Show more

Use to navigate results, ENTER to select one, ESC to close

Type in any word to easily find the endpoint, property or group of operations you are looking for.

Elastic APIs hub
  • Elastic Cloud API
  • Elastic Cloud Billing API
  • Elastic Cloud Enterprise API
  • Elastic Cloud Serverless API
  • Elasticsearch API
  • Elasticsearch Serverless API
  • Kibana API
  • Kibana Serverless API
  • Logstash API
  • Observability Intake Serverless API
Back to hub page
Download source
  • JSON OpenAPI specification
  • YAML OpenAPI specification
Feedback
Kibana API logo Kibana API logo dark
main
  • main default
  • v8
  • v9

Topics

  • Introduction
  • Authentication
  • Kibana spaces

Endpoints

  • Agent Builder
    • Send A2A task POST
    • Get A2A agent card GET
    • List agents GET
    • Create an agent POST
    • Get an agent by ID GET
    • Update an agent PUT
    • Delete an agent DELETE
    • List conversations GET
    • Get conversation by ID GET
    • Delete conversation by ID DELETE
    • Send chat message POST
    • Send chat message (streaming) POST
    • MCP server POST
    • List tools GET
    • Create a tool POST
    • Execute a Tool POST
    • Get a tool by id GET
    • Update a tool PUT
    • Delete a tool DELETE
  • Alerting
    • Get the alerting framework health GET
    • Get the rule types GET
    • Get rule details GET
    • Update a rule PUT
    • Create a rule POST
    • Delete a rule DELETE
    • Disable a rule POST
    • Enable a rule POST
    • Mute all alerts POST
    • Unmute all alerts POST
    • Update the API key for a rule POST
    • Schedule a snooze for the rule POST
    • Mute an alert POST
    • Unmute an alert POST
    • Delete a snooze schedule for a rule DELETE
    • Get information about rules GET
  • APM agent configuration
    • Get a list of agent configurations GET
    • Create or update agent configuration PUT
    • Delete agent configuration DELETE
    • Get agent name for service GET
    • Get environments for service GET
    • Lookup single agent configuration POST
    • Get single agent configuration GET
  • APM agent keys
    • Create an APM agent key POST
  • APM annotations
    • Create a service annotation POST
    • Search for annotations GET
  • APM server schema
    • Save APM server schema POST
  • APM sourcemaps
    • Get source maps GET
    • Upload a source map POST
    • Delete source map DELETE
  • Cases
    • Create a case POST
    • Delete cases DELETE
    • Update cases PATCH
    • Search cases GET
    • Get case information GET
    • Get all alerts for a case GET
    • Add a case comment or alert POST
    • Delete all case comments and alerts DELETE
    • Update a case comment or alert PATCH
    • Find case comments and alerts GET
    • Get a case comment or alert GET
    • Delete a case comment or alert DELETE
    • Push a case to an external service POST
    • Attach a file to a case POST
    • Find case activity GET
    • Get cases for an alert GET
    • Get case settings GET
    • Add case settings POST
    • Update case settings PATCH
    • Get case connectors GET
    • Get case creators GET
    • Get case tags GET
  • Connectors
    • Get connector types GET
    • Get connector information GET
    • Update a connector PUT
    • Create a connector POST
    • Delete a connector DELETE
    • Run a connector POST
    • Get all connectors GET
  • Data streams
    • Get data streams GET
    • Get data streams GET
  • Data views
    • Get all data views GET
    • Create a data view POST
    • Get a data view GET
    • Update a data view POST
    • Delete a data view DELETE
    • Update data view fields metadata POST
    • Create or update a runtime field PUT
    • Create a runtime field POST
    • Get a runtime field GET
    • Update a runtime field POST
    • Delete a runtime field from a data view DELETE
    • Get the default data view GET
    • Set the default data view POST
    • Swap saved object references POST
    • Preview a saved object reference swap POST
  • Elastic Agent actions
    • Create an agent action POST
    • Reassign an agent POST
    • Request agent diagnostics POST
    • Unenroll an agent POST
    • Upgrade an agent POST
    • Get an agent action status GET
    • Cancel an agent action POST
    • Bulk reassign agents POST
    • Bulk request diagnostics from agents POST
    • Bulk unenroll agents POST
    • Bulk update agent tags POST
    • Bulk upgrade agents POST
  • Elastic Agent binary download sources
    • Get agent binary download sources GET
    • Create an agent binary download source POST
