Elastic Stack (ELK Stack) Fleet managed integrations API
The Fleet managed integrations API from Elastic Stack (ELK Stack) — 4 operation(s) for fleet managed integrations.
Work with this as data
Every API here is available over the APIs.io API and to AI agents over MCP.
MCP server
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
Tools for apis
7 MCP tools reach this
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.
Call it yourself
curl for this page
This API
curl "https://apis.io/api/v1/apis/elk-stack-fleet-managed-integrations-api"
All apis
curl "https://apis.io/api/v1/apis?limit=25"Discovery needs no key. Ratings and market analysis are Pro.
Get an API key
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.
OpenAPI Specification
openapi: 3.2.0
info:
contact:
name: Kibana Team
description: 'The Kibana REST APIs enable you to manage resources such as connectors, data views, and saved objects.
The API calls are stateless.
Each request that you make happens in isolation from other calls and must include all of the necessary information for Kibana to fulfill the
request.
API requests return JSON output, which is a format that is machine-readable and works well for automation.
To interact with Kibana APIs, use the following operations:
- GET: Fetches the information.
- PATCH: Applies partial modifications to the existing information.
- POST: Adds new information.
- PUT: Updates the existing information.
- DELETE: Removes the information.
You can prepend any Kibana API endpoint with `kbn:` and run the request in **Dev Tools → Console**.
For example:
```
GET kbn:/api/data_views
```
For more information about the console, refer to [Run API requests](https://www.elastic.co/docs/explore-analyze/query-filter/tools/console).
NOTE: Access to internal Kibana API endpoints will be restricted in Kibana version 9.0. Please move any integrations to publicly documented APIs.
## Documentation source and versions
This documentation is derived from the `main` branch of the [kibana](https://github.com/elastic/kibana) repository.
It is provided under license [Attribution-NonCommercial-NoDerivatives 4.0 International](https://creativecommons.org/licenses/by-nc-nd/4.0/).
This documentation contains work-in-progress information for future Elastic Stack releases.
'
title: Kibana Fleet managed integrations API
version: ''
x-doc-license:
name: Attribution-NonCommercial-NoDerivatives 4.0 International
url: https://creativecommons.org/licenses/by-nc-nd/4.0/
x-feedbackLink:
label: Feedback
url: https://github.com/elastic/docs-content/issues/new?assignees=&labels=feedback%2Ccommunity&projects=&template=api-feedback.yaml&title=%5BFeedback%5D%3A+
servers:
- url: https://{kibana_url}
variables:
kibana_url:
default: localhost:5601
security:
- apiKeyAuth: []
- basicAuth: []
tags:
- name: Fleet managed integrations
paths:
/api/fleet/managed_integrations:
get:
description: '**Spaces method and path for this operation:**
<div><span class="operation-verb get">get</span> <span class="operation-path">/s/{space_id}/api/fleet/managed_integrations</span></div>
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
List managed integrations'
operationId: get-fleet-managed-integrations
parameters:
- description: Page number. Defaults to `1`.
in: query
name: page
required: false
schema:
type: number
- description: Number of results per page. Defaults to `20`.
in: query
name: perPage
required: false
schema:
type: number
- description: Field to sort results by. Defaults to `updated_at`.
in: query
name: sortField
required: false
schema:
maxLength: 256
type: string
- description: Sort order, ascending or descending. Defaults to `desc`.
in: query
name: sortOrder
required: false
schema:
enum:
- desc
- asc
type: string
- description: 'A KQL query string to filter results. Filtering is restricted to the following fields: `name`, `namespace`, `package.name`.'
