Kibana Fleet agentless policies API
The Fleet agentless policies API from Kibana — 2 operation(s) for fleet agentless policies.
OpenAPI Specification
openapi: 3.0.3
info:
contact:
name: Kibana Team
description: 'The Kibana REST APIs enable you to manage resources such as connectors, data views, and saved objects.
The API calls are stateless.
Each request that you make happens in isolation from other calls and must include all of the necessary information for Kibana to fulfill the
request.
API requests return JSON output, which is a format that is machine-readable and works well for automation.
To interact with Kibana APIs, use the following operations:
- GET: Fetches the information.
- PATCH: Applies partial modifications to the existing information.
- POST: Adds new information.
- PUT: Updates the existing information.
- DELETE: Removes the information.
You can prepend any Kibana API endpoint with `kbn:` and run the request in **Dev Tools → Console**.
For example:
```
GET kbn:/api/data_views
```
For more information about the console, refer to [Run API requests](https://www.elastic.co/docs/explore-analyze/query-filter/tools/console).
NOTE: Access to internal Kibana API endpoints will be restricted in Kibana version 9.0. Please move any integrations to publicly documented APIs.
## Documentation source and versions
This documentation is derived from the `main` branch of the [kibana](https://github.com/elastic/kibana) repository.
It is provided under license [Attribution-NonCommercial-NoDerivatives 4.0 International](https://creativecommons.org/licenses/by-nc-nd/4.0/).
This documentation contains work-in-progress information for future Elastic Stack releases.
'
title: Kibana APIs Actions Fleet agentless policies API
version: ''
x-doc-license:
name: Attribution-NonCommercial-NoDerivatives 4.0 International
url: https://creativecommons.org/licenses/by-nc-nd/4.0/
x-feedbackLink:
label: Feedback
url: https://github.com/elastic/docs-content/issues/new?assignees=&labels=feedback%2Ccommunity&projects=&template=api-feedback.yaml&title=%5BFeedback%5D%3A+
servers:
- url: https://{kibana_url}
variables:
kibana_url:
default: localhost:5601
security:
- apiKeyAuth: []
- basicAuth: []
tags:
- name: Fleet agentless policies
paths:
/api/fleet/agentless_policies:
post:
description: '**Spaces method and path for this operation:**
<div><span class="operation-verb post">post</span> <span class="operation-path">/s/{space_id}/api/fleet/agentless_policies</span></div>
Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.
Create an agentless policy'
operationId: post-fleet-agentless-policies
parameters:
- description: A required header to protect against CSRF attacks
in: header
name: kbn-xsrf
required: true
schema:
example: 'true'
type: string
- description: The format of the response package policy.
in: query
name: format
required: false
schema:
default: simplified
enum:
- legacy
- simplified
type: string
requestBody:
content:
application/json:
examples:
createAgentlessPoliciesRequestExample:
description: Example request to create agentless policies
value:
description: test
inputs:
ESS Billing-cel:
enabled: true
streams:
ess_billing.billing:
enabled: true
vars:
hide_sensitive: true
http_client_timeout: 30s
lookbehind: 365
tags:
- forwarded
- billing
ess_billing.credits:
enabled: false
vars:
api_key: <REPLACE_WITH_YOUR_API_KEY>
organization_id: '1234'
name: ess_billing-1
namespace: default
package:
name: ess_billing
version: 1.6.0
createAgentlessPoliciesReuseAWSCloudConnectorExample:
description: Example request to create agentless policy reusing an existing AWS cloud connector
value:
cloud_connector:
cloud_connector_id: existing-aws-connector-id
target_csp: aws
description: CSPM integration for AWS reusing existing cloud connector
inputs:
cspm-cloudbeat/cis_aws:
enabled: true
streams:
cloud_security_posture.findings:
enabled: true
vars:
aws.account_type: organization-account
aws.credentials.type: cloud_connector
aws.supports_cloud_connectors: true
external_id:
id: ABCDEFGHIJKLMNOPQRST
isSecretRef: true
role_arn: arn:aws:iam::123456789012:role/TestRole
vars:
cloud_formation_template: https://console.aws.amazon.com/cloudformation/home#/stacks/quickcreate?templateURL=https://elastic-cspm-cft.s3.eu-central-1.amazonaws.com/cloudformation-cspm-ACCOUNT_TYPE-9.2.0.yml
