# Kibana integration

> Kibana by Elastic REST API: manage data views, saved objects, dashboards, alerting rules, connectors, cases, spaces, SLOs, Fleet, and Elastic Security on a self-managed or Elastic Cloud Kibana.

- Authentication: apiKey

## Tools (719)

- **Acknowledge an alert episode**: Create an action for a specific alert episode.[Required authorization] Route required privileges: manage_alerting-v2-alerts.
- **Activate an alert episode**: Create an action for a specific alert episode.[Required authorization] Route required privileges: manage_alerting-v2-alerts.
- **Add a case comment or alert**: You must have `all` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the case you're creating.
- **Add and remove attack discovery alert tags**: Add tags to attack discovery alerts, and remove them from alerts, by attack IDs in a single request.
- **Add and remove detection alert tags**: Add tags to detection alerts, and remove them from alerts, by alert IDs or a query, in a single request.
- **Add case settings**: Case settings include external connection details, custom fields, and templates.
- **Add events to a conversation**: Append custom events to a conversation's timeline.
- **Add or update a note**: Creates a new note or updates an existing one.
- **Add parameters**: Add one or more parameters to the Synthetics app.
- **Applies a bulk action to multiple Knowledge Base Entries**: The bulk action is applied to all Knowledge Base Entries that match the filter or to the list of Knowledge Base Entries by their IDs.
- **Apply a bulk action to anonymization fields**: Apply a bulk action to multiple anonymization fields.
- **Apply a bulk action to detection rules**: Apply a bulk action, such as bulk edit, duplicate, or delete, to multiple detection rules.
- **Apply a bulk action to prompts**: Apply a bulk action to multiple prompts.
- **Archive a maintenance window.**: [Required authorization] Route required privileges: write-maintenance-window.
- **Assign an alert episode to a user**: Create an action for a specific alert episode.[Required authorization] Route required privileges: manage_alerting-v2-alerts.
- **Assign and unassign users from attack discovery alerts**: Assign users to attack discovery alerts, and unassign them from alerts.
- **Assign and unassign users from detection alerts**: Assign users to detection alerts, and unassign them from alerts.
- **Attach a file to a case**: Attach a file to a case.
- **Authorize transforms**: Reauthorize Elasticsearch transforms installed by a package with secondary authorization headers.
- **Batch delete rollup and summary data (POST /s/{spaceId}/api/observability/slos/_delete_instances)**: The deletion occurs for the specified list of `sloId` and `instanceId`.
- **Batch delete rollup and summary data (slo)**: The deletion occurs for the specified list of `sloId`.
- **Bulk acknowledge alert episodes**: Create the same action for multiple alert episodes in a single request.[Required authorization] Route required privileges: manage_alerting-v2-alerts.
- **Bulk activate alert episodes**: Create the same action for multiple alert episodes in a single request.[Required authorization] Route required privileges: manage_alerting-v2-alerts.
- **Bulk assign alert episodes**: Create the same action for multiple alert episodes in a single request.[Required authorization] Route required privileges: manage_alerting-v2-alerts.
- **Bulk change agent privilege level**: Change multiple agents' privilege level to unprivileged.[Required authorization] Route required privileges: fleet-agents-all.
- **Bulk create monitors**: Create up to 1000 monitors in one request.
- **Bulk create workflows**: Create multiple workflows in a single request.
- **Bulk deactivate alert episodes**: Create the same action for multiple alert episodes in a single request.[Required authorization] Route required privileges: manage_alerting-v2-alerts.
- **Bulk delete Attack Discovery schedules**: Deletes multiple Attack Discovery schedules by ID.
- **Bulk delete package policies**: Delete multiple package policies by ID.[Required authorization] Route required privileges: fleet-agent-policies-all AND integrations-all.
- **Bulk delete SLO definitions and their associated summary and rollup data.**: Bulk delete SLO definitions and their associated summary and rollup data.
- **Bulk delete workflows**: Delete multiple workflows by their IDs.[Required authorization] Route required privileges: workflowsManagement:delete.
- **Bulk disable Attack Discovery schedules**: Disables multiple Attack Discovery schedules by ID.
- **Bulk enable Attack Discovery schedules**: Enables multiple Attack Discovery schedules by ID.
- **Bulk enable/disable namespace-level customization for packages**: Enable or disable namespace-level index template customization for a list of packages in one call.
- **Bulk get agent policies**: Get multiple agent policies by ID.[Required authorization] Route required privileges: fleet-agent-policies-read OR fleet-agents-read OR fleet-setup.
- **Bulk get assets**: Retrieve multiple Kibana saved object assets by their IDs and types.[Required authorization] Route required privileges: integrations-read OR fleet-setup OR fleet-all.
- **Bulk get package policies**: Get multiple package policies by ID.
- **Bulk install packages**: Install multiple packages from the Elastic Package Registry in a single request.[Required authorization] Route required privileges: integrations-all AND fleet-agent-policies-all.
- **Bulk reassign agents**: Reassign multiple agents to a different agent policy.[Required authorization] Route required privileges: fleet-agents-all.
- **Bulk remove OpAMP collectors**: Remove multiple OpAMP collectors from the Fleet agents list.
- **Bulk request diagnostics from agents**: Request diagnostics bundles from multiple agents.[Required authorization] Route required privileges: fleet-agents-read.
- **Bulk restart agents**: Restart multiple Elastic Agents.
- **Bulk revoke or delete enrollment API keys**: Revoke or delete multiple enrollment API keys.[Required authorization] Route required privileges: fleet-agents-all.
- **Bulk rollback agents**: Rollback multiple agents to the previous version.[Required authorization] Route required privileges: fleet-agents-all.
- **Bulk rollback packages**: Rollback multiple packages to their previous versions.[Required authorization] Route required privileges: integrations-all AND fleet-agent-policies-all.
- **Bulk tag alert episodes**: Create the same action for multiple alert episodes in a single request.[Required authorization] Route required privileges: manage_alerting-v2-alerts.
- **Bulk unacknowledge alert episodes**: Create the same action for multiple alert episodes in a single request.[Required authorization] Route required privileges: manage_alerting-v2-alerts.
- **Bulk unenroll agents**: Unenroll multiple agents, optionally revoking their enrollment API keys.[Required authorization] Route required privileges: fleet-agents-all.
- **Bulk uninstall packages**: Uninstall multiple packages in a single operation.[Required authorization] Route required privileges: integrations-all AND fleet-agent-policies-all.
- **Bulk update agent tags**: Add or remove tags across multiple agents.[Required authorization] Route required privileges: fleet-agents-all.
- **Bulk update attachments**: Bulk update attachments linked to a stream.
- **Bulk update Attack discoveries**: Performs bulk updates on multiple Attack discoveries, including workflow status changes and visibility settings.
- **Bulk update entities**: Update multiple entity records in the Entity Store in a single request.[Required authorization] Route required privileges: securitySolution.
- **Bulk update monitors**: Partially update multiple monitors in a single request.
- **Bulk upgrade agents**: Upgrade multiple agents to a newer version, with optional rollout controls.[Required authorization] Route required privileges: fleet-agents-all.
- **Bulk upgrade managed integrations**: Upgrade multiple managed integrations to their installed package version, migrating each package policy's config onto the new schema.
- **Bulk upgrade packages**: Upgrade multiple packages to their latest versions.[Required authorization] Route required privileges: integrations-all AND fleet-agent-policies-all.
- **Cancel all active workflow executions**: Request cancellation for all non-terminal executions of the given workflow in the current space.[Required authorization] Route required privileges: workflowsManagement:cancelExecution.
- **Cancel an agent action**: Cancel a pending action for a specific agent.[Required authorization] Route required privileges: fleet-agents-all.
- **Cancel a response action**: Cancel a running or pending response action (Applies only to some agent types).
- **Cancel a workflow execution**: Cancel a running workflow execution by its ID.[Required authorization] Route required privileges: workflowsManagement:cancelExecution.
- **Cancel snooze for action policies in bulk by ID**: [Required authorization] Route required privileges: manage_alerting-v2-action-policies.
- **Change agent privilege level**: Change the privilege level of a single agent to unprivileged.[Required authorization] Route required privileges: fleet-agents-all.
- **Check attachment staleness**: Checks staleness for the latest version of all conversation attachments against their origin snapshot.[Required authorization] Route required privileges: agentBuilder:read.
- **Check Fleet Server health**: Check the health status of a Fleet Server instance by its host ID.
- **Check if data streams have data**: Check whether one or more data stream index patterns contain any documents indexed at or after the given start time.[Required authorization] Route required privileges: fleet-read.
- **Check permissions**: Check whether the current user has the required permissions to use Fleet.
- **Cleanup the Risk Engine**: Cleaning up the the Risk Engine by removing the indices, mapping and transforms
- **Clone a workflow**: Create a copy of an existing workflow.[Required authorization] Route required privileges: workflowsManagement:create AND workflowsManagement:read.
- **Compute an SLO instance summary at a point in time**: Compute the summary of an SLO at a given point in time.
- **Compute SLO instance summaries in bulk at a point in time**: Compute the summary of multiple SLO instances at a given point in time.