    • Get an agent binary download source GET
    • Update an agent binary download source PUT
    • Delete an agent binary download source DELETE
  • Elastic Agent policies
    • Get agent policies GET
    • Create an agent policy POST
    • Bulk get agent policies POST
    • Get an agent policy GET
    • Update an agent policy PUT
    • Get auto upgrade agent status GET
    • Copy an agent policy POST
    • Download an agent policy GET
    • Get a full agent policy GET
    • Get outputs for an agent policy GET
    • Delete an agent policy POST
    • Get outputs for agent policies POST
    • Get a full K8s agent manifest GET
    • Download an agent manifest GET
  • Elastic Agent status
    • Get an agent status summary GET
  • Elastic Agents
    • Get incoming agent data GET
    • Get agents GET
    • Get agents by action ids POST
    • Get an agent GET
    • Update an agent by ID PUT
    • Delete an agent DELETE
    • Migrate a single agent POST
    • Get agent uploads GET
    • Get available agent versions GET
    • Migrate multiple agents POST
    • Delete an uploaded file DELETE
    • Get an uploaded file GET
    • Get agent setup info GET
    • Initiate agent setup POST
    • Get agent tags GET
  • Elastic Package Manager (EPM)
    • Bulk get assets POST
    • Get package categories GET
    • Create a custom integration POST
    • Update a custom integration PUT
    • Get packages GET
    • Install a package by upload POST
    • Bulk install packages POST
    • Bulk rollback packages POST
    • Get Bulk rollback packages details GET
    • Bulk uninstall packages POST
    • Get Bulk uninstall packages details GET
    • Bulk upgrade packages POST
    • Get Bulk upgrade packages details GET
    • Get a package GET
    • Update package settings PUT
    • Install a package from the registry POST
    • Delete a package DELETE
    • Get a package file GET
    • Delete assets for an input package DELETE
    • Install Kibana assets for a package POST
    • Delete Kibana assets for a package DELETE
    • Install Kibana alert rule for a package POST
    • Authorize transforms POST
    • Rollback a package to previous version POST
    • Get package stats GET
    • Get installed packages GET
    • Get a limited package list GET
    • Get an inputs template GET
    • Get a package signature verification key ID GET
  • Fleet agentless policies
    • Create an agentless policy POST
    • Delete an agentless policy DELETE
  • Fleet cloud connectors
    • Get cloud connectors GET
    • Create cloud connector POST
    • Get cloud connector GET
    • Update cloud connector PUT
    • Delete cloud connector (supports force deletion) DELETE
  • Fleet enrollment API keys
    • Get enrollment API keys GET
    • Create an enrollment API key POST
    • Get an enrollment API key GET
    • Revoke an enrollment API key DELETE
  • Fleet internals
    • Check permissions GET
    • Check Fleet Server health POST
    • Get settings GET
    • Update settings PUT
    • Initiate Fleet setup POST
  • Fleet outputs
    • Generate a Logstash API key POST
    • Get outputs GET
    • Create output POST
    • Get output GET
    • Update output PUT
    • Delete output DELETE
    • Get the latest output health GET
  • Fleet package policies
    • Get package policies GET
    • Create a package policy POST
    • Bulk get package policies POST
    • Get a package policy GET
    • Update a package policy PUT
    • Delete a package policy DELETE
    • Bulk delete package policies POST
    • Upgrade a package policy POST
    • Dry run a package policy upgrade POST
  • Fleet proxies
    • Get proxies GET
    • Create a proxy POST
    • Get a proxy GET
    • Update a proxy PUT
    • Delete a proxy DELETE
  • Fleet remote synced integrations
    • Get remote synced integrations status by outputId GET
    • Get remote synced integrations status GET
  • Fleet Server hosts
    • Get Fleet Server hosts GET
    • Create a Fleet Server host POST
    • Get a Fleet Server host GET
    • Update a Fleet Server host PUT
    • Delete a Fleet Server host DELETE
  • Fleet service tokens
    • Create a service token POST
  • Fleet uninstall tokens
    • Get metadata for latest uninstall tokens GET
    • Get a decrypted uninstall token GET
  • Logstash configuration management
    • Get a Logstash pipeline GET
    • Create or update a Logstash pipeline PUT
    • Delete a Logstash pipeline DELETE
    • Get all Logstash pipelines GET
  • Maintenance windows
    • Create a maintenance window. POST
    • Search for a maintenance window. GET