in: query
name: kuery
required: false
schema:
maxLength: 4096
type: string
responses:
'200':
content:
application/json:
examples:
listManagedIntegrationsResponseExample:
description: Example response for listing managed integrations
value:
items:
- created_at: '2025-11-06T18:27:43.541Z'
created_by: test_user
description: test
id: d52a7812-5736-4fdc-aed8-72152afa1ffa
inputs:
ESS Billing-cel:
enabled: true
streams:
ess_billing.billing:
enabled: true
ess_billing.credits:
enabled: false
vars:
api_key:
id: QY1sWpoBbWcMW-edr0Ee
isSecretRef: true
organization_id: '1234'
url: https://billing.elastic-cloud.com
name: ess_billing-1
namespace: default
package:
name: ess_billing
title: Elasticsearch Service Billing
version: 1.6.0
updated_at: '2025-11-06T18:27:43.541Z'
updated_by: test_user
- cloud_connector:
cloud_connector_id: aws-connector-67890
enabled: true
created_at: '2025-11-06T18:27:43.541Z'
created_by: test_user
description: CSPM integration for AWS with cloud connector
id: aws-policy-12345
inputs:
cspm-cloudbeat/cis_aws:
enabled: true
name: cspm-aws-policy
namespace: default
package:
name: cloud_security_posture
title: Cloud Security Posture Management
version: 3.1.1
updated_at: '2025-11-06T18:27:43.541Z'
updated_by: test_user
vars:
deployment: aws
posture: cspm
page: 1
perPage: 20
total: 2
schema:
additionalProperties: false
type: object
properties:
items:
items:
$ref: '#/components/schemas/Kibana_HTTP_APIs_managed_integration'
maxItems: 10000
type: array
page:
type: number
perPage:
type: number
total:
type: number
required:
- items
- total
- page
- perPage
description: Indicates a successful response
'400':
content:
application/json:
examples:
genericErrorResponseExample:
description: Example of a generic error response
value:
error: Bad Request
message: An error message describing what went wrong
statusCode: 400
schema:
additionalProperties: false
description: Generic Error
type: object
properties:
attributes: {}
error:
type: string
errorType:
type: string
message:
type: string
statusCode:
type: number
required:
- message
- attributes
description: Bad Request
summary: Get managed integrations
tags:
- Fleet managed integrations
x-state: Experimental; added in 9.5.0
x-metaTags:
- content: Kibana
name: product_name
post:
description: '**Spaces method and path for this operation:**
<div><span class="operation-verb post">post</span> <span class="operation-path">/s/{space_id}/api/fleet/managed_integrations</span></div>
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
Create a managed integration'
operationId: post-fleet-managed-integrations
parameters:
- description: A required header to protect against CSRF attacks
in: header
name: kbn-xsrf
required: true
schema:
example: 'true'
type: string
requestBody:
content:
application/json:
examples:
createManagedIntegrationsRequestExample:
description: Example request to create a managed integration
value:
description: test
inputs:
ESS Billing-cel:
enabled: true
streams:
ess_billing.billing:
enabled: true
vars:
hide_sensitive: true
http_client_timeout: 30s
lookbehind: 365
tags:
- forwarded
- billing
ess_billing.credits:
enabled: false
vars:
api_key: <REPLACE_WITH_YOUR_API_KEY>
organization_id: '1234'
name: ess_billing-1
namespace: default
package:
name: ess_billing
version: 1.6.0
createManagedIntegrationsReuseAWSCloudConnectorExample:
description: Example request to create a managed integration reusing an existing AWS cloud connector
value:
cloud_connector:
cloud_connector_id: existing-aws-connector-id
enabled: true
target_csp: aws
description: CSPM integration for AWS reusing existing cloud connector
inputs:
cspm-cloudbeat/cis_aws:
enabled: true
streams:
cloud_security_posture.findings:
enabled: true
vars:
aws.account_type: organization-account
aws.credentials.type: cloud_connector
aws.supports_cloud_connectors: true
external_id:
id: ABCDEFGHIJKLMNOPQRST
isSecretRef: true
role_arn: arn:aws:iam::123456789012:role/TestRole
vars:
cloud_formation_template: https://console.aws.amazon.com/cloudformation/home#/stacks/quickcreate?templateURL=https://elastic-cspm-cft.s3.eu-central-1.amazonaws.com/cloudformation-cspm-ACCOUNT_TYPE-9.2.0.yml
cspm-cloudbeat/cis_azure:
enabled: false
cspm-cloudbeat/cis_gcp:
enabled: false
name: cspm-aws-reuse-policy
namespace: default
package:
name: cloud_security_posture
version: 3.1.1
vars:
deployment: aws
posture: cspm
createManagedIntegrationsWithAWSCloudConnectorExample:
