range:
                value:
                  description: This list has ip ranges
                  id: ip_range_list
                  name: Simple list with ip ranges
                  type: ip_range
              keyword:
                value:
                  description: This list describes bad host names
                  id: keyword_list
                  name: Simple list with a keyword
                  type: keyword
              keyword_custom_format:
                value:
                  description: This parses the first found ipv4 only
                  id: keyword_custom_format_list
                  name: Simple list with a keyword using a custom format
                  type: keyword
            schema:
              type: object
              properties:
                description:
                  $ref: '#/components/schemas/Security_Lists_API_ListDescription'
                id:
                  $ref: '#/components/schemas/Security_Lists_API_ListId'
                meta:
                  $ref: '#/components/schemas/Security_Lists_API_ListMetadata'
                name:
                  $ref: '#/components/schemas/Security_Lists_API_ListName'
                type:
                  $ref: '#/components/schemas/Security_Lists_API_ListType'
                version:
                  default: 1
                  minimum: 1
                  type: integer
              required:
              - name
              - description
              - type
        description: Value list's properties
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                ip:
                  value:
                    _version: WzAsMV0=
                    '@timestamp': '2025-01-08T04:47:34.273Z'
                    created_at: '2025-01-08T04:47:34.273Z'
                    created_by: elastic
                    description: This list describes bad internet ips
                    id: ip_list
                    immutable: false
                    name: Simple list with ips
                    tie_breaker_id: f5508188-b1e9-4e6e-9662-d039a7d89899
                    type: ip
                    updated_at: '2025-01-08T04:47:34.273Z'
                    updated_by: elastic
                    version: 1
                ip_range:
                  value:
                    _version: WzAsMV0=
                    '@timestamp': '2025-01-09T18:23:52.241Z'
                    created_at: '2025-01-09T18:23:52.241Z'
                    created_by: elastic
                    description: This list has ip ranges
                    id: ip_range_list
                    immutable: false
                    name: Simple list with ip ranges
                    tie_breaker_id: 74aebdaf-601f-4940-b351-155728ff7003
                    type: ip_range
                    updated_at: '2025-01-09T18:23:52.241Z'
                    updated_by: elastic
                    version: 1
                keyword:
                  value:
                    _version: WzEsMV0=
                    '@timestamp': '2025-01-09T18:24:55.786Z'
                    created_at: '2025-01-09T18:24:55.786Z'
                    created_by: elastic
                    description: This list describes bad host names
                    id: keyword_list
                    immutable: false
                    name: Simple list with a keyword
                    tie_breaker_id: f7e7dbaa-daf7-4c9a-a3dc-56643923ef68
                    type: keyword
                    updated_at: '2025-01-09T18:24:55.786Z'
                    updated_by: elastic
                    version: 1
                keyword_custom_format:
                  value:
                    _version: WzIsMV0=
                    '@timestamp': '2025-01-09T18:25:39.604Z'
                    created_at: '2025-01-09T18:25:39.604Z'
                    created_by: elastic
                    description: This parses the first found ipv4 only
                    id: keyword_custom_format_list
                    immutable: false
                    name: Simple list with a keyword using a custom format
                    tie_breaker_id: 8247ae63-b780-47b8-9a89-948b643e9ec2
                    type: keyword
                    updated_at: '2025-01-09T18:25:39.604Z'
                    updated_by: elastic
                    version: 1
              schema:
                $ref: '#/components/schemas/Security_Lists_API_List'
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                notFound:
                  value:
                    message: To create a list, the data stream must exist first. Data stream \".lists-default\" does not exist
                    status_code: 400
              schema:
                oneOf:
                - $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
                - $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
          description: Invalid input data response
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: '[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]'
                    statusCode: 401
              schema:
                $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
          description: Unsuccessful authentication response
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  value:
                    error: Forbidden
                    message: API [POST /api/lists] is unauthorized for user, this action is granted by the Kibana privileges [lists-all]
                    statusCode: 403
              schema:
                $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
          description: Not enough privileges response
        '409':
          content:
            application/json:
              examples:
                alreadyExists:
                  value:
                    message: 'list id: "keyword_custom_format_list" already exists'
                    status_code: 409
              schema:
                $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
          description: List already exists response
        '500':
          content:
            application/json:
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
              schema:
                $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
          description: Internal server error response
      summary: Create a value list
      tags:
      - Security Lists API
      x-metaTags:
      - content: Kibana
        name: product_name
    put:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb put">put</span>&nbsp;<span class="operation-path">/s/{space_id}/api/lists</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Update a value list using the list `id`. The original list is replaced, and all unspecified fields are deleted.

        > info

        > You cannot modify the `id` value.

