Kibana connectors API
Connectors provide a central place to store connection information for services and integrations with Elastic or third party systems. Alerting rules can use connectors to run actions when rule conditions are met.
OpenAPI Specification
openapi: 3.0.3
info:
contact:
name: Kibana Team
description: 'The Kibana REST APIs enable you to manage resources such as connectors, data views, and saved objects.
The API calls are stateless.
Each request that you make happens in isolation from other calls and must include all of the necessary information for Kibana to fulfill the
request.
API requests return JSON output, which is a format that is machine-readable and works well for automation.
To interact with Kibana APIs, use the following operations:
- GET: Fetches the information.
- PATCH: Applies partial modifications to the existing information.
- POST: Adds new information.
- PUT: Updates the existing information.
- DELETE: Removes the information.
You can prepend any Kibana API endpoint with `kbn:` and run the request in **Dev Tools → Console**.
For example:
```
GET kbn:/api/data_views
```
For more information about the console, refer to [Run API requests](https://www.elastic.co/docs/explore-analyze/query-filter/tools/console).
NOTE: Access to internal Kibana API endpoints will be restricted in Kibana version 9.0. Please move any integrations to publicly documented APIs.
## Documentation source and versions
This documentation is derived from the `main` branch of the [kibana](https://github.com/elastic/kibana) repository.
It is provided under license [Attribution-NonCommercial-NoDerivatives 4.0 International](https://creativecommons.org/licenses/by-nc-nd/4.0/).
This documentation contains work-in-progress information for future Elastic Stack releases.
'
title: Kibana APIs Actions connectors API
version: ''
x-doc-license:
name: Attribution-NonCommercial-NoDerivatives 4.0 International
url: https://creativecommons.org/licenses/by-nc-nd/4.0/
x-feedbackLink:
label: Feedback
url: https://github.com/elastic/docs-content/issues/new?assignees=&labels=feedback%2Ccommunity&projects=&template=api-feedback.yaml&title=%5BFeedback%5D%3A+
servers:
- url: https://{kibana_url}
variables:
kibana_url:
default: localhost:5601
security:
- apiKeyAuth: []
- basicAuth: []
tags:
- name: connectors
description: 'Connectors provide a central place to store connection information for services and integrations with Elastic or third party systems. Alerting rules can use connectors to run actions when rule conditions are met.
'
externalDocs:
description: Connector documentation
url: https://www.elastic.co/docs/reference/kibana/connectors-kibana
x-displayName: Connectors
paths:
/api/actions/connector_types:
get:
description: '**Spaces method and path for this operation:**
<div><span class="operation-verb get">get</span> <span class="operation-path">/s/{space_id}/api/actions/connector_types</span></div>
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
You do not need any Kibana feature privileges to run this API.'
operationId: get-actions-connector-types
parameters:
- description: A filter to limit the retrieved connector types to those that support a specific feature (such as alerting or cases).
in: query
name: feature_id
required: false
schema:
type: string
responses:
'200':
content:
application/json:
schema:
items:
additionalProperties: false
type: object
properties:
allow_multiple_system_actions:
description: Indicates whether multiple instances of the same system action connector can be used in a single rule.
type: boolean
enabled:
description: Indicates whether the connector is enabled.
type: boolean
enabled_in_config:
description: Indicates whether the connector is enabled in the Kibana configuration.
type: boolean
enabled_in_license:
description: Indicates whether the connector is enabled through the license.
type: boolean
id:
description: The identifier for the connector.
type: string
is_deprecated:
description: Indicates whether the connector type is deprecated.
type: boolean
is_system_action_type:
description: Indicates whether the action is a system action.
type: boolean
minimum_license_required:
description: The minimum license required to enable the connector.
enum:
- basic
- standard
- gold
- platinum
- enterprise
- trial
type: string
name:
description: The name of the connector type.
type: string
source:
description: The source of the connector type definition.
enum:
- yml
- spec
- stack
type: string
sub_feature:
description: Indicates the sub-feature type the connector is grouped under.
enum:
- endpointSecurity
type: string
supported_feature_ids:
description: The list of supported features
items:
type: string
type: array
required:
- id
- name
- enabled
- enabled_in_config
- enabled_in_license
- minimum_license_required
- supported_feature_ids
- is_system_action_type
- is_deprecated
- source
type: array
examples:
getConnectorTypesServerlessResponse:
$ref: '#/components/examples/get_connector_types_generativeai_response'
description: Indicates a successful call.
