Elastic Stack

Elastic Stack (ELK Stack) Security AI Assistant API

Manage and interact with Security Assistant resources.

GitHub OpenAPI

Operations 21

Each operation below carries the questions people ask an LLM about it and the instructions they give an agent to run it. Generated by API Evangelist overlay

POST /api/security_ai_assistant/anonymization_fields/_bulk_action Bulk create, update or delete anonymization fields · Apply a bulk action to anonymization fields #
Ask an LLM
“Can I change which fields the Security AI Assistant anonymizes in one batch?”
“Is there a way to delete several anonymization fields at once?”
Tell an agent
Create these anonymization fields in bulk: {create}.
Update anonymization fields {update} and delete {delete} in one bulk action.
GET /api/security_ai_assistant/anonymization_fields/_find List anonymization fields · Get anonymization fields #
Ask an LLM
“Which fields does the security AI assistant anonymize before sending to the model?”
“Can I filter and sort the anonymization field list?”
Tell an agent
List all anonymization fields.
Find anonymization fields matching {filter}, sorted by {sort_field}.
POST /api/security_ai_assistant/chat/complete Get a model response from the security assistant · Create a model response #
Ask an LLM
“How do I send messages to the Elastic Security AI Assistant and get an answer back?”
“Can the assistant's response be streamed?”
Tell an agent
Send {messages} to the assistant through connector {connectorId} and persist it: {persist}.
Ask the security assistant {messages} via connector {connectorId} in conversation {conversationId}, persist {persist}.
DELETE /api/security_ai_assistant/current_user/conversations Delete all my assistant conversations · Delete conversations #
Ask an LLM
“Can I clear my entire security assistant chat history?”
“Is it possible to delete all conversations except a few I want to keep?”
Tell an agent destructive · confirm first
Delete all of my assistant conversations.
Delete every conversation except {excludedIds}.
POST /api/security_ai_assistant/current_user/conversations Start a new assistant conversation · Create a conversation #
Ask an LLM
“Can I create a saved conversation with the security AI assistant ahead of time?”
“What does a new assistant conversation need besides a title?”
Tell an agent
Create a conversation titled {title}.
Start a new assistant conversation {title} in category {category}.
GET /api/security_ai_assistant/current_user/conversations/_find Search my assistant conversations · Get conversations #
Ask an LLM
“What conversations have I had with the security AI assistant?”
“Can I list only conversations I own?”
Tell an agent
List my assistant conversations.
Find conversations matching {filter}, page {page}.
DELETE /api/security_ai_assistant/current_user/conversations/{id} Delete one assistant conversation · Delete a conversation #
Ask an LLM
“Can I delete a single chat with the security assistant?”
“What removes one specific conversation from my history?”
Tell an agent destructive · confirm first
Delete conversation {id}.
Remove assistant chat {id} from my history.
GET /api/security_ai_assistant/current_user/conversations/{id} Get an assistant conversation · Get a conversation #
Ask an LLM
“Can I pull up the full message history of one assistant conversation?”
“What's in a specific security assistant chat?”
Tell an agent
Show conversation {id}.
Get the messages in assistant conversation {id}.
PUT /api/security_ai_assistant/current_user/conversations/{id} Update an assistant conversation · Update a conversation #
Ask an LLM
“Can I rename an existing assistant conversation?”
“Is it possible to change the connector config on a conversation I already have?”
Tell an agent
Rename conversation {id} to {title}.
Update existing conversation {id} to use API config {apiConfig}.
GET /api/security_ai_assistant/knowledge_base Check the assistant's knowledge base status · Read a KnowledgeBase #
Ask an LLM
“Is the security AI assistant's knowledge base set up?”
“What's the current state of the assistant knowledge base?”
Tell an agent
Show the knowledge base status.
Check whether the security assistant knowledge base is ready.
POST /api/security_ai_assistant/knowledge_base Set up the assistant knowledge base · Create a KnowledgeBase #
Ask an LLM
“How do I install the knowledge base for the security AI assistant?”
“Can I skip loading Security Labs content when setting it up?”
Tell an agent
Set up the knowledge base using model {modelId}.
Create the assistant knowledge base, ignoring Security Labs: {ignoreSecurityLabs}.
GET /api/security_ai_assistant/knowledge_base/{resource} Check knowledge base status for a resource · Read a KnowledgeBase for a resource #
Ask an LLM
“Is the knowledge base ready for a particular resource?”
“Can I check a resource-specific knowledge base instead of the default?”
Tell an agent
Show knowledge base status for resource {resource}.
Check whether the {resource} knowledge base is installed.
POST /api/security_ai_assistant/knowledge_base/{resource} Set up the knowledge base for a resource · Create a KnowledgeBase for a resource #
Ask an LLM
“Can I create a knowledge base for one specific resource?”
“What model does a resource knowledge base use when I install it?”
Tell an agent
Create the knowledge base for resource {resource}.
Install the {resource} knowledge base with model {modelId}.
POST /api/security_ai_assistant/knowledge_base/entries Add a knowledge base entry · Create a Knowledge Base Entry #
Ask an LLM
“How do I teach the security assistant a new fact or document?”
“Can I add a single entry to the knowledge base?”
Tell an agent
Add a new knowledge base entry with this content.
Create one knowledge base entry for the security assistant.
POST /api/security_ai_assistant/knowledge_base/entries/_bulk_action Bulk manage knowledge base entries · Applies a bulk action to multiple Knowledge Base Entries #
Ask an LLM
“Can I add, edit and remove many knowledge base entries in one request?”
“What's the bulk option for knowledge base entries?”
Tell an agent
Bulk create knowledge base entries {create}.
Bulk delete knowledge base entries {delete} and update {update}.
GET /api/security_ai_assistant/knowledge_base/entries/_find Search knowledge base entries · Finds Knowledge Base Entries that match the given query #
Ask an LLM
“Which entries are in the security assistant's knowledge base?”
“Can I filter knowledge base entries by a query?”
Tell an agent
List knowledge base entries.
Find knowledge base entries matching {filter}, {per_page} per page.
DELETE /api/security_ai_assistant/knowledge_base/entries/{id} Delete a knowledge base entry · Deletes a single Knowledge Base Entry using the `id` field #
Ask an LLM
“Can I remove one outdated entry from the assistant's knowledge base?”
“What deletes a single knowledge base entry by ID?”
Tell an agent destructive · confirm first
Delete knowledge base entry {id}.
Remove outdated entry {id} from the knowledge base.
GET /api/security_ai_assistant/knowledge_base/entries/{id} Get a knowledge base entry · Read a Knowledge Base Entry #
Ask an LLM
“What does a specific knowledge base entry contain?”
“Can I read one entry by its ID?”
Tell an agent
Show knowledge base entry {id}.
Get the content of entry {id}.
PUT /api/security_ai_assistant/knowledge_base/entries/{id} Update a knowledge base entry · Update a Knowledge Base Entry #
Ask an LLM
“Can I edit a knowledge base entry that already exists?”
“How is a single knowledge base entry's content changed?”
Tell an agent
Update knowledge base entry {id}.
Replace the content of existing entry {id} with this text.
POST /api/security_ai_assistant/prompts/_bulk_action Bulk create, update or delete prompts · Apply a bulk action to prompts #
Ask an LLM
“Can I manage many security assistant prompts in one request?”
“Is there a way to delete several saved prompts together?”
Tell an agent
Bulk create prompts {create}.
Update prompts {update} and delete prompts {delete}.
GET /api/security_ai_assistant/prompts/_find List assistant prompts · Get prompts #
Ask an LLM
“Which system and quick prompts are saved for the security assistant?”
“Can I sort and page through saved prompts?”
Tell an agent
List all saved prompts.
Find prompts matching {filter} sorted by {sort_field} {sort_order}.