        '
      operationId: UpdateList
      requestBody:
        content:
          application/json:
            examples:
              replaceList:
                value:
                  description: Latest list of bad ips
                  id: ip_list
                  name: Bad ips - updated
            schema:
              example:
                description: Latest list of bad ips
                id: ip_list
                name: Bad ips - updated
              type: object
              properties:
                _version:
                  $ref: '#/components/schemas/Security_Lists_API_ListVersionId'
                description:
                  $ref: '#/components/schemas/Security_Lists_API_ListDescription'
                id:
                  $ref: '#/components/schemas/Security_Lists_API_ListId'
                meta:
                  $ref: '#/components/schemas/Security_Lists_API_ListMetadata'
                name:
                  $ref: '#/components/schemas/Security_Lists_API_ListName'
                version:
                  $ref: '#/components/schemas/Security_Lists_API_ListVersion'
              required:
              - id
              - name
              - description
        description: Value list's properties
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                ip:
                  value:
                    _version: WzIsMV0=
                    '@timestamp': '2025-01-08T04:47:34.273Z'
                    created_at: '2025-01-08T04:47:34.273Z'
                    created_by: elastic
                    description: Latest list of bad ips
                    id: ip_list
                    immutable: false
                    name: Bad ips - updated
                    tie_breaker_id: f5508188-b1e9-4e6e-9662-d039a7d89899
                    type: ip
                    updated_at: '2025-01-08T05:39:39.292Z'
                    updated_by: elastic
                    version: 3
              schema:
                $ref: '#/components/schemas/Security_Lists_API_List'
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                badRequest:
                  value:
                    error: Bad Request
                    message: '[request body]: id: Expected string, received number'
                    statusCode: 400
              schema:
                oneOf:
                - $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
                - $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
          description: Invalid input data response
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: '[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]'
                    statusCode: 401
              schema:
                $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
          description: Unsuccessful authentication response
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  value:
                    error: Forbidden
                    message: API [PUT /api/lists] is unauthorized for user, this action is granted by the Kibana privileges [lists-all]
                    statusCode: 403
              schema:
                $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
          description: Not enough privileges response
        '404':
          content:
            application/json:
              examples:
                notFound:
                  value:
                    message: 'list id: \"foo\" not found'
                    status_code: 404
              schema:
                $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
          description: List not found response
        '500':
          content:
            application/json:
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
              schema:
                $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
          description: Internal server error response
      summary: Update a value list
      tags:
      - Security Lists API
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/lists/_find:
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/lists/_find</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Get a paginated subset of value lists. By default, the first page is returned, with 20 results per page.'
      operationId: FindLists
      parameters:
      - description: The page number to return.
        in: query
        name: page
        required: false
        schema:
          example: 1
          type: integer
      - description: The number of value lists to return per page.
        in: query
        name: per_page
        required: false
        schema:
          example: 20
          type: integer
      - description: Determines which field is used to sort the results.
        in: query
        name: sort_field
        required: false
        schema:
          example: name
          format: nonempty
          minLength: 1
          type: string
      - description: Determines the sort order, which can be `desc` or `asc`
        in: query
        name: sort_order
        required: false
        schema:
          enum:
          - desc
          - asc
          example: asc
          type: string
      - description: Returns the lists that come after the last lists returned in the previous call (use the `cursor` value returned in the previous call). This parameter uses the `tie_breaker_id` field to ensure all lists are sorted and returned correctly.
        in: query
        name: cursor
        required: false
        schema:
          $ref: '#/components/schemas/Security_Lists_API_FindListsCursor'
      - description: 'Filters the returned results according to the value of the specified field,

          using the <field name>:<field value> syntax.

          '
        in: query
        name: filter
        required: false
        schema:
          $ref: '#/components/schemas/Security_Lists_API_FindListsFilter'
      responses:
        '200':
          content:
            application/json:
              examples:
                ipList:
                  value:
                    cursor: WzIwLFsiZjU1MDgxODgtYjFlOS00ZTZlLTk2NjItZDAzOWE3ZDg5ODk5Il1d
                    data:
                    - _version: WzAsMV0=
                      '@timestamp': '2025-01-08T04:47:34.273Z

                        '
                      created_at: '2025-01-08T04:47:34.273Z

                        '
                      created_by: elastic
                      description: This list describes bad internet ip
                      id: ip_list
                      immutable: false
                      name: Simple list with an ip
                      tie_breaker_id: f5508188-b1e9-4e6e-9662-d039a7d89899
                      type: ip
                      updated_at: '2025-01-08T04:47:34.273Z

                        '
                      updated_by: elastic
                      version: 1
                    page: 1
                    per_page: 20
                    total: 1
              schema:
                type: object
                properties:
                  cursor:
                    $ref: '#/components/schemas/Security_Lists_API_FindListsCursor'
                  data:
                    items:
                      $ref: '#/components/schemas/Security_Lists_API_List'
                    type: array
                  page:
                    minimum: 0
                    type: integer
                  per_page:
                    minimum: 0
                    type: integer
                  total:
                    minimum: 0
                    type: integer
                required:
                - data
                - page
                - per_page
                - total
                - cursor
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                badRequest:
                  value:
                    error: Bad Request
                    message: '[request query]: page: Expected number, received nan'
                    statusCode: 400
              schema:
                oneOf:
                - $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
                - $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
          description: Invalid input data response
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: '[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]'
                    statusCode: 401
              schema:
                $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
          description: Unsuccessful authentication response
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  value:
                    error: Forbidden
                    message: API [GET /api/lists/_find?page=1&per_page=20] is unauthorized for user, this action is granted by the Kibana privileges [lists-read]
                    statusCode: 403
              schema:
                $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
          description: Not enough privileges response
        '500':
          content:
            application/json:
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
              schema:
                $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
          description: Internal server error response
      summary: Get value lists
      tags:
      - Security Lists API
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/lists/index:
    delete:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb delete">delete</span>&nbsp;<span class="operation-path">/s/{space_id}/api/lists/index</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Delete the `.lists` and `.items` data streams.'
      operationId: DeleteListIndex
      responses:
        '200':
          content:
            application/json:
              examples:
                acknowledged:
                  value:
                    acknowledged: true
              schema:
                type: object
                properties:
                  acknowledged:
                    type: boolean
                required:
                - acknowledged
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                badRequest:
                  value:
                    message: 'Unable to delete value list data streams: invalid or missing index metadata'
                    status_code: 400
              schema:
                oneOf:
                - $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
                - $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
          description: Invalid input data response
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: '[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]'
                    statusCode: 401
              schema:
                $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
          description: Unsuccessful authentication response
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  value:
                    error: Forbidden
                    message: API [DELETE /api/lists/index] is not authorized; lists-all (or equivalent) is required to delete data streams
                    statusCode: 403
              schema:
                $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
          description: Not enough privileges response
        '404':
          content:
            application/json:
              examples:
                notFound:
                  value:
                    message: The value list data stream was not found in this space
                    status_code: 404
              schema:
                $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
          description: List data stream not found response
        '500':
          content:
            application/json:
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
              schema:
                $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
          description: Internal server error response
      summary: Delete value list data streams
      tags:
      - Security Lists API
      x-metaTags:
      - content: Kibana
        name: product_name
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/lists/index</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Verify that `.lists` and `.items` data streams exist.'
      operationId: ReadListIndex
      responses:
        '200':
          content:
            application/json:
              examples:
                bothExist:
                  value:
                    list_index: true
                    list_item_index: true
              schema:
                type: object
                properties:
                  list_index:
                    type: boolean
                  list_item_index:
                    type: boolean
                required:
                - list_index
                - list_item_index
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                badRequest:
                  value:
                    message: Unable to read value list data stream status for this space
                    status_code: 400
              schema:
                oneOf:
                - $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
                - $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
          description: Invalid input data response
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: '[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]'
                    statusCode: 401
              schema:
                $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
          description: Unsuccessful authentication response
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  value:
                    error: Forbidden
                    message: API [GET /api/lists/index] is not authorized; list read permissions are required
                    statusCode: 403
              schema:
                $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
          description: Not enough privileges response
        '404':
          content:
            application/json:
              examples:
                notFound:
                  value:
                    message: Value list backing indices were not found for this space
                    status_code: 404
              schema:
                $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
          description: List data stream(s) not found response
        '500':
          content:
            application/json:
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
              schema:
                $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
          description: Internal server error response
      summary: Get status of value list data streams
      tags:
      - Security Lists API
      x-metaTags:
      - content: Kibana
        name: product_name
    post:
      deprecated: true
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/lists/index</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        **DEPRECATED.** `deprecated: true` is set on this operation. Value list backing data streams for the space