'403':
description: Indicates that this call is forbidden.
summary: Get connector types
tags:
- connectors
x-metaTags:
- content: Kibana
name: product_name
/api/actions/connector/_oauth_callback:
get:
description: '**Spaces method and path for this operation:**
<div><span class="operation-verb get">get</span> <span class="operation-path">/s/{space_id}/api/actions/connector/_oauth_callback</span></div>
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
Handles the OAuth 2.0 authorization code callback from external providers. Exchanges the authorization code for access and refresh tokens.<br/><br/>[Required authorization] Route required privileges: actions:oauth.'
operationId: get-actions-connector-oauth-callback
parameters:
- description: The authorization code returned by the OAuth provider.
in: query
name: code
required: false
schema:
type: string
- description: The state parameter for CSRF protection.
in: query
name: state
required: false
schema:
type: string
- description: Error code if the authorization failed.
in: query
name: error
required: false
schema:
type: string
- description: Human-readable error description.
in: query
name: error_description
required: false
schema:
type: string
- description: Session state from the OAuth provider (e.g., Microsoft).
in: query
name: session_state
required: false
schema:
type: string
responses:
'200':
description: Returns an HTML callback page.
'302':
description: Redirects to the return URL with authorization result query parameters.
'401':
description: User is not authenticated.
summary: Handle OAuth callback
tags:
- connectors
x-state: Added in 9.4.0
x-metaTags:
- content: Kibana
name: product_name
/api/actions/connector/{id}:
delete:
description: '**Spaces method and path for this operation:**
<div><span class="operation-verb delete">delete</span> <span class="operation-path">/s/{space_id}/api/actions/connector/{id}</span></div>
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
WARNING: When you delete a connector, it cannot be recovered.'
operationId: delete-actions-connector-id
parameters:
- description: A required header to protect against CSRF attacks
in: header
name: kbn-xsrf
required: true
schema:
example: 'true'
type: string
- description: An identifier for the connector.
in: path
name: id
required: true
schema:
type: string
responses:
'204':
description: Indicates a successful call.
'403':
description: Indicates that this call is forbidden.
summary: Delete a connector
tags:
- connectors
x-metaTags:
- content: Kibana
name: product_name
get:
operationId: get-actions-connector-id
parameters:
- description: An identifier for the connector.
in: path
name: id
required: true
schema:
type: string
responses:
'200':
content:
application/json:
schema:
additionalProperties: false
type: object
properties:
auth_mode:
description: The authentication mode used for the connector.
enum:
- shared
- per-user
type: string
config:
additionalProperties:
nullable: true
type: object
connector_type_id:
description: The connector type identifier.
type: string
id:
description: The identifier for the connector.
type: string
is_connector_type_deprecated:
description: Indicates whether the connector type is deprecated.
type: boolean
is_deprecated:
description: Indicates whether the connector is deprecated.
type: boolean
is_missing_secrets:
description: Indicates whether the connector is missing secrets.
type: boolean
is_preconfigured:
description: 'Indicates whether the connector is preconfigured. If true, the `config` and `is_missing_secrets` properties are omitted from the response. '
type: boolean
is_system_action:
description: Indicates whether the connector is used for system actions.
type: boolean
name:
description: ' The name of the connector.'
type: string
required:
- id
- name
- connector_type_id
- is_preconfigured
- is_deprecated
- is_system_action
- is_connector_type_deprecated
examples:
getConnectorResponse:
$ref: '#/components/examples/get_connector_response'
description: Indicates a successful call.
'403':
description: Indicates that this call is forbidden.
summary: Get connector information
tags:
- connectors
x-metaTags:
- content: Kibana
name: product_name
description: '**Spaces method and path for this operation:**
<div><span class="operation-verb get">get</span> <span class="operation-path">/s/{space_id}/api/actions/connector/{id}</span></div>
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.'
post:
operationId: post-actions-connector-id
parameters:
- description: A required header to protect against CSRF attacks
in: header
name: kbn-xsrf
required: true
schema:
example: 'true'
type: string
- description: An identifier for the connector.
in: path
name: id
required: true
schema:
maxLength: 36
minLength: 1
type: string
requestBody:
content:
application/json:
schema:
additionalProperties: false
type: object
properties:
connector_type_id:
description: The type of connector.