cspm-cloudbeat/cis_azure:
enabled: false
cspm-cloudbeat/cis_gcp:
enabled: false
name: cspm-aws-reuse-policy
namespace: default
package:
name: cloud_security_posture
version: 3.1.1
vars:
deployment: aws
posture: cspm
createAgentlessPoliciesWithAWSCloudConnectorExample:
description: Example request to create agentless policy with AWS cloud connector
value:
cloud_connector:
target_csp: aws
description: CSPM integration for AWS with cloud connector
inputs:
cspm-cloudbeat/cis_aws:
enabled: true
streams:
cloud_security_posture.findings:
enabled: true
vars:
aws.account_type: organization-account
aws.credentials.type: cloud_connector
aws.supports_cloud_connectors: true
external_id:
id: ABCDEFGHIJKLMNOPQRST
isSecretRef: true
role_arn: arn:aws:iam::123456789012:role/TestRole
vars:
cloud_formation_template: https://console.aws.amazon.com/cloudformation/home#/stacks/quickcreate?templateURL=https://elastic-cspm-cft.s3.eu-central-1.amazonaws.com/cloudformation-cspm-ACCOUNT_TYPE-9.2.0.yml
cspm-cloudbeat/cis_azure:
enabled: false
cspm-cloudbeat/cis_gcp:
enabled: false
name: cspm-aws-policy
namespace: default
package:
name: cloud_security_posture
version: 3.1.1
vars:
deployment: aws
posture: cspm
createAgentlessPoliciesWithAzureCloudConnectorExample:
description: Example request to create agentless policy with Azure cloud connector
value:
cloud_connector:
target_csp: azure
description: CSPM integration for Azure with cloud connector
inputs:
cspm-cloudbeat/cis_aws:
enabled: false
cspm-cloudbeat/cis_azure:
enabled: true
streams:
cloud_security_posture.findings:
enabled: true
vars:
azure_credentials_cloud_connector_id:
type: text
value: existing-azure-credentials-connector-id
azure.account_type: organization-account
client_id:
id: client-secret-id
isSecretRef: true
tenant_id:
id: tenant-secret-id
isSecretRef: true
cspm-cloudbeat/cis_gcp:
enabled: false
name: cspm-azure-policy
namespace: default
package:
name: cloud_security_posture
version: 3.1.1
vars:
deployment: azure
posture: cspm
schema:
additionalProperties: false
type: object
properties:
additional_datastreams_permissions:
description: Additional datastream permissions, that will be added to the agent policy.
items:
type: string
maxItems: 100
nullable: true
type: array
cloud_connector:
additionalProperties: false
type: object
properties:
cloud_connector_id:
description: ID of an existing cloud connector to reuse. If not provided, a new connector will be created.
type: string
enabled:
default: false
description: Whether cloud connectors are enabled for this policy.
type: boolean
name:
description: Optional name for the cloud connector. If not provided, will be auto-generated from credentials.
maxLength: 255
minLength: 1
type: string
target_csp:
description: Target cloud service provider. If not provided, will be auto-detected from inputs.
enum:
- aws
- azure
- gcp
type: string
description:
description: Policy description.
type: string
force:
description: Force package policy creation even if the package is not verified, or if the agent policy is managed.
type: boolean
global_data_tags:
items:
additionalProperties: false
type: object
properties:
name:
description: The name of the custom field. Cannot contain spaces.
type: string
value:
anyOf:
- type: string
- type: number
description: The value of the custom field.
required:
- name
- value
maxItems: 100
type: array
id:
description: Policy unique identifier.
type: string
inputs:
additionalProperties:
additionalProperties: false
type: object
properties:
deprecated:
additionalProperties: false
type: object
properties:
description:
type: string
replaced_by:
additionalProperties:
type: string
type: object
since:
type: string
required:
- description
enabled:
description: Enable or disable that input. Defaults to `true` (enabled).
type: boolean
streams:
additionalProperties:
additionalProperties: false
type: object
properties:
deprecated:
additionalProperties: false
type: object
properties:
description:
type: string
replaced_by:
additionalProperties:
type: string
type: object
since:
type: string
required:
- description
enabled:
description: Enable or disable that stream. Defaults to `true` (enabled).