    • Get maintenance window details. GET
    • Delete a maintenance window. DELETE
    • Update a maintenance window. PATCH
    • Archive a maintenance window. POST
    • Unarchive a maintenance window. POST
  • Fleet Message Signing Service
    • Rotate a Fleet message signing key pair POST
  • Machine learning
    • Sync saved objects in the default space GET
    • Update jobs spaces POST
    • Update trained models spaces POST
  • Observability AI Assistant
    • Generate a chat completion POST
  • Roles
    • Get all roles GET
    • Get a role GET
    • Create or update a role PUT
    • Delete a role DELETE
    • Create or update roles POST
  • Saved objects
    • Rotate a key for encrypted saved objects POST
    • Create saved objects POST
    • Delete saved objects POST
    • Get saved objects POST
    • Resolve saved objects POST
    • Update saved objects POST
    • Export saved objects POST
    • Search for saved objects GET
    • Import saved objects POST
    • Resolve import errors POST
    • Create a saved object POST
    • Get a saved object GET
    • Update a saved object PUT
    • Create a saved object POST
    • Resolve a saved object GET
  • Security AI assistant
    • Apply a bulk action to anonymization fields POST
    • Get anonymization fields GET
    • Create a model response POST
    • Create a conversation POST
    • Delete conversations DELETE
    • Get conversations GET
    • Get a conversation GET
    • Update a conversation PUT
    • Delete a conversation DELETE
    • Read a KnowledgeBase GET
    • Create a KnowledgeBase POST
    • Read a KnowledgeBase for a resource GET
    • Create a KnowledgeBase for a resource POST
    • Create a Knowledge Base Entry POST
    • Applies a bulk action to multiple Knowledge Base Entries POST
    • Finds Knowledge Base Entries that match the given query. GET
    • Read a Knowledge Base Entry GET
    • Update a Knowledge Base Entry PUT
    • Deletes a single Knowledge Base Entry using the `id` field DELETE
    • Apply a bulk action to prompts POST
    • Get prompts GET
  • Security Attack discovery
    • Bulk update Attack discoveries POST
    • Find Attack discoveries that match the search criteria GET
    • Generate attack discoveries from alerts POST
    • Get the latest attack discovery generations metadata for the current user GET
    • Get a single Attack discovery generation, including its discoveries and (optional) generation metadata GET
    • Dismiss an attack discovery generation POST
    • Create Attack discovery schedule POST
    • Finds Attack discovery schedules that match the search criteria GET
    • Get Attack discovery schedule by ID GET
    • Update Attack discovery schedule PUT
    • Delete Attack discovery schedule DELETE
    • Disable Attack discovery schedule POST
    • Enable Attack discovery schedule POST
  • Security detections
    • Reads the alert index name if it exists GET
    • Create an alerts index POST
    • Delete an alerts index DELETE
    • Returns user privileges for the Kibana space GET
    • Retrieve a detection rule GET
    • Update a detection rule PUT
    • Create a detection rule POST
    • Delete a detection rule DELETE
    • Patch a detection rule PATCH
    • Apply a bulk action to detection rules POST
    • Export detection rules POST
    • List all detection rules GET
    • Import detection rules POST
    • Install prebuilt detection rules and Timelines PUT
    • Retrieve the status of prebuilt detection rules and Timelines GET
    • Preview rule alerts generated on specified time range POST
    • Assign and unassign users from detection alerts POST
    • Finalize detection alert migrations POST
    • Initiate a detection alert migration POST
    • Clean up detection alert migrations DELETE
    • Retrieve the status of detection alert migrations GET
    • Find and/or aggregate detection alerts POST
    • Set a detection alert status POST
    • Add and remove detection alert tags POST
    • List all detection rule tags GET
  • Security Elastic Endpoint exceptions
    • Create an Elastic Endpoint rule exception list POST
    • Get an Elastic Endpoint rule exception list item GET
    • Update an Elastic Endpoint rule exception list item PUT
    • Create an Elastic Endpoint rule exception list item POST
    • Delete an Elastic Endpoint exception list item DELETE
    • Get Elastic Endpoint exception list items GET
  • Security endpoint management
    • Get response actions GET
    • Get response actions status GET
    • Get action details GET
    • Get file information GET