type: string
name:
description: The display name for the connector.
type: string
config:
additionalProperties: {}
default: {}
description: The connector configuration details.
oneOf:
- $ref: '#/components/schemas/bedrock_config'
- $ref: '#/components/schemas/crowdstrike_config'
- $ref: '#/components/schemas/d3security_config'
- $ref: '#/components/schemas/email_config'
- $ref: '#/components/schemas/gemini_config'
- $ref: '#/components/schemas/resilient_config'
- $ref: '#/components/schemas/index_config'
- $ref: '#/components/schemas/jira_config'
- $ref: '#/components/schemas/genai_azure_config'
- $ref: '#/components/schemas/genai_openai_config'
- $ref: '#/components/schemas/genai_openai_other_config'
- $ref: '#/components/schemas/opsgenie_config'
- $ref: '#/components/schemas/pagerduty_config'
- $ref: '#/components/schemas/sentinelone_config'
- $ref: '#/components/schemas/servicenow_config'
- $ref: '#/components/schemas/servicenow_itom_config'
- $ref: '#/components/schemas/slack_api_config'
- $ref: '#/components/schemas/swimlane_config'
- $ref: '#/components/schemas/thehive_config'
- $ref: '#/components/schemas/tines_config'
- $ref: '#/components/schemas/torq_config'
- $ref: '#/components/schemas/webhook_config'
- $ref: '#/components/schemas/cases_webhook_config'
- $ref: '#/components/schemas/xmatters_config'
secrets:
additionalProperties: {}
default: {}
oneOf:
- $ref: '#/components/schemas/bedrock_secrets'
- $ref: '#/components/schemas/crowdstrike_secrets'
- $ref: '#/components/schemas/d3security_secrets'
- $ref: '#/components/schemas/email_secrets'
- $ref: '#/components/schemas/gemini_secrets'
- $ref: '#/components/schemas/resilient_secrets'
- $ref: '#/components/schemas/jira_secrets'
- $ref: '#/components/schemas/defender_secrets'
- $ref: '#/components/schemas/teams_secrets'
- $ref: '#/components/schemas/genai_secrets'
- $ref: '#/components/schemas/opsgenie_secrets'
- $ref: '#/components/schemas/pagerduty_secrets'
- $ref: '#/components/schemas/sentinelone_secrets'
- $ref: '#/components/schemas/servicenow_secrets'
- $ref: '#/components/schemas/slack_api_secrets'
- $ref: '#/components/schemas/swimlane_secrets'
- $ref: '#/components/schemas/thehive_secrets'
- $ref: '#/components/schemas/tines_secrets'
- $ref: '#/components/schemas/torq_secrets'
- $ref: '#/components/schemas/webhook_secrets'
- $ref: '#/components/schemas/cases_webhook_secrets'
- $ref: '#/components/schemas/xmatters_secrets'
required:
- name
- connector_type_id
examples:
createEmailConnectorRequest:
$ref: '#/components/examples/create_email_connector_request'
createIndexConnectorRequest:
$ref: '#/components/examples/create_index_connector_request'
createWebhookConnectorRequest:
$ref: '#/components/examples/create_webhook_connector_request'
createXmattersConnectorRequest:
$ref: '#/components/examples/create_xmatters_connector_request'
responses:
'200':
content:
application/json:
schema:
additionalProperties: false
type: object
properties:
auth_mode:
description: The authentication mode used for the connector.
enum:
- shared
- per-user
type: string
config:
additionalProperties:
nullable: true
type: object
connector_type_id:
description: The connector type identifier.
type: string
id:
description: The identifier for the connector.
type: string
is_connector_type_deprecated:
description: Indicates whether the connector type is deprecated.
type: boolean
is_deprecated:
description: Indicates whether the connector is deprecated.
type: boolean
is_missing_secrets:
description: Indicates whether the connector is missing secrets.
type: boolean
is_preconfigured:
description: 'Indicates whether the connector is preconfigured. If true, the `config` and `is_missing_secrets` properties are omitted from the response. '
type: boolean
is_system_action:
description: Indicates whether the connector is used for system actions.
type: boolean
name:
description: ' The name of the connector.'
type: string
required:
- id
- name
- connector_type_id
- is_preconfigured
- is_deprecated
- is_system_action
- is_connector_type_deprecated
examples:
createEmailConnectorResponse:
$ref: '#/components/examples/create_email_connector_response'
createIndexConnectorResponse:
$ref: '#/components/examples/create_index_connector_response'
createWebhookConnectorResponse:
$ref: '#/components/examples/create_webhook_connector_response'
createXmattersConnectorResponse:
$ref: '#/components/examples/get_connector_response'
description: Indicates a successful call.
