Kibana Elastic Agent policies API
Elastic Agent policies APIs enable you to manage agent policies, including creating, updating, and deleting policies, as well as to retrieve agent policy outputs, manifests, and auto-upgrade status information.
OpenAPI Specification
openapi: 3.0.3
info:
contact:
name: Kibana Team
description: 'The Kibana REST APIs enable you to manage resources such as connectors, data views, and saved objects.
The API calls are stateless.
Each request that you make happens in isolation from other calls and must include all of the necessary information for Kibana to fulfill the
request.
API requests return JSON output, which is a format that is machine-readable and works well for automation.
To interact with Kibana APIs, use the following operations:
- GET: Fetches the information.
- PATCH: Applies partial modifications to the existing information.
- POST: Adds new information.
- PUT: Updates the existing information.
- DELETE: Removes the information.
You can prepend any Kibana API endpoint with `kbn:` and run the request in **Dev Tools → Console**.
For example:
```
GET kbn:/api/data_views
```
For more information about the console, refer to [Run API requests](https://www.elastic.co/docs/explore-analyze/query-filter/tools/console).
NOTE: Access to internal Kibana API endpoints will be restricted in Kibana version 9.0. Please move any integrations to publicly documented APIs.
## Documentation source and versions
This documentation is derived from the `main` branch of the [kibana](https://github.com/elastic/kibana) repository.
It is provided under license [Attribution-NonCommercial-NoDerivatives 4.0 International](https://creativecommons.org/licenses/by-nc-nd/4.0/).
This documentation contains work-in-progress information for future Elastic Stack releases.
'
title: Kibana APIs Actions Elastic Agent policies API
version: ''
x-doc-license:
name: Attribution-NonCommercial-NoDerivatives 4.0 International
url: https://creativecommons.org/licenses/by-nc-nd/4.0/
x-feedbackLink:
label: Feedback
url: https://github.com/elastic/docs-content/issues/new?assignees=&labels=feedback%2Ccommunity&projects=&template=api-feedback.yaml&title=%5BFeedback%5D%3A+
servers:
- url: https://{kibana_url}
variables:
kibana_url:
default: localhost:5601
security:
- apiKeyAuth: []
- basicAuth: []
tags:
- name: Elastic Agent policies
description: 'Elastic Agent policies APIs enable you to manage agent policies, including creating, updating, and deleting policies, as well as to retrieve agent policy outputs, manifests, and auto-upgrade status information.
'
x-displayName: Elastic Agent policies
paths:
/api/fleet/agent_policies:
get:
description: '**Spaces method and path for this operation:**
<div><span class="operation-verb get">get</span> <span class="operation-path">/s/{space_id}/api/fleet/agent_policies</span></div>
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
List all agent policies.<br/><br/>[Required authorization] Route required privileges: fleet-agent-policies-read OR fleet-agents-read OR fleet-setup.'
operationId: get-fleet-agent-policies
parameters:
- description: Page number
in: query
name: page
required: false
schema:
type: number
- description: Number of results per page
in: query
name: perPage
required: false
schema:
type: number
- description: Field to sort results by
in: query
name: sortField
required: false
schema:
type: string
- description: Sort order, ascending or descending
in: query
name: sortOrder
required: false
schema:
enum:
- desc
- asc
type: string
- description: When true, only show policies with upgradeable agents
in: query
name: showUpgradeable
required: false
schema:
type: boolean
- description: A KQL query string to filter results
in: query
name: kuery
required: false
schema:
type: string
- description: use withAgentCount instead
in: query
name: noAgentCount
required: false
schema:
deprecated: true
type: boolean
- description: get policies with agent count
in: query
name: withAgentCount
required: false
schema:
type: boolean
- description: get full policies with package policies populated
in: query
name: full
required: false
schema:
type: boolean
- description: 'Format for the response: simplified or legacy'
in: query
name: format
required: false
schema:
enum:
- simplified
- legacy
type: string
responses:
'200':
content:
application/json:
examples:
getAgentPoliciesExample:
description: List of agent policies
value:
items:
- description: A sample agent policy
id: agent-policy-id-1
is_managed: false
is_protected: false
name: My agent policy
namespace: default
revision: 1
status: active
updated_at: '2024-01-15T10:00:00.000Z'
updated_by: user1
page: 1
perPage: 20
total: 1
schema:
additionalProperties: false
type: object
properties:
items:
items:
additionalProperties: false
type: object
properties:
advanced_settings:
additionalProperties: false
type: object
properties:
agent_download_target_directory:
nullable: true
agent_download_timeout:
nullable: true
agent_features_disable_policy_change_acks_enabled:
nullable: true
agent_internal:
nullable: true
agent_limits_go_max_procs:
nullable: true
agent_logging_files_interval:
nullable: true
agent_logging_files_keepfiles:
nullable: true
agent_logging_files_rotateeverybytes:
nullable: true
agent_logging_level:
nullable: true
agent_logging_metrics_period:
nullable: true
agent_logging_to_files:
nullable: true
agent_monitoring_runtime_experimental:
nullable: true
agent_features:
items:
additionalProperties: false
type: object
properties:
enabled:
type: boolean
name:
type: string
required:
- name
- enabled
maxItems: 100
type: array
agentless:
additionalProperties: false
type: object
properties:
cloud_connectors:
additionalProperties: false
type: object
properties:
enabled:
type: boolean
target_csp:
enum:
- aws
- azure
- gcp
type: string
required:
- enabled
resources:
additionalProperties: false
type: object
properties:
requests:
additionalProperties: false
type: object
properties:
cpu:
type: string
memory:
type: string
agents:
type: number
agents_per_version:
items:
additionalProperties: false
type: object
properties:
count:
type: number
version:
type: string
required:
- version
- count
maxItems: 1000
type: array
created_at:
type: string
data_output_id:
nullable: true
type: string
description:
type: string
download_source_id:
nullable: true
type: string
fips_agents:
type: number
fleet_server_host_id:
nullable: true
type: string
global_data_tags:
description: User defined data tags that are added to all of the inputs. The values can be strings or numbers.
items:
additionalProperties: false
type: object
properties:
name:
type: string
value:
anyOf:
- type: string
- type: number
required:
- name
- value
maxItems: 100
type: array
has_agent_version_conditions:
type: boolean
has_fleet_server:
type: boolean
id:
type: string
inactivity_timeout:
default: 1209600
minimum: 0
type: number
is_default:
type: boolean
is_default_fleet_server:
type: boolean
is_managed:
type: boolean
is_preconfigured:
type: boolean
is_protected:
description: Indicates whether the agent policy has tamper protection enabled. Default false.
type: boolean
is_verifier:
description: Indicates this is a short-lived verifier policy used for OTel permission verification.
type: boolean
keep_monitoring_alive:
default: false
description: When set to true, monitoring will be enabled but logs/metrics collection will be disabled
nullable: true
type: boolean
min_agent_version:
nullable: true
type: string
monitoring_diagnostics:
additionalProperties: false
type: object
properties:
limit:
additionalProperties: false
type: object
properties:
burst:
type: number
interval:
type: string
uploader:
additionalProperties: false
type: object
properties:
init_dur:
type: string
max_dur:
type: string
max_retries:
type: number
monitoring_enabled:
items:
enum:
- logs
- metrics
- traces
type: string
maxItems: 3
type: array
monitoring_http:
additionalProperties: false
type: object
properties:
buffer:
additionalProperties: false
type: object
properties:
enabled:
default: false
type: boolean
enabled:
type: boolean
host:
type: string
port:
maximum: 65353
minimum: 0
type: number
monitoring_output_id:
nullable: true
type: string
monitoring_pprof_enabled:
type: boolean
name:
minLength: 1
type: string
namespace:
minLength: 1
type: string
overrides:
additionalProperties:
nullable: true
description: Override settings that are defined in the agent policy. Input settings cannot be overridden. The override option should be used only in unusual circumstances and not as a routine procedure.
