Elastic Package Manager (EPM) APIs enable you to manage packages and integrations, including installing, updating, and uninstalling packages, managing custom integrations, and handling package assets.
Every API here is available over the APIs.io API and to AI agents over MCP.
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.curl "https://apis.io/api/v1/apis/elk-stack-elastic-package-manager-epm-api"curl "https://apis.io/api/v1/apis?limit=25"Discovery needs no key. Ratings and market analysis are Pro.
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.
openapi: 3.2.0
info:
contact:
name: Kibana Team
description: 'The Kibana REST APIs enable you to manage resources such as connectors, data views, and saved objects.
The API calls are stateless.
Each request that you make happens in isolation from other calls and must include all of the necessary information for Kibana to fulfill the
request.
API requests return JSON output, which is a format that is machine-readable and works well for automation.
To interact with Kibana APIs, use the following operations:
- GET: Fetches the information.
- PATCH: Applies partial modifications to the existing information.
- POST: Adds new information.
- PUT: Updates the existing information.
- DELETE: Removes the information.
You can prepend any Kibana API endpoint with `kbn:` and run the request in **Dev Tools → Console**.
For example:
```
GET kbn:/api/data_views
```
For more information about the console, refer to [Run API requests](https://www.elastic.co/docs/explore-analyze/query-filter/tools/console).
NOTE: Access to internal Kibana API endpoints will be restricted in Kibana version 9.0. Please move any integrations to publicly documented APIs.
## Documentation source and versions
This documentation is derived from the `main` branch of the [kibana](https://github.com/elastic/kibana) repository.
It is provided under license [Attribution-NonCommercial-NoDerivatives 4.0 International](https://creativecommons.org/licenses/by-nc-nd/4.0/).
This documentation contains work-in-progress information for future Elastic Stack releases.
'
title: Kibana Elastic Package Manager (EPM) API
version: ''
x-doc-license:
name: Attribution-NonCommercial-NoDerivatives 4.0 International
url: https://creativecommons.org/licenses/by-nc-nd/4.0/
x-feedbackLink:
label: Feedback
url: https://github.com/elastic/docs-content/issues/new?assignees=&labels=feedback%2Ccommunity&projects=&template=api-feedback.yaml&title=%5BFeedback%5D%3A+
servers:
- url: https://{kibana_url}
variables:
kibana_url:
default: localhost:5601
security:
- apiKeyAuth: []
- basicAuth: []
tags:
- name: Elastic Package Manager (EPM)
description: 'Elastic Package Manager (EPM) APIs enable you to manage packages and integrations, including installing, updating, and uninstalling packages, managing custom integrations, and handling package assets.
'
x-displayName: Elastic Package Manager (EPM)
paths:
/api/fleet/epm/bulk_assets:
post:
description: '**Spaces method and path for this operation:**
<div><span class="operation-verb post">post</span> <span class="operation-path">/s/{space_id}/api/fleet/epm/bulk_assets</span></div>
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
Retrieve multiple Kibana saved object assets by their IDs and types.<br/><br/>[Required authorization] Route required privileges: integrations-read OR fleet-setup OR fleet-all.'
operationId: post-fleet-epm-bulk-assets
parameters:
- description: A required header to protect against CSRF attacks
in: header
name: kbn-xsrf
required: true
schema:
example: 'true'
type: string
requestBody:
content:
application/json:
examples:
postBulkGetAssetsRequestExample:
description: Retrieve multiple assets by their IDs and types
value:
assetIds:
- id: dashboard-id-1
type: dashboard
- id: index-pattern-id-1
type: index_pattern
schema:
$ref: '#/components/schemas/Kibana_HTTP_APIs_get_bulk_assets_request'
responses:
'200':
content:
application/json:
examples:
postBulkGetAssetsExample:
description: Requested assets
value:
items:
- appLink: /app/dashboards#/view/dashboard-id-1
attributes:
title: My Dashboard
id: dashboard-id-1
type: dashboard
schema:
$ref: '#/components/schemas/Kibana_HTTP_APIs_get_bulk_assets_response'
description: Successful response
'400':
content:
application/json:
examples:
genericErrorResponseExample:
description: Example of a generic error response
value:
error: Bad Request
message: An error message describing what went wrong
statusCode: 400
schema:
additionalProperties: false
description: Generic Error
type: object
properties:
attributes: {}
error:
type: string
errorType:
type: string
message:
type: string
statusCode:
type: number
required:
- message
- attributes
description: Bad Request
summary: Bulk get assets
tags:
- Elastic Package Manager (EPM)
x-metaTags:
- content: Kibana
name: product_name
/api/fleet/epm/categories:
get:
description: '**Spaces method and path for this operation:**
<div><span class="operation-verb get">get</span> <span class="operation-path">/s/{space_id}/api/fleet/epm/categories</span></div>
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
Get a list of integration categories.<br/><br/>[Required authorization] Route required privileges: integrations-read OR fleet-setup OR fleet-all.'
