Elastic Stack

Elastic Stack (ELK Stack) Elastic Package Manager (EPM) API

Elastic Package Manager (EPM) APIs enable you to manage packages and integrations, including installing, updating, and uninstalling packages, managing custom integrations, and handling package assets.

GitHub OpenAPI

Operations 36

Each operation below carries the questions people ask an LLM about it and the instructions they give an agent to run it. Generated by API Evangelist overlay

POST /api/fleet/epm/bulk_assets Fetch several Kibana saved objects by asset ID · Bulk get assets #
Ask an LLM
“Can I pull the definitions of several integration assets like dashboards and visualizations in one call?”
“Which Kibana saved objects correspond to a list of asset IDs installed by Fleet packages?”
Tell an agent
Look up the Kibana assets with IDs {assetIds} in one bulk request.
Fetch the saved object details for asset IDs {assetIds} that integrations installed.
GET /api/fleet/epm/categories List integration categories · Get package categories #
Ask an LLM
“What categories are Fleet integrations grouped into, like security or observability?”
“Can the integration category list include prerelease packages too?”
Tell an agent
List every integration category in the Fleet package registry.
Show integration categories, including prerelease packages when {prerelease} is true.
POST /api/fleet/epm/custom_integrations Create a custom integration · Create a custom integration #
Ask an LLM
“How do I build my own custom Fleet integration with its own datasets?”
“Can I define the data streams for a homegrown integration when I create it?”
Tell an agent
Create a custom integration named {integrationName} with datasets {datasets}.
Register new custom integration {integrationName} and overwrite any existing one with force {force}.
PUT /api/fleet/epm/custom_integrations/{pkgName} Update a custom integration's readme and categories · Update a custom integration #
Ask an LLM
“Can I change the README text of a custom integration I already built?”
“How can I recategorize an existing custom integration?”
Tell an agent
Replace the README of custom integration {pkgName} with {readMeData}.
Set the categories of my custom integration {pkgName} to {categories}, keeping readme {readMeData}.
GET /api/fleet/epm/packages Browse available integration packages · Get packages #
Ask an LLM
“What integrations are available in the Fleet package registry?”
“Can I filter the integration catalog down to a single category?”
Tell an agent
List all integration packages in the {category} category.
Browse the full integration catalog with package policy counts included.
POST /api/fleet/epm/packages Install an integration from an uploaded archive · Install a package by upload #
Ask an LLM
“How do I install an integration package from a zip file I have locally instead of the registry?”
“Can I upload a package archive and skip rolling over its data streams?”
Tell an agent
Install the integration package I'm uploading as an archive file.
Upload and install this package zip, skipping data stream rollover set to {skipDataStreamRollover}.
POST /api/fleet/epm/packages/_bulk Install several integration packages at once · Bulk install packages #
Ask an LLM
“Can I install a whole list of integrations from the registry in a single request?”
“Is it possible to bulk install packages even when an outdated version is requested?”
Tell an agent
Install these integration packages together: {packages}.
Bulk install packages {packages}, allowing outdated versions {allow_outdated_version}.
POST /api/fleet/epm/packages/_bulk_namespace_customization Toggle namespace customization for many packages · Bulk enable/disable namespace-level customization for packages #
Ask an LLM
“Can I turn on namespace-level customization for several integrations at once?”
“Which namespaces can I enable or disable per-namespace customization for across packages?”
Tell an agent
Enable namespace-level customization for namespaces {enable} on packages {packages}.
Disable namespace customization for {disable} across packages {packages}.
POST /api/fleet/epm/packages/_bulk_rollback Roll back several packages to prior versions · Bulk rollback packages #
Ask an LLM
“Can I revert a batch of integrations to their previous versions after a bad upgrade?”
“Does a bulk package rollback run as a background task I can track?”
Tell an agent
Roll back packages {packages} to their previously installed versions.
Start a bulk rollback task for integrations {packages}.
GET /api/fleet/epm/packages/_bulk_rollback/{taskId} Check progress of a bulk package rollback · Get Bulk rollback packages details #
Ask an LLM
“Did my bulk package rollback finish, and which packages failed to revert?”
“Where can I see the results of a rollback task I started for multiple integrations?”
Tell an agent
Show the status of bulk rollback task {taskId}.
Check whether rollback task {taskId} has completed for all packages.
POST /api/fleet/epm/packages/_bulk_uninstall Uninstall several integration packages · Bulk uninstall packages #
Ask an LLM
“Can I remove many integrations from Fleet in one go?”
“Is there a force option when bulk uninstalling packages that are still in use?”
Tell an agent destructive · confirm first
Uninstall integration packages {packages} in bulk.
Force a bulk uninstall of packages {packages} with force {force}.
GET /api/fleet/epm/packages/_bulk_uninstall/{taskId} Check progress of a bulk package uninstall · Get Bulk uninstall packages details #