- **Configure the Risk Engine Saved Object**: Configuring the Risk Engine Saved Object
- **Copies timeline or timeline template**: Copies and returns a timeline or timeline template.
- **Copy an agent policy**: Copy an agent policy by ID.[Required authorization] Route required privileges: fleet-agent-policies-all.
- **Copy a pack**: Create a copy of a query pack with a unique name by appending a `_copy` suffix.
- **Copy a saved query**: Create a copy of a saved query with a unique name by appending a `_copy` suffix.
- **Copy saved objects between spaces**: It also allows you to automatically copy related objects, so when you copy a dashboard, this can automatically copy over the associated visualizations, data views, and saved Discover sessions, as required.
- **Create a case**: You must have `all` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the case you're creating.
- **Create a case template**: Creates a case template from a YAML definition.
- **Create a clean draft Timeline or Timeline template**: Create a clean draft Timeline or Timeline template for the current user.
- **Create a connector**: Create a connector
- **Create a conversation**: Create a new Security AI Assistant conversation.
- **Create a custom integration**: Create a new custom integration package with user-defined data streams.[Required authorization] Route required privileges: integrations-all AND fleet-agent-policies-all.
- **Create a dashboard**: Creates a new dashboard and returns its ID, full state, and metadata.
- **Create a data view**: Create a data view.
- **Create a detection rule**: Refer to Spaces for more information.
- **Create a field definition**: Creates a field definition in the field library.
- **Create a Fleet Server host**: Create a new Fleet Server host.[Required authorization] Route required privileges: fleet-settings-all.
- **Create a KnowledgeBase**: Create a knowledge base.
- **Create a Knowledge Base Entry**: Create a Knowledge Base Entry
- **Create a KnowledgeBase for a resource**: Create a knowledge base with a specific resource identifier.
- **Create a links library item**: Creates a new links library item and returns its ID, full state, and metadata.
- **Create a live query**: Create and run a live query.
- **Create a maintenance window.**: [Required authorization] Route required privileges: write-maintenance-window.
- **Create a managed integration**: Create a managed integration
- **Create a markdown library item**: Creates a new markdown library item and returns its ID, full state, and metadata.
- **Create a model response**: Create a model response for the given chat conversation.
- **Create a monitor**: Create a new monitor with the specified attributes.
- **Create an action policy**: Creates an action policy with a server-generated identifier.
- **Create an agent**: Create a new agent.
- **Create an agent action**: Create a new action for a specific agent.[Required authorization] Route required privileges: fleet-agents-all.
- **Create an agent binary download source**: Create a new agent binary download source.[Required authorization] Route required privileges: fleet-settings-all.
- **Create an agent policy**: Create a new agent policy.[Required authorization] Route required privileges: fleet-agent-policies-all.
- **Create an AI Index**: Creates an AI Index record attached to a data stream or index.
- **Create an alerts index**: Creates an index for Elastic Security alerts.
- **Create an APM agent key**: Create a new agent key for APM.
- **Create an Elastic Endpoint rule exception list**: Create the exception list for Elastic Endpoint rule exceptions.
- **Create an Elastic Endpoint rule exception list item**: Create an Elastic Endpoint exception list item, and associate it with the Elastic Endpoint exception list.
- **Create an enrollment API key**: Create an enrollment API key for a given agent policy.[Required authorization] Route required privileges: fleet-agents-all.
- **Create an entity**: Create a new entity record in the Entity Store for the specified entity type.[Required authorization] Route required privileges: securitySolution.
- **Create a new watchlist**: Creates a new entity analytics watchlist with an optional set of entity sources.
- **Create an exception list**: An exception list groups exception items and can be associated with detection rules.
- **Create an exception list item**: Create an exception item and associate it with the specified exception list.
- **Create an SLO**: You must have `all` privileges for the **SLOs** feature in the **Observability** section of the Kibana feature privileges.
- **Create a pack**: Create a query pack.
- **Create a package policy**: Create a new package policy and assign it to an agent policy.
- **Create a private location**: You must have `all` privileges for the Synthetics and Uptime feature in the Observability section of the Kibana feature privileges.
- **Create a proxy**: Create a new Fleet proxy.[Required authorization] Route required privileges: fleet-settings-all.
- **Create a rule (alerting)**: Create a rule (alerting)
- **Create a rule (alerting-v2)**: Creates a rule with a server-generated identifier.
- **Create a runtime field**: Create a runtime field for a data view.
- **Create a saved query**: Create and save a query for later use.
- **Create a service annotation**: Create a new annotation for a specific service.
- **Create a service token**: Create a Fleet Server service token.
- **Create a shared exception list**: An exception list groups exception items and can be associated with detection rules.
- **Create a short URL**: Kibana URLs may be long and cumbersome, short URLs are much easier to remember and share.
- **Create a skill**: Create a new user-defined skill.
- **Create a space**: Create a new Kibana space.
- **Create a tag**: Creates a new tag and returns it.
- **Create a Timeline or Timeline template**: Create a new Timeline or Timeline template.
- **Create a tool**: Create a new tool.
- **Create Attack Discovery schedule**: Creates a new Attack Discovery schedule that analyzes security alerts at specified intervals.
- **Create a value list**: Create a new value list.
- **Create a value list item**: Create a value list item and associate it with the specified value list.
- **Create a workflow**: Create a new workflow from a YAML definition.
- **Create cloud connector**: Create a new Fleet cloud connector.[Required authorization] Route required privileges: fleet-agent-policies-all OR integrations-all.
- **Create cloud onboarding deployment**: Create a new Fleet cloud onboarding deployment.[Required authorization] Route required privileges: fleet-agent-policies-all OR integrations-all.
- **Create conversation**: Create an empty conversation without sending a message.
- **Create conversation attachment**: Create a new attachment for a conversation with version tracking.[Required authorization] Route required privileges: agentBuilder:read.
- **Create or replace an action policy**: Creates an action policy with the given identifier, or fully replaces it if one already exists.[Required authorization] Route required privileges: manage_alerting-v2-action-policies AND read_alerting-v2-rules.
- **Create or replace a rule**: Creates a rule with the given identifier, or fully replaces it if one already exists.[Required authorization] Route required privileges: manage_alerting-v2-rules.
- **Create or update agent configuration**: Create or update an agent configuration.
- **Create or update a Logstash pipeline**: Create a centrally-managed Logstash pipeline or update a pipeline.
- **Create or update an AI Index**: Creates an AI Index with the given ID, or replaces an existing one.
- **Create or update a protection updates note**: Create or update the protection updates note for a package policy.
- **Create or update a role**: Create a new Kibana role or update the attributes of an existing role.
- **Create or update a runtime field**: Create or update a runtime field for a data view.
- **Create or update a stream**: Creates or updates a stream definition.
- **Create or update roles**: Create or update multiple Kibana roles in a single request.
- **Create output**: Create a new Fleet output.[Required authorization] Route required privileges: fleet-settings-all.
- **Create rule exception items**: Create exception items that apply to a single detection rule.
- **Create rules in bulk**: Creates up to 100 rules in a single request.
- **Create script**: Create a new script entry by uploading a script file
- **Create space settings**: Create or update Fleet settings for the current Kibana space.[Required authorization] Route required privileges: fleet-settings-all.
- **Create visualization**: Creates a Lens visualization and saves it to the library.
- **Deactivate an alert episode**: Create an action for a specific alert episode.[Required authorization] Route required privileges: manage_alerting-v2-alerts.
- **Delete a backfill by ID**: Delete a backfill by ID
- **Delete a case comment or alert**: You must have `all` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the cases you're deleting.
- **Delete a case template**: Soft-deletes a case template (all versions).
- **Delete a connector**: WARNING: When you delete a connector, it cannot be recovered.
- **Delete a conversation**: Delete an existing conversation using the conversation ID.
- **Delete action policies in bulk by ID**: [Required authorization] Route required privileges: manage_alerting-v2-action-policies.
- **Delete a dashboard**: Permanently deletes a dashboard by ID.
- **Delete a data view**: Delete a data view by its identifier.
- **Delete a detection rule**: Delete a detection rule using the `rule_id` or `id` field.
- **Delete a field definition**: Deletes a field definition.
- **Delete a Fleet Server host**: Delete a Fleet Server host by ID.[Required authorization] Route required privileges: fleet-settings-all.
- **Delete agent configuration**: Delete an existing agent configuration.
- **Delete a links library item**: Permanently deletes a links library item by ID.
- **Delete all case comments and alerts**: Deletes all comments and alerts from a case.
- **Delete a Logstash pipeline**: Delete a centrally-managed Logstash pipeline.
- **Delete a maintenance window.**: [Required authorization] Route required privileges: write-maintenance-window.
- **Delete a managed integration**: Delete a managed integration
- **Delete a markdown library item**: Permanently deletes a markdown library item by ID.
- **Delete a monitor**: Delete a monitor from the Synthetics app.
- **Delete an action policy**: Deletes the action policy whose ID you include in the URL path.
- **Delete an agent (agent builder)**: Delete an agent by ID.