operationId: get-fleet-epm-categories
parameters:
- description: When true, include prerelease packages in the results
in: query
name: prerelease
required: false
schema:
type: boolean
- description: When true, include categories that only contain policy templates
in: query
name: include_policy_templates
required: false
schema:
type: boolean
responses:
'200':
content:
application/json:
examples:
getCategoriesExample:
description: List of integration categories
value:
items:
- count: 42
id: security
title: Security
- count: 38
id: observability
title: Observability
schema:
$ref: '#/components/schemas/Kibana_HTTP_APIs_get_categories_response'
description: Successful response
'400':
content:
application/json:
examples:
genericErrorResponseExample:
description: Example of a generic error response
value:
error: Bad Request
message: An error message describing what went wrong
statusCode: 400
schema:
additionalProperties: false
description: Generic Error
type: object
properties:
attributes: {}
error:
type: string
errorType:
type: string
message:
type: string
statusCode:
type: number
required:
- message
- attributes
description: Bad Request
summary: Get package categories
tags:
- Elastic Package Manager (EPM)
x-metaTags:
- content: Kibana
name: product_name
/api/fleet/epm/custom_integrations:
post:
description: '**Spaces method and path for this operation:**
<div><span class="operation-verb post">post</span> <span class="operation-path">/s/{space_id}/api/fleet/epm/custom_integrations</span></div>
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
Create a new custom integration package with user-defined data streams.<br/><br/>[Required authorization] Route required privileges: integrations-all AND fleet-agent-policies-all.'
operationId: post-fleet-epm-custom-integrations
parameters:
- description: A required header to protect against CSRF attacks
in: header
name: kbn-xsrf
required: true
schema:
example: 'true'
type: string
requestBody:
content:
application/json:
examples:
postCreateCustomIntegrationRequestExample:
description: Create a new custom integration
value:
datasets:
- name: my_custom_logs.access
type: logs
integrationName: my_custom_logs
schema:
$ref: '#/components/schemas/Kibana_HTTP_APIs_create_custom_integration_request'
responses:
'200':
content:
application/json:
examples:
postCreateCustomIntegrationExample:
description: Custom integration successfully created
value:
_meta:
install_source: custom
items:
- id: my_custom_logs-logs-my_custom_logs.access
type: index_template
schema:
$ref: '#/components/schemas/Kibana_HTTP_APIs_install_package_response'
description: Successful response
'400':
content:
application/json:
examples:
genericErrorResponseExample:
description: Example of a generic error response
value:
error: Bad Request
message: An error message describing what went wrong
statusCode: 400
schema:
additionalProperties: false
description: Generic Error
type: object
properties:
attributes: {}
error:
type: string
errorType:
type: string
message:
type: string
statusCode:
type: number
required:
- message
- attributes
description: Bad Request
summary: Create a custom integration
tags:
- Elastic Package Manager (EPM)
x-metaTags:
- content: Kibana
name: product_name
/api/fleet/epm/custom_integrations/{pkgName}:
put:
description: '**Spaces method and path for this operation:**
<div><span class="operation-verb put">put</span> <span class="operation-path">/s/{space_id}/api/fleet/epm/custom_integrations/{pkgName}</span></div>
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
Update the datasets of an existing custom integration package.<br/><br/>[Required authorization] Route required privileges: fleet-settings-all AND integrations-all.'