Ask an LLM
“Has my bulk uninstall of integrations completed yet?”
“Which packages in a bulk uninstall task hit errors?”
Tell an agent
Get the status of bulk uninstall task {taskId}.
Report any failed packages in uninstall task {taskId}.
POST /api/fleet/epm/packages/_bulk_upgrade Upgrade several integration packages · Bulk upgrade packages #
Ask an LLM
“Can I upgrade a batch of installed integrations to their latest versions at once?”
“Will a bulk package upgrade also upgrade the package policies that use them?”
Tell an agent
Upgrade packages {packages} to their newest versions.
Bulk upgrade {packages} and upgrade their package policies too: {upgrade_package_policies}.
GET /api/fleet/epm/packages/_bulk_upgrade/{taskId} Check progress of a bulk package upgrade · Get Bulk upgrade packages details #
Ask an LLM
“Is the bulk integration upgrade I kicked off still running?”
“What were the per-package results of an upgrade task?”
Tell an agent
Show the progress of bulk upgrade task {taskId}.
List packages that failed in upgrade task {taskId}.
DELETE /api/fleet/epm/packages/{pkgName} Uninstall an integration package · Delete a package #
Ask an LLM
“How can I uninstall an integration without naming the version I have installed?”
“Can I force removal of a package that still has policies attached?”
Tell an agent destructive · confirm first
Uninstall the {pkgName} integration.
Force uninstall package {pkgName} with force set to {force}.
GET /api/fleet/epm/packages/{pkgName} Get details of an integration package · Get a package #
Ask an LLM
“What does the latest version of a given integration include, and is it installed?”
“Can I get package metadata without naming a specific version?”
Tell an agent
Show details for the {pkgName} integration package.
Get full package info for {pkgName}, including metadata.
POST /api/fleet/epm/packages/{pkgName} Install the latest version of a registry package · Install a package from the registry #
Ask an LLM
“How do I install the newest release of an integration straight from the registry?”
“Can I install a package even if its dependency check would fail?”
Tell an agent
Install the latest {pkgName} integration from the package registry.
Install {pkgName} from the registry, skipping the dependency check {skipDependencyCheck}.
PUT /api/fleet/epm/packages/{pkgName} Change settings for an installed package · Update package settings #
Ask an LLM
“How do I make an integration's policies upgrade automatically when the package updates?”
“Can I turn on namespace customization for an installed package without specifying its version?”
Tell an agent
Keep package policies up to date automatically for {pkgName}: {keepPoliciesUpToDate}.
Enable namespace customization for {namespace_customization_enabled_for} on package {pkgName}.
DELETE /api/fleet/epm/packages/{pkgName}/{pkgVersion} Uninstall a specific package version · Delete a package #
Ask an LLM
“Can I uninstall one exact version of an integration by name and version number?”
“What happens if I force-delete a versioned package still used by policies?”
Tell an agent destructive · confirm first
Uninstall {pkgName} version {pkgVersion}.
Force removal of package {pkgName} at {pkgVersion} with force {force}.
GET /api/fleet/epm/packages/{pkgName}/{pkgVersion} Get details of a specific package version · Get a package #
Ask an LLM
“What is in a particular version of an integration before I install it?”
“Can I inspect an unverified package version's info?”
Tell an agent
Show package {pkgName} at version {pkgVersion}.
Get info for {pkgName} {pkgVersion}, ignoring signature verification {ignoreUnverified}.
POST /api/fleet/epm/packages/{pkgName}/{pkgVersion} Install a specific version of a registry package · Install a package from the registry #
Ask an LLM
“How do I install an older, exact version of an integration from the registry?”
“Can I ignore package constraints when installing a pinned version?”
Tell an agent
Install {pkgName} version {pkgVersion} from the registry.
Install {pkgName} {pkgVersion} even if it is outdated, allow_outdated_version {allow_outdated_version}.
PUT /api/fleet/epm/packages/{pkgName}/{pkgVersion} Change settings for a specific package version · Update package settings #
Ask an LLM
“Can I change auto-update policy behavior for one pinned version of an integration?”
“Which settings can I update when targeting a package by name and version?”
Tell an agent
For {pkgName} version {pkgVersion}, set keep policies up to date to {keepPoliciesUpToDate}.
Apply namespace customization settings {namespace_customization_settings} to {pkgName} {pkgVersion}.
GET /api/fleet/epm/packages/{pkgName}/{pkgVersion}/{filePath} Read a file from inside a package · Get a package file #
Ask an LLM
“Can I view the raw contents of a file bundled in an integration package, like its manifest?”
“Where do I fetch a specific file path from a package version?”
Tell an agent
Show file {filePath} from package {pkgName} version {pkgVersion}.
Download {filePath} inside the {pkgName} {pkgVersion} package.
DELETE /api/fleet/epm/packages/{pkgName}/{pkgVersion}/datastream_assets Delete data stream assets for a package policy · Delete assets for a package #
Ask an LLM
“Can I clean up the data stream assets a package created for one package policy?”
“Which package policy do I need to name to remove a package's datastream assets?”
