Kibana Elastic Package Manager (EPM) API
Elastic Package Manager (EPM) APIs enable you to manage packages and integrations, including installing, updating, and uninstalling packages, managing custom integrations, and handling package assets.
OpenAPI Specification
openapi: 3.0.3
info:
contact:
name: Kibana Team
description: 'The Kibana REST APIs enable you to manage resources such as connectors, data views, and saved objects.
The API calls are stateless.
Each request that you make happens in isolation from other calls and must include all of the necessary information for Kibana to fulfill the
request.
API requests return JSON output, which is a format that is machine-readable and works well for automation.
To interact with Kibana APIs, use the following operations:
- GET: Fetches the information.
- PATCH: Applies partial modifications to the existing information.
- POST: Adds new information.
- PUT: Updates the existing information.
- DELETE: Removes the information.
You can prepend any Kibana API endpoint with `kbn:` and run the request in **Dev Tools → Console**.
For example:
```
GET kbn:/api/data_views
```
For more information about the console, refer to [Run API requests](https://www.elastic.co/docs/explore-analyze/query-filter/tools/console).
NOTE: Access to internal Kibana API endpoints will be restricted in Kibana version 9.0. Please move any integrations to publicly documented APIs.
## Documentation source and versions
This documentation is derived from the `main` branch of the [kibana](https://github.com/elastic/kibana) repository.
It is provided under license [Attribution-NonCommercial-NoDerivatives 4.0 International](https://creativecommons.org/licenses/by-nc-nd/4.0/).
This documentation contains work-in-progress information for future Elastic Stack releases.
'
title: Kibana APIs Actions Elastic Package Manager (EPM) API
version: ''
x-doc-license:
name: Attribution-NonCommercial-NoDerivatives 4.0 International
url: https://creativecommons.org/licenses/by-nc-nd/4.0/
x-feedbackLink:
label: Feedback
url: https://github.com/elastic/docs-content/issues/new?assignees=&labels=feedback%2Ccommunity&projects=&template=api-feedback.yaml&title=%5BFeedback%5D%3A+
servers:
- url: https://{kibana_url}
variables:
kibana_url:
default: localhost:5601
security:
- apiKeyAuth: []
- basicAuth: []
tags:
- name: Elastic Package Manager (EPM)
description: 'Elastic Package Manager (EPM) APIs enable you to manage packages and integrations, including installing, updating, and uninstalling packages, managing custom integrations, and handling package assets.
'
x-displayName: Elastic Package Manager (EPM)
paths:
/api/fleet/epm/bulk_assets:
post:
description: '**Spaces method and path for this operation:**
<div><span class="operation-verb post">post</span> <span class="operation-path">/s/{space_id}/api/fleet/epm/bulk_assets</span></div>
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
Retrieve multiple Kibana saved object assets by their IDs and types.<br/><br/>[Required authorization] Route required privileges: integrations-read OR fleet-setup OR fleet-all.'
operationId: post-fleet-epm-bulk-assets
parameters:
- description: A required header to protect against CSRF attacks
in: header
name: kbn-xsrf
required: true
schema:
example: 'true'
type: string
requestBody:
content:
application/json:
examples:
postBulkGetAssetsRequestExample:
description: Retrieve multiple assets by their IDs and types
value:
assetIds:
- id: dashboard-id-1
type: dashboard
- id: index-pattern-id-1
type: index_pattern
schema:
additionalProperties: false
type: object
properties:
assetIds:
items:
additionalProperties: false
type: object
properties:
id:
type: string
type:
type: string
required:
- id
- type
maxItems: 10000
type: array
required:
- assetIds
responses:
'200':
content:
application/json:
examples:
postBulkGetAssetsExample:
description: Requested assets
value:
items:
- appLink: /app/dashboards#/view/dashboard-id-1
attributes:
title: My Dashboard
id: dashboard-id-1
type: dashboard
schema:
additionalProperties: false
type: object
properties:
items:
items:
additionalProperties: false
type: object
properties:
appLink:
type: string
attributes:
additionalProperties: false
type: object
properties:
description:
type: string
service:
type: string
title:
type: string
id:
type: string
type:
type: string
updatedAt:
type: string
required:
- id
- type
- attributes
maxItems: 10000
type: array
required:
- items
description: Successful response
'400':
content:
application/json:
examples:
genericErrorResponseExample:
description: Example of a generic error response
value:
error: Bad Request
message: An error message describing what went wrong
statusCode: 400
schema:
additionalProperties: false
description: Generic Error
type: object
properties:
attributes:
nullable: true
error:
type: string
errorType:
type: string
message:
type: string
statusCode:
type: number
required:
- message
- attributes
description: Bad Request
summary: Bulk get assets
tags:
- Elastic Package Manager (EPM)
x-metaTags:
- content: Kibana
name: product_name
/api/fleet/epm/categories:
get:
description: '**Spaces method and path for this operation:**
<div><span class="operation-verb get">get</span> <span class="operation-path">/s/{space_id}/api/fleet/epm/categories</span></div>
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
Get a list of integration categories.<br/><br/>[Required authorization] Route required privileges: integrations-read OR fleet-setup OR fleet-all.'