operationId: put-fleet-epm-custom-integrations-pkgname
parameters:
- description: A required header to protect against CSRF attacks
in: header
name: kbn-xsrf
required: true
schema:
example: 'true'
type: string
- description: Package name
in: path
name: pkgName
required: true
schema:
type: string
requestBody:
content:
application/json:
examples:
putUpdateCustomIntegrationRequestExample:
description: Update a custom integration
value:
datasets:
- name: my_custom_logs.access
type: logs
integrationName: my_custom_logs
schema:
additionalProperties: false
type: object
properties:
categories:
items:
type: string
maxItems: 10
type: array
readMeData:
type: string
required:
- readMeData
responses:
'200':
content:
application/json:
examples:
putUpdateCustomIntegrationExample:
description: Custom integration successfully updated
value: {}
description: Successful response
'400':
content:
application/json:
examples:
genericErrorResponseExample:
description: Example of a generic error response
value:
error: Bad Request
message: An error message describing what went wrong
statusCode: 400
schema:
additionalProperties: false
description: Generic Error
type: object
properties:
attributes: {}
error:
type: string
errorType:
type: string
message:
type: string
statusCode:
type: number
required:
- message
- attributes
description: Bad Request
summary: Update a custom integration
tags:
- Elastic Package Manager (EPM)
x-metaTags:
- content: Kibana
name: product_name
/api/fleet/epm/packages:
get:
description: '**Spaces method and path for this operation:**
<div><span class="operation-verb get">get</span> <span class="operation-path">/s/{space_id}/api/fleet/epm/packages</span></div>
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
Get a list of integration packages available in the registry.<br/><br/>[Required authorization] Route required privileges: integrations-read OR fleet-setup OR fleet-all.'
operationId: get-fleet-epm-packages
parameters:
- description: Filter packages by category
in: query
name: category
required: false
schema:
type: string
- description: When true, include prerelease packages in the results
in: query
name: prerelease
required: false
schema:
type: boolean
- description: When true, exclude the install status from the response
in: query
name: excludeInstallStatus
required: false
schema:
type: boolean
- description: When true, include the number of package policies per package
in: query
name: withPackagePoliciesCount
required: false
schema:
type: boolean
responses:
'200':
content:
application/json:
examples:
getPackagesExample:
description: List of available integration packages
value:
items:
- categories:
- cloud
description: Collect logs and metrics from Amazon Web Services
id: aws
name: aws
status: not_installed
title: AWS
version: 2.10.0
searchExcluded: 0
total: 1
schema:
$ref: '#/components/schemas/Kibana_HTTP_APIs_get_packages_response'
description: Successful response
'400':
content:
application/json:
examples:
genericErrorResponseExample:
description: Example of a generic error response
value:
error: Bad Request
message: An error message describing what went wrong
statusCode: 400
schema:
additionalProperties: false
description: Generic Error
type: object
properties:
attributes: {}
error:
type: string
errorType:
type: string
message:
type: string
statusCode:
type: number
required:
- message
- attributes
description: Bad Request
summary: Get packages
tags:
- Elastic Package Manager (EPM)
x-metaTags:
- content: Kibana
name: product_name
post:
description: '**Spaces method and path for this operation:**
<div><span class="operation-verb post">post</span> <span class="operation-path">/s/{space_id}/api/fleet/epm/packages</span></div>
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
Install a package by uploading a .zip or .tar.gz archive (max 100MB).<br/><br/>[Required authorization] Route required privileges: integrations-all AND fleet-agent-policies-all.'