- **Delete an agent binary download source**: Delete an agent binary download source by ID.[Required authorization] Route required privileges: fleet-settings-all.
- **Delete an agent (Elastic Agents)**: Delete an agent by ID.[Required authorization] Route required privileges: fleet-agents-all.
- **Delete an agent policy**: Delete an agent policy by ID.[Required authorization] Route required privileges: fleet-agent-policies-all.
- **Delete an AI Index**: Deletes an AI Index by ID.
- **Delete an alerts index**: Permanently deletes the Elastic Security alerts backing index in the current space, including the alerts stored in it.
- **Delete an Elastic Endpoint exception list item**: Delete an Elastic Endpoint exception list item, specified by the `id` or `item_id` field.
- **Delete an entity**: Delete a single entity record from the Entity Store.
- **Delete an exception list**: Delete an exception list using the `id` or `list_id` field.
- **Delete an exception list item**: Delete an exception list item using the `id` or `item_id` field.
- **Delete an SLO**: You must have the `write` privileges for the **SLOs** feature in the **Observability** section of the Kibana feature privileges.
- **Delete an uploaded file**: Delete a file uploaded by an agent.[Required authorization] Route required privileges: fleet-agents-all.
- **Delete a pack**: Delete a query pack using the pack ID.
- **Delete a package (DELETE /api/fleet/epm/packages/{pkgName}/{pkgVersion})**: Uninstall a specific version of a package and remove all its assets.[Required authorization] Route required privileges: integrations-all AND fleet-agent-policies-all.
- **Delete a package (Elastic Package Manager (EPM))**: Uninstall a package and remove all its assets.[Required authorization] Route required privileges: integrations-all AND fleet-agent-policies-all.
- **Delete a package policy**: Delete a package policy by ID.[Required authorization] Route required privileges: fleet-agent-policies-all AND integrations-all.
- **Delete a parameter**: Delete a parameter from the Synthetics app.
- **Delete a plugin**: Delete an installed plugin by ID.
- **Delete a private location**: You must have `all` privileges for the Synthetics and Uptime feature in the Observability section of the Kibana feature privileges.
- **Delete a proxy**: Delete a proxy by ID[Required authorization] Route required privileges: fleet-settings-all.
- **Delete a role**: Delete a Kibana role by its name.
- **Delete a rule (alerting)**: Delete a rule (alerting)
- **Delete a rule (alerting-v2)**: [Required authorization] Route required privileges: manage_alerting-v2-rules.
- **Delete a runtime field**: Delete a runtime field from a data view.
- **Delete a saved query**: Delete a saved query using the query ID.
- **Delete a script**: Delete a script
- **Delete a short URL**: Delete a Kibana short URL.
- **Delete a skill**: Delete a user-created skill by ID.
- **Delete a snooze schedule for a rule**: Delete a snooze schedule for a rule
- **Delete a space**: When you delete a space, all saved objects that belong to the space are automatically deleted, which is permanent and cannot be undone.
- **Delete assets for a package**: Delete datastream assets for a specific package, by data stream name.[Required authorization] Route required privileges: integrations-all AND fleet-agent-policies-all.
- **Delete a stream**: Deletes a stream definition and the underlying data stream[Required authorization] Route required privileges: manage_stream.
- **Delete a tag**: Permanently deletes a tag by ID.
- **Delete a tool**: Delete a tool by ID.
- **Delete Attack Discovery schedule**: Permanently deletes an Attack Discovery schedule and all associated configuration.
- **Delete a value list**: Delete a value list using the list ID.
- **Delete a value list item**: Delete a value list item using its `id`, or its `list_id` and `value` fields.
- **Delete a workflow**: Delete a single workflow by its ID.[Required authorization] Route required privileges: workflowsManagement:delete.
- **Delete cases**: You must have `read` or `all` privileges and the `delete` sub-feature privilege for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the cases you're deleting.
- **Delete cloud connector (supports force deletion)**: Delete a cloud connector by ID.
- **Delete cloud onboarding deployment**: Delete a cloud onboarding deployment by ID.[Required authorization] Route required privileges: fleet-agent-policies-all OR integrations-all.
- **Delete conversation attachment**: Delete an attachment.
- **Delete conversation by ID**: Delete a conversation by ID.
- **Delete conversations**: This endpoint allows users to permanently delete all conversations.
- **Delete Kibana assets for a package**: Delete Kibana assets (dashboards, visualizations, etc.) for a specific package version.[Required authorization] Route required privileges: integrations-all AND fleet-agent-policies-all.
- **Delete monitors**: Delete multiple monitors by sending a list of config IDs.
- **Delete one or more notes**: Deletes notes by saved object ID.
- **Delete output**: Delete output by ID.[Required authorization] Route required privileges: fleet-settings-all.
- **Delete parameters**: Delete parameters from the Synthetics app.
- **Delete rules in bulk by ID**: [Required authorization] Route required privileges: manage_alerting-v2-rules.
- **Delete rules matching a query (dry-run by default)**: [Required authorization] Route required privileges: manage_alerting-v2-rules.
- **Deletes a single Knowledge Base Entry using the `id` field**: Delete a Knowledge Base Entry by its unique `id`.
- **Delete source map**: Delete a previously uploaded source map.
- **Delete Timelines or Timeline templates**: Delete one or more Timelines or Timeline templates.
- **Delete value list data streams**: Delete the `.lists` and `.items` data streams.
- **Delete visualization**: Permanently deletes a Lens visualization.
- **Deprecated: Bulk upgrade managed integrations**: Deprecated.
- **Deprecated: Create a managed integration**: Deprecated.
- **Deprecated: Delete a managed integration**: Deprecated.
- **Deprecated: Get a managed integration**: Deprecated.
- **Deprecated: Get managed integrations**: Deprecated.
- **Deprecated: Preview a managed integrations upgrade**: Deprecated.
- **Deprecated: Update a managed integration**: Deprecated.
- **Describe an AI Index**: Returns a free-form text context block for an agent.
- **Disable action policies in bulk by ID**: [Required authorization] Route required privileges: manage_alerting-v2-action-policies.
- **Disable an action policy**: Disable an action policy by identifier.[Required authorization] Route required privileges: manage_alerting-v2-action-policies.
- **Disable an entity resolution rule**: Disable a managed entity resolution rule in this space.[Required authorization] Route required privileges: securitySolution AND securitySolution-entity-analytics.
- **Disable an SLO**: You must have the `write` privileges for the **SLOs** feature in the **Observability** section of the Kibana feature privileges.
- **Disable a rule (alerting)**: Disable a rule (alerting)
- **Disable a rule (alerting-v2)**: Disable a rule by identifier.[Required authorization] Route required privileges: manage_alerting-v2-rules.
- **Disable Attack Discovery schedule**: Disables an Attack Discovery schedule, preventing it from running according to its configured interval.
- **Disable legacy URL aliases**: Disable one or more legacy URL aliases so that they no longer resolve to their target saved objects.
- **Disable rules in bulk by ID**: [Required authorization] Route required privileges: manage_alerting-v2-rules.
- **Disable rules matching a query (dry-run by default)**: [Required authorization] Route required privileges: manage_alerting-v2-rules.
- **Disable streams**: Disables wired streams and deletes all existing stream definitions.
- **Disable the history snapshot task**: Disable the Entity Store history snapshot task for this space so it no longer creates snapshot indices.
- **Dismiss an Attack Discovery generation**: Dismisses an Attack Discovery generation for the current user, indicating that its status should not be reported in the UI.
- **Download a file**: Download a file associated with a response action.
- **Download an agent manifest**: Download the Kubernetes manifest for deploying Elastic Agent.[Required authorization] Route required privileges: fleet-agent-policies-read OR fleet-setup.
- **Download an agent policy**: Download an agent policy by ID.[Required authorization] Route required privileges: fleet-agent-policies-read OR fleet-setup.
- **Download a script file**: Download a script file
- **Dry run a package policy upgrade**: Preview the changes that would be applied by upgrading a package policy to a newer package version.[Required authorization] Route required privileges: fleet-agent-policies-read AND integrations-read.
- **Duplicate an exception list**: Duplicate an existing exception list.
- **Enable action policies in bulk by ID**: [Required authorization] Route required privileges: manage_alerting-v2-action-policies.
- **Enable an action policy**: Enable an action policy by identifier.[Required authorization] Route required privileges: manage_alerting-v2-action-policies.
- **Enable an entity resolution rule**: Enable a managed entity resolution rule in this space.[Required authorization] Route required privileges: securitySolution AND securitySolution-entity-analytics.
- **Enable an SLO**: You must have the `write` privileges for the **SLOs** feature in the **Observability** section of the Kibana feature privileges.
- **Enable a rule (alerting)**: Enable a rule (alerting)
- **Enable a rule (alerting-v2)**: Enable a rule by identifier.[Required authorization] Route required privileges: manage_alerting-v2-rules.
- **Enable Attack Discovery schedule**: Enables a previously disabled Attack Discovery schedule, allowing it to run according to its configured interval.
- **Enable rules in bulk by ID**: [Required authorization] Route required privileges: manage_alerting-v2-rules.