description: Example request to create a managed integration with AWS cloud connector
value:
cloud_connector:
enabled: true
target_csp: aws
description: CSPM integration for AWS with cloud connector
inputs:
cspm-cloudbeat/cis_aws:
enabled: true
streams:
cloud_security_posture.findings:
enabled: true
vars:
aws.account_type: organization-account
aws.credentials.type: cloud_connector
aws.supports_cloud_connectors: true
external_id:
id: ABCDEFGHIJKLMNOPQRST
isSecretRef: true
role_arn: arn:aws:iam::123456789012:role/TestRole
vars:
cloud_formation_template: https://console.aws.amazon.com/cloudformation/home#/stacks/quickcreate?templateURL=https://elastic-cspm-cft.s3.eu-central-1.amazonaws.com/cloudformation-cspm-ACCOUNT_TYPE-9.2.0.yml
cspm-cloudbeat/cis_azure:
enabled: false
cspm-cloudbeat/cis_gcp:
enabled: false
name: cspm-aws-policy
namespace: default
package:
name: cloud_security_posture
version: 3.1.1
vars:
deployment: aws
posture: cspm
createManagedIntegrationsWithAzureCloudConnectorExample:
description: Example request to create a managed integration with Azure cloud connector
value:
cloud_connector:
enabled: true
target_csp: azure
description: CSPM integration for Azure with cloud connector
inputs:
cspm-cloudbeat/cis_aws:
enabled: false
cspm-cloudbeat/cis_azure:
enabled: true
streams:
cloud_security_posture.findings:
enabled: true
vars:
azure_credentials_cloud_connector_id:
type: text
value: existing-azure-credentials-connector-id
azure.account_type: organization-account
client_id:
id: client-secret-id
isSecretRef: true
tenant_id:
id: tenant-secret-id
isSecretRef: true
cspm-cloudbeat/cis_gcp:
enabled: false
name: cspm-azure-policy
namespace: default
package:
name: cloud_security_posture
version: 3.1.1
vars:
deployment: azure
posture: cspm
schema:
$ref: '#/components/schemas/Kibana_HTTP_APIs_create_managed_integration_request'
responses:
'200':
content:
application/json:
examples:
createManagedIntegrationsResponseExample:
description: Example response for creating a managed integration
value:
item:
created_at: '2025-11-06T18:27:43.541Z'
created_by: test_user
description: test
id: d52a7812-5736-4fdc-aed8-72152afa1ffa
inputs:
ESS Billing-cel:
enabled: true
streams:
ess_billing.billing:
enabled: true
vars:
hide_sensitive: true
http_client_timeout: 30s
lookbehind: 365
tags:
- forwarded
- billing
ess_billing.credits:
enabled: false
vars:
api_key:
id: QY1sWpoBbWcMW-edr0Ee
isSecretRef: true
organization_id: '1234'
url: https://billing.elastic-cloud.com
name: ess_billing-1
namespace: default
package:
name: ess_billing
title: Elasticsearch Service Billing
version: 1.6.0
updated_at: '2025-11-06T18:27:43.541Z'
updated_by: test_user
createManagedIntegrationsWithAWSCloudConnectorResponseExample:
description: Example response for AWS cloud connector integration
value:
item:
cloud_connector:
cloud_connector_id: aws-connector-67890
enabled: true
created_at: '2025-11-06T18:27:43.541Z'
created_by: test_user
description: CSPM integration for AWS with cloud connector
id: aws-policy-12345
inputs:
cspm-cloudbeat/cis_aws:
enabled: true
streams:
cloud_security_posture.findings:
enabled: true
vars:
aws.account_type: organization-account
aws.credentials.type: cloud_connector
external_id:
id: secret-external-id-123
isSecretRef: true
role_arn: arn:aws:iam::123456789012:role/TestRole
vars:
cloud_formation_template: https://console.aws.amazon.com/cloudformation/home#/stacks/quickcreate?templateURL=https://elastic-cspm-cft.s3.eu-central-1.amazonaws.com/cloudformation-cspm-ACCOUNT_TYPE-9.2.0.yml
cspm-cloudbeat/cis_azure:
enabled: false
cspm-cloudbeat/cis_gcp:
enabled: false
name: cspm-aws-policy
namespace: default
package:
name: cloud_security_posture
title: Cloud Security Posture Management
version: 3.1.1
updated_at: '2025-11-06T18:27:43.541Z'
updated_by: test_user
vars:
deployment: aws
posture: cspm
createManagedIntegrationsWithAzureCloudConnectorResponseExample:
description: Example response for Azure cloud connector integration
value:
item:
cloud_connector:
cloud_connector_id: azure-connector-67890
enabled: true
created_at: '2025-11-06T18:27:43.541Z'
created_by: test_user
description: CSPM integration for Azure with cloud connector
id: azure-policy-12345
inputs:
cspm-cloudbeat/cis_aws:
enabled: false
cspm-cloudbeat/cis_azure:
enabled: true
streams:
cloud_security_posture.findings:
enabled: true
vars:
azure_credentials_cloud_connector_id:
type: text
value: existing-azure-credentials-connector-id
azure.account_type: organization-account