operationId: post-fleet-epm-packages
parameters:
- description: A required header to protect against CSRF attacks
in: header
name: kbn-xsrf
required: true
schema:
example: 'true'
type: string
- description: When true, ignore mapping update errors during installation
in: query
name: ignoreMappingUpdateErrors
required: false
schema:
default: false
type: boolean
- description: When true, skip data stream rollover after installation
in: query
name: skipDataStreamRollover
required: false
schema:
default: false
type: boolean
requestBody:
content:
application/gzip:
examples:
postInstallByUploadRequestExample:
description: Upload a .zip or .tar.gz package archive (max 100MB)
value: <binary package archive>
application/gzip; application/zip:
examples:
postInstallByUploadRequestExample:
description: Upload a .zip or .tar.gz package archive (max 100MB)
value: <binary package archive>
schema:
format: binary
type: string
responses:
'200':
content:
application/gzip; application/zip:
examples:
postInstallByUploadExample:
description: Package successfully installed from upload
value:
_meta:
install_source: upload
items:
- id: my-custom-package-logs-default
type: index_template
schema:
$ref: '#/components/schemas/Kibana_HTTP_APIs_install_package_response'
application/json:
examples:
postInstallByUploadExample:
description: Package successfully installed from upload
value:
_meta:
install_source: upload
items:
- id: my-custom-package-logs-default
type: index_template
description: Successful response
'400':
content:
application/gzip; application/zip:
examples:
genericErrorResponseExample:
description: Example of a generic error response
value:
error: Bad Request
message: An error message describing what went wrong
statusCode: 400
schema:
additionalProperties: false
description: Generic Error
type: object
properties:
attributes: {}
error:
type: string
errorType:
type: string
message:
type: string
statusCode:
type: number
required:
- message
- attributes
application/json:
examples:
genericErrorResponseExample:
description: Example of a generic error response
value:
error: Bad Request
message: An error message describing what went wrong
statusCode: 400
description: Bad Request
summary: Install a package by upload
tags:
- Elastic Package Manager (EPM)
x-metaTags:
- content: Kibana
name: product_name
/api/fleet/epm/packages/_bulk:
post:
description: '**Spaces method and path for this operation:**
<div><span class="operation-verb post">post</span> <span class="operation-path">/s/{space_id}/api/fleet/epm/packages/_bulk</span></div>
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
Install multiple packages from the Elastic Package Registry in a single request.<br/><br/>[Required authorization] Route required privileges: integrations-all AND fleet-agent-policies-all.'
operationId: post-fleet-epm-packages-bulk
parameters:
- description: A required header to protect against CSRF attacks
in: header
name: kbn-xsrf
required: true
schema:
example: 'true'
type: string
- description: When true, allow installing prerelease versions
in: query
name: prerelease
required: false
schema:
type: boolean
requestBody:
content:
application/json:
examples:
postBulkInstallPackagesRequestExample:
description: Install multiple packages from the registry
value:
packages:
- system
- aws
schema:
$ref: '#/components/schemas/Kibana_HTTP_APIs_bulk_install_packages_from_registry_request'
responses:
'200':
content:
application/json:
examples:
postBulkInstallPackagesExample:
description: Bulk install results
value:
items:
- name: system
result:
assets: []
status: installed
- name: aws
result:
assets: []
status: installed
schema:
$ref: '#/components/schemas/Kibana_HTTP_APIs_bulk_install_packages_from_registry_response'
description: Successful response
'400':
content:
application/json:
examples:
genericErrorResponseExample:
description: Example of a generic error response
value:
error: Bad Request
message: An error message describing what went wrong
statusCode: 400
schema:
additionalProperties: false
description: Generic Error
type: object
properties:
attributes: {}
error:
type: string
errorType:
type: string
message:
type: string
statusCode:
type: number
required:
- message
- attributes
description: Bad Request
summary: Bulk install packages
tags:
- Elastic Package Manager (EPM)
x-metaTags:
- content: Kibana
name: product_name
/api/fleet/epm/packages/_bulk_namespace_customization:
post:
description: '**Spaces method and path for this operation:**
<div><span class="operation-verb post">post</span> <span class="operation-path">/s/{space_id}/api/fleet/epm/packages/_bulk_namespace_customization</span></div>
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
Enable or disable namespace-level index template customization for a list of packages in one call. Use this for IaC-style declarative flows.<br/><br/>[Required authorization] Route required privileges: integrations-all AND fleet-agent-policies-all.'