'403':
description: Indicates that this call is forbidden.
summary: Create a connector
tags:
- connectors
x-metaTags:
- content: Kibana
name: product_name
description: '**Spaces method and path for this operation:**
<div><span class="operation-verb post">post</span> <span class="operation-path">/s/{space_id}/api/actions/connector/{id}</span></div>
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.'
put:
operationId: put-actions-connector-id
parameters:
- description: A required header to protect against CSRF attacks
in: header
name: kbn-xsrf
required: true
schema:
example: 'true'
type: string
- description: An identifier for the connector.
in: path
name: id
required: true
schema:
type: string
requestBody:
content:
application/json:
schema:
additionalProperties: false
type: object
properties:
name:
description: The display name for the connector.
type: string
config:
additionalProperties: {}
default: {}
description: The connector configuration details.
oneOf:
- $ref: '#/components/schemas/bedrock_config'
- $ref: '#/components/schemas/crowdstrike_config'
- $ref: '#/components/schemas/d3security_config'
- $ref: '#/components/schemas/email_config'
- $ref: '#/components/schemas/gemini_config'
- $ref: '#/components/schemas/resilient_config'
- $ref: '#/components/schemas/index_config'
- $ref: '#/components/schemas/jira_config'
- $ref: '#/components/schemas/defender_config'
- $ref: '#/components/schemas/genai_azure_config'
- $ref: '#/components/schemas/genai_openai_config'
- $ref: '#/components/schemas/opsgenie_config'
- $ref: '#/components/schemas/pagerduty_config'
- $ref: '#/components/schemas/sentinelone_config'
- $ref: '#/components/schemas/servicenow_config'
- $ref: '#/components/schemas/servicenow_itom_config'
- $ref: '#/components/schemas/slack_api_config'
- $ref: '#/components/schemas/swimlane_config'
- $ref: '#/components/schemas/thehive_config'
- $ref: '#/components/schemas/tines_config'
- $ref: '#/components/schemas/torq_config'
- $ref: '#/components/schemas/webhook_config'
- $ref: '#/components/schemas/cases_webhook_config'
- $ref: '#/components/schemas/xmatters_config'
secrets:
additionalProperties: {}
default: {}
oneOf:
- $ref: '#/components/schemas/bedrock_secrets'
- $ref: '#/components/schemas/crowdstrike_secrets'
- $ref: '#/components/schemas/d3security_secrets'
- $ref: '#/components/schemas/email_secrets'
- $ref: '#/components/schemas/gemini_secrets'
- $ref: '#/components/schemas/resilient_secrets'
- $ref: '#/components/schemas/jira_secrets'
- $ref: '#/components/schemas/teams_secrets'
- $ref: '#/components/schemas/genai_secrets'
- $ref: '#/components/schemas/opsgenie_secrets'
- $ref: '#/components/schemas/pagerduty_secrets'
- $ref: '#/components/schemas/sentinelone_secrets'
- $ref: '#/components/schemas/servicenow_secrets'
- $ref: '#/components/schemas/slack_api_secrets'
- $ref: '#/components/schemas/swimlane_secrets'
- $ref: '#/components/schemas/thehive_secrets'
- $ref: '#/components/schemas/tines_secrets'
- $ref: '#/components/schemas/torq_secrets'
- $ref: '#/components/schemas/webhook_secrets'
- $ref: '#/components/schemas/cases_webhook_secrets'
- $ref: '#/components/schemas/xmatters_secrets'
required:
- name
examples:
updateIndexConnectorRequest:
$ref: '#/components/examples/update_index_connector_request'
responses:
'200':
content:
application/json:
schema:
additionalProperties: false
type: object
properties:
auth_mode:
description: The authentication mode used for the connector.
enum:
- shared
- per-user
type: string
config:
additionalProperties:
nullable: true
type: object
connector_type_id:
description: The connector type identifier.
type: string
id:
description: The identifier for the connector.
type: string
is_connector_type_deprecated:
description: Indicates whether the connector type is deprecated.
type: boolean
is_deprecated:
description: Indicates whether the connector is deprecated.
type: boolean
is_missing_secrets:
description: Indicates whether the connector is missing secrets.
type: boolean
is_preconfigured:
description: 'Indicates whether the connector is preconfigured. If true, the `config` and `is_missing_secrets` properties are omitted from the response. '
type: boolean
is_system_action:
description: Indicates whether the connector is used for system actions.
type: boolean
name:
description: ' The name of the connector.'
type: string
required:
- id
- name
- connector_type_id
- is_preconfigured
- is_deprecated
- is_system_action
- is_connector_type_deprecated
description: Indicates a successful call.