        are now created as part of supported workflows; calling this explicitly is rarely required.

        **WARNING:** Do not use for new integrations. Prefer the UI or the list and list-item APIs after confirming

        indices exist with `GET /api/lists/index`.


        Creates the `.lists` and `.items` data streams in the current Kibana space.

        '
      operationId: CreateListIndex
      responses:
        '200':
          content:
            application/json:
              examples:
                acknowledged:
                  value:
                    acknowledged: true
              schema:
                type: object
                properties:
                  acknowledged:
                    type: boolean
                required:
                - acknowledged
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                badRequest:
                  value:
                    message: Indices exist but the request could not be completed for the current space. Check that Elasticsearch and Kibana privileges allow index creation for lists.
                    status_code: 400
              schema:
                oneOf:
                - $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
                - $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
          description: Invalid input data response
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: '[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]

                      '
                    statusCode: 401
              schema:
                $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
          description: Unsuccessful authentication response
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  value:
                    error: Forbidden
                    message: API [POST /api/lists/index] is unauthorized for user, this action is granted by the Kibana privileges [lists-all]
                    statusCode: 403
              schema:
                $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
          description: Not enough privileges response
        '409':
          content:
            application/json:
              examples:
                alreadyExists:
                  value:
                    message: 'data stream: \".lists-default\" and \".items-default\" already exists'
                    status_code: 409
              schema:
                $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
          description: List data stream exists response
        '500':
          content:
            application/json:
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
              schema:
                $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
          description: Internal server error response
      summary: Create list data streams
      tags:
      - Security Lists API
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/lists/items:
    delete:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb delete">delete</span>&nbsp;<span class="operation-path">/s/{space_id}/api/lists/items</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Delete a value list item using its `id`, or its `list_id` and `value` fields.'
      operationId: DeleteListItem
      parameters:
      - description: Value list item's identifier. Required if `list_id` and `value` are not specified.
        in: query
        name: id
        required: false
        schema:
          $ref: '#/components/schemas/Security_Lists_API_ListItemId'
      - description: Value list's identifier. Required if `id` is not specified.
        in: query
        name: list_id
        required: false
        schema:
          $ref: '#/components/schemas/Security_Lists_API_ListId'
      - description: The value used to evaluate exceptions. Required if `id` is not specified.
        in: query
        name: value
        required: false
        schema:
          example: 255.255.255.255
          type: string
      - description: Determines when changes made by the request are made visible to search.
        in: query
        name: refresh
        required: false
        schema:
          default: 'false'
          enum:
          - 'true'
          - 'false'
          - wait_for
          example: false
          type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                ip:
                  value:
                    _version: WzIwLDFd
                    '@timestamp': '2025-01-08T05:15:05.159Z'
                    created_at: '2025-01-08T05:15:05.159Z'
                    created_by: elastic
                    id: pd1WRJQBs4HAK3VQeHFI
                    list_id: ip_list
                    tie_breaker_id: eee41dc7-1666-4876-982f-8b0f7b59eca3
                    type: ip
                    updated_at: '2025-01-08T05:44:14.009Z'
                    updated_by: elastic
                    value: 255.255.255.255
              schema:
                oneOf:
                - $ref: '#/components/schemas/Security_Lists_API_ListItem'
                - items:
                    $ref: '#/components/schemas/Security_Lists_API_ListItem'
                  type: array
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                badRequest:
                  value:
                    message: Either \"list_id\" or \"id\" needs to be defined in the request
                    status_code: 400
              schema:
                oneOf:
                - $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
                - $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
          description: Invalid input data response
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: '[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]'
                    statusCode: 401
              schema:
                $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
          description: Unsuccessful authentication response
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  value:
                    error: Forbidden
                    message: API [DELETE /api/lists/items?id=pd1WRJQBs4HAK3VQeHFI] is unauthorized for user, this action is granted by the Kibana privileges [lists-all]
                    statusCode: 403
              schema:
                $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
          description: Not enough privileges response
        '404':
          content:
            application/json:
              examples:
                notFound:
                  value:
                    message: 'list item with id: \"pd1WRJQBs4HAK3VQeHFI\" not found'
                    status_code: 404
              schema:
                $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
          description: List item not found response
        '500':
          content:
            application/json:
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
              schema:
                $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
          description: Internal server error response
      summary: Delete a value list item
      tags:
      - Security Lists API
      x-metaTags:
      - content: Kibana
        name: product_name
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/lists/items</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Get the details of a value list item.'
      operationId: ReadListItem
      parameters:
      - description: Value list item identifier. Required if `list_id` and `value` are not specified.
        in: query
        name: id
        required: false
        schema:
          $ref: '#/components/schemas/Security_Lists_API_ListId'
      - description: Value list item list's `id` identfier. Required if `id` is not specified.
        in: query
        name: list_id
        required: false
        schema:
          $ref: '#/components/schemas/Security_Lists_API_ListId'
      - description: The value used to evaluate exceptions. Required if `id` is not specified.
        in: query
        name: value