nullable: true
type: object
package_agent_version_conditions:
items:
additionalProperties: false
type: object
properties:
name:
type: string
title:
type: string
version_condition:
type: string
required:
- name
- title
- version_condition
maxItems: 1000
nullable: true
type: array
package_policies:
anyOf:
- items:
type: string
maxItems: 10000
type: array
- description: This field is present only when retrieving a single agent policy, or when retrieving a list of agent policies with the ?full=true parameter
items:
additionalProperties: false
type: object
properties:
additional_datastreams_permissions:
description: Additional datastream permissions, that will be added to the agent policy.
items:
type: string
maxItems: 1000
nullable: true
type: array
agents:
type: number
cloud_connector_id:
description: ID of the cloud connector associated with this package policy.
nullable: true
type: string
cloud_connector_name:
description: Transient field for cloud connector name during creation.
maxLength: 255
minLength: 1
nullable: true
type: string
created_at:
type: string
created_by:
type: string
description:
description: Package policy description
type: string
elasticsearch:
additionalProperties: true
type: object
properties:
privileges:
additionalProperties: true
type: object
properties:
cluster:
items:
type: string
maxItems: 100
type: array
enabled:
type: boolean
global_data_tags:
items:
additionalProperties: false
type: object
properties:
name:
description: The name of the custom field. Cannot contain spaces.
type: string
value:
anyOf:
- type: string
- type: number
description: The value of the custom field.
required:
- name
- value
maxItems: 100
nullable: true
type: array
id:
description: Package policy unique identifier.
type: string
inputs:
anyOf:
- items:
additionalProperties: false
type: object
properties:
compiled_input:
nullable: true
config:
additionalProperties:
additionalProperties: false
type: object
properties:
frozen:
type: boolean
type:
type: string
value:
nullable: true
required:
- value
description: Package variable (see integration documentation for more information)
type: object
deprecated:
additionalProperties: false
type: object
properties:
description:
type: string
replaced_by:
additionalProperties:
type: string
type: object
since:
type: string
required:
- description
enabled:
type: boolean
id:
type: string
keep_enabled:
type: boolean
migrate_from:
type: string
name:
type: string
policy_template:
type: string
streams:
items:
additionalProperties: false
type: object
properties:
compiled_stream:
nullable: true
config:
additionalProperties:
additionalProperties: false
type: object
properties:
frozen:
type: boolean
type:
type: string
value:
nullable: true
required:
- value
description: Package variable (see integration documentation for more information)
type: object
data_stream:
additionalProperties: false
type: object
properties:
dataset:
type: string
elasticsearch:
additionalProperties: false
type: object
properties:
dynamic_dataset:
type: boolean
dynamic_namespace:
type: boolean
privileges:
additionalProperties: false
type: object
properties:
indices:
items:
type: string
maxItems: 100
type: array
type:
type: string
required:
- dataset
deprecated:
additionalProperties: false
type: object
properties:
description:
type: string
replaced_by:
additionalProperties:
type: string
type: object
since:
type: string
required:
- description
enabled:
type: boolean
id:
type: string
keep_enabled:
type: boolean
migrate_from:
type: string
release:
enum:
- ga
- beta
- experimental
type: string
var_group_selections:
additionalProperties:
type: string
description: Variable group selections. Maps var_group name to the selected option name within that group.
type: object
vars:
additionalProperties:
additionalProperties: false
type: object
properties:
frozen:
type: boolean
type:
type: string
value:
nullable: true
required:
- value
description: Package variable (see integration documentation for more information)
type: object
required:
- enabled
- data_stream
- compiled_stream
maxItems: 1000
type: array
type:
type: string
var_group_selections:
additionalProperties:
type: string
description: Variable group selections. Maps var_group name to the selected option name within that group.
type: object
vars:
additionalProperties:
additionalProperties: false
type: object
properties:
frozen:
type: boolean
type:
type: string
value:
nullable: true
required:
- value
description: Package variable (see integration documentation for more information)
type: object
required:
- type
- enabled
- streams
- compiled_input
maxItems: 100
type: array
- additionalProperties:
additionalProperties: false
type: object
properties:
deprecated:
additionalProperties: false
type: object
properties:
description:
type: string
replaced_by:
additionalProperties:
type: string
type: object
since:
# --- truncated at 32 KB (357 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/kibana/refs/heads/main/openapi/kibana-elastic-agent-policies-api-openapi.yml