'403':
description: Indicates that this call is forbidden.
summary: Update a connector
tags:
- connectors
x-metaTags:
- content: Kibana
name: product_name
description: '**Spaces method and path for this operation:**
<div><span class="operation-verb put">put</span> <span class="operation-path">/s/{space_id}/api/actions/connector/{id}</span></div>
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.'
/api/actions/connector/{id}/_execute:
post:
description: '**Spaces method and path for this operation:**
<div><span class="operation-verb post">post</span> <span class="operation-path">/s/{space_id}/api/actions/connector/{id}/_execute</span></div>
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
You can use this API to test an action that involves interaction with Kibana services or integrations with third-party systems.'
operationId: post-actions-connector-id-execute
parameters:
- description: A required header to protect against CSRF attacks
in: header
name: kbn-xsrf
required: true
schema:
example: 'true'
type: string
- description: An identifier for the connector.
in: path
name: id
required: true
schema:
type: string
requestBody:
content:
application/json:
schema:
additionalProperties: false
type: object
properties:
params:
additionalProperties: {}
oneOf:
- $ref: '#/components/schemas/run_acknowledge_resolve_pagerduty'
- $ref: '#/components/schemas/run_documents'
- $ref: '#/components/schemas/run_message_email'
- $ref: '#/components/schemas/run_message_serverlog'
- $ref: '#/components/schemas/run_message_slack'
- $ref: '#/components/schemas/run_trigger_pagerduty'
- $ref: '#/components/schemas/run_addevent'
- $ref: '#/components/schemas/run_closealert'
- $ref: '#/components/schemas/run_closeincident'
- $ref: '#/components/schemas/run_createalert'
- $ref: '#/components/schemas/run_fieldsbyissuetype'
- $ref: '#/components/schemas/run_getagentdetails'
- $ref: '#/components/schemas/run_getagents'
- $ref: '#/components/schemas/run_getchoices'
- $ref: '#/components/schemas/run_getfields'
- $ref: '#/components/schemas/run_getincident'
- $ref: '#/components/schemas/run_issue'
- $ref: '#/components/schemas/run_issues'
- $ref: '#/components/schemas/run_issuetypes'
- $ref: '#/components/schemas/run_postmessage'
- $ref: '#/components/schemas/run_pushtoservice'
- $ref: '#/components/schemas/run_validchannelid'
required:
- params
examples:
runIndexConnectorRequest:
$ref: '#/components/examples/run_index_connector_request'
runJiraConnectorRequest:
$ref: '#/components/examples/run_jira_connector_request'
runServerLogConnectorRequest:
$ref: '#/components/examples/run_servicenow_itom_connector_request'
runSlackConnectorRequest:
$ref: '#/components/examples/run_slack_api_connector_request'
runSwimlaneConnectorRequest:
$ref: '#/components/examples/run_swimlane_connector_request'
responses:
'200':
content:
application/json:
schema:
additionalProperties: false
type: object
properties:
auth_mode:
description: The authentication mode used for the connector.
enum:
- shared
- per-user
type: string
config:
additionalProperties:
nullable: true
type: object
connector_type_id:
description: The connector type identifier.
type: string
id:
description: The identifier for the connector.
type: string
is_connector_type_deprecated:
description: Indicates whether the connector type is deprecated.
type: boolean
is_deprecated:
description: Indicates whether the connector is deprecated.
type: boolean
is_missing_secrets:
description: Indicates whether the connector is missing secrets.
type: boolean
is_preconfigured:
description: 'Indicates whether the connector is preconfigured. If true, the `config` and `is_missing_secrets` properties are omitted from the response. '
type: boolean
is_system_action:
des
# --- truncated at 32 KB (123 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/kibana/refs/heads/main/openapi/kibana-connectors-api-openapi.yml