    • Download a file GET
    • Cancel a response action POST
    • Run a command POST
    • Get a file POST
    • Isolate an endpoint POST
    • Terminate a process POST
    • Get running processes POST
    • Run a script POST
    • Scan a file or directory POST
    • Get actions state GET
    • Suspend a process POST
    • Release an isolated endpoint POST
    • Upload a file POST
    • Get a metadata list GET
    • Get metadata GET
    • Get a policy response GET
    • Get a protection updates note GET
    • Create or update a protection updates note POST
  • Security entity analytics
    • Get an asset criticality record GET
    • Upsert an asset criticality record POST
    • Delete an asset criticality record DELETE
    • Bulk upsert asset criticality records POST
    • List asset criticality records GET
    • Delete the Privilege Monitoring Engine DELETE
    • Disable the Privilege Monitoring Engine POST
    • Initialize the Privilege Monitoring Engine POST
    • Schedule the Privilege Monitoring Engine POST
    • Health check on Privilege Monitoring GET
    • Run a privileges check on Privilege Monitoring GET
    • Create a new monitored user POST
    • Upsert multiple monitored users via CSV upload POST
    • Update a monitored user PUT
    • Delete a monitored user DELETE
    • List all monitored users GET
    • Installs the privileged access detection package for the Entity Analytics privileged user monitoring experience POST
    • Gets the status of the privileged access detection package for the Entity Analytics privileged user monitoring experience GET
    • Initialize the Entity Store POST
    • List the Entity Engines GET
    • Delete Entity Engines DELETE
    • Get an Entity Engine GET
    • Delete the Entity Engine DELETE
    • Initialize an Entity Engine POST
    • Start an Entity Engine POST
    • Stop an Entity Engine POST
    • Apply DataView indices to all installed engines POST
    • Upsert an entity in Entity Store PUT
    • Delete an entity in Entity Store DELETE
    • Upsert many entities in Entity Store PUT
    • List Entity Store Entities GET
    • Get the status of the Entity Store GET
    • Cleanup the Risk Engine DELETE
    • Configure the Risk Engine Saved Object PATCH
    • Run the risk scoring engine POST
  • Security exceptions
    • Create rule exception items POST
    • Get exception list details GET
    • Update an exception list PUT
    • Create an exception list POST
    • Delete an exception list DELETE
    • Duplicate an exception list POST
    • Export an exception list POST
    • Get exception lists GET
    • Import an exception list POST
    • Get an exception list item GET
    • Update an exception list item PUT
    • Create an exception list item POST
    • Delete an exception list item DELETE
    • Get exception list items GET
    • Get an exception list summary GET
    • Create a shared exception list POST
  • Security lists
    • Get value list details GET
    • Update a value list PUT
    • Create a value list POST
    • Delete a value list DELETE
    • Patch a value list PATCH
    • Get value lists GET
    • Get status of value list data streams GET
    • Create list data streams POST
    • Delete value list data streams DELETE
    • Get a value list item GET
    • Update a value list item PUT
    • Create a value list item POST
    • Delete a value list item DELETE
    • Patch a value list item PATCH
    • Export value list items POST
    • Get value list items GET
    • Import value list items POST
    • Get value list privileges GET
  • Security Osquery
    • Get live queries GET
    • Create a live query POST
    • Get live query details GET
    • Get live query results GET
    • Get packs GET
    • Create a pack POST
    • Get pack details GET
    • Update a pack PUT
    • Delete a pack DELETE
    • Get saved queries GET
    • Create a saved query POST
    • Get saved query details GET
    • Update a saved query PUT
    • Delete a saved query DELETE
  • Security timeline
    • Get notes GET
    • Delete a note DELETE
    • Add or update a note PATCH
    • Pin/unpin an event PATCH
    • Get Timeline or Timeline template details GET
    • Create a Timeline or Timeline template POST
    • Delete Timelines or Timeline templates DELETE
    • Update a Timeline PATCH
    • Copies timeline or timeline template GET
    • Get draft Timeline or Timeline template details GET
    • Create a clean draft Timeline or Timeline template POST
    • Export Timelines POST
    • Favorite a Timeline or Timeline template PATCH