        required: false
        schema:
          example: 127.0.0.2
          type: string
      responses:
        '200':
          content:
            application/json:
              examples:
                ip:
                  value:
                    _version: WzExLDFd
                    '@timestamp': '2025-01-08T05:16:25.882Z'
                    created_at: '2025-01-08T05:16:25.882Z'
                    created_by: elastic
                    id: qN1XRJQBs4HAK3VQs3Gc
                    list_id: ip_list
                    tie_breaker_id: a9a34c02-a385-436e-86a0-02a3942f3537
                    type: ip
                    updated_at: '2025-01-08T05:16:25.882Z'
                    updated_by: elastic
                    value: 127.0.0.2
              schema:
                oneOf:
                - $ref: '#/components/schemas/Security_Lists_API_ListItem'
                - items:
                    $ref: '#/components/schemas/Security_Lists_API_ListItem'
                  type: array
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                badRequest:
                  value:
                    message: Either \"list_id\" or \"id\" needs to be defined in the request
                    status_code: 400
              schema:
                oneOf:
                - $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
                - $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
          description: Invalid input data response
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: '[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]'
                    statusCode: 401
              schema:
                $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
          description: Unsuccessful authentication response
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  value:
                    error: Forbidden
                    message: API [GET /api/lists/items?id=qN1XRJQBs4HAK3VQs3Gc] is unauthorized for user, this action is granted by the Kibana privileges [lists-read]
                    statusCode: 403
              schema:
                $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
          description: Not enough privileges response
        '404':
          content:
            application/json:
              examples:
                notFound:
                  value:
                    message: 'list item id: \"foo\" not found'
                    status_code: 404
              schema:
                $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
          description: List item not found response
        '500':
          content:
            application/json:
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
              schema:
                $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
          description: Internal server error response
      summary: Get a value list item
      tags:
      - Security Lists API
      x-metaTags:
      - content: Kibana
        name: product_name
    patch:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb patch">patch</span>&nbsp;<span class="operation-path">/s/{space_id}/api/lists/items</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Update specific fields of an existing value list item using the item `id`.'
      operationId: PatchListItem
      requestBody:
        content:
          application/json:
            examples:
              changeValue:
                value:
                  id: pd1WRJQBs4HAK3VQeHFI
                  value: 255.255.255.255
            schema:
              type: object
              properties:
                _version:
                  $ref: '#/components/schemas/Security_Lists_API_ListVersionId'
                id:
                  $ref: '#/components/schemas/Security_Lists_API_ListItemId'
                meta:
                  $ref: '#/components/schemas/Security_Lists_API_ListItemMetadata'
                refresh:
                  description: Determines when changes made by the request are made visible to search.
                  enum:
                  - 'true'
                  - 'false'
                  - wait_for
                  type: string
                value:
                  $ref: '#/components/schemas/Security_Lists_API_ListItemValue'
              required:
              - id
        description: Value list item's properties
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                ipItem:
                  value:
                    _version: WzE5LDFd
                    '@timestamp': '2025-01-08T05:15:05.159Z'
                    created_at: '2025-01-08T05:15:05.159Z'
                    created_by: elastic
                    id: pd1WRJQBs4HAK3VQeHFI
                    list_id: ip_list
                    tie_breaker_id: eee41dc7-1666-4876-982f-8b0f7b59eca3
                    type: ip
                    updated_at: '2025-01-08T05:23:37.602Z'
                    updated_by: elastic
                    value: 255.255.255.255
              schema:
                $ref: '#/components/schemas/Security_Lists_API_ListItem'
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                badRequest:
                  value:
                    message: '{"took":15,"timed_out":false,"total":1,"updated":0,"deleted":0,"batches":1,"version_conflicts":0,"noops":0,"retries":{"bulk":0,"search":0},"throttled_millis":0,"requests_per_second":-1,"throttled_until_millis":0,"failures":[{"index":".ds-.items-default-2025.01.09-000001","id":"ip_item","cause":{"type":"document_parsing_exception","reason":"[1:107] failed to parse field [ip] of type [ip] in document with id ip_item. Preview of fields value: 2","caused_by":{"type":"illegal_argument_exception","reason":"2 is not an IP string literal."}},"status":400}]}'
                    status_code: 400
              schema:
                oneOf:
                - $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
                - $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
          description: Invalid input data response
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: '[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]'
                    statusCode: 401
              schema:
                $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
          description: Unsuccessful authentication response
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  value:
                    error: Forbidden
                    message: API [PATCH /api/lists/items] is unauthorized for user, this action is granted by the Kibana privileges [lists-all]
                    statusCode: 403
              schema:
                $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
          description: Not enough privileges response
        '404':
          content:
            application/json:
              examples:
                notFound:
                  value:
                    message: 'list item id: \"foo\" not found'
                    status_code: 404
              schema:
                $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
          description: List item not found response
        '500':
          content:
            application/json:
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
              schema:
                $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
          description: Internal server error response
      summary: Patch a value list item
      tags:
      - Security Lists API
      x-metaTags:
      - content: Kibana
        name: product_name
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/lists/items</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Create a value list item and associate it with the specified value list.


        All value list items in the same list must be the same type. For example, each list item in an `ip` list must define a specific IP address.

        > info

        > Before creating a list item, you must create a list.