type: boolean
var_group_selections:
additionalProperties:
type: string
description: Variable group selections. Maps var_group name to the selected option name within that group.
type: object
vars:
additionalProperties:
anyOf:
- type: string
- type: number
- type: boolean
- items:
type: string
maxItems: 100
type: array
- items:
type: number
maxItems: 100
type: array
- additionalProperties: false
type: object
properties:
id:
type: string
isSecretRef:
type: boolean
required:
- id
- isSecretRef
nullable: true
description: Input/stream level variable. Refer to the integration documentation for more information.
type: object
description: Input streams. Refer to the integration documentation to know which streams are available.
type: object
vars:
additionalProperties:
anyOf:
- type: string
- type: number
- type: boolean
- items:
type: string
maxItems: 100
type: array
- items:
type: number
maxItems: 100
type: array
- additionalProperties: false
type: object
properties:
id:
type: string
isSecretRef:
type: boolean
required:
- id
- isSecretRef
nullable: true
description: Input/stream level variable. Refer to the integration documentation for more information.
type: object
description: Package policy inputs. Refer to the integration documentation to know which inputs are available.
type: object
name:
description: Unique name for the policy.
type: string
namespace:
description: Policy namespace. When not specified, it inherits the agent policy namespace.
type: string
package:
additionalProperties: false
type: object
properties:
experimental_data_stream_features:
items:
additionalProperties: false
type: object
properties:
data_stream:
type: string
features:
additionalProperties: false
type: object
properties:
doc_value_only_numeric:
type: boolean
doc_value_only_other:
type: boolean
synthetic_source:
type: boolean
tsdb:
type: boolean
required:
- data_stream
- features
maxItems: 100
type: array
fips_compatible:
type: boolean
name:
description: Package name
type: string
requires_root:
type: boolean
title:
type: string
version:
description: Package version
type: string
required:
- name
- version
policy_template:
description: The policy template to use for the agentless package policy. If not provided, the default policy template will be used.
type: string
var_group_selections:
additionalProperties:
type: string
description: Variable group selections. Maps var_group name to the selected option name within that group.
type: object
vars:
additionalProperties:
anyOf:
- type: string
- type: number
- type: boolean
- items:
type: string
maxItems: 100
type: array
- items:
type: number
maxItems: 100
type: array
- additionalProperties: false
type: object
properties:
id:
type: string
isSecretRef:
type: boolean
required:
- id
- isSecretRef
nullable: true
description: Input/stream level variable. Refer to the integration documentation for more information.
type: object
required:
- name
- package
responses:
'200':
content:
application/json:
examples:
createAgentlessPoliciesResponseExample:
description: Example response showing the successful result of communication initialisation over MCP protocol
value:
item:
created_at: '2025-11-06T18:27:43.541Z'
created_by: test_user
description: test
enabled: true
id: d52a7812-5736-4fdc-aed8-72152afa1ffa
inputs:
ESS Billing-cel:
enabled: true
streams:
ess_billing.billing:
enabled: true
vars:
hide_sensitive: true
http_client_timeout: 30s
lookbehind: 365
tags:
- forwarded
- billing
ess_billing.credits:
enabled: false
vars:
api_key:
id: QY1sWpoBbWcMW-edr0Ee
isSecretRef: true
organization_id: '1234'
url: https://billing.elastic-cloud.com
name: ess_billing-1
namespace: default
package:
name: ess_billing
title: Elasticsearch Service Billing
version: 1.6.0
revision: 1
secret_references:
- id: QY1sWpoBbWcMW-edr0Ee
supports_agentless: true
updated_at: '2025-11-06T18:27:43.541Z'
updated_by: test_user
version: WzE0OTgsMV0=
createAgentlessPoliciesWithAWSCloudConnectorResponseExample:
description: Example response for AWS cloud connector integration
value:
item:
cloud_connector_id: aws-connector-67890
created_at: '2025-11-06T18:27:43.541Z'
created_by: test_user
description: CSPM integration for AWS with cloud connector
enabled: true
id: aws-policy-12345
inputs:
cspm-cloudbeat/cis_aws:
enabled: true
streams:
cloud_security_posture.findings:
enabled: true
vars:
aws.account_type: organization-account
aws.credentials.type: cloud_connector
external_id:
id: secret-external-id-123
isSecretRef: true
role_arn: arn:aws:iam::123456789012:role/TestRole
vars:
cloud_formation_template: https://console.aws.amazon.com/cloudformation/home#/stacks/quickcreate?templateURL=https://elastic-cspm-cft.s3.eu-central-1.amazonaws.com/cloudformation-cspm-ACCOUNT_TYPE-9.2.0.yml
cspm-cloudbeat/cis_azure:
enabled: false
cspm-cloudbeat/cis_gcp:
enabled: false
name: cspm-aws-policy
namespace: default
package:
name: cloud_security_posture
title: Cloud Security Posture Management
version: 3.1.1
revision: 1
secret_references:
- id: secret-external-id-123
supports_agentless: true
supports_cloud_connector: true
updated_at: '2025-11-06T18:27:43.541Z'
updated_by: test_user
vars:
deployment: aws
posture: cspm
version: WzE0OTgsMV0=
createAgentlessPoliciesWithAzureCloudConnectorResponseExample:
description: Example response for Azure cloud connector integration
value:
item:
cloud_connector_id: azure-connector-67890
created_at: '2025-11-06T18:27:43.541Z'
created_by: test_user
description: CSPM integration for Azure with cloud connector
enabled: true
id: azure-policy-12345
inputs:
cspm-cloudbeat/cis_aws:
enabled: false
cspm-cloudbeat/cis_azure:
enabled: true
streams:
cloud_security_posture.findings:
enabled: true
vars:
azure_credentials_cloud_connector_id:
type: text
value: existing-azure-credentials-connector-id
azure.account_type: organization-account
client_id:
id: client-secret-id-456
isSecretRef: true
tenant_id:
id: tenant-secret-id-123
isSecretRef: true
cspm-cloudbeat/cis_gcp:
enabled: false
name: cspm-azure-policy
namespace: default
package:
name: cloud_security_posture
title: Cloud Security Posture Management
version: 3.1.1
revision: 1
secret_references:
- id: tenant-secret-id-123
- id: client-secret-id-456
supports_agentless: true
supports_cloud_connector: true
updated_at: '2025-11-06T18:27:43.541Z'
updated_by: test_user
vars:
deployment: azure
posture: cspm
version: WzE0OTgsMV0=
schema:
additionalProperties: false
type: object
properties:
item:
additionalProperties: false
description: The created agentless package policy.
type: object
properties:
additional_datastreams_permissions:
description: Additional datastream permissions, that will be added to the agent policy.
items:
type: string
maxItems: 1000
nullable: true
type: array
agents:
type: number
cloud_connector_id:
description: ID of the cloud connector associated with this package policy.
nullable: true
type: string
cloud_connector_name:
description: Transient field for cloud connector name during creation.
maxLength: 255
minLength: 1
nullable: true
type: string
created_at:
type: string
created_by:
type: string
description:
description: Package policy description
type: string
elasticsearch:
additionalProperties: true
type: object
properties:
privileges:
additionalProperties: true
type: object
properties:
cluster:
items:
type: string
maxItems: 100
type: array
enabled:
type: boolean
global_data_tags:
items:
additionalProperties: false
type: object
properties:
name:
description: The name of the custom field. Cannot contain spaces.
type: string
value:
anyOf:
- type: string
- type: number
description: The value of the custom field.
required:
- name
- value
maxItems: 100
nullable: true
type: array
id:
description: Package policy unique identifier.
type: string
inputs:
anyOf:
- items:
additionalProperties: false
type: object
properties:
compiled_input:
nullable: true
config:
additionalProperties:
additionalProperties: false
type: object
properties:
frozen:
type: boolean
type:
type: string
value:
nullable: true
required:
- value
description: Package variable (see integration documentation for more information)
type: object
deprecated:
additionalProperties: false
type: object
properties:
description:
type: string
replaced_by:
additionalProperties:
type: string
type: object
since:
type: string
required:
- description
enabled:
type: boolean
id:
type: string
keep_enabled:
# --- truncated at 32 KB (59 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/kibana/refs/heads/main/openapi/kibana-fleet-agentless-policies-api-openapi.yml