    • Import Timelines POST
    • Install prepackaged Timelines POST
    • Get an existing saved Timeline or Timeline template GET
    • Get Timelines or Timeline templates GET
  • Short URLs
    • Create a short URL POST
    • Resolve a short URL GET
    • Get a short URL GET
    • Delete a short URL DELETE
  • Service level objectives
    • Get a paginated list of SLOs GET
    • Create an SLO POST
    • Bulk delete SLO definitions and their associated summary and rollup data. POST
    • Retrieve the status of the bulk deletion GET
    • Batch delete rollup and summary data POST
    • Batch delete rollup and summary data POST
    • Get an SLO GET
    • Update an SLO PUT
    • Delete an SLO DELETE
    • Reset an SLO POST
    • Disable an SLO POST
    • Enable an SLO POST
    • Get the SLO definitions GET
  • Spaces
    • Copy saved objects between spaces POST
    • Disable legacy URL aliases POST
    • Get shareable references POST
    • Update saved objects in spaces POST
    • Get all spaces GET
    • Create a space POST
    • Get a space GET
    • Update a space PUT
    • Delete a space DELETE
  • Streams
    • Get stream list GET
    • Disable streams POST
    • Enable streams POST
    • Resync streams POST
    • Get a stream GET
    • Create or update a stream PUT
    • Delete a stream DELETE
    • Fork a stream POST
    • Get group stream settings GET
    • Upsert group stream settings PUT
    • Get ingest stream settings GET
    • Update ingest stream settings PUT
    • Export stream content POST
    • Import content into a stream POST
    • Get stream dashboards GET
    • Bulk update dashboards POST
    • Link a dashboard to a stream PUT
    • Unlink a dashboard from a stream DELETE
    • Get stream queries GET
    • Bulk update queries POST
    • Upsert a query to a stream PUT
    • Remove a query from a stream DELETE
    • Get stream rules GET
    • Link a rule to a stream PUT
    • Unlink a rule from a stream DELETE
    • Read the significant events GET
    • Generate significant events POST
    • Preview significant events POST
    • Get stream attachments GET
    • Bulk update attachments POST
    • Link an attachment to a stream PUT
    • Unlink an attachment from a stream DELETE
  • Synthetics
    • Trigger an on-demand test run for a monitor POST
    • Get monitors GET
    • Create a monitor POST
    • Delete monitors POST
    • Get a monitor GET
    • Update a monitor PUT
    • Delete a monitor DELETE
    • Get parameters GET
    • Add parameters POST
    • Delete parameters DELETE
    • Get a parameter GET
    • Update a parameter PUT
    • Delete a parameter DELETE
    • Get private locations GET
    • Create a private location POST
    • Get a private location GET
    • Update a private location PUT
    • Delete a private location DELETE
  • System
    • Get features GET
    • Get Kibana's current status GET
  • Task manager
    • Get the task manager health GET
  • Upgrade assistant
    • Get the upgrade readiness status GET
  • Uptime
    • Get uptime settings GET
    • Update uptime settings PUT
  • User session management
    • Invalidate user sessions POST
Powered by Bump.sh
Elastic APIs hub
  • Elastic Cloud API
  • Elastic Cloud Billing API
  • Elastic Cloud Enterprise API
  • Elastic Cloud Serverless API
  • Elasticsearch API
  • Elasticsearch Serverless API
  • Kibana API
  • Kibana Serverless API
  • Logstash API
  • Observability Intake Serverless API
Back to hub page
Download source
  • JSON OpenAPI specification
  • YAML OpenAPI specification
Feedback
Kibana API logo Kibana API logo dark

Alerting

Alerting enables you to define rules, which detect complex conditions within your data. When a condition is met, the rule tracks it as an alert and runs the actions that are defined in the rule. Actions typically involve the use of connectors to interact with Kibana services or third party integrations.

Alerting documentation
Operations quick access
GET /api/alerting/_health GET /api/alerting/rule_types GET /api/alerting/rule/{id} PUT /api/alerting/rule/{id} POST /api/alerting/rule/{id} DELETE /api/alerting/rule/{id} POST /api/alerting/rule/{id}/_disable POST /api/alerting/rule/{id}/_enable POST /api/alerting/rule/{id}/_mute_all POST /api/alerting/rule/{id}/_unmute_all POST /api/alerting/rule/{id}/_update_api_key POST /api/alerting/rule/{id}/snooze_schedule POST /api/alerting/rule/{rule_id}/alert/{alert_id}/_mute POST /api/alerting/rule/{rule_id}/alert/{alert_id}/_unmute DELETE /api/alerting/rule/{ruleId}/snooze_schedule/{scheduleId} GET /api/alerting/rules/_find