Tell an agent destructive · confirm first
Delete datastream assets of {pkgName} {pkgVersion} for package policy {packagePolicyId}.
Remove the data stream index templates and pipelines {pkgName} {pkgVersion} made for policy {packagePolicyId}.
GET /api/fleet/epm/packages/{pkgName}/{pkgVersion}/dependencies List a package version's dependencies · Get package dependencies #
Ask an LLM
“Which other packages does a given integration version depend on?”
“Do I need to install anything else before this integration version?”
Tell an agent
List dependencies of {pkgName} version {pkgVersion}.
Show what packages {pkgName} {pkgVersion} requires.
DELETE /api/fleet/epm/packages/{pkgName}/{pkgVersion}/kibana_assets Remove a package's Kibana assets · Delete Kibana assets for a package #
Ask an LLM
“Can I delete just the dashboards and visualizations an integration installed, keeping the package?”
“How are an integration's Kibana saved objects removed from the current space?”
Tell an agent destructive · confirm first
Delete the Kibana assets installed by {pkgName} {pkgVersion}.
Remove dashboards and saved objects of package {pkgName} version {pkgVersion}.
POST /api/fleet/epm/packages/{pkgName}/{pkgVersion}/kibana_assets Install a package's Kibana assets · Install Kibana assets for a package #
Ask an LLM
“How do I install an integration's dashboards and saved objects into additional Kibana spaces?”
“Can I reinstall a package's Kibana assets by forcing it?”
Tell an agent
Install Kibana assets for {pkgName} {pkgVersion} into spaces {space_ids}.
Force reinstall the dashboards of {pkgName} {pkgVersion} with force {force}.
POST /api/fleet/epm/packages/{pkgName}/{pkgVersion}/rule_assets Install a package's alerting rule assets · Install Kibana alert rule for a package #
Ask an LLM
“Can I install the alert rules that ship with an integration package?”
“Is there a force flag to reinstall a package's Kibana alert rule templates?”
Tell an agent
Install the alerting rule assets from {pkgName} {pkgVersion}.
Reinstall alert rules for {pkgName} {pkgVersion}, force {force}.
POST /api/fleet/epm/packages/{pkgName}/{pkgVersion}/transforms/authorize Authorize a package's transforms · Authorize transforms #
Ask an LLM
“How do I grant my credentials to the transforms an integration installed so they can run?”
“Which transforms need reauthorizing after installing a package version?”
Tell an agent
Authorize transforms {transforms} for package {pkgName} {pkgVersion}.
Reauthorize the {pkgName} {pkgVersion} transforms listed in {transforms} with my current user.
POST /api/fleet/epm/packages/{pkgName}/review_upgrade Review a pending upgrade with deprecations · Review a pending policy upgrade for a package with deprecations #
Ask an LLM
“An integration upgrade is blocked by deprecations; how do I accept or decline it?”
“Can I approve a pending policy upgrade to a specific target version?”
Tell an agent
Review the pending {pkgName} upgrade to {target_version} with action {action}.
Accept the deprecation-flagged policy upgrade of {pkgName} to version {target_version}, action {action}.
POST /api/fleet/epm/packages/{pkgName}/rollback Roll back one package to its previous version · Rollback a package to previous version #
Ask an LLM
“Can I undo an upgrade of a single integration and go back to the prior version?”
“What happens to package policies when I revert one package?”
Tell an agent
Roll back the {pkgName} integration to its previous version.
Revert package {pkgName} after its last upgrade.
GET /api/fleet/epm/packages/{pkgName}/stats Get usage stats for a package · Get package stats #
Ask an LLM
“How many agent policies are using a particular integration?”
“Where do I see usage statistics for an installed package?”
Tell an agent
Show usage stats for package {pkgName}.
Count how many policies use the {pkgName} integration.
GET /api/fleet/epm/packages/installed List installed packages · Get installed packages #
Ask an LLM
“Which integrations are currently installed in my deployment?”
“Can I restrict the installed package list to ones with active data streams?”
Tell an agent
List installed packages whose name matches {nameQuery}.
Show installed integrations with {dataStreamType} data streams, {perPage} per page.
GET /api/fleet/epm/packages/limited List packages that cannot be removed · Get a limited package list #
Ask an LLM
“Which packages are limited, meaning they can't be uninstalled or removed from policies?”
“What is on the limited package list in Fleet?”
Tell an agent
Get the limited package list.
Show packages that are restricted from being uninstalled.
GET /api/fleet/epm/templates/{pkgName}/{pkgVersion}/inputs Get a package's inputs template · Get an inputs template #
Ask an LLM
“Can I get a ready-to-edit inputs configuration template for an integration version?”
“What formats can the inputs template be returned in, such as YAML or JSON?”
Tell an agent
Get the inputs template for {pkgName} {pkgVersion} in {format} format.
Generate the agent inputs config template of package {pkgName} version {pkgVersion}.
GET /api/fleet/epm/verification_key_id Get the package signing key ID · Get a package signature verification key ID #
Ask an LLM
“Which GPG key ID does Fleet use to verify integration package signatures?”
“Can I check the key ID used for package signature verification?”
Tell an agent
Show the package signature verification key ID.
Get the GPG key ID Fleet trusts for signed packages.