- **Enable rules matching a query (dry-run by default)**: [Required authorization] Route required privileges: manage_alerting-v2-rules.
- **Enable streams**: Enables wired streams[Required authorization] Route required privileges: manage_stream.
- **Enable the history snapshot task**: Enable the Entity Store history snapshot task for this space.
- **Export an exception list**: Export an exception list and its associated items to an NDJSON file.
- **Export detection rules**: Export detection rules to an `.ndjson` file.
- **Export live query results**: Export the results of a live query action as a downloadable file.
- **Export saved objects**: Retrieve sets of saved objects that you want to import into Kibana.
- **Export scheduled query results**: Export all result rows for a specific scheduled query execution as a downloadable file.
- **Export stream content**: Exports a content pack with the stream structure (routing, mappings, and processing).
- **Export Timelines**: Export Timelines as an NDJSON file.
- **Export value list items**: Export list item values from the specified value list.
- **Export workflows**: Export one or more workflows as JSON with YAML content and metadata.[Required authorization] Route required privileges: workflowsManagement:read OR workflowsManagement:managed:read.
- **Favorite a Timeline or Timeline template**: Favorite a Timeline or Timeline template for the current user.
- **Find and/or aggregate attack discovery alerts**: Find and/or aggregate attack discovery alerts that match the given query.
- **Find and/or aggregate detection alerts**: Find and/or aggregate detection alerts that match the given query.
- **Find Attack discoveries that match the search criteria**: Find Attack discoveries that match the search criteria.
- **Find Attack Discovery schedules that match the search criteria**: Find Attack Discovery schedules that match the search criteria.
- **Find backfills for rules**: Find backfills for rules
- **Find case activity**: Retrieves a paginated list of user activity for a case.
- **Find case comments**: Retrieves a paginated list of comments for a case.
- **Finds Knowledge Base Entries that match the given query.**: Finds Knowledge Base Entries that match the given query.
- **Fork a stream**: Forks a wired stream and creates a child stream[Required authorization] Route required privileges: manage_stream.
- **Generate a chat completion**: Create a new chat completion by using the Observability AI Assistant.
- **Generate a Logstash API key**: Generate an API key for Logstash to use with a Fleet output.[Required authorization] Route required privileges: fleet-settings-all.
- **Generate a memory dump from the host machine**: Generates memory dumps on the targeted host.
- **Generate attack discoveries from alerts**: Initiates the generation of attack discoveries by analyzing security alerts using AI.
- **Get A2A agent card**: Get agent discovery metadata in JSON format.
- **Get a backfill by ID**: Get a backfill by ID
- **Get a case comment or alert**: You must have `read` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the cases with the comments you're seeking.
- **Get a case template by ID**: Returns the details of a case template.
- **Get a conversation**: Get the details of an existing conversation using the conversation ID.
- **Get action details**: Get the details of a response action using the action ID.
- **get-actions-connector-oauth-callback-script**: Returns the OAuth callback script
- **Get actions state**: Get a response actions state, which reports whether encryption is enabled.
- **Get a dashboard**: Returns the complete state of a dashboard by ID.
- **Get a data view**: Retrieve a single data view by its identifier.
- **Get a decrypted uninstall token**: Get one decrypted uninstall token by its ID.[Required authorization] Route required privileges: fleet-agents-all.
- **Get a field definition by ID**: Returns a single field definition by its ID.
- **Get a file**: Get a file from an endpoint.
- **Get a Fleet Server host**: Get a Fleet Server host by ID.[Required authorization] Route required privileges: fleet-settings-read.
- **Get a full agent policy**: Get a full agent policy by ID.[Required authorization] Route required privileges: fleet-agent-policies-read.
- **Get a full K8s agent manifest**: Get the Kubernetes manifest for deploying Elastic Agent.[Required authorization] Route required privileges: fleet-agent-policies-read OR fleet-setup.
- **Get agent binary download sources**: List all agent binary download sources.[Required authorization] Route required privileges: fleet-agent-policies-read OR fleet-settings-read.
- **Get agent consumption data**: Returns paginated, per-conversation token consumption data for a given agent.
- **Get agent name for service**: Retrieve `agentName` for a service.
- **Get agent policies**: List all agent policies.[Required authorization] Route required privileges: fleet-agent-policies-read OR fleet-agents-read OR fleet-setup.
- **Get agents**: List agents, with optional filtering and pagination.[Required authorization] Route required privileges: fleet-agents-read.
- **Get agents by action ids**: Retrieve agents associated with specific action IDs.[Required authorization] Route required privileges: fleet-agents-read.
- **Get agent setup info**: Get the current Fleet setup status, including whether Fleet is ready to enroll agents and which requirements or optional features are missing.[Required authorization] Route required privileges: fleet-agents-read OR fleet-agent-policies-read OR fleet-settings-read OR fleet-setup.
- **Get agent tags**: Get a list of all tags used across enrolled agents.[Required authorization] Route required privileges: fleet-agents-read.
- **Get agent uploads**: Get a list of files uploaded by a specific agent.[Required authorization] Route required privileges: fleet-agents-read.
- **Get a limited package list**: Get the list of packages that cannot be uninstalled (e.g. elastic_agent, fleet_server).[Required authorization] Route required privileges: integrations-read OR fleet-setup OR fleet-all.
- **Get a links library item by ID**: Returns the complete state of a links library item by ID.
- **Get a list of agent configurations**: Retrieve all agent configurations.
- **Get a list of scripts**: Retrieve a list of scripts
- **Get all alerts for a case**: You must have `read` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the cases you're seeking.
- **Get all case templates**: Returns a paginated list of case templates.
- **Get all connectors**: Get all connectors
- **Get all data views**: Retrieve a list of all data views.
- **Get all field definitions**: Returns a paginated list of field definitions (field library entries) for the given owner.
- **Get all Logstash pipelines**: Get a list of all centrally-managed Logstash pipelines.
- **Get all roles**: Retrieve all Kibana roles.
- **Get all spaces**: Retrieve all available Kibana spaces.
- **Get a Logstash pipeline**: Get information for a centrally-managed Logstash pipeline.
- **Get a managed integration**: Get a managed integration by ID
- **Get a markdown library item by ID**: Returns the complete state of a markdown library item by ID.
- **Get a metadata list**: Get a list of all endpoint host metadata.
- **Get a monitor**: Get a monitor
- **Get an action policy**: Get an action policy by identifier.[Required authorization] Route required privileges: read_alerting-v2-action-policies.
- **Get an agent**: Get an agent by ID.[Required authorization] Route required privileges: fleet-agents-read.
- **Get an agent action status**: Get the current status of recent agent actions.[Required authorization] Route required privileges: fleet-agents-read.
- **Get an agent binary download source**: Get an agent binary download source by ID.[Required authorization] Route required privileges: fleet-agent-policies-read OR fleet-settings-read.
- **Get an agent by ID**: Get a specific agent by ID.
- **Get an agent policy**: Get an agent policy by ID.[Required authorization] Route required privileges: fleet-agent-policies-read OR fleet-agents-read OR fleet-setup.
- **Get an agent's access control list**: Get the access control for a specific agent.
- **Get an agent's effective config**: Get an agent's effective config by ID.[Required authorization] Route required privileges: fleet-agents-read.
- **Get an agent status summary**: Get a summary of agent statuses for a given agent policy.
- **Get an AI Index**: Fetches an AI Index by ID from the current space, including the ES|QL query derived from each trace.
- **Get an Elastic Endpoint rule exception list item**: Get the details of an Elastic Endpoint exception list item, specified by the `id` or `item_id` field.
- **Get an enrollment API key**: Get an enrollment API key by ID.[Required authorization] Route required privileges: fleet-agents-all OR fleet-setup.
- **Get an exception list item**: Get the details of an exception list item using the `id` or `item_id` field.
- **Get an exception list summary**: Get a summary of the specified exception list.
- **Get an inputs template**: Get an inputs template for a package, used to pre-populate package policy forms.[Required authorization] Route required privileges: integrations-read OR fleet-setup OR fleet-all.
- **Get anonymization fields**: Get a list of all anonymization fields.
- **Get an SLO**: You must have the `read` privileges for the **SLOs** feature in the **Observability** section of the Kibana feature privileges.
- **Get an uploaded file**: Get a file uploaded by an agent.[Required authorization] Route required privileges: fleet-agents-read.
- **Get a package (Elastic Package Manager (EPM))**: Get information about a package by name, returning the latest installed or available version.
- **Get a package file**: Get the contents of a specific file from a package.[Required authorization] Route required privileges: integrations-read OR fleet-setup OR fleet-all.
- **Get a package (GET /api/fleet/epm/packages/{pkgName}/{pkgVersion})**: Get information about a specific version of a package.
- **Get a package policy**: Get a package policy by ID.
- **Get a package signature verification key ID**: Get the GPG key ID used to verify the signatures of packages from the Elastic Package Registry.[Required authorization] Route required privileges: integrations-read OR fleet-setup OR fleet-all.