        '
      operationId: CreateListItem
      requestBody:
        content:
          application/json:
            examples:
              ip:
                value:
                  list_id: ip_list
                  value: 127.0.0.1
              ip_range:
                value:
                  list_id: ip_range_list
                  value: 192.168.0.0/16
              keyword:
                value:
                  list_id: keyword_list
                  value: zeek
            schema:
              type: object
              properties:
                id:
                  $ref: '#/components/schemas/Security_Lists_API_ListItemId'
                list_id:
                  $ref: '#/components/schemas/Security_Lists_API_ListId'
                meta:
                  $ref: '#/components/schemas/Security_Lists_API_ListItemMetadata'
                refresh:
                  description: Determines when changes made by the request are made visible to search.
                  enum:
                  - 'true'
                  - 'false'
                  - wait_for
                  example: wait_for
                  type: string
                value:
                  $ref: '#/components/schemas/Security_Lists_API_ListItemValue'
              required:
              - list_id
              - value
        description: Value list item's properties
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                ip:
                  value:
                    _version: WzAsMV0=
                    '@timestamp': '2025-01-08T04:59:06.154Z'
                    created_at: '2025-01-08T04:59:06.154Z'
                    created_by: elastic
                    id: 21b01cfb-058d-44b9-838c-282be16c91cc
                    list_id: ip_list
                    tie_breaker_id: b57c762c-3036-465c-9bfb-7bfb5e6e515a
                    type: ip
                    updated_at: '2025-01-08T04:59:06.154Z'
                    updated_by: elastic
                    value: 127.0.0.1
                ip_range:
                  value:
                    _version: WzEsMV0=
                    '@timestamp': '2025-01-09T18:33:08.202Z'
                    created_at: '2025-01-09T18:33:08.202Z'
                    created_by: elastic
                    id: ip_range_item
                    list_id: ip_range_list
                    tie_breaker_id: ea1b4189-efda-4637-b8f9-74655a5ebb61
                    type: ip_range
                    updated_at: '2025-01-09T18:33:08.202Z'
                    updated_by: elastic
                    value: 192.168.0.0/16
                keyword:
                  value:
                    _version: WzIsMV0=
                    '@timestamp': '2025-01-09T18:34:29.422Z'
                    created_at: '2025-01-09T18:34:29.422Z'
                    created_by: elastic
                    id: 7f24737d-1da8-4626-a568-33070591bb4e
                    list_id: keyword_list
                    tie_breaker_id: 2108ced2-5e5d-401e-a88e-4dd69fc5fa27
                    type: keyword
                    updated_at: '2025-01-09T18:34:29.422Z'
                    updated_by: elastic
                    value: zeek
              schema:
                $ref: '#/components/schemas/Security_Lists_API_ListItem'
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                badRequest:
                  value:
                    error: Bad Request
                    message: uri [/api/lists/items] with method [post] exists but is not available with the current configuration
                    statusCode: 400
              schema:
                oneOf:
                - $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
                - $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
          description: Invalid input data response
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: '[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]'
                    statusCode: 401
              schema:
                $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
          description: Unsuccessful authentication response
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  value:
                    error: Forbidden
                    message: API [POST /api/lists/items] is unauthorized for user, this action is granted by the Kibana privileges [lists-all]
                    statusCode: 403
              schema:
                $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
          description: Not enough privileges response
        '404':
          content:
            application/json:
              examples:
                listNotFound:
                  value:
                    message: 'list id: \"ip_list\" does not exist'
                    status_code: 404
              schema:
                $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
          description: Not enough privileges response
        '409':
          content:
            application/json:
              examples:
                alreadyExists:
                  value:
                    message: 'list item id: \"ip_item\" already exists'
                    status_code: 409
              schema:
                $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
          description: List item already exists response
        '500':
          content:
            application/json:
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
              schema:
                $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
          description: Internal server error response
      summary: Create a value list item
      tags:
      - Security Lists API
      x-metaTags:
      - content: Kibana
        name: product_name
    put:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb put">put</span>&nbsp;<span class="operation-path">/s/{space_id}/api/lists/items</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Update a value list item using the list item ID. The original list item is replaced, and all unspecified fields are deleted.

        > info

        > You cannot modify the `id` value.

        '
      operationId: UpdateListItem
      requestBody:
        content:
          application/json:
            examples:
              fullReplace:
                value:
                  id: ip_item
                  value: 255.255.255.255
            schema:
              example:
                id: ip_item
                value: 255.255.255.255
              type: object
              properties:
                _version:
                  $ref: '#/components/schemas/Security_Lists_API_ListVersionId'
                id:
                  $ref: '#/components/schemas/Security_Lists_API_ListItemId'
                meta:
                  $ref: '#/components/schemas/Security_Lists_API_ListItemMetadata'
                value:
                  $ref: '#/components/schemas/Security_Lists_API_ListItemValue'
              required:
              - id
              - value
        description: Value list item's properties
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                ip:
                  value:
                    _version: WzIwLDFd
                    '@timestamp': '2025-01-08T05:15:05.159Z'
                    created_at: '2025-01-08T05:15:05.159Z'
                    created_by: elastic
                    id: pd1WRJQBs4HAK3VQeHFI
                    list_id: ip_list
                    tie_breaker_id: eee41dc7-1666-4876-982f-8b0f7b59eca3
                    type: ip
                    updated_at: '2025-01-08T05:44:14.009Z'
                    updated_by: elastic
                    value: 255.255.255.255
              schema:
                $ref: '#/components/schemas/Security_Lists_API_ListItem'
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                badRequest:
                  value:
                    error: Bad Request
                    message: '[request body]: id: Expected string, received number'
                    statusCode: 400
              schema:
                oneOf:
                - $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
                - $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
          description: Invalid input data response
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: '[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]'
                    statusCode: 401
              schema:
                $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
          description: Unsuccessful authentication response
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  value:
                    error: Forbidden
                    message: API [PATCH /api/lists/items] is unauthorized for user, this action is granted by the Kibana privileges [lists-all]
                    statusCode: 403
              schema:
                $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
          description: Not enough privileges response
        '404':
          content:
            application/json:
              examples:
                notFound:
                  value:
                    message: 'list item id: \"foo\" not found'
                    status_code: 404
              schema:
                $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
          description: List item not found response
        '500':
          content:
            application/json:
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
              schema:
                $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
          description: Internal server error response
      summary: Update a value list item
      tags:
      - Security Lists API
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/lists/items/_export:
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/lists/items/_export</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Export list item values from the specified value list.'
      operationId: ExportListItems
      parameters:
      - description: Value list's `id` to export.
        in: query
        name: list_id
        required: true
        schema:
          $ref: '#/components/schemas/Security_Lists_API_ListId'
      responses:
        '200':
          content:
            application/ndjson:
              examples:
                ipLines:
                  value: '127.0.0.1

                    127.0.0.2

                    127.0.0.3

                    '
              schema:
                description: A `.txt` file containing list items from the specified list
                example: '127.0.0.1