Documentation

📖
Documentation
https://www.elastic.co/docs/reference/elasticsearch
📖
APIReference
https://www.elastic.co/docs/api/doc/elasticsearch/
📖
Documentation
https://www.elastic.co/docs/reference/kibana
📖
APIReference
https://www.elastic.co/docs/api/doc/kibana/

Specifications

⚙
OpenAPI
https://raw.githubusercontent.com/api-evangelist/elk-stack/refs/heads/main/openapi/elk-stack-security-ai-assistant-api-api-openapi.yml

Other Resources

🔗
SourceCode
https://github.com/elastic/elasticsearch-specification
🔗
SourceCode
https://github.com/elastic/kibana
🔗
ToolCrosswalk
https://raw.githubusercontent.com/api-evangelist/elk-stack/refs/heads/main/mcp/elk-stack-tool-crosswalk.yml

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this
  • find_apisBrowse and filter every API in the catalog.
  • get_api_artifactsOne API's artifacts, grouped by type.
  • get_openapiThe primary OpenAPI for this API.
  • find_similar_apisAPIs that look like this one.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This API 
curl "https://apis.io/api/v1/apis/elk-stack:elk-stack-security-ai-assistant-api-api"
All apis 
curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

elk-stack-security-ai-assistant-api-api-openapi.yml Raw ↑ 
openapi: 3.2.0
info:
  contact:
    name: Kibana Team
  description: The Kibana REST APIs enable you to manage resources such as connectors, data views, and saved objects.
  title: Kibana Security AI Assistant API
  version: ''
  x-doc-license:
    name: Attribution-NonCommercial-NoDerivatives 4.0 International
    url: https://creativecommons.org/licenses/by-nc-nd/4.0/
  x-feedbackLink:
    label: Feedback
    url: https://github.com/elastic/docs-content/issues/new?assignees=&labels=feedback%2Ccommunity&projects=&template=api-feedback.yaml&title=%5BFeedback%5D%3A+
servers:
- url: https://{kibana_url}
  variables:
    kibana_url:
      default: localhost:5601
security:
- apiKeyAuth: []
- basicAuth: []
tags:


# --- truncated at 32 KB (144 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/elk-stack/refs/heads/main/openapi/elk-stack-security-ai-assistant-api-api-openapi.yml