- **Get a paginated list of SLOs**: You must have the `read` privileges for the **SLOs** feature in the **Observability** section of the Kibana feature privileges.
- **Get a parameter**: Get a parameter from the Synthetics app.
- **Get a plugin by id**: Get a specific plugin by ID.
- **Get a policy response**: Get the most recent policy response for an endpoint.
- **Get a private location**: You must have `read` privileges for the Synthetics and Uptime feature in the Observability section of the Kibana feature privileges.
- **Get a protection updates note**: Get the protection updates note for a package policy.
- **Get a proxy**: Get a proxy by ID.[Required authorization] Route required privileges: fleet-settings-read.
- **Get a role**: Retrieve a Kibana role by its name.
- **Get a rule**: [Required authorization] Route required privileges: read_alerting-v2-rules.
- **Get a runtime field**: Retrieve a single runtime field by name from a data view.
- **Get a short URL**: Get a single Kibana short URL.
- **Get a single Attack Discovery generation, including its discoveries and (optional) generation metadata**: Returns a specific Attack Discovery generation, including all generated Attack discoveries and associated metadata, including execution status and statistics.
- **Get a skill by id**: Get a specific skill by ID.
- **Get a space**: Retrieve a single Kibana space by its identifier.
- **Get a step execution**: Retrieve details of a single step execution within a workflow execution.[Required authorization] Route required privileges: workflowsManagement:read AND workflowsManagement:readExecution.
- **Get a stream**: Fetches a stream definition and associated dashboards[Required authorization] Route required privileges: read_stream.
- **Get a tag**: Returns a tag by ID.
- **Get a tool by id**: Get a specific tool by ID.
- **Get Attack Discovery schedule by ID**: Retrieves a specific Attack Discovery schedule by its unique identifier.
- **Get auto upgrade agent status**: Get the auto-upgrade status for agents assigned to an agent policy.[Required authorization] Route required privileges: fleet-agents-read.
- **Get available agent versions**: Get a list of Elastic Agent versions available for upgrade.[Required authorization] Route required privileges: fleet-agents-read.
- **Get available connectors**: Retrieve the Kibana action connectors that can be used in workflow steps, grouped by connector type.
- **Get a value list item**: Get the details of a value list item.
- **Get a watchlist by ID**: Retrieves the details of an entity analytics watchlist by its unique identifier.
- **Get a workflow**: Retrieve a single workflow by its ID.[Required authorization] Route required privileges: workflowsManagement:read OR workflowsManagement:managed:read.
- **Get a workflow execution**: Retrieve details of a single workflow execution by its ID.[Required authorization] Route required privileges: workflowsManagement:read AND workflowsManagement:readExecution.
- **Get Bulk rollback packages details**: Get the status and results of a bulk package rollback operation.[Required authorization] Route required privileges: integrations-all AND fleet-agent-policies-all.
- **Get Bulk uninstall packages details**: Get the status and results of a bulk package uninstall operation.[Required authorization] Route required privileges: integrations-all AND fleet-agent-policies-all.
- **Get Bulk upgrade packages details**: Get the status and results of a bulk package upgrade operation.[Required authorization] Route required privileges: integrations-all AND fleet-agent-policies-all.
- **Get case connectors**: Get information about connectors that are supported for use in cases.
- **Get case creators**: Returns information about the users who opened cases.
- **Get case information**: Returns case details.
- **Get case settings**: Get setting details such as the closure type, custom fields, templates, and the default connector for cases.
- **Get cases for an alert**: You must have `read` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the cases you're seeking.
- **Get case tags**: Aggregates and returns a list of case tags.
- **Get child executions**: Retrieve child workflow executions spawned by sub-workflow steps within a parent execution.[Required authorization] Route required privileges: workflowsManagement:read AND workflowsManagement:readExecution.
- **Get cloud connector**: Get a cloud connector by ID.[Required authorization] Route required privileges: fleet-agent-policies-read OR integrations-read.
- **Get cloud connectors**: List all Fleet cloud connectors.[Required authorization] Route required privileges: fleet-agent-policies-read OR integrations-read.
- **Get cloud connector usage (package policies using the connector)**: Get a list of package policies that are using a given cloud connector.[Required authorization] Route required privileges: fleet-agent-policies-read OR integrations-read.
- **Get cloud onboarding deployment**: Get a cloud onboarding deployment by ID.[Required authorization] Route required privileges: fleet-agent-policies-read OR integrations-read.
- **Get cloud onboarding deployments by connector ID**: List all cloud onboarding deployments for a given connector ID.[Required authorization] Route required privileges: fleet-agent-policies-read OR integrations-read.
- **Get connector information**: Get connector information
- **Get connector types**: You do not need any Kibana feature privileges to run this API.
- **Get conversation attachment**: Get a single attachment by ID for a conversation.[Required authorization] Route required privileges: agentBuilder:read.
- **Get conversation by ID**: Get a specific conversation by ID.
- **Get conversations**: Get a list of all conversations for the current user.
- **Get data streams (Data streams)**: List all Fleet-managed data streams with metadata including package, namespace, size, and last activity.[Required authorization] Route required privileges: fleet-agents-all AND fleet-agent-policies-all AND fleet-settings-all.
- **Get data streams (GET /api/fleet/epm/data_streams)**: Get a list of data streams created by installed integration packages.[Required authorization] Route required privileges: integrations-read OR fleet-setup OR fleet-all.
- **Get draft Timeline or Timeline template details**: Get the details of the draft Timeline or Timeline template for the current user.
- **Get Elastic Endpoint exception list items**: Get a list of all Elastic Endpoint exception list items.
- **Get enrollment API keys**: List all enrollment API keys.[Required authorization] Route required privileges: fleet-agents-all OR fleet-setup.
- **Get Entity Store status**: Get the overall Entity Store status and per-engine statuses, optionally including component-level health details.[Required authorization] Route required privileges: securitySolution.
- **Get environments for service**: Retrieve the available environments for a given service, to be used in agent configuration.
- **Get exception list details**: Get the details of an exception list using the `id` or `list_id` field.
- **Get exception list items**: Get a list of all exception list items in the specified list.
- **Get exception lists**: Get a list of all exception list containers.
- **Get execution logs**: Retrieve paginated logs for a workflow execution.
- **Get execution step executions**: Retrieve a paginated list of step executions for a specific workflow execution.
- **Get features**: Get information about all Kibana features.
- **Get file information**: Get information for the specified response action file download.
- **Get Fleet Server hosts**: List all Fleet Server hosts.[Required authorization] Route required privileges: fleet-agents-all OR fleet-settings-read.
- **Get incoming agent data**: Get the data streams that an agent is actively sending data to.[Required authorization] Route required privileges: fleet-agents-read.
- **Get information about rules**: Get information about rules
- **Get ingest stream settings**: Fetches the ingest settings of an ingest stream definition[Required authorization] Route required privileges: read_stream.
- **Get installed packages**: Get a list of all currently installed integration packages.[Required authorization] Route required privileges: integrations-read OR fleet-setup OR fleet-all.
- **Get Kibana's current status**: Returns Kibana's overall operational status and a per-service breakdown for Elasticsearch, Saved Objects, and registered plugins.
- **Get live queries**: Get a list of all live queries.
- **Get live query details**: Get the details of a live query using the query ID.
- **Get live query results**: Get the results of a live query using the query action ID.
- **Get maintenance window details.**: [Required authorization] Route required privileges: read-maintenance-window.
- **Get managed integrations**: List managed integrations
- **Get metadata**: Get host metadata for a specific endpoint.
- **Get metadata for latest uninstall tokens**: List the metadata for the latest uninstall tokens per agent policy.[Required authorization] Route required privileges: fleet-agents-all.
- **Get monitors**: Get a list of monitors.
- **Get notes**: Returns Security Timeline notes as saved objects.
- **Get output**: Get output by ID.[Required authorization] Route required privileges: fleet-settings-read OR fleet-agent-policies-read.
- **Get outputs**: List all Fleet outputs.[Required authorization] Route required privileges: fleet-settings-read OR fleet-agent-policies-read.
- **Get outputs for agent policies**: Get a list of outputs associated with agent policies.[Required authorization] Route required privileges: fleet-agent-policies-read AND fleet-settings-read.
- **Get outputs for an agent policy**: Get a list of outputs associated with agent policy by policy id.[Required authorization] Route required privileges: fleet-agent-policies-read AND fleet-settings-read.
- **Get package categories**: Get a list of integration categories.[Required authorization] Route required privileges: integrations-read OR fleet-setup OR fleet-all.
- **Get package dependencies**: Get the list of packages that a specific package depends on.[Required authorization] Route required privileges: integrations-read OR fleet-setup OR fleet-all.
- **Get package policies**: List all package policies.
- **Get packages**: Get a list of integration packages available in the registry.[Required authorization] Route required privileges: integrations-read OR fleet-setup OR fleet-all.
- **Get package stats**: Get usage statistics for a specific package, such as the number of agent policies using it.[Required authorization] Route required privileges: integrations-read OR fleet-setup OR fleet-all.
- **Get pack details**: Get the details of a query pack using the pack ID.