                  127.0.0.2

                  127.0.0.3

                  127.0.0.4

                  127.0.0.5

                  127.0.0.6

                  127.0.0.7

                  127.0.0.8

                  127.0.0.9

                  '
                format: binary
                type: string
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                badRequest:
                  value:
                    error: 'Bad Request","message":"[request query]: list_id: Required'
                    statusCode: 400
              schema:
                oneOf:
                - $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
                - $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
          description: Invalid input data response
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: '[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]'
                    statusCode: 401
              schema:
                $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
          description: Unsuccessful authentication response
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  value:
                    error: Forbidden
                    message: API [POST /api/lists/items/_export?list_id=ips.txt] is unauthorized for user, this action is granted by the Kibana privileges [lists-read]
                    statusCode: 403
              schema:
                $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
          description: Not enough privileges response
        '404':
          content:
            application/json:
              examples:
                notFound:
                  value:
                    message: 'list id: "unknown_list" not found'
                    status_code: 404
              schema:
                $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
          description: List not found response
        '500':
          content:
            application/json:
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
              schema:
                $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
          description: Internal server error response
      summary: Export value list items
      tags:
      - Security Lists API
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/lists/items/_find:
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/lists/items/_find</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Get all value list items in the specified list.'
      operationId: FindListItems
      parameters:
      - description: Parent value list's `id` to page through items for.
        in: query
        name: list_id
        required: true
        schema:
          $ref: '#/components/schemas/Security_Lists_API_ListId'
      - description: The page number to return.
        in: query
        name: page
        required: false
        schema:
          example: 1
          type: integer
      - description: The number of list items to return per page.
        in: query
        name: per_page
        required: false
        schema:
          example: 20
          type: integer
      - description: Determines which field is used to sort the results.
        in: query
        name: sort_field
        required: false
        schema:
          example: value
          format: nonempty
          minLength: 1
          type: string
      - description: Determines the sort order, which can be `desc` or `asc`
        in: query
        name: sort_order
        required: false
        schema:
          enum:
          - desc
          - asc
          example: asc
          type: string
      - description: 'Opaque cursor returned in a previous response; pass it to continue listing from the next page. Omit on the first request.

          '
        in: query
        name: cursor
        required: false
        schema:
          $ref: '#/components/schemas/Security_Lists_API_FindListItemsCursor'
      - description: 'Filters the returned results according to the value of the specified field,

          using the <field name>:<field value> syntax.

          '
        in: query
        name: filter
        required: false
        schema:
          $ref: '#/components/schemas/Security_Lists_API_FindListItemsFilter'
      responses:
        '200':
          content:
            application/json:
              examples:
                ip:
                  value:
                    cursor: WzIwLFsiYjU3Yzc2MmMtMzAzNi00NjVjLTliZmItN2JmYjVlNmU1MTVhIl1d
                    data:
                    - _version: WzAsMV0=
                      '@timestamp': '2025-01-08T04:59:06.154Z'
                      created_at: '2025-01-08T04:59:06.154Z'
                      created_by: elastic
                      id: 21b01cfb-058d-44b9-838c-282be16c91cc
                      list_id: ip_list
                      tie_breaker_id: b57c762c-3036-465c-9bfb-7bfb5e6e515a
                      type: ip
                      updated_at: '2025-01-08T04:59:06.154Z'
                      updated_by: elastic
                      value: 127.0.0.1
                    page: 1
                    per_page: 20
                    total: 1
              schema:
                type: object
                properties:
                  cursor:
                    $ref: '#/components/schemas/Security_Lists_API_FindListItemsCursor'
                  data:
                    items:
                      $ref: '#/components/schemas/Security_Lists_API_ListItem'
                    type: array
                  page:
                    minimum: 0
                    type: integer
                  per_page:
                    minimum: 0
                    type: integer
                  total:
                    minimum: 0
                    type: integer
                required:
                - data
                - page
                - per_page
                - total
                - cursor
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                badRequest:
                  value:
                    error: Bad Request,
                    message: '[request query]: list_id: Required'
                    statusCode: 400,
              schema:
                oneOf:
                - $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
                - $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
          description: Invalid input data response
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: '[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]'
                    statusCode: 401
              schema:
                $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
          description: Unsuccessful authentication response
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  value:
                    error: Forbidden
                    message: API [GET /api/lists/items/_find?list_id=ip_list&page=1&per_page=20] is unauthorized for user, this action is granted by the Kibana privileges [lists-read]
                    statusCode: 403
              schema:
                $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
          description: Not enough privileges response
        '500':
          content:
            application/json:
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
              schema:
                $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
          description: Internal server error response
      summary: Get value list items
      tags:
      - Security Lists API
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/lists/items/_import:
    post:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb post">post</span>&nbsp;<span class="operation-path">/s/{space_id}/api/lists/items/_import</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Import value list items from a TXT or CSV file. The maximum file size is 9 million bytes.


        You can import items to a new or existing list.

        '
      operationId: ImportListItems
      parameters:
      - description: 'List''s id.


          Required when importing to an existing list.

          '
        in: query
        name: list_id
        required: false
        schema:
          $ref: '#/components/schemas/Security_Lists_API_ListId'
      - description: 'Type of the importing list.


          Required when importing a new list whose list `id` is not specified.

          '
        examples:
          ip:
            value: ip
        in: query
        name: type
        required: false
        schema:
          $ref: '#/components/schemas/Security_Lists_API_ListType'
      - description: Determines when changes made by the request are made visible to search.
        in: query
        name: refresh
        required: false
        schema:
          enum:
          - 'true'
          - 'false'
          - wait_for
          example: true
          type: string
      requestBody:
        content:
          multipart/form-data:
            examples:
              ipLinesFile:
                value:
                  file: list_values.txt
            schema:
              type: object
              properties:
                file:
                  description: A `.txt` or `.csv` file containing newline separated list items.
                  example: '127.0.0.1