operationId: get-fleet-epm-categories
parameters:
- description: When true, include prerelease packages in the results
in: query
name: prerelease
required: false
schema:
type: boolean
- description: When true, include categories that only contain policy templates
in: query
name: include_policy_templates
required: false
schema:
type: boolean
responses:
'200':
content:
application/json:
examples:
getCategoriesExample:
description: List of integration categories
value:
items:
- count: 42
id: security
title: Security
- count: 38
id: observability
title: Observability
schema:
additionalProperties: false
type: object
properties:
items:
items:
additionalProperties: false
type: object
properties:
count:
type: number
id:
type: string
parent_id:
type: string
parent_title:
type: string
title:
type: string
required:
- id
- title
- count
maxItems: 10000
type: array
required:
- items
description: Successful response
'400':
content:
application/json:
examples:
genericErrorResponseExample:
description: Example of a generic error response
value:
error: Bad Request
message: An error message describing what went wrong
statusCode: 400
schema:
additionalProperties: false
description: Generic Error
type: object
properties:
attributes:
nullable: true
error:
type: string
errorType:
type: string
message:
type: string
statusCode:
type: number
required:
- message
- attributes
description: Bad Request
summary: Get package categories
tags:
- Elastic Package Manager (EPM)
x-metaTags:
- content: Kibana
name: product_name
/api/fleet/epm/custom_integrations:
post:
description: '**Spaces method and path for this operation:**
<div><span class="operation-verb post">post</span> <span class="operation-path">/s/{space_id}/api/fleet/epm/custom_integrations</span></div>
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
Create a new custom integration package with user-defined data streams.<br/><br/>[Required authorization] Route required privileges: integrations-all AND fleet-agent-policies-all.'
operationId: post-fleet-epm-custom-integrations
parameters:
- description: A required header to protect against CSRF attacks
in: header
name: kbn-xsrf
required: true
schema:
example: 'true'
type: string
requestBody:
content:
application/json:
examples:
postCreateCustomIntegrationRequestExample:
description: Create a new custom integration
value:
datasets:
- name: my_custom_logs.access
type: logs
integrationName: my_custom_logs
schema:
additionalProperties: false
type: object
properties:
datasets:
items:
additionalProperties: false
type: object
properties:
name:
type: string
type:
enum:
- logs
- metrics
- traces
- synthetics
- profiling
type: string
required:
- name
- type
maxItems: 10
type: array
force:
type: boolean
integrationName:
type: string
required:
- integrationName
- datasets
responses:
'200':
content:
application/json:
examples:
postCreateCustomIntegrationExample:
description: Custom integration successfully created
value:
_meta:
install_source: custom
items:
- id: my_custom_logs-logs-my_custom_logs.access
type: index_template
schema:
additionalProperties: false
type: object
properties:
_meta:
additionalProperties: false
type: object
properties:
install_source:
type: string
name:
type: string
required:
- install_source
- name
items:
items:
anyOf:
- additionalProperties: false
type: object
properties:
deferred:
type: boolean
id:
type: string
originId:
type: string
type:
anyOf:
- enum:
- dashboard
- lens
- visualization
- search
- index-pattern
- map
- ml-module
- security-rule
- csp-rule-template
- osquery-pack-asset
- osquery-saved-query
- tag
type: string
- type: string
required:
- id
- type
- additionalProperties: false
type: object
properties:
deferred:
type: boolean
id:
type: string
type:
enum:
- index
- index_template
- component_template
- ingest_pipeline
- ilm_policy
- data_stream_ilm_policy
- transform
- ml_model
- knowledge_base
- esql_view
type: string
version:
type: string
required:
- id
- type
maxItems: 10000
type: array
required:
- items
- _meta
description: Successful response
'400':
content:
application/json:
examples:
genericErrorResponseExample:
description: Example of a generic error response
value:
error: Bad Request
message: An error message describing what went wrong
statusCode: 400
schema:
additionalProperties: false
description: Generic Error
type: object
properties:
attributes:
nullable: true
error:
type: string
errorType:
type: string
message:
type: string
statusCode:
type: number
required:
- message
- attributes
description: Bad Request
summary: Create a custom integration
tags:
- Elastic Package Manager (EPM)
x-metaTags:
- content: Kibana
name: product_name
/api/fleet/epm/custom_integrations/{pkgName}:
put:
description: '**Spaces method and path for this operation:**
<div><span class="operation-verb put">put</span> <span class="operation-path">/s/{space_id}/api/fleet/epm/custom_integrations/{pkgName}</span></div>
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
Update the datasets of an existing custom integration package.<br/><br/>[Required authorization] Route required privileges: fleet-settings-all AND integrations-all.'