- **Get packs**: Get a list of all query packs.
- **Get parameters**: Get a list of all parameters.
- **Get private locations**: Get a list of private locations.
- **Get prompts**: Get a list of all prompts based on optional filters, sorting, and pagination.
- **Get proxies**: List all Fleet proxies.[Required authorization] Route required privileges: fleet-settings-read.
- **Get query stream settings**: Fetches the query settings of a query stream definition[Required authorization] Route required privileges: read_stream.
- **Get remote synced integrations status**: Get the synchronization status of all remote integrations across connected remote clusters.[Required authorization] Route required privileges: fleet-settings-read AND integrations-read.
- **Get remote synced integrations status by outputId**: Get the synchronization status of remote integrations for a specific output by its ID.[Required authorization] Route required privileges: fleet-settings-read AND integrations-read.
- **Get resolution group**: Get the resolution group for a given entity, returning all linked entities.[Required authorization] Route required privileges: securitySolution AND securitySolution-entity-analytics.
- **Get response actions**: Get a list of all response actions.
- **Get response actions status**: Get the status of response actions for the specified agent IDs.
- **Get risk score history for an entity**: Returns time-ordered historical risk score entries from the risk score time-series index for a given entity.
- **Get rule details**: Get rule details
- **Get rules in bulk**: [Required authorization] Route required privileges: read_alerting-v2-rules.
- **Get running processes**: Get a list of all processes running on an endpoint.
- **Get saved queries**: Get a list of all saved queries.
- **Get saved query details**: Get the details of a saved query using the query ID.
- **Get scheduled action results**: Get paginated per-agent action results for a specific scheduled query execution, with success/failure aggregation and execution metadata (pack name, query name/text, timestamp).
- **Get scheduled query results**: Get paginated query result rows (the actual osquery output data) for a specific scheduled query execution.
- **Get script**: Get a script
- **Get settings**: Get the global Fleet settings.[Required authorization] Route required privileges: fleet-settings-read.
- **Get shareable references**: Collect references and space contexts for saved objects.
- **Get single agent configuration**: Retrieve a single agent configuration matching the given service name and environment.
- **Get source maps**: Get an array of Fleet artifacts, including source map uploads.
- **Get space settings**: Get the Fleet settings for the current Kibana space.
- **Get status of value list data streams**: Verify that `.lists` and `.items` data streams exist.
- **Gets the status of the privileged access detection package for the Entity Analytics privileged user monitoring experience**: Returns the installation and ML module setup status of the privileged access detection package, along with the state of each associated ML job.
- **Get stream attachments**: Fetches all attachments linked to a stream that are visible to the current user in the current space.
- **Get stream list**: Fetches list of all streams[Required authorization] Route required privileges: read_stream.
- **Get the alerting framework health**: You must have `read` privileges for the **Management > Stack Rules** feature or for at least one of the **Analytics > Discover**, **Analytics > Machine Learning**, **Observability**, or **Security** features.
- **Get the default data view**: Retrieve the identifier of the default data view for the current Kibana space.
- **Get the Elasticsearch query for a rule**: Returns the Elasticsearch query that a rule executes, and optionally its response.
- **Get the external input form for a paused workflow execution**: Returns an HTML form for submitting external input to a paused waitForInput step.
- **Get the fields applicable to a case**: Returns the fields you can write to a case's `extended_fields` when creating a case for the given owner.
- **Get the fields applicable to an existing case**: Returns the fields you can write to the case's `extended_fields`.
- **Get the latest Attack Discovery generations metadata for the current user**: Get the latest Attack Discovery generations metadata (that are not dismissed) for the current user.
- **Get the latest output health**: Get the latest health status of an output by ID.[Required authorization] Route required privileges: fleet-settings-read.
- **Get the rule types**: If you have `read` privileges for one or more Kibana features, the API response contains information about the appropriate rule types.
- **Get the SLO definitions**: You must have the `read` privileges for the **SLOs** feature in the **Observability** section of the Kibana feature privileges.
- **Get the task manager health**: Get the health status of the Kibana task manager.
- **Get the upgrade readiness status**: Check the status of your cluster.
- **Get Timeline or Timeline template details**: Get the details of an existing saved Timeline or Timeline template.
- **Get Timelines or Timeline templates**: Get a list of all saved Timelines or Timeline templates.
- **Get unified query history**: Get a unified, time-sorted history of live, rule-triggered, and scheduled osquery executions.
- **Get Universal Profiling setup status**: Check if Universal Profiling has been set up and configured properly[Required authorization] Route required privileges: profiling.
- **Get uptime settings**: You must have `read` privileges for the uptime feature in the Observability section of the Kibana feature privileges.
- **Get value list details**: Get the details of a value list using the list ID.
- **Get value list items**: Get all value list items in the specified list.
- **Get value list privileges**: Returns the caller's authentication state and the Elasticsearch `cluster`, `index`, and `application` privileges for `.lists` and `.items` data streams in the current Kibana space.
- **Get value lists**: Get a paginated subset of value lists.
- **Get visualization**: Returns a single Lens visualization by its ID.
- **Get workflow aggregations**: Retrieve distinct values and their counts for the specified workflow fields.
- **Get workflow executions**: Retrieve a paginated list of executions for a specific workflow.[Required authorization] Route required privileges: workflowsManagement:read AND workflowsManagement:readExecution.
- **Get workflow JSON schema**: Retrieve the JSON schema used to validate workflow YAML definitions.
- **Get workflows**: Retrieve a paginated list of workflows with optional filtering.[Required authorization] Route required privileges: workflowsManagement:read.
- **Get workflows by IDs**: Retrieve multiple workflows by their IDs in a single request.
- **Get workflow statistics**: Retrieve summary statistics about workflows, including total, enabled, and disabled counts; execution history metrics for the last 30 days are included only when the caller has execution read privilege.[Required authorization] Route required privileges: workflowsManagement:read.
- **Get workflow step executions**: Retrieve a paginated list of step-level execution records for a specific workflow.
- **Handle OAuth callback**: Handles the OAuth 2.0 authorization code callback from external providers.
- **Import an exception list**: Import an exception list and its associated items from an NDJSON file.
- **Import content into a stream**: Imports stream structure (routing, mappings, and processing) from a content pack into a stream.[Required authorization] Route required privileges: manage_stream.
- **Import detection rules**: Import detection rules from an `.ndjson` file, including actions and exception lists.
- **Import saved objects**: Create sets of Kibana saved objects from a file created by the export API.
- **Import Timelines**: Import Timelines.
- **Import value list items**: Import value list items from a TXT or CSV file.
- **Initialize security solution flows**: Run one or more Security Solution initialization flows for the current space.
- **Initialize Universal Profiling setup**: Set up Universal Profiling resources and configuration[Required authorization] Route required privileges: profiling.
- **Initiate Fleet setup (Elastic Agents)**: Initialize Fleet.
- **Initiate Fleet setup (Fleet internals)**: Initialize Fleet and create the necessary Elasticsearch resources for Fleet to operate.
- **Install a package by upload**: Install a package by uploading a .zip or .tar.gz archive (max 100MB).
- **Install a package from the registry (Elastic Package Manager (EPM))**: Install the latest version of a package from the Elastic Package Registry.[Required authorization] Route required privileges: integrations-all AND fleet-agent-policies-all.
- **Install a package from the registry (POST /api/fleet/epm/packages/{pkgName}/{pkgVersion})**: Install a specific version of a package from the Elastic Package Registry.[Required authorization] Route required privileges: integrations-all AND fleet-agent-policies-all.
- **Install a plugin**: Install a plugin from a GitHub Claude plugin URL or a direct ZIP URL.
- **Install Kibana alert rule for a package**: Install Kibana alert rule assets for a specific package version.[Required authorization] Route required privileges: integrations-all AND fleet-agent-policies-all.
- **Install Kibana assets for a package**: Install Kibana assets (dashboards, visualizations, etc.) for a specific package version.[Required authorization] Route required privileges: integrations-all AND fleet-agent-policies-all.
- **Install prebuilt detection rules and Timelines**: Install and update all Elastic prebuilt detection rules and Timelines.
- **Install prepackaged Timelines**: Install or update prepackaged Timelines.
- **Installs the privileged access detection package for the Entity Analytics privileged user monitoring experience**: Installs the privileged access detection integration package and sets up the associated ML modules required for the Entity Analytics privileged user monitoring experience.
- **Install the Entity Store**: Install the Entity Store and create engines for the specified entity types.
- **Invalidate user sessions**: Invalidate user sessions that match a query.
- **Isolate an endpoint**: Isolate an endpoint from the network.
- **Link an attachment to a stream**: Links an attachment to a stream.
- **Link entities**: Link one or more entities to a target entity, creating a resolution group.
- **List action policies**: Get a paginated list of action policies with optional filtering and sorting.[Required authorization] Route required privileges: read_alerting-v2-action-policies.
- **List action policy executions**: Get a paginated list of dispatcher summary events for action policies in the current space.[Required authorization] Route required privileges: read_alerting-v2-execution-history.
- **List agents**: List all available agents.