client_id:
id: client-secret-id-456
isSecretRef: true
tenant_id:
id: tenant-secret-id-123
isSecretRef: true
cspm-cloudbeat/cis_gcp:
enabled: false
name: cspm-azure-policy
namespace: default
package:
name: cloud_security_posture
title: Cloud Security Posture Management
version: 3.1.1
updated_at: '2025-11-06T18:27:43.541Z'
updated_by: test_user
vars:
deployment: azure
posture: cspm
schema:
$ref: '#/components/schemas/Kibana_HTTP_APIs_managed_integration_response'
description: Indicates a successful response
'400':
content:
application/json:
examples:
genericErrorResponseExample:
description: Example of a generic error response
value:
error: Bad Request
message: An error message describing what went wrong
statusCode: 400
schema:
additionalProperties: false
description: Generic Error
type: object
properties:
attributes: {}
error:
type: string
errorType:
type: string
message:
type: string
statusCode:
type: number
required:
- message
- attributes
description: Bad Request
'409':
content:
application/json:
examples:
conflictErrorResponseExample:
description: Example of a conflict error response
value:
error: Conflict
message: An error message describing what went wrong
statusCode: 409
schema:
additionalProperties: false
description: Generic Error
type: object
properties:
attributes: {}
error:
type: string
errorType:
type: string
message:
type: string
statusCode:
type: number
required:
- message
- attributes
description: Conflict
summary: Create a managed integration
tags:
- Fleet managed integrations
x-state: Experimental; added in 9.3.0
x-metaTags:
- content: Kibana
name: product_name
/api/fleet/managed_integrations/_upgrade:
post:
description: '**Spaces method and path for this operation:**
<div><span class="operation-verb post">post</span> <span class="operation-path">/s/{space_id}/api/fleet/managed_integrations/_upgrade</span></div>
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
Upgrade multiple managed integrations to their installed package version, migrating each package policy''s config onto the new schema. Always returns 200 with a per-policy result array; a missing id, or an id that is not a managed integration, is reported as a per-item failure (`success: false` + `statusCode`) without failing the batch, so valid ids are still upgraded. A successful result means the policy''s saved object was upgraded, while the agentless deployment is reconciled asynchronously in the background. Policies already at the installed version are a genuine no-op: they still report `success: true` (calls stay idempotent) but nothing is re-persisted or redeployed. Note: agent-policy-level agentless settings (resources, ownership tags) are not re-derived from the new package version — use the update (PUT) endpoint for those.'
operationId: post-fleet-managed-integrations-upgrade
parameters:
- description: A required header to protect against CSRF attacks
in: header
name: kbn-xsrf
required: true
schema:
example: 'true'
type: string
requestBody:
content:
application/json:
examples:
upgradeManagedIntegrationsRequestExample:
description: Bulk upgrade managed integrations to their installed package version
value:
policyIds:
- d52a7812-5736-4fdc-aed8-72152afa1ffa
- aws-policy-12345
schema:
$ref: '#/components/schemas/Kibana_HTTP_APIs_bulk_upgrade_managed_integrations_request'
responses:
'200':
content:
application/json:
examples:
upgradeManagedIntegrationsPartialFailureResponseExample:
description: Example response where one managed integration upgraded and another id was missing or not a managed integration (the batch still returns 200)
value:
- id: d52a7812-5736-4fdc-aed8-72152afa1ffa
name: ess_billing-1
success: true
- body:
message: Agentless policy aws-policy-12345 not found
id: aws-policy-12345
statusCode: 404
success: false
upgradeManagedIntegrationsResponseExample:
description: Example response where every policy was upgraded
value:
- id: d52a7812-5736-4fdc-aed8-72152afa1ffa
name: ess_billing-1
success: true
- id: aws-policy-12345
name: cspm-aws-policy
success: true
schema:
items:
$ref: '#/components/schemas/Kibana_HTTP_APIs_bulk_upgrade_managed_integration_result'
maxItems: 10000
type: array
description: 'Indicates a successful response. Each item reports the per-policy upgrade outcome; inspect every item''s `success` flag. A missing id, or an id that is not a managed integration, is reported as a per-item failure (`success: false` + `statusCode`) without failing the batch.'