operationId: post-fleet-epm-packages-bulk-namespace-customization
parameters:
- description: A required header to protect against CSRF attacks
in: header
name: kbn-xsrf
required: true
schema:
example: 'true'
type: string
requestBody:
content:
application/json:
examples:
bulkNamespaceCustomizationRequest:
value:
disable:
- dev
enable:
- production
- staging
packages:
- system
- nginx
schema:
$ref: '#/components/schemas/Kibana_HTTP_APIs_bulk_namespace_customization_request'
responses:
'200':
content:
application/json:
examples:
successResponse:
value:
items:
- name: system
namespace_customization_enabled_for:
- production
- staging
success: true
- error: Package nginx is not installed
name: nginx
success: false
schema:
$ref: '#/components/schemas/Kibana_HTTP_APIs_bulk_namespace_customization_response'
description: 'OK: A successful request.'
'400':
content:
application/json:
examples:
badRequestResponse:
value:
error: Bad Request
message: 'Namespaces must not appear in both enable and disable: production'
statusCode: 400
schema:
additionalProperties: false
description: Generic Error
type: object
properties:
attributes: {}
error:
type: string
errorType:
type: string
message:
type: string
statusCode:
type: number
required:
- message
- attributes
description: A bad request.
summary: Bulk enable/disable namespace-level customization for packages
tags:
- Elastic Package Manager (EPM)
x-metaTags:
- content: Kibana
name: product_name
/api/fleet/epm/packages/_bulk_rollback:
post:
description: '**Spaces method and path for this operation:**
<div><span class="operation-verb post">post</span> <span class="operation-path">/s/{space_id}/api/fleet/epm/packages/_bulk_rollback</span></div>
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
Rollback multiple packages to their previous versions.<br/><br/>[Required authorization] Route required privileges: integrations-all AND fleet-agent-policies-all.'
operationId: post-fleet-epm-packages-bulk-rollback
parameters:
- description: A required header to protect against CSRF attacks
in: header
name: kbn-xsrf
required: true
schema:
example: 'true'
type: string
requestBody:
content:
application/json:
examples:
bulkRollbackRequest:
value:
packages:
- name: system
schema:
$ref: '#/components/schemas/Kibana_HTTP_APIs_bulk_rollback_packages_request'
responses:
'200':
content:
application/json:
examples:
successResponse:
value:
taskId: taskId
schema:
$ref: '#/components/schemas/Kibana_HTTP_APIs_bulk_rollback_packages_response'
description: 'OK: A successful request.'
'400':
content:
application/json:
examples:
badRequestResponse:
value:
message: Bad Request
schema:
additionalProperties: false
description: Generic Error
type: object
properties:
attributes: {}
error:
type: string
errorType:
type: string
message:
type: string
statusCode:
type: number
required:
- message
- attributes
description: A bad request.
summary: Bulk rollback packages
tags:
- Elastic Package Manager (EPM)
x-metaTags:
- content: Kibana
name: product_name
/api/fleet/epm/packages/_bulk_rollback/{taskId}:
get:
description: '**Spaces method and path for this operation:**
<div><span class="operation-verb get">get</span> <span class="operation-path">/s/{space_id}/api/fleet/epm/packages/_bulk_rollback/{taskId}</span></div>
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
Get the status and results of a bulk package rollback operation.<br/><br/>[Required authorization] Route required privileges: integrations-all AND fleet-agent-policies-all.'
operationId: get-fleet-epm-packages-bulk-rollback-taskid
parameters:
- description: Task ID of the bulk operation
in: path
name: taskId
required: true
schema:
type: string
responses:
'200':
content:
application/json:
examples:
successResponse:
value:
status: success
schema:
$ref: '#/components/schemas/Kibana_HTTP_APIs_get_one_bulk_operation_packages_response'
description: 'OK: A successful request.'
'400':
content:
application/json:
examples:
badRequestResponse:
value:
message: Bad Request
schema:
additionalProperties: false
description: Generic Error
type: object
properties:
attributes: {}
error:
type: string
errorType:
type: string
message:
type: string
statusCode:
type: number
required:
- message
- attributes
description: A bad request.
# --- truncated at 32 KB (156 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/elk-stack/refs/heads/main/openapi/elk-stack-elastic-package-manager-epm-api-openapi.yml