- **List AI Indices**: Lists up to 100 AI Indices in the current space that the caller can read.
- **List all detection rules**: Retrieve a paginated list of detection rules.
- **List all detection rule tags**: List all unique tags from all detection rules.
- **List all watchlists**: Returns a list of all entity analytics watchlists.
- **List conversation attachments**: List all attachments for a conversation.
- **List conversations**: List all conversations for a user.
- **List entities**: List entity records from the Entity Store with paging, sorting, and filtering.
- **List entity resolution rules**: List managed entity resolution rules and their effective enabled state for this space.
- **List links library items**: Returns a paginated list of links library items.
- **List markdown library items**: Returns a paginated list of markdown library items.
- **List plugins**: List all installed plugins and their managed assets.
- **List rule executions**: Get a paginated list of rule execution events.[Required authorization] Route required privileges: read_alerting-v2-execution-history.
- **List rules**: [Required authorization] Route required privileges: read_alerting-v2-rules.
- **List skills**: List all available skills (built-in and user-created).
- **List tools**: List all available tools.
- **Manually assign entities to a watchlist**: Assigns the provided entities to the specified watchlist using a "manual" source label.
- **Manually unassign entities from a watchlist**: Unassigns the provided entities from the specified watchlist.
- **MCP server**: > This endpoint is designed for MCP clients (Claude Desktop, Cursor, VS Code, etc.) and should not be used directly via REST APIs.
- **Migrate a single agent**: Migrate a single agent to another cluster.[Required authorization] Route required privileges: fleet-agents-all.
- **Migrate multiple agents**: Bulk migrate agents to another cluster.[Required authorization] Route required privileges: fleet-agents-all.
- **Mute all alerts**: Mute all alerts
- **Mute an alert**: Mute an alert
- **Partially update an action policy.**: Apply a partial update to an existing action policy.
- **Patch a detection rule**: Update specific fields of an existing detection rule using the `rule_id` or `id` field.
- **Patch a value list**: Update specific fields of an existing list using the list `id`.
- **Patch a value list item**: Update specific fields of an existing value list item using the item `id`.
- **Pin/unpin an event**: Pin/unpin an event to/from an existing Timeline.
- **Preview a managed integrations upgrade**: Preview upgrading multiple managed integrations without applying any change.
- **Preview rule alerts generated on specified time range**: Simulates a detection rule using the same rule type and query logic as a persisted rule, over a short time window, without persisting a rule or writing alerts.
- **Preview swap references**: Preview the effect of swapping saved object references from one data view to another.
- **Push a case to an external service**: You must have `all` privileges for the **Actions and Connectors** feature in the **Management** section of the Kibana feature privileges.
- **Query AI Indices**: Runs an ES|QL query as the current user.
- **Query roles**: Query Kibana roles with optional filters, paging, and sorting.
- **Read a KnowledgeBase**: Read a single KB
- **Read a Knowledge Base Entry**: Retrieve a Knowledge Base Entry by its unique `id`.
- **Read a KnowledgeBase for a resource**: Read a knowledge base with a specific resource identifier.
- **Reads the alert index name if it exists**: Returns the backing Elasticsearch index for Elastic Security detection alerts in the current space, and whether its mapping is outdated.
- **Reassign an agent**: Reassign an agent to a different agent policy.[Required authorization] Route required privileges: fleet-agents-all.
- **Release an isolated endpoint**: Release an isolated endpoint, allowing it to rejoin a network.
- **Remove an OpAMP collector**: Remove a specific OpAMP collector from the Fleet agents list.
- **Rename attachment**: Rename an attachment without creating a new version.[Required authorization] Route required privileges: agentBuilder:read.
- **Request agent diagnostics**: Request a diagnostics bundle from a specific agent.[Required authorization] Route required privileges: fleet-agents-read.
- **Reset an SLO**: You must have the `write` privileges for the **SLOs** feature in the **Observability** section of the Kibana feature privileges.
- **Resolve a short URL**: Resolve a Kibana short URL by its slug.
- **Resolve a Timeline or Timeline template**: Resolve a Timeline or Timeline template, surfacing outcomes such as `exactMatch`, `aliasMatch`, or `conflict` when object IDs have been remapped during upgrades or imports.
- **Resolve conflicts copying saved objects**: Overwrite saved objects that are returned as errors from the copy saved objects to space API.[Required authorization] Route required privileges: copySavedObjectsToSpaces.
- **Resolve import errors**: To resolve errors from the import objects API, you can retry certain saved objects, overwrite specific saved objects, and change references to different saved objects
- **Restart an agent**: Restart an Elastic Agent.
- **Restore deleted attachment**: Restore a soft-deleted attachment.[Required authorization] Route required privileges: agentBuilder:read.
- **Resume a workflow execution**: Resume a paused workflow execution with the provided input.[Required authorization] Route required privileges: workflowsManagement:execute.
- **Resume a workflow execution from an external link**: Resume a paused `waitForApproval` step (pauses the workflow and waits for a human to approve/decline before execution continues) or `waitForInput` step (passes the expected input values as query parameters in the URL).
- **Resync streams**: Resyncs all streams, making sure that Elasticsearch assets are up to date[Required authorization] Route required privileges: manage_stream.
- **Retrieve a detection rule**: Retrieve a detection rule using the `rule_id` or `id` field.
- **Retrieve the status of prebuilt detection rules and Timelines**: Retrieve the status of all Elastic prebuilt detection rules and Timelines.
- **Retrieve the status of the bulk deletion**: Retrieve the status of the bulk deletion operation for SLOs.
- **Returns user privileges for the Kibana space**: Retrieves whether or not the user is authenticated, and the user's Kibana space and index privileges, which determine if the user can create an index for the Elastic Security alerts generated by detection engine rules.
- **Review a pending policy upgrade for a package with deprecations**: Review and accept or reject a pending policy upgrade for a package that contains deprecations.[Required authorization] Route required privileges: integrations-all AND fleet-agent-policies-all.
- **Revoke or delete an enrollment API key**: Revoke or delete an enrollment API key by ID.
- **Rollback an agent**: Rollback an agent to the previous version.[Required authorization] Route required privileges: fleet-agents-all.
- **Rollback a package to previous version**: Rollback a package to its previously installed version.[Required authorization] Route required privileges: integrations-all AND fleet-agent-policies-all.
- **Rotate a Fleet message signing key pair**: Rotate the key pair used by Fleet to sign messages sent to Elastic Agents.
- **Rotate a key for encrypted saved objects**: Superuser role required.
- **Rotate an uninstall token**: Rotate the uninstall token for an agent policy.
- **Rotate API keys for action policies in bulk by ID**: [Required authorization] Route required privileges: manage_alerting-v2-action-policies.
- **Run a command**: Run a shell command on an endpoint.
- **Run a connector**: You can use this API to test an action that involves interaction with Kibana services or integrations with third-party systems.
- **Run a rule now**: [Required authorization] Route required privileges: manage_alerting-v2-rules.
- **Run a script**: Run a script on a host.
- **Run a tool**: Run a tool with parameters.
- **Run a workflow**: Execute a workflow by its ID with the provided inputs.
- **Run the risk scoring engine**: Schedule the risk scoring engine to run as soon as possible.
- **Scan a file or directory**: Scan a specific file or directory on an endpoint for malware.
- **Schedule a backfill for rules**: Schedule a backfill for rules
- **Schedule a snooze for the rule**: When you snooze a rule, the rule checks continue to run but alerts will not generate actions.
- **Search cases**: You must have `read` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the cases you're seeking.
- **Search dashboards**: Returns a paginated list of dashboards.
- **Search for a maintenance window.**: [Required authorization] Route required privileges: read-maintenance-window.
- **Search for annotations**: Search for annotations related to a specific service.
- **Search tags**: Returns a paginated list of tags matching the optional `query` text.
- **Search visualizations**: Returns a paginated list of Lens visualizations matching the optional `query` text.
- **Search workflow executions**: Search across all workflow executions.[Required authorization] Route required privileges: workflowsManagement:read AND workflowsManagement:readExecution.
- **Send A2A task**: > This endpoint is designed for A2A protocol clients and should not be used directly via REST APIs.
- **Send a message and get the answer**: Send a message to an agent and get its text answer.
- **Send chat message**: Send a message to an agent and receive a complete response.
- **Send chat message (streaming)**: Send a message to an agent and receive real-time streaming events.
- **Set a detection alert status**: Set the status of one or more detection alerts.
- **Set attack discovery alerts workflow status**: Set the workflow status of one or more attack discovery alerts by IDs, optionally cascading the status to their related detection alerts.
- **Set the default data view**: Set the default data view for the current Kibana space.
- **Snooze action policies in bulk by ID**: [Required authorization] Route required privileges: manage_alerting-v2-action-policies.
- **Snooze an action policy**: Snooze an action policy until a specified time.[Required authorization] Route required privileges: manage_alerting-v2-action-policies.
- **Snooze an alert**: Snooze an alert
- **Start Entity Store engines**: Start previously stopped entity engines, resuming data processing for the specified entity types.[Required authorization] Route required privileges: securitySolution.