Documentation

📖
Documentation
https://www.elastic.co/docs/reference/elasticsearch
📖
APIReference
https://www.elastic.co/docs/api/doc/elasticsearch/
📖
Documentation
https://www.elastic.co/docs/reference/kibana
📖
APIReference
https://www.elastic.co/docs/api/doc/kibana/

Specifications

⚙
OpenAPI
https://raw.githubusercontent.com/api-evangelist/elk-stack/refs/heads/main/openapi/elk-stack-elastic-package-manager-epm-api-openapi.yml

Other Resources

🔗
SourceCode
https://github.com/elastic/elasticsearch-specification
🔗
SourceCode
https://github.com/elastic/kibana
🔗
ToolCrosswalk
https://raw.githubusercontent.com/api-evangelist/elk-stack/refs/heads/main/mcp/elk-stack-tool-crosswalk.yml

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this
  • find_apisBrowse and filter every API in the catalog.
  • get_api_artifactsOne API's artifacts, grouped by type.
  • get_openapiThe primary OpenAPI for this API.
  • find_similar_apisAPIs that look like this one.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This API 
curl "https://apis.io/api/v1/apis/elk-stack:elk-stack-elastic-package-manager-epm-api"
All apis 
curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

elk-stack-elastic-package-manager-epm-api-openapi.yml Raw ↑ 
openapi: 3.2.0
info:
  contact:
    name: Kibana Team
  description: The Kibana REST APIs enable you to manage resources such as connectors, data views, and saved objects.
  title: Kibana Elastic Package Manager (EPM) API
  version: ''
  x-doc-license:
    name: Attribution-NonCommercial-NoDerivatives 4.0 International
    url: https://creativecommons.org/licenses/by-nc-nd/4.0/
  x-feedbackLink:
    label: Feedback
    url: https://github.com/elastic/docs-content/issues/new?assignees=&labels=feedback%2Ccommunity&projects=&template=api-feedback.yaml&title=%5BFeedback%5D%3A+
servers:
- url: https://{kibana_url}
  variables:
    kibana_url:
      default: localhost:5601
security:
- apiKeyAuth: []
- basicAuth: []
tags:


# --- truncated at 32 KB (149 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/elk-stack/refs/heads/main/openapi/elk-stack-elastic-package-manager-epm-api-openapi.yml