                    127.0.0.2

                    127.0.0.3

                    127.0.0.4

                    127.0.0.5

                    127.0.0.6

                    127.0.0.7

                    127.0.0.8

                    127.0.0.9

                    '
                  format: binary
                  type: string
        required: true
      responses:
        '200':
          content:
            application/json:
              examples:
                ip:
                  value:
                    _version: WzAsMV0=
                    '@timestamp': '2025-01-08T04:47:34.273Z'
                    created_at: '2025-01-08T04:47:34.273Z'
                    created_by: elastic
                    description: This list describes bad internet ip
                    id: ip_list
                    immutable: false
                    name: Simple list with an ip
                    tie_breaker_id: f5508188-b1e9-4e6e-9662-d039a7d89899
                    type: ip
                    updated_at: '2025-01-08T04:47:34.273Z'
                    updated_by: elastic
                    version: 1
              schema:
                $ref: '#/components/schemas/Security_Lists_API_List'
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                badRequest:
                  value:
                    message: Either type or list_id need to be defined in the query
                    status_code: 400
              schema:
                oneOf:
                - $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
                - $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
          description: Invalid input data response
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: '[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]'
                    statusCode: 401
              schema:
                $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
          description: Unsuccessful authentication response
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  value:
                    error: Forbidden
                    message: API [POST /api/lists/items/_import?list_id=ip_list] is unauthorized for user, this action is granted by the Kibana privileges [lists-all]
                    statusCode: 403
              schema:
                $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
          description: Not enough privileges response
        '409':
          content:
            application/json:
              examples:
                conflict:
                  value:
                    message: List with the specified list_id does not exist, create the list or fix list_id to import to an existing one
                    status_code: 409
              schema:
                $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
          description: List with specified list_id does not exist response
        '500':
          content:
            application/json:
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
              schema:
                $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
          description: Internal server error response
      summary: Import value list items
      tags:
      - Security Lists API
      x-metaTags:
      - content: Kibana
        name: product_name
  /api/lists/privileges:
    get:
      description: '**Spaces method and path for this operation:**


        <div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/lists/privileges</span></div>


        Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.


        Returns the caller''s authentication state and the Elasticsearch `cluster`, `index`, and `application`

        privileges for `.lists` and `.items` data streams in the current Kibana space. Use this to decide which list

        APIs (`read` vs `all` operations) are available before you create or import lists.

        '
      operationId: ReadListPrivileges
      responses:
        '200':
          content:
            application/json:
              examples:
                privileges:
                  value:
                    is_authenticated: true
                    listItems:
                      application: {}
                      cluster:
                        all: true
                        manage: true
                        manage_api_key: true
                        manage_index_templates: true
                        manage_ml: true
                        manage_own_api_key: true
                        manage_pipeline: true
                        manage_security: true
                        manage_transform: true
                        monitor: true
                        monitor_ml: true
                        monitor_transform: true
                      has_all_requested: true
                      index:
                        .items-default:
                          all: true
                          create: true
                          create_doc: true
                          create_index: true
                          delete: true
                          delete_index: true
                          index: true
                          maintenance: true
                          manage: true
                          monitor: true
                          read: true
                          view_index_metadata: true
                          write: true
                      username: elastic
                    lists:
                      application: {}
                      cluster:
                        all: true
                        manage: true
                        manage_api_key: true
                        manage_index_templates: true
                        manage_ml: true
                        manage_own_api_key: true
                        manage_pipeline: true
                        manage_security: true
                        manage_transform: true
                        monitor: true
                        monitor_ml: true
                        monitor_transform: true
                      has_all_requested: true
                      index:
                        .lists-default:
                          all: true
                          create: true
                          create_doc: true
                          create_index: true
                          delete: true
                          delete_index: true
                          index: true
                          maintenance: true
                          manage: true
                          monitor: true
                          read: true
                          view_index_metadata: true
                          write: true
                      username: elastic
              schema:
                type: object
                properties:
                  is_authenticated:
                    type: boolean
                  listItems:
                    $ref: '#/components/schemas/Security_Lists_API_ListItemPrivileges'
                  lists:
                    $ref: '#/components/schemas/Security_Lists_API_ListPrivileges'
                required:
                - lists
                - listItems
                - is_authenticated
          description: Successful response
        '400':
          content:
            application/json:
              examples:
                badRequest:
                  value:
                    error: Bad Request
                    message: 'Unable to resolve list privileges: invalid or missing space context for this request'
                    statusCode: 400
              schema:
                oneOf:
                - $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
                - $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
          description: Invalid input data response
        '401':
          content:
            application/json:
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: '[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]'
                    statusCode: 401
              schema:
                $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
          description: Unsuccessful authentication response
        '403':
          content:
            application/json:
              examples:
                forbidden:
                  value:
                    error: Forbidden
                    message: API [GET /api/lists/privileges] is unauthorized for user, this action is granted by the Kibana privileges [lists-read]
                    statusCode: 403
              schema:
                $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
          description: Not enough privileges response
        '500':
          content:
            application/json:
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
              schema:
                $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
          description: Internal server error response
      summary: Get value list privileges
      tags:
      - Security Lists API
      x-metaTags:
      - content: Kibana
        name: product_name
components:
  schemas:
    Security_Lists_API_FindListsFilter:
      example: value:127.0.0.1
      type: string
    Security_Lists_API_ListMetadata:
      additionalProperties: true
      description: Placeholder for metadata about the value list.
      type: object
    Security_Lists_API_ListName:
      description: Value list's name.
      example: List of bad IPs
      format: nonempty
      minLength: 1
      type: string
    Security_Lists_API_ListId:
      description: Value list's identifier.
      example: 21b01cfb-058d-44b9-838c-282be16c91cd
      format: nonempty
      minLength: 1
      type: string
    Security_Lists_API_ListDescription:
      description: Describes the value list.
      format: nonempty
      minLength: 1
      type: string
    Security_Lists_API_ListItemId:
      description: Value list item's identifier.
      example: 54b01cfb-058d-44b9-838c-282be16c91cd
      format: nonempty
      minLength: 1
      type: string
    Security_Lists_API_ListItemMetadata:
      additionalProperties: true
      description: Placeholder for metadata about the value list item.
      type: object
    Security_Lists_API_ListPrivileges:
      type: object
      properties:
        application:
          additionalProperties:
            type: boolean
          type: object
        cluster:
          additionalProperties:
            type: boolean
          type: object
        has_all_requested:
          type: boolean
        index:
          additionalProperties:
            additionalProperties:
              type: boolean
            type: object
          type: object
        username:
          type: string
      required:
      - username
      - has_all_requested
      - cluster
      - index
      - application
    Security_Lists_API_ListType:
      description: 'Specifies the Elasticsearch data type of excludes the list container holds. Some common examples:


        - `keyword`: Many ECS fields are Elasticsearch keywords

        - `ip`: IP addresses

        - `ip_range`: Range of IP addresses (supports IPv4, IPv6, and CIDR notation)