operationId: put-fleet-epm-custom-integrations-pkgname
parameters:
- description: A required header to protect against CSRF attacks
in: header
name: kbn-xsrf
required: true
schema:
example: 'true'
type: string
- description: Package name
in: path
name: pkgName
required: true
schema:
type: string
requestBody:
content:
application/json:
examples:
putUpdateCustomIntegrationRequestExample:
description: Update a custom integration
value:
datasets:
- name: my_custom_logs.access
type: logs
integrationName: my_custom_logs
schema:
additionalProperties: false
type: object
properties:
categories:
items:
type: string
maxItems: 10
type: array
readMeData:
type: string
required:
- readMeData
responses:
'200':
content:
application/json:
examples:
putUpdateCustomIntegrationExample:
description: Custom integration successfully updated
value: {}
description: Successful response
'400':
content:
application/json:
examples:
genericErrorResponseExample:
description: Example of a generic error response
value:
error: Bad Request
message: An error message describing what went wrong
statusCode: 400
schema:
additionalProperties: false
description: Generic Error
type: object
properties:
attributes:
nullable: true
error:
type: string
errorType:
type: string
message:
type: string
statusCode:
type: number
required:
- message
- attributes
description: Bad Request
summary: Update a custom integration
tags:
- Elastic Package Manager (EPM)
x-metaTags:
- content: Kibana
name: product_name
/api/fleet/epm/packages:
get:
description: '**Spaces method and path for this operation:**
<div><span class="operation-verb get">get</span> <span class="operation-path">/s/{space_id}/api/fleet/epm/packages</span></div>
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
Get a list of integration packages available in the registry.<br/><br/>[Required authorization] Route required privileges: integrations-read OR fleet-setup OR fleet-all.'
operationId: get-fleet-epm-packages
parameters:
- description: Filter packages by category
in: query
name: category
required: false
schema:
type: string
- description: When true, include prerelease packages in the results
in: query
name: prerelease
required: false
schema:
type: boolean
- description: When true, exclude the install status from the response
in: query
name: excludeInstallStatus
required: false
schema:
type: boolean
- description: When true, include the number of package policies per package
in: query
name: withPackagePoliciesCount
required: false
schema:
type: boolean
responses:
'200':
content:
application/json:
examples:
getPackagesExample:
description: List of available integration packages
value:
items:
- categories:
- cloud
description: Collect logs and metrics from Amazon Web Services
id: aws
name: aws
status: not_installed
title: AWS
version: 2.10.0
searchExcluded: 0
total: 1
schema:
additionalProperties: false
type: object
properties:
items:
items:
additionalProperties: true
type: object
properties:
categories:
items:
type: string
maxItems: 100
type: array
conditions:
additionalProperties: true
type: object
properties:
deprecated:
additionalProperties: true
type: object
properties:
description:
type: string
replaced_by:
additionalProperties:
type: string
type: object
since:
type: string
required:
- description
elastic:
additionalProperties: true
type: object
properties:
capabilities:
items:
type: string
maxItems: 10
type: array
subscription:
type: string
kibana:
additionalProperties: true
type: object
properties:
version:
type: string
data_streams:
items:
additionalProperties:
nullable: true
type: object
maxItems: 1000
type: array
deprecated:
additionalProperties: true
type: object
properties:
description:
type: string
replaced_by:
additionalProperties:
type: string
type: object
since:
type: string
required:
- description
description:
type: string
discovery:
additionalProperties: true
type: object
properties:
datasets:
items:
additionalProperties: true
type: object
properties:
name:
type: string
required:
- name
maxItems: 100
type: array
fields:
items:
additionalProperties: true
type: object
properties:
name:
type: string
required:
- name
maxItems: 100
type: array
download:
type: string
format_version:
type: string
icons:
items:
additionalProperties: true
type: object
properties:
dark_mode:
type: boolean
path:
type: string
size:
type: string
src:
type: string
title:
type: string
type:
type: string
required:
- src
maxItems: 100
type: array
id:
type: string
installationInfo:
additionalProperties: true
type: object
properties:
additional_spaces_installed_kibana:
additionalProperties:
items:
additionalProperties: true
type: object
properties:
deferred:
type: boolean
id:
type: string
originId:
type: string
type:
anyOf:
- enum:
- dashboard
- lens
- visualization
- search
- index-pattern
- map
- ml-module
- security-rule
- csp-rule-template
- osquery-pack-asset
- osquery-saved-query
- tag
type: string
- type: string
required:
- id
- type
maxItems: 100
type: array
type: object
created_at:
type: string
experimental_data_stream_features:
items:
additionalProperties: true
type: object
properties:
data_stream:
type: string
features:
additionalProperties: true
type: object
properties:
doc_value_only_numeric:
type: boolean
doc_value_only_other:
type: boolean
synthetic_source:
type: boolean
tsdb:
type: boolean
required:
- data_stream
- features
maxItems: 100
type: array
install_format_schema_version:
type: string
install_source:
enum:
- registry
- upload
- bundled
- custom
type: string
install_status:
enum:
- installed
- installing
- install_failed
type: string
installed_es:
items:
additionalProperties: true
type: object
properties:
deferred:
type: boolean
id:
type: string
type:
enum:
- index
- index_template
- component_template
- ingest_pipeline
- ilm_policy
- data_stream_ilm_policy
- transform
- ml_model
- knowledge_base
- esql_view
type: string
version:
type: string
required:
# --- truncated at 32 KB (253 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/kibana/refs/heads/main/openapi/kibana-elastic-package-manager-epm-api-openapi.yml