'400':
content:
application/json:
examples:
genericErrorResponseExample:
description: Example of a generic error response
value:
error: Bad Request
message: An error message describing what went wrong
statusCode: 400
schema:
additionalProperties: false
description: Generic Error
type: object
properties:
attributes: {}
error:
type: string
errorType:
type: string
message:
type: string
statusCode:
type: number
required:
- message
- attributes
description: Bad Request
summary: Bulk upgrade managed integrations
tags:
- Fleet managed integrations
x-state: Experimental; added in 9.5.0
x-metaTags:
- content: Kibana
name: product_name
/api/fleet/managed_integrations/_upgrade/dryrun:
post:
description: '**Spaces method and path for this operation:**
<div><span class="operation-verb post">post</span> <span class="operation-path">/s/{space_id}/api/fleet/managed_integrations/_upgrade/dryrun</span></div>
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
Preview upgrading multiple managed integrations without applying any change. Targets the installed package version by default; pass `pkgVersion` to preview a specific (for example, not-yet-installed) version. Each result returns the current/proposed version and any migration errors, plus — only on a clean dry-run (`hasErrors: false`) — the migrated `proposedPolicy`. `proposedPolicy` is for the edit-and-upgrade flow (edit it, then save via the update (PUT) endpoint); to apply an upgrade as-is, use `_upgrade`.'
operationId: post-fleet-managed-integrations-upgrade-dryrun
parameters:
- description: A required header to protect against CSRF attacks
in: header
name: kbn-xsrf
required: true
schema:
example: 'true'
type: string
requestBody:
content:
application/json:
examples:
upgradeManagedIntegrationsDryRunRequestExample:
description: Preview the upgrade of managed integrations to their installed package version
value:
policyIds:
- d52a7812-5736-4fdc-aed8-72152afa1ffa
upgradeManagedIntegrationsDryRunTargetVersionRequestExample:
description: Preview the upgrade against an explicit target package version (for example, before installing the new version). Defaults to the installed package version when omitted.
value:
pkgVersion: 1.6.0
policyIds:
- d52a7812-5736-4fdc-aed8-72152afa1ffa
schema:
$ref: '#/components/schemas/Kibana_HTTP_APIs_managed_integration_upgrade_dry_run_request'
responses:
'200':
content:
application/json:
examples:
upgradeManagedIntegrationsDryRunMigrationErrorsExample:
description: Example dry-run response where migrating the config to the new version produced errors. `hasErrors` is true and `errors` explains why; do not feed the (partial) proposed config into the update endpoint without resolving them.
value:
- currentVersion: 1.5.0
errors:
- message: Variable "organization_id" is required
hasErrors: true
id: d52a7812-5736-4fdc-aed8-72152afa1ffa
name: ess_billing-1
proposedVersion: 1.6.0
upgradeManagedIntegrationsDryRunMixedResponseExample:
description: 'Example dry-run response for a mixed batch: one managed integration previews cleanly while two ids are missing or not managed integrations. Ids that are missing or not managed integrations are surfaced as per-item failures (`hasErrors: true` + `statusCode`) without failing the batch, and results stay in request order.'
value:
- currentVersion: 0.5.0
hasErrors: false
id: 2e426392-f856-4ab2-bc31-92d4dbb8d134
name: agentless_hello_world-16
proposedPolicy:
cloud_connector: null
created_at: '2026-07-01T15:59:08.299Z'
created_by: admin
description: ''
id: 2e426392-f856-4ab2-bc31-92d4dbb8d134
inputs:
agentless_hello_world-cel:
enabled: true
streams:
agentless_hello_world.generic:
enabled: true
vars:
url: https://epr.elastic.co
agentless_hello_world.mock_counter:
# --- truncated at 32 KB (85 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/elk-stack/refs/heads/main/openapi/elk-stack-fleet-managed-integrations-api-openapi.yml