- **Start OAuth authorization (redirects to the identity provider)**: [Required authorization] Route required privileges: actions:oauth.
- **Stop Entity Store engines**: Stop running entity engines, pausing data processing for the specified entity types.[Required authorization] Route required privileges: securitySolution.
- **Submit external input for a paused workflow execution**: Resume a workflow execution that is paused and waiting for external input.
- **Suspend a process**: Suspend a running process on an endpoint.
- **Swap saved object references**: Swap saved object references from one data view to another.
- **Sync saved objects in the default space**: Synchronizes Kibana saved objects for machine learning jobs and trained models in the default space.
- **Tag an alert episode**: Create an action for a specific alert episode.[Required authorization] Route required privileges: manage_alerting-v2-alerts.
- **Terminate a process**: Terminate a running process on an endpoint.
- **Test a workflow**: Execute a workflow in test mode without requiring it to be saved or enabled.
- **Test a workflow step**: Execute a single step from a workflow definition in test mode.[Required authorization] Route required privileges: workflowsManagement:execute.
- **Trigger an on-demand test run for a monitor**: Trigger an immediate test execution for the specified monitor.
- **Unacknowledge an alert episode**: Create an action for a specific alert episode.[Required authorization] Route required privileges: manage_alerting-v2-alerts.
- **Unarchive a maintenance window.**: [Required authorization] Route required privileges: write-maintenance-window.
- **Unenroll an agent**: Unenroll a specific agent, optionally revoking its enrollment API key.[Required authorization] Route required privileges: fleet-agents-all.
- **Uninstall the Entity Store**: Uninstall the Entity Store, removing engines and associated resources for the specified entity types.[Required authorization] Route required privileges: securitySolution.
- **Unlink an attachment from a stream**: Unlinks an attachment from a stream.
- **Unlink entities**: Remove one or more entities from their resolution group.
- **Unmute all alerts**: Unmute all alerts
- **Unmute an alert**: Unmute an alert
- **Unsnooze an action policy**: Remove the snooze from an action policy.[Required authorization] Route required privileges: manage_alerting-v2-action-policies.
- **Unsnooze an alert**: Unsnooze an alert
- **Update a case comment or alert**: You must have `all` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the case you're updating.
- **Update a case template**: Fully replaces a case template.
- **Update a connector**: Update a connector
- **Update a conversation**: Update an existing conversation using the conversation ID.
- **Update a conversation's access control**: Replace a conversation's access mode and member list.
- **Update a custom integration**: Update the datasets of an existing custom integration package.[Required authorization] Route required privileges: fleet-settings-all AND integrations-all.
- **Update a data view**: Update an existing data view.
- **Update a detection rule**: Update a detection rule using the `rule_id` or `id` field.
- **Update a field definition**: Updates editable attributes of a field definition.
- **Update a Fleet Server host**: Update a Fleet Server host by ID.[Required authorization] Route required privileges: fleet-settings-all.
- **Update a Knowledge Base Entry**: Update an existing Knowledge Base Entry by its unique `id`.
- **Update a maintenance window.**: [Required authorization] Route required privileges: write-maintenance-window.
- **Update a managed integration**: Update a managed integration by ID.
- **Update a managed workflow**: Partially update an existing managed workflow.
- **Update a monitor**: Update a monitor with the specified attributes.
- **Update an action policy API key**: Rotate the API key for an action policy.[Required authorization] Route required privileges: manage_alerting-v2-action-policies.
- **Update an agent**: Update an existing agent configuration.
- **Update an agent binary download source**: Update an agent binary download source by ID.[Required authorization] Route required privileges: fleet-settings-all.
- **Update an agent by ID**: Update an agent by ID.[Required authorization] Route required privileges: fleet-agents-all.
- **Update an agent policy**: Update an agent policy by ID.[Required authorization] Route required privileges: fleet-agent-policies-all.
- **Update an agent's access control list**: Replace the per-agent access-control entries.
- **Update an Elastic Endpoint rule exception list item**: Update an Elastic Endpoint exception list item, specified by the `id` or `item_id` field.
- **Update an entity**: Update an existing entity record in the Entity Store.
- **Update an exception list**: Update an exception list using the `id` or `list_id` field.
- **Update an exception list item**: Update an exception list item using the `id` or `item_id` field.
- **Update an existing watchlist**: Updates the name, description, risk modifier, or managed status of an existing entity analytics watchlist.
- **Update an SLO**: You must have the `write` privileges for the **SLOs** feature in the **Observability** section of the Kibana feature privileges.
- **Update a pack**: Update a query pack using the pack ID.
- **Update a package policy**: Update a package policy by ID.
- **Update a parameter**: Update a parameter in the Synthetics app.
- **Update a private location**: Update an existing private location's label.
- **Update a proxy**: Update a proxy by ID.[Required authorization] Route required privileges: fleet-settings-all.
- **Update a rule (alerting)**: Update a rule (alerting)
- **Update a rule (alerting-v2)**: [Required authorization] Route required privileges: manage_alerting-v2-rules.
- **Update a runtime field**: Update an existing runtime field in a data view.
- **Update a saved query**: Update a saved query using the query ID.
- **Update a skill**: Update an existing user-created skill.
- **Update a space**: Update an existing Kibana space.
- **Update a Timeline**: Update an existing Timeline.
- **Update a tool**: Update an existing tool.
- **Update attachment origin**: Update the origin reference for an attachment.
- **Update Attack Discovery schedule**: Updates an existing Attack Discovery schedule with new configuration.
- **Update a value list**: Update a value list using the list `id`.
- **Update a value list item**: Update a value list item using the list item ID.
- **Update a workflow**: Partially update an existing workflow.
- **Update cases**: You must have `all` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the case you're updating.
- **Update case settings**: Updates setting details such as the closure type, custom fields, templates, and the default connector for cases.
- **Update cloud connector**: Update a cloud connector by ID.[Required authorization] Route required privileges: fleet-agent-policies-all OR integrations-all.
- **Update cloud onboarding deployment**: Update a cloud onboarding deployment by ID.[Required authorization] Route required privileges: fleet-agent-policies-all OR integrations-all.
- **Update conversation attachment**: Update an attachment content.
- **Update field metadata**: Update field metadata for a data view.
- **Update ingest stream settings**: Upserts the ingest settings of an ingest stream definition[Required authorization] Route required privileges: manage_stream.
- **Update jobs spaces**: Update a list of jobs to add and/or remove them from given spaces.
- **Update output**: Update output by ID.[Required authorization] Route required privileges: fleet-settings-all.
- **Update package settings (Elastic Package Manager (EPM))**: Update settings for a package, such as whether policies are kept up to date automatically.[Required authorization] Route required privileges: integrations-all AND fleet-agent-policies-all.
- **Update package settings (PUT /api/fleet/epm/packages/{pkgName}/{pkgVersion})**: Update settings for a specific version of a package.[Required authorization] Route required privileges: integrations-all AND fleet-agent-policies-all.
- **Update saved objects in spaces**: Update one or more saved objects to add or remove them from some spaces.
- **Update script**: Update (full or partial) a script entry
- **Update settings**: Update the global Fleet settings.[Required authorization] Route required privileges: fleet-settings-all.
- **Update the API key for a rule**: Update the API key for a rule
- **Update the API key of rules in bulk by ID**: Rotates each rule executor task API key to one derived from the current user’s credentials.[Required authorization] Route required privileges: manage_alerting-v2-rules.
- **Update the API key of rules matching a query (dry-run by default)**: Rotates each matching rule executor task API key to one derived from the current user’s credentials.[Required authorization] Route required privileges: manage_alerting-v2-rules.
- **Update the Entity Store**: Update the Entity Store configuration without reinstalling.
- **Update trained models spaces**: Update a list of trained models to add and/or remove them from given spaces.
- **Update uptime settings**: Update uptime setting attributes like `heartbeatIndices`, `certExpirationThreshold`, `certAgeThreshold`, `defaultConnectors`, or `defaultEmail`.
- **Upgrade an agent**: Upgrade a specific agent to a newer version.[Required authorization] Route required privileges: fleet-agents-all.
- **Upgrade a package policy**: Upgrade a package policy to a newer package version.[Required authorization] Route required privileges: fleet-agent-policies-all AND integrations-all.
- **Upload a CSV file to add entities to a watchlist**: Uploads a CSV file to add entities to a watchlist.
- **Upload a file**: Upload a file to an endpoint.
- **Upload a source map**: Upload a source map for a specific service and version.
- **Upsert a dashboard**: Creates a new dashboard with the given ID if none exists, or replaces the complete state of an existing one.
- **Upsert a markdown library item**: Replaces the full state of a markdown library item.
- **Upsert a tag**: Updates a tag if it exists, or creates it at the provided ID.
- **Upsert links library item**: Replaces the full state of a links library item.
- **Upsert query stream settings**: Upserts the query settings of a query stream definition[Required authorization] Route required privileges: manage_stream.
- **Upsert visualization**: Replaces the full configuration of an existing Lens visualization.

Connect Kibana in General Input: https://www.generalinput.com/apps/kibana