        '
      enum:
      - binary
      - boolean
      - byte
      - date
      - date_nanos
      - date_range
      - double
      - double_range
      - float
      - float_range
      - geo_point
      - geo_shape
      - half_float
      - integer
      - integer_range
      - ip
      - ip_range
      - keyword
      - long
      - long_range
      - shape
      - short
      - text
      type: string
    Security_Lists_API_FindListItemsCursor:
      description: Returns the items that come after the last item returned in the previous call (use the `cursor` value returned in the previous call). This parameter uses the `tie_breaker_id` field to ensure all items are sorted and returned correctly.
      example: WzIwLFsiYjU3Yzc2MmMtMzAzNi00NjVjLTliZmItN2JmYjVlNmU1MTVhIl1d
      format: nonempty
      minLength: 1
      type: string
    Security_Lists_API_SiemErrorResponse:
      type: object
      properties:
        message:
          type: string
        status_code:
          type: integer
      required:
      - status_code
      - message
    Security_Lists_API_FindListItemsFilter:
      example: value:127.0.0.1
      type: string
    Security_Lists_API_ListItemValue:
      description: The value used to evaluate exceptions.
      format: nonempty
      minLength: 1
      type: string
    Security_Lists_API_ListVersion:
      description: The document version number.
      example: 1
      minimum: 1
      type: integer
    Security_Lists_API_ListItem:
      type: object
      properties:
        _version:
          $ref: '#/components/schemas/Security_Lists_API_ListVersionId'
        '@timestamp':
          example: '2025-01-08T04:47:34.273Z'
          format: date-time
          type: string
        created_at:
          description: Autogenerated date of object creation.
          example: '2025-01-08T04:47:34.273Z'
          format: date-time
          type: string
        created_by:
          description: Autogenerated value - user that created object.
          example: elastic
          type: string
        id:
          $ref: '#/components/schemas/Security_Lists_API_ListItemId'
        list_id:
          $ref: '#/components/schemas/Security_Lists_API_ListId'
        meta:
          $ref: '#/components/schemas/Security_Lists_API_ListItemMetadata'
        tie_breaker_id:
          description: Field used in search to ensure all containers are sorted and returned correctly.
          example: f5508188-b1e9-4e6e-9662-d039a7d89899
          type: string
        type:
          $ref: '#/components/schemas/Security_Lists_API_ListType'
        updated_at:
          description: Autogenerated date of last object update.
          example: '2025-01-08T04:47:34.273Z'
          format: date-time
          type: string
        updated_by:
          description: Autogenerated value - user that last updated object.
          example: elastic
          type: string
        value:
          $ref: '#/components/schemas/Security_Lists_API_ListItemValue'
      required:
      - id
      - type
      - list_id
      - value
      - tie_breaker_id
      - created_at
      - created_by
      - updated_at
      - updated_by
    Security_Lists_API_ListVersionId:
      description: 'The version id, normally returned by the API when the document is retrieved. Use it ensure updates are done against the latest version.

        '
      example: WzIsMV0=
      type: string
    Security_Lists_API_FindListsCursor:
      example: WzIwLFsiYjU3Yzc2MmMtMzAzNi00NjVjLTliZmItN2JmYjVlNmU1MTVhIl1d
      format: nonempty
      minLength: 1
      type: string
    Security_Lists_API_PlatformErrorResponse:
      type: object
      properties:
        error:
          type: string
        message:
          type: string
        statusCode:
          type: integer
      required:
      - statusCode
      - error
      - message
    Security_Lists_API_ListItemPrivileges:
      type: object
      properties:
        application:
          additionalProperties:
            type: boolean
          type: object
        cluster:
          additionalProperties:
            type: boolean
          type: object
        has_all_requested:
          type: boolean
        index:
          additionalProperties:
            additionalProperties:
              type: boolean
            type: object
          type: object
        username:
          type: string
      required:
      - username
      - has_all_requested
      - cluster
      - index
      - application
    Security_Lists_API_List:
      type: object
      properties:
        _version:
          $ref: '#/components/schemas/Security_Lists_API_ListVersionId'
        '@timestamp':
          example: '2025-01-08T04:47:34.273Z'
          format: date-time
          type: string
        created_at:
          description: Autogenerated date of object creation.
          example: '2025-01-08T04:47:34.273Z'
          format: date-time
          type: string
        created_by:
          description: Autogenerated value - user that created object.
          example: elastic
          type: string
        description:
          $ref: '#/components/schemas/Security_Lists_API_ListDescription'
        id:
          $ref: '#/components/schemas/Security_Lists_API_ListId'
        immutable:
          type: boolean
        meta:
          $ref: '#/components/schemas/Security_Lists_API_ListMetadata'
        name:
          $ref: '#/components/schemas/Security_Lists_API_ListName'
        tie_breaker_id:
          description: Field used in search to ensure all containers are sorted and returned correctly.
          example: f5508188-b1e9-4e6e-9662-d039a7d89899
          type: string
        type:
          $ref: '#/components/schemas/Security_Lists_API_ListType'
        updated_at:
          description: Autogenerated date of last object update.
          example: '2025-01-08T04:47:34.273Z'
          format: date-time
          type: string
        updated_by:
          description: Autogenerated value - user that last updated object.
          example: elastic
          type: string
        version:
          $ref: '#/components/schemas/Security_Lists_API_ListVersion'
      required:
      - id
      - type
      - name
      - description
      - immutable
      - version
      - tie_breaker_id
      - created_at
      - created_by
      - updated_at
      - updated_by
  securitySchemes:
    apiKeyAuth:
      description: 'These APIs use key-based authentication. You must create an API key and use the encoded value in the request header. For example: `Authorization: ApiKey base64AccessApiKey`

        '
      in: header
      name: Authorization
      type: apiKey
    basicAuth:
      scheme: basic
      type: http
x-topics:
- title: Kibana spaces
  content: "Spaces enable you to organize your dashboards and other saved objects into meaningful categories.\nYou can use the default space or create your own spaces.\n\nTo run APIs in non-default spaces, you must add `s/{space_id}/` to the path.\nFor example:\n\n```bash\ncurl -X GET \"http://${KIBANA_URL}/s/marketing/api/data_views\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\"\n```\n\nIf you use the Kibana console to send API requests, it automatically adds the appropriate space identifier.\n\nTo learn more, check out [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces).\n"